Merge pull request #311 from the-luap/release-please--branches--beta

chore(beta): release 3.28.3-beta.0

.drone.yml

@@ -1,114 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-steps:
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-      
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-trigger:
-  branch:
-    - main
-    - develop
-  event:
-    - push
-    - pull_request
-
----
-kind: pipeline
-type: docker
-name: release
-
-steps:
-  # Build Backend Release
-  - name: build-backend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      
-  # Build Frontend Release
-  - name: build-frontend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-
-  # -------- NEW: Publish Docker images to GitHub Container Registry --------
-  - name: push-backend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-
-  - name: push-frontend-ghcr
-    image: plugins/docker
-    settings:
-      repo: ghcr.io/the-luap/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: ghcr.io
-      username:
-        from_secret: GITHUB_USERNAME
-      password:
-        from_secret: GITHUB_TOKEN
-      build_args:
-        - VERSION=${DRONE_TAG}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-
-trigger:
-  event:
-    - tag

.env.example

@@ -7,6 +7,34 @@ NODE_ENV=production
 # JWT Secret (generate with: openssl rand -base64 64)
 JWT_SECRET=your_very_long_random_jwt_secret_here
 
+# Auth cookie Secure flag
+#   unset  - default: follows NODE_ENV (production=true, dev=false)
+#   true   - always set Secure (HTTPS-only cookies; breaks plain-HTTP access)
+#   false  - never set Secure (allows HTTP; cookies not protected on HTTPS)
+#   auto   - decide per request: Secure on HTTPS, not on HTTP
+#
+# Use COOKIE_SECURE=auto if your deployment is reachable over both HTTPS
+# (via reverse proxy like Nginx Proxy Manager, Traefik, Caddy) AND plain
+# HTTP (e.g. LAN access at http://192.168.x.x:3010). The backend reads
+# req.secure from Express, which respects the X-Forwarded-Proto header
+# when the proxy is in the trust list.
+#
+# Requirements for auto mode:
+#   1. Your reverse proxy MUST send X-Forwarded-Proto: https on HTTPS
+#      requests. Standard configs for NPM/Traefik/Caddy do this by default.
+#   2. The proxy must be on a trusted IP range. By default PicPeak trusts
+#      loopback and private networks (127.0.0.1, 10.x, 172.16-31.x,
+#      192.168.x, link-local). Proxies outside those ranges need custom
+#      trust proxy configuration.
+# COOKIE_SECURE=auto
+
+# Cookie SameSite attribute (Lax | Strict | None). Default: Lax
+# COOKIE_SAMESITE=Lax
+
+# Cookie Domain — set this if serving auth cookies across subdomains.
+# Leave unset for same-origin setups.
+# COOKIE_DOMAIN=.example.com
+
 # Database Configuration (PostgreSQL)
 DATABASE_CLIENT=pg
 DB_USER=picpeak
@@ -22,6 +50,7 @@ REDIS_PASSWORD=your_secure_redis_password_here
 # Admin Account (initial setup)
 ADMIN_USERNAME=admin
 ADMIN_EMAIL=admin@yourdomain.com
+ADMIN_PASSWORD=your_secure_admin_password_here
 
 # Email Configuration
 # For Gmail: use app-specific password
@@ -39,6 +68,11 @@ EMAIL_FROM=noreply@yourdomain.com
 FRONTEND_URL=https://yourdomain.com
 ADMIN_URL=https://yourdomain.com
 
+# API URL for email assets (logos, images in notification emails)
+# This must be the publicly accessible URL where email recipients can load images.
+# If not set, defaults to http://localhost:3001 which will show broken images in emails.
+API_URL=https://yourdomain.com/api
+
 # Frontend API base
 # For pre-built images and production behind a reverse proxy, keep '/api'.
 # If you rebuild the frontend yourself, you may set a full URL at build time.
@@ -50,6 +84,16 @@ VITE_API_URL=/api
 # DB_PORT=5432
 # REDIS_PORT=6379
 
+# Release Channel
+# Options: 'stable' (default), 'beta', or specific version like 'v2.3.0'
+# 'stable' uses the :stable tag (same as :latest on main)
+# 'beta' uses the :beta tag for pre-release versions
+PICPEAK_CHANNEL=stable
+
+# Update Check Configuration
+# Set to 'false' to disable update notifications in admin UI
+UPDATE_CHECK_ENABLED=true
+
 # Timezone
 TZ=UTC
 

.gitea/workflows/mirror-to-github.yml

@@ -1,132 +0,0 @@
-name: Mirror to GitHub
-
-on:
-  workflow_dispatch:  # Allow manual triggering only
-
-jobs:
-  mirror:
-    runs-on: ubuntu-latest
-    # Note: For GitHub fine-grained tokens, ensure the token has:
-    # - Repository access to the-luap/picpeak
-    # - Repository permissions: Contents (Read and Write), Metadata (Read)
-    # For classic tokens: repo scope is sufficient
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0  # Full history for proper mirroring
-
-      - name: Setup Git
-        run: |
-          git config --global user.name "the-luap"
-          git config --global user.email "paul-nothaft@hotmail.de"
-
-      - name: Remove sensitive files and directories
-        run: |
-          echo "Current files before cleanup:"
-          ls -la | head -10 || true
-          echo "..."
-          
-          # Remove sensitive files/directories if they exist
-          echo "Removing sensitive files..."
-          rm -rf .gitea/ || true
-          rm -rf scripts/install-gitea-runner.sh || true
-          rm -rf .drone* || true
-          rm -rf photo-sharing-prd.md || true
-          rm -rf CLAUDE.md || true
-          rm -rf storage/ || true
-          rm -rf events/ || true
-          rm -rf .playwright-mcp/
-          rm -rf .swarm || true
-          rm -rf .claude-flow || true
-
-          
-          echo "Sensitive files removal completed"
-          
-          # Add and commit the cleanup if there are changes
-          git add -A
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: remove sensitive files for GitHub mirror"
-            echo "✅ Committed cleanup of sensitive files"
-          else
-            echo "✅ No sensitive files to remove"
-          fi
-          
-          echo "Final file structure (top level):"
-          ls -la | head -10 || true
-
-      - name: Check GitHub token
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-        run: |
-          if [ -z "$GITHUBTOKEN" ]; then
-            echo "ERROR: GITHUBTOKEN secret is not set!"
-            echo "Please add a GitHub Personal Access Token as a secret named GITHUBTOKEN"
-            echo ""
-            echo "For fine-grained tokens:"
-            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens"
-            echo "  - Create token with repository access to the-luap/picpeak"
-            echo "  - Grant permissions: Contents (Read and Write), Metadata (Read)"
-            echo ""
-            echo "For classic tokens:"
-            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic)"
-            echo "  - Create token with 'repo' scope"
-            exit 1
-          else
-            echo "✅ GitHub token is available (length: ${#GITHUBTOKEN})"
-            # Try to detect token type (fine-grained tokens are typically longer)
-            if [ ${#GITHUBTOKEN} -gt 80 ]; then
-              echo "📌 Token appears to be a fine-grained personal access token"
-            else
-              echo "📌 Token appears to be a classic personal access token"
-            fi
-          fi
-
-      - name: Push to GitHub
-        env:
-          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
-          GIT_TRACE: 1  # Enable Git trace for debugging if needed
-        run: |
-          # Remove existing github remote if it exists
-          git remote remove github || true
-          
-          # Configure Git to use the token for authentication
-          # This method works for both classic and fine-grained tokens
-          git config --global url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf "https://github.com/"
-          
-          # Add GitHub remote (clean URL without credentials)
-          git remote add github https://github.com/the-luap/picpeak.git
-          
-          # Verify remote was added
-          echo "GitHub remote configuration:"
-          git remote -v
-          
-          # Push to GitHub main branch with error handling
-          echo "Pushing to GitHub..."
-          if git push github main --force 2>&1; then
-            echo "✅ Push to GitHub completed successfully!"
-          else
-            echo "❌ Push to GitHub failed!"
-            echo ""
-            echo "Common issues and solutions:"
-            echo "1. Token permissions: Ensure your token has 'Contents: write' permission"
-            echo "2. Token expiration: Check if your token has expired"
-            echo "3. Repository access: Verify the token has access to the-luap/picpeak repository"
-            echo ""
-            echo "For fine-grained tokens, required permissions:"
-            echo "  - Repository access: the-luap/picpeak"
-            echo "  - Repository permissions: Contents (Read and Write), Metadata (Read)"
-            echo ""
-            echo "For classic tokens, required scope: 'repo'"
-            exit 1
-          fi
-          
-          # Clean up the git config after push
-          git config --global --unset url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf
-
-      - name: Workflow completed
-        run: |
-          echo "✅ Mirror to GitHub workflow completed successfully!"
-          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
-          echo "🔒 Sensitive files have been removed from the mirror"
-

.gitea/workflows/test.yml

@@ -1,52 +0,0 @@
-name: Test and Lint
-
-on:
-  push:
-    branches: [ main, develop ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  backend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install backend dependencies
-        working-directory: ./backend
-        run: npm ci
-      
-      - name: Run backend linting
-        working-directory: ./backend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Run backend tests
-        working-directory: ./backend
-        run: npm test || true  # Continue on test failures for now
-  
-  frontend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci --legacy-peer-deps
-      
-      - name: Run frontend linting
-        working-directory: ./frontend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build

.gitea/workflows/version-and-release.yml

@@ -1,269 +0,0 @@
-name: Version and Release
-
-on:
-  workflow_dispatch:
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    outputs:
-      new_version: ${{ steps.version.outputs.new_version }}
-      version_changed: ${{ steps.version.outputs.version_changed }}
-      component_changed: ${{ steps.version.outputs.component_changed }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITEA_TOKEN || github.token }}
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Configure Git
-        run: |
-          git config --global user.name 'Gitea Actions Bot'
-          git config --global user.email 'actions@gitea.local'
-      
-      - name: Detect changes and bump version
-        id: version
-        run: |
-          set -e  # Exit on error
-          
-          echo "=== Debug Info ==="
-          echo "GitHub event before: ${{ github.event.before }}"
-          echo "GitHub SHA: ${{ github.sha }}"
-          echo "Current directory: $(pwd)"
-          echo "Git log (last 5): $(git log --oneline -5)"
-          
-          # Get the commit range for changed files
-          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
-            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
-            echo "Using commit range: $COMMIT_RANGE"
-            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-          else
-            # First commit or no previous commit, check against HEAD~1 if it exists
-            if git rev-parse HEAD~1 >/dev/null 2>&1; then
-              COMMIT_RANGE="HEAD~1..HEAD"
-              echo "Using commit range: $COMMIT_RANGE"
-              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
-            else
-              echo "First commit detected, checking all files"
-              CHANGED_FILES=$(git ls-files)
-            fi
-          fi
-          
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-          
-          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
-          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
-          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
-          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
-          
-          echo "Backend files changed: $BACKEND_CHANGED"
-          echo "Frontend files changed: $FRONTEND_CHANGED"
-          echo "Root files changed: $ROOT_CHANGED"
-          
-          # Get current versions
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.1.0")
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.1.0")
-          
-          echo "Current backend version: $BACKEND_VERSION"
-          echo "Current frontend version: $FRONTEND_VERSION"
-          
-          # Determine what to update based on changes
-          BACKEND_UPDATE=false
-          FRONTEND_UPDATE=false
-          COMPONENT_CHANGED="none"
-          
-          if [ "$ROOT_CHANGED" -gt 0 ]; then
-            # Root changes affect both components
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Root changes detected - updating both components"
-          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Both components changed
-            BACKEND_UPDATE=true
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="both"
-            # Use the higher version as source
-            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
-              SOURCE_VERSION=$BACKEND_VERSION
-            else
-              SOURCE_VERSION=$FRONTEND_VERSION
-            fi
-            echo "Both backend and frontend changed - updating both"
-          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
-            # Only backend changed
-            BACKEND_UPDATE=true
-            COMPONENT_CHANGED="backend"
-            SOURCE_VERSION=$BACKEND_VERSION
-            echo "Only backend changed - updating backend"
-          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
-            # Only frontend changed
-            FRONTEND_UPDATE=true
-            COMPONENT_CHANGED="frontend"
-            SOURCE_VERSION=$FRONTEND_VERSION
-            echo "Only frontend changed - updating frontend"
-          else
-            echo "No relevant changes detected"
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-            echo "component_changed=none" >> $GITHUB_OUTPUT
-            echo "new_version=" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          
-          echo "Component changed: $COMPONENT_CHANGED"
-          echo "Source version: $SOURCE_VERSION"
-          echo "Backend update: $BACKEND_UPDATE"
-          echo "Frontend update: $FRONTEND_UPDATE"
-          
-          # Calculate new version
-          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
-          MAJOR="${version_parts[0]}"
-          MINOR="${version_parts[1]}"
-          PATCH="${version_parts[2]}"
-          
-          # Increment patch version and ensure tag uniqueness
-          git fetch --tags --quiet || true
-          NEW_PATCH=$((PATCH + 1))
-          NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          
-          while git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; do
-            echo "Tag v${NEW_VERSION} already exists, bumping patch version again"
-            NEW_PATCH=$((NEW_PATCH + 1))
-            NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          done
-          
-          echo "New version: $NEW_VERSION"
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
-          
-          # Update versions in package.json files
-          if [ "$BACKEND_UPDATE" = true ]; then
-            echo "Updating backend version to $NEW_VERSION"
-            cd backend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          if [ "$FRONTEND_UPDATE" = true ]; then
-            echo "Updating frontend version to $NEW_VERSION"
-            cd frontend && npm version $NEW_VERSION --no-git-tag-version
-            cd ..
-          fi
-          
-          # Check if there are changes to commit
-          if [[ -n $(git status --porcelain) ]]; then
-            echo "version_changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-          fi
-      
-      - name: Commit version bump
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          set -e  # Exit on any error
-          
-          # First, ensure we have the latest changes
-          echo "Fetching latest changes..."
-          git fetch origin main
-          
-          # Check if we're behind and need to update
-          LOCAL=$(git rev-parse HEAD)
-          REMOTE=$(git rev-parse origin/main)
-          
-          if [ "$LOCAL" != "$REMOTE" ]; then
-            echo "Local is behind remote, pulling changes..."
-            git pull origin main --no-rebase
-          fi
-          
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            git add backend/package.json backend/package-lock.json
-            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            git add frontend/package.json frontend/package-lock.json
-            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
-          fi
-          
-          # Pull latest changes before pushing to avoid conflicts
-          echo "Pulling latest changes from origin/main..."
-          if ! git pull --rebase origin main; then
-            echo "Rebase failed, attempting to resolve..."
-            # If rebase fails, abort and try a regular merge
-            git rebase --abort || true
-            git pull origin main --no-rebase
-          fi
-          
-          # Push the changes with retry logic
-          echo "Pushing version bump..."
-          PUSH_SUCCESS=false
-          
-          for i in 1 2 3; do
-            echo "Push attempt $i of 3..."
-            
-            # Try to push
-            if git push origin main 2>&1; then
-              echo "Successfully pushed version bump on attempt $i"
-              PUSH_SUCCESS=true
-              break
-            else
-              echo "Push failed on attempt $i"
-              
-              if [ $i -lt 3 ]; then
-                echo "Waiting 5 seconds before retry..."
-                sleep 5
-                
-                echo "Pulling latest changes..."
-                git fetch origin main
-                
-                # Try rebase first, fall back to merge
-                if ! git rebase origin/main; then
-                  echo "Rebase failed, trying merge..."
-                  git rebase --abort 2>/dev/null || true
-                  git pull origin main --no-rebase
-                fi
-              fi
-            fi
-          done
-          
-          if [ "$PUSH_SUCCESS" = "false" ]; then
-            echo "ERROR: Failed to push after 3 attempts"
-            exit 1
-          fi
-      
-      - name: Create Git tag
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          COMPONENT="${{ steps.version.outputs.component_changed }}"
-          
-          if [ "$COMPONENT" = "both" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
-          elif [ "$COMPONENT" = "backend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
-          elif [ "$COMPONENT" = "frontend" ]; then
-            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
-          fi
-          
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
-          git push origin "v${{ steps.version.outputs.new_version }}"
-  
-  trigger-drone:
-    needs: version-bump
-    if: needs.version-bump.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Drone Build
-        run: |
-          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
-          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
-          echo "Drone will automatically trigger on the new tag"
-          # Drone CI will automatically trigger on the tag push event

.github/ISSUE_TEMPLATE/security_vulnerability.md

@@ -9,7 +9,7 @@ assignees: ''
 
 ⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.**
 
-Instead, please email security@example.com with the details.
+Instead, please use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new) or email **info@picpeak.app** with the details.
 
 For minor security improvements or questions, you can use this template:
 

.github/workflows/docker-build.yml

@@ -1,13 +1,19 @@
 name: Build and Push Docker Images
 
+# This workflow is triggered by:
+# - Push to main/develop branches (builds 'latest' or branch-tagged images)
+# - Version tags from Release Please (e.g., v1.2.0 -> builds versioned images)
+# - GitHub Releases (created by Release Please)
+# - Manual workflow dispatch
+
 on:
   push:
-    branches: [ main, develop ]
-    tags: [ 'v*.*.*' ]
+    branches: [ main, beta ]
+    tags: [ 'v*.*.*', 'v*.*.*-beta.*' ]  # Triggered by Release Please tags (stable and beta)
   pull_request:
-    branches: [ main ]
+    branches: [ main, beta ]
   release:
-    types: [ published ]
+    types: [ published ]  # Triggered when Release Please creates a release
   workflow_dispatch:
     inputs:
       push:
@@ -31,15 +37,44 @@ jobs:
       contents: read
       packages: write
       security-events: write
-    
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Determine build context
+      id: context
+      run: |
+        # Determine if this is a beta or stable release
+        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/beta ]]; then
+          echo "channel=beta" >> $GITHUB_OUTPUT
+          echo "is_prerelease=true" >> $GITHUB_OUTPUT
+        else
+          echo "channel=stable" >> $GITHUB_OUTPUT
+          echo "is_prerelease=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # Only build ARM64 for tagged releases (v*.*.*)
+        # QEMU emulation is too slow/unreliable for npm operations on regular builds
+        if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+          echo "skip_qemu=false" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+          echo "skip_qemu=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Set up QEMU
+      if: steps.platforms.outputs.skip_qemu != 'true'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: arm64
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
-      with:
-        platforms: linux/amd64,linux/arm64
 
     - name: Log in to Container Registry
       if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -65,10 +100,12 @@ jobs:
           type=ref,event=branch
           type=ref,event=pr
           type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
+          type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
+          type=sha,format=short
           type=raw,value=latest,enable={{is_default_branch}}
+          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/main' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          type=raw,value=beta,enable=${{ github.ref == 'refs/heads/beta' || steps.context.outputs.is_prerelease == 'true' }}
 
     - name: Build and push Backend Docker image
       uses: docker/build-push-action@v5
@@ -79,7 +116,7 @@ jobs:
         push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
         tags: ${{ steps.meta-backend.outputs.tags }}
         labels: ${{ steps.meta-backend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
         cache-from: type=gha,scope=backend
         cache-to: type=gha,mode=max,scope=backend
         build-args: |
@@ -100,7 +137,7 @@ jobs:
 
     - name: Upload Trivy scan results to GitHub Security tab
       if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: 'trivy-backend.sarif'
         category: 'backend-vulnerabilities'
@@ -111,15 +148,44 @@ jobs:
       contents: read
       packages: write
       security-events: write
-    
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Determine build context
+      id: context
+      run: |
+        # Determine if this is a beta or stable release
+        if [[ "${{ github.ref }}" == refs/tags/v*-beta* ]] || [[ "${{ github.ref }}" == refs/heads/beta ]]; then
+          echo "channel=beta" >> $GITHUB_OUTPUT
+          echo "is_prerelease=true" >> $GITHUB_OUTPUT
+        else
+          echo "channel=stable" >> $GITHUB_OUTPUT
+          echo "is_prerelease=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Determine build platforms
+      id: platforms
+      run: |
+        # Only build ARM64 for tagged releases (v*.*.*)
+        # QEMU emulation is too slow/unreliable for npm operations on regular builds
+        if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+          echo "skip_qemu=false" >> $GITHUB_OUTPUT
+        else
+          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+          echo "skip_qemu=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Set up QEMU
+      if: steps.platforms.outputs.skip_qemu != 'true'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: arm64
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
-      with:
-        platforms: linux/amd64,linux/arm64
 
     - name: Log in to Container Registry
       if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -145,10 +211,12 @@ jobs:
           type=ref,event=branch
           type=ref,event=pr
           type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
+          type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
+          type=sha,format=short
           type=raw,value=latest,enable={{is_default_branch}}
+          type=raw,value=stable,enable=${{ github.ref == 'refs/heads/main' || (startsWith(github.ref, 'refs/tags/v') && steps.context.outputs.is_prerelease == 'false') }}
+          type=raw,value=beta,enable=${{ github.ref == 'refs/heads/beta' || steps.context.outputs.is_prerelease == 'true' }}
 
     - name: Build and push Frontend Docker image
       uses: docker/build-push-action@v5
@@ -159,7 +227,7 @@ jobs:
         push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
         tags: ${{ steps.meta-frontend.outputs.tags }}
         labels: ${{ steps.meta-frontend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
         cache-from: type=gha,scope=frontend
         cache-to: type=gha,mode=max,scope=frontend
         build-args: |
@@ -180,7 +248,7 @@ jobs:
 
     - name: Upload Trivy scan results to GitHub Security tab
       if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: 'trivy-frontend.sarif'
         category: 'frontend-vulnerabilities'

.github/workflows/release-please-beta.yml

@@ -0,0 +1,37 @@
+name: Release Please (Beta)
+
+on:
+  push:
+    branches: [beta]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - name: Run Release Please
+        uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config-beta.json
+          manifest-file: .release-please-manifest-beta.json
+          target-branch: beta
+
+      - name: Output Release Info
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          echo "## Beta Release Created!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Tag:** ${{ steps.release.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Version:** ${{ steps.release.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Docker images will be built and tagged with this beta version." >> $GITHUB_STEP_SUMMARY
+

.github/workflows/release-please.yml

@@ -0,0 +1,36 @@
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}
+    steps:
+      - name: Run Release Please
+        uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      - name: Output Release Info
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          echo "## Release Created! " >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Tag:** ${{ steps.release.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Version:** ${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Docker images will be built and tagged with this version." >> $GITHUB_STEP_SUMMARY
+

.gitignore

@@ -75,9 +75,43 @@ certbot/
 
 # Ignore local contributor guide copy
 AGENTS.md
+CLAUDE.md
+
+# Working/planning documents (not for release)
+BUGS_AND_FEATURES.md
+frontend/TEST_PLAN.md
+docs/REFACTORING_PLAN.md
+docs/MULTIPLE_ADMINISTRATORS_PLAN.md
+docs/*_PLAN.md
+docs/test-*.md
+docs/feature-*.md
+
+# Scaffolding documentation (local development reference)
+docs/DATABASE_SCHEMA.md
+docs/BACKEND_SERVICES.md
+docs/API_ROUTES.md
+docs/FRONTEND_ARCHITECTURE.md
+docs/DEVELOPER_ONBOARDING.md
+docs/ENVIRONMENT_VARIABLES.md
+
+# Local backup directory (from testing)
+backup/
 
 # Local artifacts from browser tooling
 .playwright-mcp/
 
 # Local SQLite files in backend
 backend/*.sqlite*
+backend/*.db
+
+# Test files and artifacts
+test-images/
+test-logo*.jpg
+test-logo*.png
+test-results/
+
+# Development docker compose
+docker-compose.dev.yml
+
+# New layout development files
+new-layouts/

.release-please-manifest-beta.json

@@ -0,0 +1,3 @@
+{
+  ".": "3.28.3-beta.0"
+}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "2.6.1"
+}

CLAUDE.md

@@ -1,386 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Product Overview
-
-A secure photo sharing platform designed for weddings and events, enabling photographers to share time-limited, password-protected galleries. The platform features automatic expiration, archiving, and a scrappbook.de-inspired modern, minimalist UI.
-
-## Architecture Overview
-
-- **Backend**: Node.js/Express API with SQLite/PostgreSQL, file-based photo storage
-- **Frontend**: React SPA with scrappbook.de-style design (requires implementation)
-- **Storage**: File-based with active/archived separation
-- **Services**: Background workers for email, archiving, file watching, and expiration monitoring
-- **Analytics**: Umami integration for engagement tracking
-
-## Essential Commands
-
-### Backend Development
-```bash
-cd backend
-npm install               # Install dependencies
-npm run migrate          # Initialize database schema
-npm run dev              # Start with hot-reload (port 3001)
-npm test                 # Run Jest tests
-npm run lint             # ESLint checks
-```
-
-### Running a Single Test
-```bash
-cd backend
-npm test -- path/to/test.test.js
-npm test -- --testNamePattern="test name"
-```
-
-### Production Deployment
-See [DEPLOYMENT_GUIDE.md](./DEPLOYMENT_GUIDE.md) for comprehensive deployment instructions including:
-- Docker Compose deployment
-- PM2 deployment
-- Manual installation
-- Non-nginx deployment options
-- SSL/HTTPS setup
-- Troubleshooting guide
-
-**⚠️ CRITICAL PRODUCTION NOTICE:**
-- Production runs on a SEPARATE SERVER - never assume local changes affect production
-- ALWAYS request production server details before any troubleshooting
-- NO trial-and-error approaches in production - data loss is unacceptable
-- Every change must be thoroughly analyzed and tested locally first
-
-## Key Product Requirements (from PRD)
-
-### Core Features
-1. **File-Based System**: Drop photos in folders → automatic gallery creation
-2. **Automatic Expiration**: Default 30 days, with 7-day warning emails
-3. **Password Protection**: Secure access with customizable passwords
-4. **Automatic Archiving**: ZIP compression and storage after expiration
-5. **Email Notifications**: Creation, warning, and expiration notifications
-6. **Analytics**: Umami tracking for views, downloads, and engagement
-
-### Folder Structure
-```
-/events/
-  ├── active/
-  │   ├── wedding-smith-jones-2024-06-15/
-  │   │   ├── collages/
-  │   │   └── individual/
-  │   └── birthday-emma-2024-07-20/
-  └── archived/
-      └── wedding-smith-jones-2024-06-15.zip
-```
-
-## Frontend Implementation Requirements
-
-### Design Style (scrappbook.de-inspired)
-- **Color Palette**: Primary green (#5C8762), neutral backgrounds
-- **Typography**: Clean, modern sans-serif (Noto Sans or similar)
-- **Layout**: Minimalist, modular sections with grid-based photo displays
-- **Aesthetic**: Professional yet approachable, photographer-focused
-
-### Key Frontend Components to Build
-1. **Landing Page**: Password entry with event preview
-2. **Gallery View**: 
-   - Responsive photo grid with lazy loading
-   - Toggle between collages/individual photos
-   - Prominent expiration banner
-   - Download urgency indicators
-3. **Photo Lightbox**: Full-screen viewing with zoom
-4. **Mobile-First**: Responsive design with touch gestures
-5. **Personalization**: Dynamic theming per event type
-
-### User Experience Priorities
-- Clear expiration warnings (sticky banner)
-- One-click "Download All" for urgent galleries
-- Smooth image loading with skeleton screens
-- Intuitive navigation between photo categories
-- Professional presentation matching photographer branding
-
-## Key Architecture Patterns
-
-### Authentication Flow
-- JWT-based with separate tokens for admin and gallery access
-- Gallery tokens include event-specific claims
-- Auth middleware: `backend/src/middleware/auth.js`
-  - `adminAuth` - Admin panel protection
-  - `photoAuth` - Protected photo access  
-  - `verifyGalleryAccess` - Gallery-specific validation
-
-### Database Schema (Knex/SQLite)
-Main tables:
-- `events` - Gallery metadata with expiration, custom messages, themes
-- `photos` - Photo records linked to events
-- `access_logs` - IP-based usage tracking
-- `email_queue` - Async email processing
-- `admin_users` - Admin authentication
-
-### Service Architecture
-Background services run as separate processes:
-- **emailService**: Processes email queue with retry logic
-- **archiveService**: Creates ZIP archives of expired events
-- **expirationChecker**: Cron job for expiration warnings
-- **fileWatcher**: Monitors for new photo uploads
-- **backupService**: Scheduled backups with checksum-based change detection
-
-### API Structure
-- `/api/admin/*` - Admin panel endpoints (requires adminAuth)
-- `/api/gallery/*` - Public gallery endpoints  
-- `/api/auth/*` - Authentication endpoints
-- Rate limiting: 100 req/15min (general), 5 req/15min (auth)
-
-## Critical Implementation Notes
-
-1. **Security**: All gallery access requires valid JWT with event-specific claims
-2. **Expiration**: Events auto-expire based on `expires_at`, with 7-day email warnings
-3. **Email Queue**: Async processing with retry logic, check `email_queue` table
-4. **File Processing**: Sharp library for thumbnail generation (300x300)
-5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
-6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
-
-## Troubleshooting Guidelines
-
-### Before ANY Production Troubleshooting:
-1. **ALWAYS request specific details**:
-   - Production server URL/IP
-   - Current error messages/logs
-   - Recent changes or deployments
-   - Affected users/galleries
-   - Time of issue occurrence
-
-2. **Thorough Analysis Required**:
-   - Use detailed thinking/analysis for EVERY troubleshooting task
-   - Review all related code before suggesting changes
-   - Consider all potential side effects
-   - Never make assumptions about production environment
-
-3. **Safe Troubleshooting Steps**:
-   - First, reproduce issue in local/dev environment
-   - Analyze logs without modifying production
-   - Create detailed action plan before any changes
-   - Always have rollback strategy ready
-   - Document every step taken
-
-### Common Issues & Safe Approaches:
-- **Email not sending**: Check email_queue table, SMTP settings, service status
-- **Photos not loading**: Verify file permissions, storage paths, nginx config
-- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
-- **Performance problems**: Analyze with monitoring tools first, never experiment
-
-### Data Safety Rules:
-- NEVER delete or modify production data without explicit backup confirmation
-- ALWAYS verify backups exist before any data operations
-- NO direct database modifications without transaction safety
-- Log all actions for audit trail
-
-## Environment Variables
-
-### Backend (.env)
-- `JWT_SECRET` - Token signing
-- `ADMIN_URL`, `FRONTEND_URL` - CORS origins
-- `SMTP_*` - Email configuration
-- `DB_*` - PostgreSQL credentials (production)
-- `UMAMI_URL` - Umami instance URL (for server-side tracking)
-- `UMAMI_WEBSITE_ID` - Website ID from Umami
-
-### Frontend (.env)
-- `VITE_API_URL` - Backend API URL
-- `VITE_UMAMI_URL` - Umami analytics URL
-- `VITE_UMAMI_WEBSITE_ID` - Website ID from Umami
-- `VITE_UMAMI_SHARE_URL` - (Optional) Public share URL for embedded dashboard
-
-## Testing Approach
-- Jest with Supertest for API testing
-- Test files in `__tests__` directories
-- Database migrations run before tests
-- Mock email sending in tests
-
-## Umami Analytics Integration
-
-The frontend includes comprehensive Umami analytics integration for tracking user behavior and gallery performance.
-
-### Tracked Events:
-- **Gallery Events**:
-  - `gallery_password_entry` - Password attempts (success/failure)
-  - `gallery_photo_view` - Individual photo views
-  - `gallery_photo_download` - Single photo downloads
-  - `gallery_bulk_download` - Bulk/all photo downloads
-  - `gallery_expired` - Expired gallery access attempts
-- **Admin Events**:
-  - `admin_login` - Admin authentication
-  - `admin_event_created` - New event creation
-  - `admin_event_archived` - Event archiving
-  - `admin_event_deleted` - Event deletion
-  - `admin_settings_updated` - Settings changes
-- **User Behavior**:
-  - Search queries (with debouncing)
-  - Expiration warning views
-  - Page views with automatic tracking
-
-### Setup:
-1. Install Umami (self-hosted or cloud)
-2. Create a website in Umami dashboard
-3. Set environment variables:
-   ```
-   VITE_UMAMI_URL=https://your-umami-instance.com
-   VITE_UMAMI_WEBSITE_ID=your-website-id
-   VITE_UMAMI_SHARE_URL=https://your-umami-instance.com/share/...
-   ```
-
-### Analytics Dashboard:
-- Admin panel includes analytics page at `/admin/analytics`
-- Summary view with key metrics
-- Option to embed full Umami dashboard
-- Real-time event tracking
-
-## Accessibility & Performance Features
-
-### Accessibility (WCAG 2.1 AA Compliance)
-- **Error Boundaries**: Graceful error handling with recovery options
-- **Skip Links**: Skip to main content for keyboard navigation
-- **ARIA Labels**: Proper labeling for screen readers
-- **Focus Management**: Focus trap in modals, visible focus indicators
-- **Keyboard Navigation**: Full keyboard support in gallery lightbox (arrows, escape, +/-, d for download)
-- **Loading States**: Skeleton screens instead of spinners for better UX
-- **Offline Support**: Visual indicator when offline
-- **Form Validation**: Accessible error messages with aria-describedby
-
-### Performance Optimizations
-- **Lazy Loading**: Images load on scroll with Intersection Observer
-- **Skeleton Screens**: Instant visual feedback during loading
-- **Error Recovery**: Component-level error boundaries prevent full page crashes
-- **Optimistic Updates**: Immediate UI updates with background sync
-- **Debounced Search**: Prevents excessive API calls
-- **Analytics**: Non-blocking Umami integration
-
-### Component Library Enhancements
-- `<ErrorBoundary>` - Catches and displays errors gracefully
-- `<PageErrorBoundary>` - Full-page error recovery
-- `<Skeleton>` - Flexible skeleton loader with variants
-- `<OfflineIndicator>` - Network status monitoring
-- `<SkipLink>` - Accessibility navigation
-- `useFocusTrap` - Modal focus management hook
-- `useOnlineStatus` - Network status hook
-
-## Theme System & Branding
-
-### Theme Features
-- **Dynamic Theming**: CSS variables for runtime theme switching
-- **Preset Themes**: Default, Wedding, Birthday, Corporate, Minimal
-- **Customization Options**:
-  - Primary/Accent/Background/Text colors
-  - Font family selection
-  - Border radius (none, sm, md, lg)
-  - Custom logo upload
-  - Custom CSS injection
-- **Event-Specific Themes**: Override global theme per gallery
-- **Live Preview**: Real-time theme changes in admin panel
-
-### Theme Context API
-```typescript
-const { theme, setTheme, setThemeByName } = useTheme();
-```
-
-### Branding Settings
-- Company name, tagline, and support email
-- Custom footer text
-- Optional watermarking on downloads
-- Logo upload for gallery header
-
-### CSS Variables
-```css
---color-primary: #5C8762;
---color-primary-light: #7aa583;
---color-primary-dark: #4a6f4f;
---color-accent: #22c55e;
---color-background: #fafafa;
---color-text: #171717;
---font-family: 'Inter', sans-serif;
---border-radius: 0.5rem;
-```
-
-## Backup Service
-
-### Overview
-The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
-
-### Features
-- **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
-- **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
-- **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
-- **Email Notifications**: Alerts on backup failure, optional success notifications
-- **Retention Management**: Automatic cleanup of old backup runs based on retention policy
-- **Progress Tracking**: Database storage of backup history, file states, and statistics
-
-### Configuration
-Backup settings are stored in `app_settings` table with `backup_` prefix:
-- `backup_enabled`: Enable/disable the service
-- `backup_schedule`: Cron expression (e.g., '0 2 * * *')
-- `backup_destination_type`: 'local', 'rsync', or 's3'
-- `backup_retention_days`: How long to keep backup history
-- `backup_include_archived`: Whether to backup archived events
-- `backup_exclude_patterns`: File patterns to exclude
-
-### API Endpoints
-- `GET /api/admin/backup/config` - Get current configuration
-- `PUT /api/admin/backup/config` - Update configuration
-- `GET /api/admin/backup/status` - Get backup status and history
-- `POST /api/admin/backup/run` - Trigger manual backup
-- `POST /api/admin/backup/test-connection` - Test destination connectivity
-
-### Testing
-Run backup service test: `npm run test-backup`
-
-### Database Tables
-- `backup_runs`: Tracks each backup execution with statistics
-- `backup_file_states`: Stores file checksums for change detection
-
-## Thumbnail Generation
-
-### Square Thumbnail Implementation (Issue #12 Fix)
-The system now generates **square 300x300px thumbnails** to prevent blurry/stretched images in the gallery grid:
-
-- **Problem**: Previously generated 300px width with proportional height (e.g., 300x200 for 3:2 photos), but CSS forced square display causing distortion
-- **Solution**: Thumbnails now use `cover` fit mode to crop to exact 300x300px dimensions with center positioning
-- **Configuration**: Settings stored in `app_settings` table with keys: `thumbnail_width`, `thumbnail_height`, `thumbnail_fit`, `thumbnail_quality`, `thumbnail_format`
-- **Migration**: Run `040_add_thumbnail_settings.js` to add default square thumbnail settings
-- **Regeneration Script**: Use `scripts/regenerate-square-thumbnails.js` to update existing thumbnails
-
-### Thumbnail Settings API
-- `GET /api/admin/thumbnails/settings` - Get current thumbnail configuration
-- `PUT /api/admin/thumbnails/settings` - Update thumbnail settings (requires regeneration)
-- `POST /api/admin/thumbnails/regenerate` - Regenerate all thumbnails with new settings
-- `GET /api/admin/thumbnails/regenerate/status` - Check regeneration progress
-
-## Success Metrics (from PRD)
-- Time to generate gallery: <2 minutes
-- Guest satisfaction: >90%
-- System uptime: 99.9%
-- Email delivery rate: >98%
-- Successful archiving: 100%
-
-## Documentation & Development Practices
-
-### Documentation Guidelines:
-- **NEVER create new documentation files for simple tasks**
-- **ALWAYS update existing documentation (like this CLAUDE.md)**
-- Only create new .md files when explicitly requested
-- Avoid creating temporary scripts for one-off tasks
-
-### Development Best Practices:
-- Test all changes thoroughly in local environment first
-- Use version control for all changes
-- Keep commits atomic and well-described
-- Review impact on all integrated services
-- Consider backward compatibility
-- Update tests when changing functionality
-
-### Production Deployment Checklist:
-- [ ] All tests passing locally
-- [ ] Linting and type checks pass
-- [ ] Database migrations tested with rollback plan
-- [ ] Environment variables documented
-- [ ] Backup strategy confirmed
-- [ ] Monitoring alerts configured
-- [ ] Rollback procedure documented
-- [ ] Stakeholders notified of maintenance window
-- always use docker deployment for testing

DEPLOYMENT_GUIDE.md

@@ -2,37 +2,36 @@
 
 This guide covers multiple deployment options for PicPeak, from simple local setups to production-ready configurations.
 
-## 🎯 Quick Start - Simple Setup (Recommended for Beginners)
+## 📋 Table of Contents
 
-For the easiest installation without Docker or complex configurations, use our **unified setup script**:
+- [Quick Start](#-quick-start)
+- [Prerequisites](#prerequisites)
+- [Configuration](#-configuration)
+- [Deployment](#-deployment)
+- [First Login](#-first-login)
+- [Release Channels](#-release-channels)
+- [Reverse Proxy Setup](#-reverse-proxy-setup)
+- [External Media Library](#external-media-library)
+- [Maintenance](#-maintenance)
+- [Troubleshooting](#-troubleshooting)
+
+## 🚀 Quick Start
+
+### Option 1: Automated Setup Script (Easiest)
+
+For the simplest installation, use our unified setup script:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
-chmod +x setup.sh && \
-sudo ./setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
 ```
 
-This automated script handles everything including:
-- Choice between Docker or Native installation
-- OS detection and dependency installation
-- Database setup and service configuration
-- SSL/HTTPS setup (optional)
-
-Perfect for:
-- Small to medium deployments
-- Local or VPS installations  
-- Users new to server management
-- Quick testing and evaluation
+This script handles Docker/Native installation choice, OS detection, dependencies, database setup, and optional SSL.
 
 👉 **See [SIMPLE_SETUP.md](./SIMPLE_SETUP.md) for detailed instructions.**
 
----
-
-## 🐳 Docker Compose Deployment
-
-### Option 1: Using Pre-built Images (Recommended)
-
-PicPeak provides official Docker images via GitHub Container Registry for quick deployment without building:
+### Option 2: Docker with Pre-built Images (Recommended)
 
 ```bash
 # Clone repository for configuration files
@@ -43,35 +42,40 @@ cd picpeak
 cp .env.example .env
 nano .env  # Edit with your values
 
-# Use pre-built images deployment
+# Create required directories
+mkdir -p events/active events/archived data logs backup storage
+chmod -R 755 events data logs backup storage
+
+# Deploy using pre-built images
 docker compose -f docker-compose.production.yml up -d
+
+# Check logs
+docker compose -f docker-compose.production.yml logs -f
 ```
 
-The production compose file uses:
-- **Backend**: `ghcr.io/the-luap/picpeak/backend:latest`
-- **Frontend**: `ghcr.io/the-luap/picpeak/frontend:latest`
+**Available image tags:**
+| Channel | Tags | Description |
+|---------|------|-------------|
+| Stable | `stable`, `latest`, `v2.3.0` | Production-ready releases |
+| Beta | `beta`, `v2.3.0-beta.1` | Early access to new features |
+| Branch | `main`, `beta` | Latest from each branch |
 
-Available tags:
-- `latest` - Latest stable release
-- `main` - Latest main branch build
-- `develop` - Development branch (may be unstable)
-- `v1.0.0` - Specific version tags
+To select a channel, set `PICPEAK_CHANNEL` in your `.env` file (see [Release Channels](#release-channels) section)
 
-### Option 2: Building from Source
+### Option 3: Build from Source
 
-If you need to customize the application or the pre-built images aren't available, you can build locally:
+```bash
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+cp .env.example .env
+nano .env  # Edit with your values
 
-## 📋 Table of Contents
+mkdir -p events/active events/archived data logs backup storage
+chmod -R 755 events data logs backup storage
 
-- [Prerequisites](#prerequisites)
-- [Quick Start](#quick-start)
-- [Configuration](#configuration)
-- [Deployment](#deployment)
-- [First Login](#first-login)
-- [Reverse Proxy Setup](#reverse-proxy-setup)
-- [Maintenance](#maintenance)
-- [Troubleshooting](#troubleshooting)
- - [External Media Library](#external-media-library)
+docker compose build
+docker compose up -d
+```
 
 ## Prerequisites
 
@@ -80,106 +84,6 @@ If you need to customize the application or the pre-built images aren't availabl
 - SMTP server credentials for emails
 - At least 2GB RAM and 20GB storage
 
-## 🚀 Quick Start
-
-### Method 1: Using Pre-built Images (Fastest)
-
-1. **Clone the repository for configs**
-   ```bash
-   git clone https://github.com/the-luap/picpeak.git
-   cd picpeak
-   ```
-
-2. **Set up environment**
-   ```bash
-   cp .env.example .env
-   nano .env  # Edit with your values
-   ```
-
-3. **Create required directories**
-   ```bash
-   mkdir -p events/active events/archived data logs backup storage
-   chmod -R 755 events data logs backup storage
-   ```
-
-4. **Deploy using pre-built images**
-   ```bash
-   docker compose -f docker-compose.production.yml up -d
-   ```
-
-5. **Check logs**
-   ```bash
-   docker compose -f docker-compose.production.yml logs -f
-   ```
-
-## External Media Library
-
-PicPeak can reference an existing, read‑only media library mounted into the backend container. This avoids copying originals into PicPeak storage.
-
-- Map your host library path to the container as read‑only in `docker-compose.production.yml`:
-  - Add volume under `backend`: `- ${EXTERNAL_MEDIA}:/external-media:ro`
-  - Add backend env: `EXTERNAL_MEDIA_ROOT=/external-media`
-- In `.env`, set:
-  - `EXTERNAL_MEDIA=/mnt/photos` (example host path)
-  - `EXTERNAL_MEDIA_ROOT=/external-media`
-
-Usage:
-- In Admin → Events, set “Source Mode” to “Reference (external folder)”, select a folder under `/external-media`, then import to index and generate thumbnails. Originals stay in your library.
-
-Backups and Archives:
-- Backups only include data under `STORAGE_PATH` and exclude external originals. The backup manifest includes `metadata.external_references = { excluded: true, events: N, photos: M }` and the Admin UI surfaces a warning.
-- Archiving reference events creates a manifest‑only ZIP and deletes thumbnails for that event. External originals are never moved or deleted.
-
-Local (npm) setup (no Docker):
-
-1. Create or choose a folder that contains your external originals, e.g. `/Users/you/Pictures/picpeak-external` (macOS/Linux) or `C:\\Pictures\\picpeak-external` (Windows).
-2. In `backend/.env` (or your shell), set:
-   - `EXTERNAL_MEDIA_ROOT=/absolute/path/to/picpeak-external`
-   - Ensure `STORAGE_PATH` points to your PicPeak storage (defaults to `./storage`).
-3. Start services from source:
-   - Backend: `cd backend && npm install && npm run migrate && JWT_SECRET=... npm start`
-   - Frontend: `cd frontend && npm install && npm run dev` (or build + serve)
-4. In Admin → Events:
-   - Create an event, set “Source Mode” to “Reference (external folder)”.
-   - Use the folder picker to browse under your `EXTERNAL_MEDIA_ROOT` and select the subfolder to reference.
-   - Click “Import from selected folder” to index files and generate thumbnails on demand.
-
-Notes:
-- PicPeak only reads from `EXTERNAL_MEDIA_ROOT`; it never modifies or deletes your originals there.
-- Thumbnails are generated under `STORAGE_PATH/thumbnails` and are included in backups; originals in `EXTERNAL_MEDIA_ROOT` are excluded.
-- On Windows, use absolute paths (e.g., `C:\\Photos\\Library`) for `EXTERNAL_MEDIA_ROOT`.
-
-### Method 2: Building from Source
-
-1. **Clone the repository**
-   ```bash
-   git clone https://github.com/the-luap/picpeak.git
-   cd picpeak
-   ```
-
-2. **Set up environment**
-   ```bash
-   cp .env.example .env
-   nano .env  # Edit with your values
-   ```
-
-3. **Create required directories**
-   ```bash
-   mkdir -p events/active events/archived data logs backup storage
-   chmod -R 755 events data logs backup storage
-   ```
-
-4. **Build and deploy**
-   ```bash
-   docker compose build
-   docker compose up -d
-   ```
-
-5. **Check logs**
-   ```bash
-   docker compose logs -f
-   ```
-
 ## 🔧 Configuration
 
 ### Essential Environment Variables
@@ -219,14 +123,17 @@ Update `.env` with:
 - **URL Configuration** (for backend CORS):
   - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
     - Example (Docker): `http://localhost:3000`
-  - `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
-    - Example (Docker): `http://localhost:3000`
+- `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+  - Example (Docker): `http://localhost:3000`
   
   Notes:
   - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
   - Always include the scheme (`http://` or `https://`).
   - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
 
+#### Authentication Security
+- Configure login attempt thresholds from **Admin → Settings → Security**. Defaults are 5 failed attempts per IP within 15 minutes, resulting in a 30 minute lockout.
+
 #### External Database Example
 To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
 
@@ -355,14 +262,16 @@ docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
 # Show current admin username and email (password is hidden)
 docker exec picpeak-backend node scripts/show-admin-credentials.js
 
-# Reset the admin password to a new random password
+# Reset the admin password to a new random password (displays new password in console)
 docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
 ```
 
+> **Note:** When using `--reset`, the new password will be displayed in the console output. Save it immediately - it will not be shown again!
+
 #### Important Security Notes
 
 - **Login requires the email address**, not username
-- The admin password is only displayed once during initial setup
+- When resetting password, the new password is displayed once in the console - save it immediately
 - **Password change is MANDATORY** on first login - the system will force you to change it
 - If you lose the password before first login, use the `--reset` option to generate a new one
 - New password requirements: minimum 12 characters, mixed case, numbers, and special characters
@@ -424,10 +333,10 @@ If you lose your admin credentials after the first login, you'll need to manuall
 
 ```bash
 # Native reinstall example
-sudo ./setup.sh --native --force-admin-password-reset
+sudo ./picpeak-setup.sh --native --force-admin-password-reset
 
 # Docker reinstall example
-sudo ./setup.sh --docker --force-admin-password-reset
+sudo ./picpeak-setup.sh --docker --force-admin-password-reset
 ```
 
 The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.
@@ -443,10 +352,79 @@ ADMIN_EMAIL=your-email@yourdomain.com
 
 **Note**: This only works on first deployment. To change the admin email after deployment, you'll need to update it in the database or create a new admin user through the admin panel.
 
+## 🔄 Release Channels
+
+PicPeak offers two release channels for different needs:
+
+### Stable Channel (Recommended)
+- Production-ready releases
+- Thoroughly tested before release
+- Docker tags: `stable`, `latest`, or specific version like `v2.3.0`
+
+### Beta Channel
+- Early access to new features
+- May contain bugs or incomplete functionality
+- Docker tags: `beta` or specific version like `v2.3.0-beta.1`
+
+### Configuring Your Channel
+
+Set the `PICPEAK_CHANNEL` environment variable in your `.env` file:
+
+```bash
+# For stable releases (default)
+PICPEAK_CHANNEL=stable
+
+# For beta releases
+PICPEAK_CHANNEL=beta
+
+# For a specific version
+PICPEAK_CHANNEL=v2.3.0
+```
+
+The `docker-compose.production.yml` uses this variable for both backend and frontend images:
+```yaml
+image: ghcr.io/the-luap/picpeak/backend:${PICPEAK_CHANNEL:-stable}
+```
+
+### Switching Channels
+
+To switch between channels:
+
+```bash
+# Edit your .env file
+nano .env
+# Change PICPEAK_CHANNEL=stable to PICPEAK_CHANNEL=beta (or vice versa)
+
+# Pull the new images and restart
+docker compose -f docker-compose.production.yml pull
+docker compose -f docker-compose.production.yml up -d
+```
+
+### Update Notifications
+
+The admin dashboard automatically notifies you when updates are available for your channel. This feature:
+- Checks GitHub releases hourly (cached to avoid rate limits)
+- Shows updates relevant to your current channel (stable or beta)
+- Can be disabled by setting `UPDATE_CHECK_ENABLED=false` in your `.env`
+
 ## 🔒 Reverse Proxy Setup
 
 For production deployments, you should use a reverse proxy for SSL/HTTPS. The application exposes ports directly, allowing you to use any reverse proxy solution.
 
+### Routing Schema
+
+PicPeak consists of two services that need to be routed correctly:
+
+| Path | Service | Port | Description |
+|------|---------|------|-------------|
+| `/api/*` | Backend | 3001 | All API endpoints |
+| `/photos/*` | Backend | 3001 | Protected photo files |
+| `/thumbnails/*` | Backend | 3001 | Protected thumbnail files |
+| `/uploads/*` | Backend | 3001 | Upload files |
+| `/*` (everything else) | Frontend | 3000 | React SPA (including `/admin/*`, `/gallery/*`) |
+
+> **Important:** The `/admin/*` routes are served by the frontend (React SPA), NOT the backend. The backend only handles `/api/admin/*` requests.
+
 ### Option 1: Nginx
 
 Install nginx and create `/etc/nginx/sites-available/picpeak`:
@@ -465,39 +443,32 @@ server {
     ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
 
-    # Frontend
-    location / {
-        proxy_pass http://localhost:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Frontend (serves UI and /admin/*)
-    location / {
-        proxy_pass http://localhost:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Backend API and protected resources
-    location /api {
+    # Backend: API endpoints
+    location /api/ {
         proxy_pass http://localhost:3001;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
-    location ~ ^/(photos|thumbnails|uploads) {
+
+    # Backend: Protected media files
+    location ~ ^/(photos|thumbnails|uploads)/ {
         proxy_pass http://localhost:3001;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Frontend: Everything else (React SPA)
+    location / {
+        proxy_pass http://localhost:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
 }
 ```
 
@@ -527,10 +498,16 @@ services:
   backend:
     labels:
       - "traefik.enable=true"
+      # API endpoints
       - "traefik.http.routers.picpeak-api.rule=Host(`your-domain.com`) && PathPrefix(`/api`)"
       - "traefik.http.routers.picpeak-api.entrypoints=websecure"
       - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
       - "traefik.http.services.picpeak-api.loadbalancer.server.port=3001"
+      # Protected media files
+      - "traefik.http.routers.picpeak-media.rule=Host(`your-domain.com`) && (PathPrefix(`/photos`) || PathPrefix(`/thumbnails`) || PathPrefix(`/uploads`))"
+      - "traefik.http.routers.picpeak-media.entrypoints=websecure"
+      - "traefik.http.routers.picpeak-media.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak-media.loadbalancer.server.port=3001"
 ```
 
 ### Option 3: Caddy
@@ -539,21 +516,12 @@ Create a `Caddyfile`:
 
 ```caddyfile
 your-domain.com {
-    # Frontend
-    handle /* {
-        reverse_proxy localhost:3000
-    }
-
-    # Backend API and admin
+    # Backend: API endpoints
     handle /api/* {
         reverse_proxy localhost:3001
     }
-    
-    handle /admin/* {
-        reverse_proxy localhost:3001
-    }
 
-    # Protected resources
+    # Backend: Protected media files
     handle /photos/* {
         reverse_proxy localhost:3001
     }
@@ -565,6 +533,11 @@ your-domain.com {
     handle /uploads/* {
         reverse_proxy localhost:3001
     }
+
+    # Frontend: Everything else (React SPA including /admin/*, /gallery/*)
+    handle {
+        reverse_proxy localhost:3000
+    }
 }
 ```
 
@@ -644,20 +617,27 @@ docker compose up -d
 docker compose ps
 ```
 
-#### Specific Version Updates
+#### Specific Version or Channel Updates
 
-To use a specific version of the images:
+To use a specific version or switch channels, update your `.env` file:
 
 ```bash
-# Edit docker-compose.production.yml to specify version tags
-# Change: ghcr.io/the-luap/picpeak/backend:latest
-# To:     ghcr.io/the-luap/picpeak/backend:v1.0.0
+# Edit .env to change the channel or pin to a specific version
+nano .env
+
+# Options for PICPEAK_CHANNEL:
+# - stable    (recommended, production-ready)
+# - beta      (early access to new features)
+# - v2.3.0    (pin to specific stable version)
+# - v2.3.0-beta.1  (pin to specific beta version)
 
 # Then pull and restart
 docker compose -f docker-compose.production.yml pull
 docker compose -f docker-compose.production.yml up -d
 ```
 
+The admin dashboard will notify you when updates are available for your configured channel.
+
 ### Database Migrations
 
 Migrations run automatically on startup, but you can run them manually:

README.md

@@ -7,12 +7,27 @@
   [![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=flat&logo=docker&logoColor=white)](https://www.docker.com/)
   [![Node.js](https://img.shields.io/badge/node.js-6DA55F?style=flat&logo=node.js&logoColor=white)](https://nodejs.org/)
   [![React](https://img.shields.io/badge/react-%2320232a.svg?style=flat&logo=react&logoColor=%2361DAFB)](https://reactjs.org/)
+
+  [Homepage](https://www.picpeak.app) · [Live Demo](https://demo.picpeak.app) · [Documentation](DEPLOYMENT_GUIDE.md)
 </div>
 
 **PicPeak** is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding.
 
 ![PicPeak Gallery Preview](docs/screenshot-gallery.png)
 
+## 🎮 Live Demo
+
+Try PicPeak without installing anything:
+
+| | |
+|---|---|
+| **Demo URL** | [demo.picpeak.app](https://demo.picpeak.app) |
+| **Admin Panel** | [demo.picpeak.app/admin](https://demo.picpeak.app/admin) |
+| **Email** | `demo@picpeak.app` |
+| **Password** | `Demo2026!` |
+
+> The demo resets periodically. Uploaded content may be removed without notice.
+
 ## 🌟 Why Choose PicPeak?
 
 Unlike expensive SaaS solutions, PicPeak gives you:
@@ -68,9 +83,9 @@ cp .env.example .env
 nano .env
 
 # Start with Docker Compose
-docker-compose up -d
+docker compose up -d
 
-# Access at http://localhost:3005
+# Access at http://localhost:3000
 ```
 
 Note on Docker file permissions (PUID/PGID)
@@ -79,12 +94,58 @@ Note on Docker file permissions (PUID/PGID)
 - Example in `.env`:
   - `PUID=1000`
   - `PGID=1000`
-- Without this, creating events, uploads, thumbnails, or logs can fail with “Permission denied”.
+- Without this, creating events, uploads, thumbnails, or logs can fail with "Permission denied".
+
+## 🔄 Release Channels
+
+PicPeak offers two release channels for different needs:
+
+### Stable Channel (Recommended)
+- Production-ready releases
+- Thoroughly tested before release
+- Docker tags: `stable`, `latest`, or specific version like `v2.3.0`
+
+### Beta Channel
+- Early access to new features
+- May contain bugs or incomplete functionality
+- Docker tags: `beta` or specific version like `v2.3.0-beta.1`
+
+### Switching Channels
+
+Set the `PICPEAK_CHANNEL` environment variable in your `.env` file:
+
+```bash
+# For stable releases (default)
+PICPEAK_CHANNEL=stable
+
+# For beta releases
+PICPEAK_CHANNEL=beta
+
+# For a specific version
+PICPEAK_CHANNEL=v2.3.0
+```
+
+Then update your containers:
+
+```bash
+docker compose -f docker-compose.production.yml pull
+docker compose -f docker-compose.production.yml up -d
+```
+
+### Update Notifications
+
+The admin dashboard automatically notifies you when updates are available for your channel. To disable update checks, set:
+
+```bash
+UPDATE_CHECK_ENABLED=false
+```
 
 ## 📖 Documentation
 
 - 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
   - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
+- 📚 [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints
+- 🛠️ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
@@ -133,6 +194,31 @@ Perfect for:
 - **Docker**: v20.10.0+
 - **Docker Compose**: v2.0.0+
 
+### Video Support Requirements
+When enabling video uploads, consider these additional resources:
+
+| Resource | Recommendation | Notes |
+|----------|----------------|-------|
+| **RAM** | 4GB+ recommended | FFmpeg processing requires more memory |
+| **Storage** | Plan for 10-100x more | Videos are significantly larger than images |
+| **CPU** | Additional cores help | Video thumbnail extraction is CPU-intensive |
+| **Bandwidth** | Higher throughput | Video streaming requires more bandwidth |
+
+**Technical Notes:**
+- FFmpeg is bundled via npm (`@ffmpeg-installer/ffmpeg`) - no system installation required
+- Maximum upload size: **10GB per video file**
+- Chunked upload support for files >100MB (resumable uploads)
+- Supported formats: MP4, WebM, MOV, AVI
+- Video thumbnails are automatically generated from the first few seconds
+
+**For Nginx/Reverse Proxy:**
+If using Nginx, increase the client max body size:
+```nginx
+client_max_body_size 10G;
+proxy_read_timeout 3600;
+proxy_send_timeout 3600;
+```
+
 ## 🤝 Contributing
 
 We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
@@ -208,7 +294,6 @@ These features are currently in beta testing and may have limited functionality
 
 | Feature | Description | Status |
 |---------|-------------|--------|
-| **Download Protection** | Advanced image protection system with canvas rendering, invisible watermarking, and right-click prevention to protect your photos from unauthorized downloads | 🧪 Beta |
 | **Simple Deployment Script** | One-click deployment script for quick server setup with automated configuration and dependency installation | 🧪 Beta |
 
 ### 📋 Future Enhancements
@@ -217,12 +302,13 @@ These features are currently in beta testing and may have limited functionality
 |---------|-------------|----------|---------|
 | **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
 | **External Media Library (Reference Mode)** | Use an external folder library as a read‑only source with import and on‑demand thumbnail generation | High | ✅ Implemented |
-| **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
+| **Download Protection** | Advanced image protection system with canvas rendering, invisible watermarking, right-click prevention, and DevTools detection to protect photos from unauthorized downloads | High | ✅ Implemented |
+| **Gallery Templates** | Multiple gallery layouts (grid, masonry, carousel, timeline, hero, mosaic) with custom CSS styling support. Includes starter templates like Apple Liquid Glass for complete visual customization | Medium | ✅ Implemented |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
 | **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
-| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
-| **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
-| **Filtering & Export Options** | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
+| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | ✅ Implemented |
+| **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | ✅ Implemented |
+| **Filtering & Export Options** | Filter photos by likes, ratings, comments, or favorites. Search by filename. Sort by date, name, size, or rating. Export filtered selections as ZIP or generate Capture One/Lightroom-compatible file lists for professional workflows | Medium | ✅ Implemented |
 
 **Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
 
@@ -256,6 +342,8 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
 <p align="center">
   Made with ❤️ by photographers, for photographers
   <br>
+  <a href="https://www.picpeak.app">Homepage</a> •
+  <a href="https://demo.picpeak.app">Live Demo</a> •
   <a href="https://github.com/the-luap/picpeak">GitHub</a> •
   <a href="DEPLOYMENT_GUIDE.md">Documentation</a> •
   <a href="https://github.com/the-luap/picpeak/issues">Support</a>

SECURITY.md

@@ -6,8 +6,8 @@ We release patches for security vulnerabilities. Currently supported versions:
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 1.x.x   | :white_check_mark: |
-| < 1.0   | :x:                |
+| 2.x.x   | :white_check_mark: |
+| < 2.0   | :x:                |
 
 ## Reporting a Vulnerability
 
@@ -15,9 +15,9 @@ We take the security of PicPeak seriously. If you have discovered a security vul
 
 ### 1. **Do NOT create a public GitHub issue**
 
-### 2. Report the vulnerability by:
-- Opening a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
-- Mark it clearly as "SECURITY" in the title
+### 2. Report the vulnerability privately by:
+- **Preferred:** Use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new)
+- **Alternative:** Email us at **info@picpeak.app** with the details
 - Include:
   - Description of the vulnerability
   - Steps to reproduce
@@ -82,7 +82,7 @@ We believe in responsible disclosure. Once a vulnerability is fixed:
 
 ## Contact
 
-- Security issues: [Create a security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+- Security issues: Email **info@picpeak.app** or use [GitHub Private Vulnerability Reporting](https://github.com/the-luap/picpeak/security/advisories/new)
 - General support: [GitHub Issues](https://github.com/the-luap/picpeak/issues)
 
 Thank you for helping keep PicPeak and its users safe!

SIMPLE_SETUP.md

@@ -8,9 +8,9 @@ This guide provides easy installation instructions for PicPeak on Linux servers
 
 ```bash
 # Download and run the unified setup script
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
-chmod +x setup.sh && \
-sudo ./setup.sh
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
+chmod +x picpeak-setup.sh && \
+sudo ./picpeak-setup.sh
 ```
 
 The script will automatically detect your environment and recommend the best installation method.
@@ -21,7 +21,7 @@ The script will automatically detect your environment and recommend the best ins
 Best for: Most users, easy updates, isolated environment
 
 ```bash
-sudo ./setup.sh --docker
+sudo ./picpeak-setup.sh --docker
 ```
 
 **Pros:**
@@ -38,7 +38,7 @@ sudo ./setup.sh --docker
 Best for: Resource-constrained systems, Raspberry Pi, direct control
 
 ```bash
-sudo ./setup.sh --native
+sudo ./picpeak-setup.sh --native
 ```
 
 **Pros:**
@@ -73,7 +73,7 @@ sudo ./setup.sh --native
 
 ### Interactive Mode (Default)
 ```bash
-sudo ./setup.sh
+sudo ./picpeak-setup.sh
 ```
 
 The script will prompt you to choose:
@@ -87,7 +87,7 @@ The script will prompt you to choose:
 
 #### Docker with full configuration:
 ```bash
-sudo ./setup.sh --docker --unattended \
+sudo ./picpeak-setup.sh --docker --unattended \
   --domain photos.example.com \
   --email admin@example.com \
   --admin-password SecurePass123 \
@@ -100,7 +100,7 @@ sudo ./setup.sh --docker --unattended \
 
 #### Native with minimal configuration:
 ```bash
-sudo ./setup.sh --native --unattended \
+sudo ./picpeak-setup.sh --native --unattended \
   --email admin@example.com \
   --admin-password SecurePass123
 ```
@@ -219,29 +219,36 @@ location ~ ^/(photos|thumbnails|uploads) {
 
 ### Creating a Gallery
 
-#### Method 1: Via Admin Panel (Recommended)
-1. Login to admin panel
+#### Via Admin Panel
+1. Login to admin panel at `/admin`
 2. Click "Create New Event"
-3. Configure settings and upload photos
+3. Configure settings (name, date, password, customer email)
+4. Upload photos via drag & drop in the Photos tab
+5. Publish the gallery when ready
+
+#### Adding Photos via File System
+
+> **Important:** You must first create the event in the admin panel. The file watcher only detects new photos for events that already exist in the database. You cannot create a gallery by copying files alone.
+
+Once an event exists, you can add photos by copying them into the event's folder. PicPeak's built-in file watcher will automatically detect the new files, create database records, and generate thumbnails.
 
-#### Method 2: File System
 ```bash
-# Docker installation
-mkdir -p ~/picpeak/storage/events/active/wedding-smith-2024
-cp /path/to/photos/* ~/picpeak/storage/events/active/wedding-smith-2024/
+# Docker installation — copy photos into an existing event's folder
+cp /path/to/photos/*.jpg ~/picpeak/storage/events/active/<event-slug>/
 
 # Native installation
-sudo mkdir -p /opt/picpeak/events/active/wedding-smith-2024
-sudo cp /path/to/photos/* /opt/picpeak/events/active/wedding-smith-2024/
-sudo chown -R picpeak:picpeak /opt/picpeak/events/active/wedding-smith-2024
+sudo cp /path/to/photos/*.jpg /opt/picpeak/events/active/<event-slug>/
+sudo chown -R picpeak:picpeak /opt/picpeak/events/active/<event-slug>
 ```
 
+The event slug is visible in the admin panel URL or share link (e.g. `wedding-smith-2024`). Supported formats: `.jpg`, `.jpeg`, `.png`, `.webp`. The file watcher has a 2-second stability delay before processing new files.
+
 ### Gallery Structure
 ```
-wedding-smith-2024/
-├── collages/        # Group photos
-├── individual/      # Individual photos
-└── thumbnails/      # Auto-generated thumbnails
+<event-slug>/
+├── collages/        # Group photos (optional subfolder)
+├── individual/      # Individual photos (optional subfolder)
+└── photo.jpg        # Photos at root level also work
 ```
 
 ## 🔧 Service Management
@@ -293,7 +300,7 @@ sudo systemctl restart picpeak-backend picpeak-workers
 
 # Update PicPeak
 # (reruns migrations to pick up schema fixes for native installs)
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 
 ## ⚙️ Configuration
@@ -385,14 +392,14 @@ docker compose pull
 docker compose up -d
 
 # Native
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 
 ### Uninstall
 
 ```bash
 # Will prompt for confirmation and data removal options
-sudo ./setup.sh --uninstall
+sudo ./picpeak-setup.sh --uninstall
 ```
 
 ## 🐛 Troubleshooting
@@ -451,6 +458,8 @@ cd /opt/picpeak/app/backend
 sudo -u picpeak node scripts/reset-admin-password.js
 ```
 
+> **Note:** The new password will be displayed in the console output and saved to `ADMIN_PASSWORD_RESET.txt`. Save it immediately!
+
 ### Getting Help
 
 1. **Check logs:**
@@ -508,13 +517,13 @@ sudo systemctl restart picpeak-backend
 ### Home/Office Network
 ```bash
 # Simple local setup without domain
-sudo ./setup.sh --native --email admin@local.com
+sudo ./picpeak-setup.sh --native --email admin@local.com
 ```
 
 ### Public Website with HTTPS
 ```bash
 # Full production setup
-sudo ./setup.sh --docker \
+sudo ./picpeak-setup.sh --docker \
   --domain photos.company.com \
   --email admin@company.com \
   --enable-ssl
@@ -523,7 +532,7 @@ sudo ./setup.sh --docker \
 ### Raspberry Pi Setup
 ```bash
 # Optimized for ARM devices
-sudo ./setup.sh --native \
+sudo ./picpeak-setup.sh --native \
   --port 8080 \
   --email pi@local.com
 ```

backend/.env.example

@@ -9,11 +9,44 @@ PORT=3001
 # Generate with: openssl rand -base64 32
 JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456
 
+# Auth cookie Secure flag
+#   unset  - default: follows NODE_ENV (production=true, dev=false)
+#   true   - always set Secure (HTTPS-only cookies; breaks plain-HTTP access)
+#   false  - never set Secure (allows HTTP; cookies not protected on HTTPS)
+#   auto   - decide per request: Secure on HTTPS, not on HTTP
+#
+# Use COOKIE_SECURE=auto if your deployment is reachable over both HTTPS
+# (via a reverse proxy like Nginx Proxy Manager, Traefik, Caddy) AND plain
+# HTTP (e.g. LAN access at http://192.168.x.x:3001). The backend reads
+# req.secure from Express, which respects the X-Forwarded-Proto header
+# when the proxy is in the trust list.
+#
+# Requirements for auto mode:
+#   1. Your reverse proxy MUST send X-Forwarded-Proto: https on HTTPS
+#      requests. Standard configs for NPM/Traefik/Caddy do this by default.
+#   2. The proxy must be on a trusted IP range. By default PicPeak trusts
+#      loopback and private networks (127.0.0.1, 10.x, 172.16-31.x,
+#      192.168.x, link-local). Proxies outside those ranges need custom
+#      trust proxy configuration.
+# COOKIE_SECURE=auto
+
+# Cookie SameSite attribute (Lax | Strict | None). Default: Lax
+# COOKIE_SAMESITE=Lax
+
+# Cookie Domain — set this if serving auth cookies across subdomains.
+# Leave unset for same-origin setups.
+# COOKIE_DOMAIN=.example.com
+
 # URLs (adjust for your domain)
 ADMIN_URL=https://photos.example.com
 FRONTEND_URL=https://photos.example.com
 BACKEND_URL=https://photos.example.com  # Or https://api.photos.example.com if separate
 
+# API URL for email assets (logos, images in emails)
+# This must be the publicly accessible URL where recipients can load images
+# If not set, defaults to http://localhost:3001 which will break images in production emails
+API_URL=https://photos.example.com/api
+
 # Database Configuration
 DATABASE_CLIENT=pg
 DB_HOST=localhost
@@ -39,6 +72,7 @@ SMTP_PASS=your-sendgrid-api-key
 EMAIL_FROM=noreply@example.com
 
 # Storage Paths
+# IMPORTANT: STORAGE_PATH must be set to avoid file path resolution issues
 # Docker deployment:
 STORAGE_PATH=/app/storage
 EVENTS_PATH=/app/storage/events

backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS builder
+FROM node:22-alpine AS builder
 
 # Add build arguments
 ARG CACHEBUST=1
@@ -16,17 +16,24 @@ WORKDIR /app
 # Copy package files
 COPY package*.json ./
 
-# Install dependencies
-RUN npm ci --only=production
+# Install dependencies (--omit=dev replaces deprecated --only=production)
+RUN npm ci --omit=dev
 
 # Copy application files
 COPY . .
 
 # Production stage
-FROM node:20-alpine
+FROM node:22-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
+RUN apk upgrade --no-cache
+
+# Upgrade npm to fix tar, minimatch, brace-expansion CVEs in npm's own deps
+# Pin to 10.x to stay compatible with Node 22 Alpine (npm 11.x has dependency issues)
+RUN npm install -g npm@10
+
 # Install dumb-init for proper signal handling and postgresql-client for database checks
 RUN apk add --no-cache dumb-init postgresql-client
 
@@ -37,8 +44,8 @@ RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
 COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
 COPY --chown=nodejs:nodejs . .
 
-# Make wait script executable
-RUN chmod +x wait-for-db.sh
+# Ensure all source files are readable and wait script is executable
+RUN chmod -R a+r /app && chmod +x wait-for-db.sh
 
 # Create necessary directories
 RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs && \

backend/Dockerfile.dev

@@ -1,7 +1,10 @@
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
 

backend/dependencies-backend.json

@@ -1831,8 +1831,8 @@
       }
     },
     "nodemailer": {
-      "version": "6.10.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "version": "7.0.7",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.7.tgz",
       "overridden": false
     },
     "nodemon": {
@@ -2086,8 +2086,8 @@
               "version": "4.0.1"
             },
             "tar-fs": {
-              "version": "2.1.3",
-              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+              "version": "2.1.4",
+              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
               "overridden": false
             },
             "tunnel-agent": {

backend/migrations/README.md

@@ -1,6 +1,6 @@
 # Database Migrations
 
-This directory contains database migrations for the Wedding Photo Sharing platform.
+This directory contains database migrations for the PicPeak photo sharing platform.
 
 ## Directory Structure
 
@@ -9,6 +9,7 @@ Essential migrations that are always run for new deployments. These include:
 - `init.js` - Initial database schema creation
 - Backup service tables (029-035)
 - Gallery feedback tables (033)
+- Pre-generated watermarks (061)
 
 ### `/legacy`
 Migrations needed only when upgrading from older versions. New deployments can skip these as the core schema already includes all necessary tables and columns.

backend/migrations/core/001_init.js

@@ -14,8 +14,8 @@ exports.up = async function(knex) {
     // Create default admin user if none exists
     const adminExists = await knex('admin_users').first();
     if (!adminExists) {
-      // Generate a secure random password
-      const generatedPassword = generateReadablePassword();
+      // Use ADMIN_PASSWORD from environment if set, otherwise generate a random one
+      const generatedPassword = process.env.ADMIN_PASSWORD || generateReadablePassword();
       const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
       // Get admin credentials from environment or use defaults

backend/migrations/core/045_add_max_files_per_upload_setting.js

@@ -0,0 +1,48 @@
+const { DEFAULT_MAX_FILES_PER_UPLOAD, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../../src/services/uploadSettings');
+
+exports.up = async function up(knex) {
+  const settingKey = 'general_max_files_per_upload';
+
+  const existing = await knex('app_settings')
+    .where({ setting_key: settingKey })
+    .first();
+
+  if (existing) {
+    // Normalize existing value into allowed bounds
+    let parsedValue;
+    try {
+      parsedValue = existing.setting_value != null ? JSON.parse(existing.setting_value) : null;
+    } catch {
+      parsedValue = existing.setting_value;
+    }
+
+    const numeric = Number(parsedValue);
+    let normalized = DEFAULT_MAX_FILES_PER_UPLOAD;
+    if (Number.isFinite(numeric) && numeric >= 1) {
+      normalized = Math.min(MAX_ALLOWED_FILES_PER_UPLOAD, Math.floor(numeric));
+    }
+
+    if (normalized !== numeric) {
+      await knex('app_settings')
+        .where({ setting_key: settingKey })
+        .update({
+          setting_value: JSON.stringify(normalized),
+          updated_at: new Date()
+        });
+    }
+    return;
+  }
+
+  await knex('app_settings').insert({
+    setting_key: settingKey,
+    setting_value: JSON.stringify(DEFAULT_MAX_FILES_PER_UPLOAD),
+    setting_type: 'general',
+    updated_at: new Date()
+  });
+};
+
+exports.down = async function down(knex) {
+  await knex('app_settings')
+    .where({ setting_key: 'general_max_files_per_upload' })
+    .del();
+};

backend/migrations/core/046_add_customer_contact_fields.js

@@ -0,0 +1,44 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  await addColumnIfNotExists(knex, 'events', 'customer_name', (table) => {
+    table.string('customer_name');
+  });
+
+  await addColumnIfNotExists(knex, 'events', 'customer_email', (table) => {
+    table.string('customer_email');
+  });
+
+  // Backfill new columns from legacy host_* fields
+  const client = knex?.client?.config?.client;
+
+  if (client === 'pg') {
+    await knex.raw(`
+      UPDATE events
+      SET customer_name = COALESCE(customer_name, host_name),
+          customer_email = COALESCE(customer_email, host_email)
+    `);
+  } else {
+    // SQLite fallback
+    await knex('events').update({
+      customer_name: knex.raw('COALESCE(customer_name, host_name)'),
+      customer_email: knex.raw('COALESCE(customer_email, host_email)')
+    });
+  }
+};
+
+exports.down = async function down(knex) {
+  const hasCustomerName = await knex.schema.hasColumn('events', 'customer_name');
+  if (hasCustomerName) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_name');
+    });
+  }
+
+  const hasCustomerEmail = await knex.schema.hasColumn('events', 'customer_email');
+  if (hasCustomerEmail) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('customer_email');
+    });
+  }
+};

backend/migrations/core/047_add_tls_reject_unauthorized.js

@@ -0,0 +1,18 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function up(knex) {
+  // Add tls_reject_unauthorized column to email_configs table
+  // Default is true (validate certificates), false means ignore SSL/TLS certificate errors
+  await addColumnIfNotExists(knex, 'email_configs', 'tls_reject_unauthorized', (table) => {
+    table.boolean('tls_reject_unauthorized').defaultTo(true);
+  });
+};
+
+exports.down = async function down(knex) {
+  const hasColumn = await knex.schema.hasColumn('email_configs', 'tls_reject_unauthorized');
+  if (hasColumn) {
+    await knex.schema.alterTable('email_configs', (table) => {
+      table.dropColumn('tls_reject_unauthorized');
+    });
+  }
+};

backend/migrations/core/048_add_video_support.js

@@ -0,0 +1,109 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+/**
+ * Migration: Add video support to photos table
+ * - Adds columns for video metadata (media_type, duration, codecs, dimensions)
+ * - Updates existing photos to have media_type 'image'
+ */
+
+exports.up = async function(knex) {
+  console.log('Running migration: 042_add_video_support');
+
+  // Add media_type column (image or video)
+  await addColumnIfNotExists(knex, 'photos', 'media_type', (table) => {
+    table.string('media_type').defaultTo('image');
+  });
+
+  // Add mime_type column if not exists
+  await addColumnIfNotExists(knex, 'photos', 'mime_type', (table) => {
+    table.string('mime_type');
+  });
+
+  // Add duration column (for videos, in seconds)
+  await addColumnIfNotExists(knex, 'photos', 'duration', (table) => {
+    table.integer('duration');
+  });
+
+  // Add video codec information
+  await addColumnIfNotExists(knex, 'photos', 'video_codec', (table) => {
+    table.string('video_codec');
+  });
+
+  // Add audio codec information
+  await addColumnIfNotExists(knex, 'photos', 'audio_codec', (table) => {
+    table.string('audio_codec');
+  });
+
+  // Add width dimension
+  await addColumnIfNotExists(knex, 'photos', 'width', (table) => {
+    table.integer('width');
+  });
+
+  // Add height dimension
+  await addColumnIfNotExists(knex, 'photos', 'height', (table) => {
+    table.integer('height');
+  });
+
+  // Update existing photos to have media_type 'image' if not set
+  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
+  if (hasMediaType) {
+    await knex('photos')
+      .whereNull('media_type')
+      .orWhere('media_type', '')
+      .update({ media_type: 'image' });
+    console.log('Updated existing photos to have media_type "image"');
+  }
+
+  console.log('Migration 042_add_video_support completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rolling back migration: 042_add_video_support');
+
+  // Remove video support columns
+  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
+  if (hasMediaType) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('media_type');
+    });
+  }
+
+  const hasDuration = await knex.schema.hasColumn('photos', 'duration');
+  if (hasDuration) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('duration');
+    });
+  }
+
+  const hasVideoCodec = await knex.schema.hasColumn('photos', 'video_codec');
+  if (hasVideoCodec) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('video_codec');
+    });
+  }
+
+  const hasAudioCodec = await knex.schema.hasColumn('photos', 'audio_codec');
+  if (hasAudioCodec) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('audio_codec');
+    });
+  }
+
+  const hasWidth = await knex.schema.hasColumn('photos', 'width');
+  if (hasWidth) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('width');
+    });
+  }
+
+  const hasHeight = await knex.schema.hasColumn('photos', 'height');
+  if (hasHeight) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.dropColumn('height');
+    });
+  }
+
+  // Note: We don't drop mime_type as it may be used by images as well
+
+  console.log('Rollback of 042_add_video_support completed');
+};

backend/migrations/core/049_add_slug_redirects.js

@@ -0,0 +1,21 @@
+/**
+ * Migration: Add slug_redirects table for event rename feature
+ * This table stores old slugs that should redirect to new slugs
+ */
+
+exports.up = function(knex) {
+  return knex.schema.createTable('slug_redirects', (table) => {
+    table.increments('id').primary();
+    table.string('old_slug', 255).notNullable().unique();
+    table.string('new_slug', 255).notNullable();
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+
+    // Index for fast lookup
+    table.index('old_slug');
+  });
+};
+
+exports.down = function(knex) {
+  return knex.schema.dropTableIfExists('slug_redirects');
+};

backend/migrations/core/050_add_optional_event_fields_settings.js

@@ -0,0 +1,33 @@
+/**
+ * Migration: Add optional event fields settings
+ * These settings control whether customer name, customer email, and admin email
+ * are required when creating new events.
+ */
+
+exports.up = async function(knex) {
+  const settings = [
+    { setting_key: 'event_require_customer_name', setting_value: JSON.stringify(true), setting_type: 'boolean' },
+    { setting_key: 'event_require_customer_email', setting_value: JSON.stringify(true), setting_type: 'boolean' },
+    { setting_key: 'event_require_admin_email', setting_value: JSON.stringify(true), setting_type: 'boolean' }
+  ];
+
+  for (const setting of settings) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = function(knex) {
+  return knex('app_settings')
+    .whereIn('setting_key', [
+      'event_require_customer_name',
+      'event_require_customer_email',
+      'event_require_admin_email'
+    ])
+    .del();
+};

backend/migrations/core/051_add_photo_filter_indexes.js

@@ -0,0 +1,100 @@
+/**
+ * Migration: Add indexes for photo filtering performance
+ * These indexes optimize queries that filter by feedback metrics
+ */
+
+exports.up = async function(knex) {
+  // Add comment_count column if it doesn't exist
+  const hasCommentCount = await knex.schema.hasColumn('photos', 'comment_count');
+  if (!hasCommentCount) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.integer('comment_count').defaultTo(0);
+    });
+  }
+
+  // Add indexes for common filter queries
+  // Note: PostgreSQL supports partial indexes, SQLite does not
+  const client = knex.client.config.client;
+
+  if (client === 'pg' || client === 'postgresql') {
+    // Partial indexes for PostgreSQL
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_rating_filter
+      ON photos(event_id, average_rating)
+      WHERE average_rating > 0
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_likes_filter
+      ON photos(event_id, like_count)
+      WHERE like_count > 0
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_favorites_filter
+      ON photos(event_id, favorite_count)
+      WHERE favorite_count > 0
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_comments_filter
+      ON photos(event_id, comment_count)
+      WHERE comment_count > 0
+    `);
+  } else {
+    // Regular indexes for SQLite
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_rating_filter
+      ON photos(event_id, average_rating)
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_likes_filter
+      ON photos(event_id, like_count)
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_favorites_filter
+      ON photos(event_id, favorite_count)
+    `);
+
+    await knex.raw(`
+      CREATE INDEX IF NOT EXISTS idx_photos_comments_filter
+      ON photos(event_id, comment_count)
+    `);
+  }
+
+  // Create export_jobs table for tracking large exports
+  const hasExportJobs = await knex.schema.hasTable('export_jobs');
+  if (!hasExportJobs) {
+    await knex.schema.createTable('export_jobs', (table) => {
+      table.increments('id').primary();
+      table.string('job_id', 50).unique().notNullable();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.integer('admin_user_id').references('id').inTable('admin_users').onDelete('SET NULL');
+      table.string('format', 20).notNullable();
+      table.string('status', 20).defaultTo('pending');
+      table.integer('progress').defaultTo(0);
+      table.integer('total_photos');
+      table.json('options');
+      table.string('file_path', 500);
+      table.bigInteger('file_size');
+      table.text('error_message');
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('completed_at');
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Drop indexes
+  await knex.raw('DROP INDEX IF EXISTS idx_photos_rating_filter');
+  await knex.raw('DROP INDEX IF EXISTS idx_photos_likes_filter');
+  await knex.raw('DROP INDEX IF EXISTS idx_photos_favorites_filter');
+  await knex.raw('DROP INDEX IF EXISTS idx_photos_comments_filter');
+
+  // Drop export_jobs table
+  await knex.schema.dropTableIfExists('export_jobs');
+
+  // Note: We don't remove comment_count column as it might have data
+};

backend/migrations/core/052_add_css_templates.js

@@ -0,0 +1,192 @@
+/**
+ * Migration: Add CSS Templates feature
+ * Creates css_templates table and adds css_template_id to events table
+ */
+
+// Default CSS template content
+const DEFAULT_CSS_TEMPLATE = `/*
+ * PicPeak Custom CSS Template: Elegant Dark
+ *
+ * Available CSS Custom Properties:
+ * --gallery-bg: Background color
+ * --gallery-text: Primary text color
+ * --gallery-accent: Accent/highlight color
+ * --gallery-border: Border color
+ * --gallery-shadow: Box shadow value
+ * --gallery-radius: Border radius value
+ * --gallery-spacing: Base spacing unit
+ */
+
+/* ===== Base Theme Variables ===== */
+.gallery-page {
+  --gallery-bg: #1a1a2e;
+  --gallery-bg-secondary: #16213e;
+  --gallery-text: #eaeaea;
+  --gallery-text-muted: #8b8b9a;
+  --gallery-accent: #e94560;
+  --gallery-accent-hover: #ff6b6b;
+  --gallery-border: #2d2d44;
+  --gallery-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
+  --gallery-radius: 12px;
+  --gallery-spacing: 16px;
+}
+
+/* ===== Page Background ===== */
+.gallery-page {
+  background: linear-gradient(135deg, var(--gallery-bg) 0%, var(--gallery-bg-secondary) 100%);
+  min-height: 100vh;
+  color: var(--gallery-text);
+}
+
+/* ===== Gallery Header ===== */
+.gallery-header {
+  background: rgba(22, 33, 62, 0.8);
+  backdrop-filter: blur(10px);
+  border-bottom: 1px solid var(--gallery-border);
+  padding: calc(var(--gallery-spacing) * 2);
+}
+
+.gallery-title {
+  color: var(--gallery-text);
+  font-size: 2rem;
+  font-weight: 700;
+  letter-spacing: -0.02em;
+}
+
+/* ===== Photo Grid ===== */
+.photo-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: var(--gallery-spacing);
+  padding: calc(var(--gallery-spacing) * 2);
+}
+
+/* ===== Photo Cards ===== */
+.photo-card {
+  background: var(--gallery-bg-secondary);
+  border-radius: var(--gallery-radius);
+  overflow: hidden;
+  transition: transform 0.3s ease, box-shadow 0.3s ease;
+  border: 1px solid var(--gallery-border);
+}
+
+.photo-card:hover {
+  transform: translateY(-4px);
+  box-shadow: var(--gallery-shadow);
+}
+
+.photo-card img {
+  width: 100%;
+  height: 200px;
+  object-fit: cover;
+  transition: transform 0.3s ease;
+}
+
+.photo-card:hover img {
+  transform: scale(1.05);
+}
+
+/* ===== Buttons ===== */
+.gallery-btn {
+  background: var(--gallery-accent);
+  color: white;
+  border: none;
+  border-radius: calc(var(--gallery-radius) / 2);
+  padding: calc(var(--gallery-spacing) / 2) var(--gallery-spacing);
+  font-weight: 600;
+  cursor: pointer;
+  transition: background 0.2s ease, transform 0.2s ease;
+}
+
+.gallery-btn:hover {
+  background: var(--gallery-accent-hover);
+  transform: translateY(-2px);
+}
+
+/* ===== Lightbox ===== */
+.lightbox-overlay {
+  background: rgba(10, 10, 20, 0.95);
+  backdrop-filter: blur(20px);
+}
+
+/* ===== Responsive Adjustments ===== */
+@media (max-width: 768px) {
+  .gallery-page {
+    --gallery-spacing: 12px;
+  }
+
+  .photo-grid {
+    grid-template-columns: repeat(auto-fill, minmax(160px, 1fr));
+  }
+
+  .gallery-title {
+    font-size: 1.5rem;
+  }
+}`;
+
+exports.up = async function(knex) {
+  // Create css_templates table
+  const hasTable = await knex.schema.hasTable('css_templates');
+  if (!hasTable) {
+    await knex.schema.createTable('css_templates', (table) => {
+      table.increments('id').primary();
+      table.integer('slot_number').notNullable();
+      table.string('name', 50).notNullable().defaultTo('Untitled');
+      table.text('css_content').notNullable().defaultTo('');
+      table.boolean('is_enabled').notNullable().defaultTo(false);
+      table.boolean('is_default').notNullable().defaultTo(false);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+      table.unique('slot_number');
+    });
+
+    // Insert default templates
+    await knex('css_templates').insert([
+      {
+        slot_number: 1,
+        name: 'Elegant Dark',
+        css_content: DEFAULT_CSS_TEMPLATE,
+        is_enabled: true,
+        is_default: true
+      },
+      {
+        slot_number: 2,
+        name: 'Untitled',
+        css_content: '',
+        is_enabled: false,
+        is_default: false
+      },
+      {
+        slot_number: 3,
+        name: 'Untitled',
+        css_content: '',
+        is_enabled: false,
+        is_default: false
+      }
+    ]);
+  }
+
+  // Add css_template_id to events table
+  const hasColumn = await knex.schema.hasColumn('events', 'css_template_id');
+  if (!hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.integer('css_template_id').references('id').inTable('css_templates').onDelete('SET NULL');
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove css_template_id from events table
+  const hasColumn = await knex.schema.hasColumn('events', 'css_template_id');
+  if (hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('css_template_id');
+    });
+  }
+
+  // Drop css_templates table
+  await knex.schema.dropTableIfExists('css_templates');
+};
+
+// Export default template for use in reset functionality
+module.exports.DEFAULT_CSS_TEMPLATE = DEFAULT_CSS_TEMPLATE;

backend/migrations/core/053_add_liquid_glass_templates.js

@@ -0,0 +1,731 @@
+/**
+ * Migration: Add Liquid Glass CSS Templates
+ * Updates template slots 2 and 3 with Apple-inspired Liquid Glass designs
+ *
+ * These are starter example templates for new installations.
+ * Users can edit or replace them as needed.
+ */
+
+const APPLE_LIQUID_GLASS = `/*
+ * PicPeak Custom CSS Template: Apple Liquid Glass
+ * Authentic iOS 26 / macOS Tahoe Liquid Glass Design
+ */
+
+/* ===== Apple System Fonts ===== */
+.gallery-page,
+.gallery-page *,
+.gallery-sidebar,
+.gallery-sidebar * {
+  font-family: -apple-system, BlinkMacSystemFont, "SF Pro Display", "SF Pro Text",
+               "Helvetica Neue", Arial, sans-serif;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+/* ===== CSS Variables ===== */
+:root {
+  --glass-blur: 20px;
+  --glass-blur-heavy: 40px;
+  --glass-saturation: 180%;
+  --glass-bg: rgba(255, 255, 255, 0.08);
+  --glass-bg-medium: rgba(255, 255, 255, 0.18);
+  --glass-bg-solid: rgba(255, 255, 255, 0.25);
+  --glass-border: rgba(255, 255, 255, 0.2);
+  --glass-border-light: rgba(255, 255, 255, 0.4);
+  --glass-shadow: 0 8px 32px rgba(31, 38, 135, 0.15);
+  --glass-inset: inset 0 1px 1px rgba(255, 255, 255, 0.4),
+                 inset 0 -1px 1px rgba(0, 0, 0, 0.05);
+  --gallery-gradient: linear-gradient(135deg, #667eea 0%, #764ba2 50%, #f093fb 100%);
+  --gallery-text: #1a1a2e;
+  --gallery-text-light: #ffffff;
+  --gallery-accent: #667eea;
+  --gallery-radius: 20px;
+  --gallery-radius-sm: 12px;
+}
+
+/* ===== Page Background ===== */
+.gallery-page {
+  background: var(--gallery-gradient) !important;
+  background-attachment: fixed !important;
+  min-height: 100vh;
+}
+
+.gallery-page::before {
+  content: '';
+  position: fixed;
+  inset: 0;
+  background:
+    radial-gradient(ellipse 600px 400px at 15% 85%, rgba(255, 255, 255, 0.2) 0%, transparent 50%),
+    radial-gradient(ellipse 500px 350px at 85% 15%, rgba(255, 255, 255, 0.15) 0%, transparent 45%);
+  pointer-events: none;
+  z-index: 0;
+}
+
+/* ===== TOP BAR / HEADER - Liquid Glass ===== */
+.gallery-page .gallery-header,
+.gallery-page header {
+  background: var(--glass-bg-medium) !important;
+  backdrop-filter: blur(var(--glass-blur-heavy)) saturate(var(--glass-saturation)) !important;
+  -webkit-backdrop-filter: blur(var(--glass-blur-heavy)) saturate(var(--glass-saturation)) !important;
+  border-bottom: 1px solid var(--glass-border) !important;
+  box-shadow: var(--glass-shadow), var(--glass-inset) !important;
+}
+
+.gallery-page .gallery-header > div {
+  background: transparent !important;
+  border: none !important;
+}
+
+/* ===== SIDEBAR - Liquid Glass ===== */
+.gallery-sidebar {
+  background: var(--glass-bg-medium) !important;
+  backdrop-filter: blur(var(--glass-blur-heavy)) saturate(var(--glass-saturation)) !important;
+  -webkit-backdrop-filter: blur(var(--glass-blur-heavy)) saturate(var(--glass-saturation)) !important;
+  border-right: 1px solid var(--glass-border) !important;
+  box-shadow: 4px 0 32px rgba(31, 38, 135, 0.1), var(--glass-inset) !important;
+}
+
+.gallery-sidebar h2,
+.gallery-sidebar h3 {
+  color: var(--gallery-text) !important;
+  font-weight: 600 !important;
+}
+
+/* ===== HERO LAYOUT - Transform to Glass Title Box ===== */
+/* Target the hero wrapper */
+.gallery-page .relative.-mt-6 {
+  margin-top: 0 !important;
+}
+
+/* Target the hero section (first child with h-[60vh]) */
+.gallery-page .relative.-mt-6 > .relative:first-child {
+  height: auto !important;
+  min-height: auto !important;
+  margin: 0 !important;
+  padding: 2rem !important;
+  display: flex !important;
+  justify-content: center !important;
+  align-items: center !important;
+  background: transparent !important;
+}
+
+/* Hide the hero background image */
+.gallery-page .relative.-mt-6 > .relative:first-child > img,
+.gallery-page .relative.-mt-6 > .relative:first-child > canvas {
+  display: none !important;
+}
+
+/* Hide the dark overlay */
+.gallery-page .relative.-mt-6 > .relative:first-child > .absolute.inset-0.bg-black {
+  display: none !important;
+}
+
+/* Style the content area as glass title box */
+.gallery-page .relative.-mt-6 > .relative:first-child > .absolute.inset-0.flex {
+  position: relative !important;
+  inset: auto !important;
+  background: var(--glass-bg-medium) !important;
+  backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  border: 1px solid var(--glass-border-light) !important;
+  border-radius: var(--gallery-radius) !important;
+  padding: 2rem 3rem !important;
+  box-shadow: var(--glass-shadow), var(--glass-inset) !important;
+  max-width: 600px !important;
+  width: auto !important;
+}
+
+/* Hide logo in glass title box */
+.gallery-page .relative.-mt-6 > .relative:first-child .mb-6 {
+  display: none !important;
+}
+
+/* Style title text */
+.gallery-page .relative.-mt-6 > .relative:first-child h1 {
+  color: var(--gallery-text) !important;
+  text-shadow: none !important;
+  font-weight: 700 !important;
+  font-size: 2.25rem !important;
+  margin-bottom: 0.75rem !important;
+}
+
+/* Style date text */
+.gallery-page .relative.-mt-6 > .relative:first-child .text-white\\/90 {
+  color: var(--gallery-text) !important;
+  opacity: 0.8;
+}
+
+/* Hide scroll down button */
+.gallery-page .relative.-mt-6 > .relative:first-child > .absolute.bottom-8,
+.gallery-page .relative.-mt-6 > .relative:first-child > button.absolute {
+  display: none !important;
+}
+
+/* ===== PHOTO GRID ===== */
+.gallery-page .photo-grid {
+  display: grid !important;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)) !important;
+  gap: 1.25rem !important;
+  padding: 1rem !important;
+}
+
+/* ===== PHOTO CARDS - Liquid Glass ===== */
+.gallery-page .photo-card {
+  background: var(--glass-bg) !important;
+  backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  border: 1px solid var(--glass-border) !important;
+  border-radius: var(--gallery-radius) !important;
+  overflow: hidden !important;
+  transition: all 0.4s cubic-bezier(0.4, 0, 0.2, 1) !important;
+  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.1), var(--glass-inset) !important;
+}
+
+.gallery-page .photo-card:hover {
+  transform: translateY(-6px) scale(1.02) !important;
+  box-shadow: 0 20px 40px rgba(102, 126, 234, 0.25),
+              0 8px 16px rgba(0, 0, 0, 0.1),
+              var(--glass-inset) !important;
+  border-color: var(--glass-border-light) !important;
+}
+
+.gallery-page .photo-card img {
+  transition: transform 0.4s ease !important;
+}
+
+.gallery-page .photo-card:hover img {
+  transform: scale(1.05) !important;
+}
+
+/* ===== BUTTONS - Glass Pill Style ===== */
+.gallery-page button,
+.gallery-page [role="button"],
+.gallery-sidebar button {
+  background: var(--glass-bg) !important;
+  backdrop-filter: blur(12px) saturate(150%) !important;
+  -webkit-backdrop-filter: blur(12px) saturate(150%) !important;
+  border: 1px solid var(--glass-border) !important;
+  border-radius: 9999px !important;
+  color: var(--gallery-text) !important;
+  font-weight: 500 !important;
+  transition: all 0.3s ease !important;
+}
+
+.gallery-page button:hover,
+.gallery-page [role="button"]:hover,
+.gallery-sidebar button:hover {
+  background: var(--glass-bg-medium) !important;
+  transform: translateY(-1px);
+  box-shadow: 0 4px 16px rgba(102, 126, 234, 0.2) !important;
+}
+
+.gallery-page button[class*="bg-primary"],
+.gallery-page .gallery-btn-download {
+  background: linear-gradient(135deg, var(--gallery-accent) 0%, #764ba2 100%) !important;
+  color: white !important;
+  border: none !important;
+}
+
+/* ===== INPUT FIELDS ===== */
+.gallery-page input,
+.gallery-page select,
+.gallery-sidebar input,
+.gallery-sidebar select {
+  background: rgba(255, 255, 255, 0.25) !important;
+  backdrop-filter: blur(8px) !important;
+  -webkit-backdrop-filter: blur(8px) !important;
+  border: 1px solid var(--glass-border) !important;
+  border-radius: var(--gallery-radius-sm) !important;
+  color: var(--gallery-text) !important;
+}
+
+/* Input placeholder text - make it visible */
+.gallery-page input::placeholder,
+.gallery-sidebar input::placeholder {
+  color: rgba(26, 26, 46, 0.6) !important;
+  opacity: 1 !important;
+}
+
+/* Input focus state */
+.gallery-page input:focus,
+.gallery-sidebar input:focus {
+  background: rgba(255, 255, 255, 0.35) !important;
+  border-color: var(--glass-border-light) !important;
+  outline: none !important;
+  box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.2) !important;
+}
+
+/* ===== FOOTER ===== */
+.gallery-page .gallery-footer,
+.gallery-page footer {
+  background: var(--glass-bg) !important;
+  backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation)) !important;
+  border-top: 1px solid var(--glass-border) !important;
+}
+
+/* ===== LIGHTBOX ===== */
+.gallery-page [class*="fixed"][class*="inset-0"][class*="z-50"] {
+  background: rgba(0, 0, 0, 0.7) !important;
+  backdrop-filter: blur(30px) !important;
+  -webkit-backdrop-filter: blur(30px) !important;
+}
+
+/* ===== SCROLLBAR ===== */
+.gallery-page ::-webkit-scrollbar,
+.gallery-sidebar ::-webkit-scrollbar {
+  width: 8px;
+}
+
+.gallery-page ::-webkit-scrollbar-track,
+.gallery-sidebar ::-webkit-scrollbar-track {
+  background: rgba(255, 255, 255, 0.1);
+}
+
+.gallery-page ::-webkit-scrollbar-thumb,
+.gallery-sidebar ::-webkit-scrollbar-thumb {
+  background: rgba(255, 255, 255, 0.3);
+  border-radius: 4px;
+}
+
+/* ===== RESPONSIVE ===== */
+@media (max-width: 768px) {
+  :root {
+    --gallery-radius: 16px;
+    --glass-blur: 16px;
+  }
+
+  .gallery-page .relative.-mt-6 > .relative:first-child > .absolute.inset-0.flex {
+    padding: 1.5rem 2rem !important;
+    max-width: 90% !important;
+  }
+
+  .gallery-page .relative.-mt-6 > .relative:first-child h1 {
+    font-size: 1.5rem !important;
+  }
+
+  .gallery-page .photo-grid {
+    grid-template-columns: repeat(2, 1fr) !important;
+    gap: 0.75rem !important;
+  }
+}
+
+/* ===== ACCESSIBILITY ===== */
+@media (prefers-reduced-motion: reduce) {
+  .gallery-page .photo-card,
+  .gallery-page button {
+    transition: none !important;
+  }
+
+  .gallery-page .photo-card:hover {
+    transform: none !important;
+  }
+}
+
+@media (prefers-reduced-transparency: reduce) {
+  .gallery-page .photo-card,
+  .gallery-page button,
+  .gallery-sidebar {
+    backdrop-filter: none !important;
+    -webkit-backdrop-filter: none !important;
+    background: rgba(255, 255, 255, 0.95) !important;
+  }
+}`;
+
+const LIQUID_GLASS_DARK = `/*
+ * PicPeak Custom CSS Template: Liquid Glass Dark
+ * Inspired by Apple's iOS 26 Liquid Glass Design Language
+ *
+ * Features:
+ * - Deep translucent dark surfaces
+ * - Neon accent highlights
+ * - Dramatic glass reflections
+ * - Subtle animated gradients
+ */
+
+/* ===== Base Theme Variables ===== */
+.gallery-page {
+  --glass-bg: rgba(15, 15, 35, 0.7);
+  --glass-bg-elevated: rgba(25, 25, 55, 0.85);
+  --glass-border: rgba(255, 255, 255, 0.1);
+  --glass-border-highlight: rgba(255, 255, 255, 0.2);
+  --glass-shadow: 0 8px 32px rgba(0, 0, 0, 0.4);
+  --glass-blur: 24px;
+  --glass-saturation: 150%;
+
+  --gallery-bg: #0a0a1a;
+  --gallery-text: #f0f0f5;
+  --gallery-text-muted: rgba(240, 240, 245, 0.6);
+  --gallery-accent: #00d4ff;
+  --gallery-accent-secondary: #ff00e5;
+  --gallery-accent-hover: #00ffea;
+  --gallery-radius: 20px;
+  --gallery-spacing: 20px;
+
+  /* Neon glow variables */
+  --neon-glow: 0 0 20px rgba(0, 212, 255, 0.5), 0 0 40px rgba(0, 212, 255, 0.2);
+  --neon-glow-secondary: 0 0 20px rgba(255, 0, 229, 0.5), 0 0 40px rgba(255, 0, 229, 0.2);
+}
+
+/* ===== Page Background ===== */
+.gallery-page {
+  background: var(--gallery-bg);
+  min-height: 100vh;
+  position: relative;
+  overflow-x: hidden;
+}
+
+/* Animated mesh gradient background */
+.gallery-page::before {
+  content: '';
+  position: fixed;
+  top: -50%;
+  left: -50%;
+  right: -50%;
+  bottom: -50%;
+  background:
+    radial-gradient(circle at 30% 20%, rgba(0, 212, 255, 0.15) 0%, transparent 40%),
+    radial-gradient(circle at 70% 80%, rgba(255, 0, 229, 0.1) 0%, transparent 40%),
+    radial-gradient(circle at 50% 50%, rgba(100, 100, 255, 0.05) 0%, transparent 60%);
+  animation: gradientShift 20s ease-in-out infinite;
+  pointer-events: none;
+  z-index: 0;
+}
+
+@keyframes gradientShift {
+  0%, 100% { transform: translate(0, 0) rotate(0deg); }
+  25% { transform: translate(2%, 2%) rotate(1deg); }
+  50% { transform: translate(-1%, 3%) rotate(-1deg); }
+  75% { transform: translate(3%, -2%) rotate(2deg); }
+}
+
+/* ===== Gallery Header ===== */
+.gallery-header {
+  background: var(--glass-bg-elevated);
+  backdrop-filter: blur(30px) saturate(var(--glass-saturation));
+  -webkit-backdrop-filter: blur(30px) saturate(var(--glass-saturation));
+  border-bottom: 1px solid var(--glass-border-highlight);
+  padding: calc(var(--gallery-spacing) * 1.5);
+  position: sticky;
+  top: 0;
+  z-index: 100;
+  box-shadow:
+    0 4px 24px rgba(0, 0, 0, 0.3),
+    inset 0 1px 0 rgba(255, 255, 255, 0.1);
+}
+
+.gallery-title {
+  color: var(--gallery-text);
+  font-weight: 700;
+  font-size: 1.75rem;
+  letter-spacing: -0.02em;
+  background: linear-gradient(135deg, var(--gallery-text) 0%, var(--gallery-accent) 100%);
+  -webkit-background-clip: text;
+  -webkit-text-fill-color: transparent;
+  background-clip: text;
+}
+
+/* ===== Photo Grid ===== */
+.photo-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+  gap: var(--gallery-spacing);
+  padding: calc(var(--gallery-spacing) * 2);
+  position: relative;
+  z-index: 1;
+}
+
+/* ===== Photo Cards - Dark Glass Style ===== */
+.photo-card {
+  position: relative;
+  background: var(--glass-bg);
+  backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation));
+  -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(var(--glass-saturation));
+  border: 1px solid var(--glass-border);
+  border-radius: var(--gallery-radius);
+  overflow: hidden;
+  transition: all 0.4s cubic-bezier(0.4, 0, 0.2, 1);
+  box-shadow:
+    0 4px 24px rgba(0, 0, 0, 0.3),
+    inset 0 1px 0 rgba(255, 255, 255, 0.05);
+}
+
+/* Top highlight reflection */
+.photo-card::before {
+  content: '';
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  height: 1px;
+  background: linear-gradient(
+    90deg,
+    transparent 0%,
+    rgba(255, 255, 255, 0.3) 50%,
+    transparent 100%
+  );
+  z-index: 2;
+}
+
+/* Inner glow effect */
+.photo-card::after {
+  content: '';
+  position: absolute;
+  inset: 0;
+  border-radius: var(--gallery-radius);
+  padding: 1px;
+  background: linear-gradient(
+    135deg,
+    rgba(0, 212, 255, 0) 0%,
+    rgba(0, 212, 255, 0) 40%,
+    rgba(0, 212, 255, 0.1) 100%
+  );
+  -webkit-mask: linear-gradient(#fff 0 0) content-box, linear-gradient(#fff 0 0);
+  -webkit-mask-composite: xor;
+  mask-composite: exclude;
+  pointer-events: none;
+  opacity: 0;
+  transition: opacity 0.4s ease;
+}
+
+.photo-card:hover {
+  transform: translateY(-8px) scale(1.02);
+  border-color: var(--glass-border-highlight);
+  box-shadow:
+    0 24px 48px rgba(0, 0, 0, 0.4),
+    0 0 0 1px rgba(0, 212, 255, 0.2),
+    var(--neon-glow);
+}
+
+.photo-card:hover::after {
+  opacity: 1;
+}
+
+.photo-card img {
+  width: 100%;
+  height: 240px;
+  object-fit: cover;
+  transition: transform 0.4s ease, filter 0.4s ease;
+  filter: brightness(0.9);
+}
+
+.photo-card:hover img {
+  transform: scale(1.05);
+  filter: brightness(1);
+}
+
+.photo-card-info {
+  padding: var(--gallery-spacing);
+  background: linear-gradient(
+    180deg,
+    rgba(0, 0, 0, 0.2) 0%,
+    rgba(0, 0, 0, 0.4) 100%
+  );
+  color: var(--gallery-text);
+}
+
+.photo-card-info p {
+  color: var(--gallery-text-muted);
+  font-size: 0.875rem;
+}
+
+/* ===== Buttons - Neon Glass Style ===== */
+.gallery-btn {
+  background: var(--glass-bg);
+  backdrop-filter: blur(10px);
+  -webkit-backdrop-filter: blur(10px);
+  border: 1px solid var(--glass-border);
+  border-radius: calc(var(--gallery-radius) / 2);
+  padding: 12px 24px;
+  color: var(--gallery-text);
+  font-weight: 600;
+  cursor: pointer;
+  transition: all 0.3s ease;
+  position: relative;
+}
+
+.gallery-btn:hover {
+  border-color: var(--gallery-accent);
+  box-shadow: var(--neon-glow);
+  color: var(--gallery-accent);
+}
+
+.gallery-btn-primary {
+  background: linear-gradient(135deg, var(--gallery-accent) 0%, var(--gallery-accent-secondary) 100%);
+  color: white;
+  border: none;
+  box-shadow: var(--neon-glow);
+}
+
+.gallery-btn-primary:hover {
+  box-shadow:
+    0 0 30px rgba(0, 212, 255, 0.6),
+    0 0 60px rgba(0, 212, 255, 0.3),
+    0 0 90px rgba(255, 0, 229, 0.2);
+  transform: translateY(-2px);
+}
+
+/* ===== Lightbox - Dark Glass ===== */
+.lightbox-overlay {
+  background: rgba(5, 5, 15, 0.9);
+  backdrop-filter: blur(40px);
+  -webkit-backdrop-filter: blur(40px);
+}
+
+.lightbox-content {
+  background: var(--glass-bg-elevated);
+  backdrop-filter: blur(24px);
+  -webkit-backdrop-filter: blur(24px);
+  border: 1px solid var(--glass-border-highlight);
+  border-radius: var(--gallery-radius);
+  box-shadow:
+    0 24px 80px rgba(0, 0, 0, 0.5),
+    var(--neon-glow);
+}
+
+/* ===== Category Pills ===== */
+.category-pill {
+  background: var(--glass-bg);
+  backdrop-filter: blur(10px);
+  -webkit-backdrop-filter: blur(10px);
+  border: 1px solid var(--glass-border);
+  border-radius: 9999px;
+  padding: 8px 20px;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--gallery-text-muted);
+  transition: all 0.3s ease;
+}
+
+.category-pill:hover {
+  border-color: var(--gallery-accent);
+  color: var(--gallery-accent);
+  box-shadow: var(--neon-glow);
+}
+
+.category-pill.active {
+  background: linear-gradient(135deg, var(--gallery-accent) 0%, var(--gallery-accent-secondary) 100%);
+  color: white;
+  border-color: transparent;
+  box-shadow: var(--neon-glow);
+}
+
+/* ===== Scrollbar Styling ===== */
+.gallery-page ::-webkit-scrollbar {
+  width: 8px;
+  height: 8px;
+}
+
+.gallery-page ::-webkit-scrollbar-track {
+  background: var(--glass-bg);
+  border-radius: 4px;
+}
+
+.gallery-page ::-webkit-scrollbar-thumb {
+  background: linear-gradient(180deg, var(--gallery-accent) 0%, var(--gallery-accent-secondary) 100%);
+  border-radius: 4px;
+}
+
+/* ===== Responsive ===== */
+@media (max-width: 768px) {
+  .gallery-page {
+    --gallery-radius: 16px;
+    --gallery-spacing: 12px;
+    --glass-blur: 16px;
+  }
+
+  .photo-grid {
+    grid-template-columns: repeat(auto-fill, minmax(160px, 1fr));
+  }
+
+  .photo-card img {
+    height: 180px;
+  }
+
+  /* Reduce animation complexity on mobile */
+  .gallery-page::before {
+    animation: none;
+  }
+}
+
+/* ===== Accessibility: Reduce Motion ===== */
+@media (prefers-reduced-motion: reduce) {
+  .gallery-page::before {
+    animation: none;
+  }
+
+  .photo-card,
+  .gallery-btn {
+    transition: none;
+  }
+
+  .photo-card:hover {
+    transform: none;
+  }
+}
+
+/* ===== Accessibility: Reduce Transparency ===== */
+@media (prefers-reduced-transparency: reduce) {
+  .photo-card,
+  .gallery-btn,
+  .gallery-header {
+    backdrop-filter: none;
+    -webkit-backdrop-filter: none;
+  }
+
+  .gallery-page {
+    --glass-bg: rgba(20, 20, 40, 0.98);
+    --glass-bg-elevated: rgba(30, 30, 60, 0.98);
+  }
+}`;
+
+exports.up = async function(knex) {
+  // Update template slot 2 with Apple Liquid Glass (Light)
+  await knex('css_templates')
+    .where({ slot_number: 2 })
+    .update({
+      name: 'Apple Liquid Glass',
+      css_content: APPLE_LIQUID_GLASS,
+      is_enabled: true,
+      is_default: false,
+      updated_at: knex.fn.now()
+    });
+
+  // Update template slot 3 with Liquid Glass Dark
+  await knex('css_templates')
+    .where({ slot_number: 3 })
+    .update({
+      name: 'Liquid Glass Dark',
+      css_content: LIQUID_GLASS_DARK,
+      is_enabled: true,
+      is_default: false,
+      updated_at: knex.fn.now()
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to empty templates
+  await knex('css_templates')
+    .where({ slot_number: 2 })
+    .update({
+      name: 'Untitled',
+      css_content: '',
+      is_enabled: false,
+      is_default: false,
+      updated_at: knex.fn.now()
+    });
+
+  await knex('css_templates')
+    .where({ slot_number: 3 })
+    .update({
+      name: 'Untitled',
+      css_content: '',
+      is_enabled: false,
+      is_default: false,
+      updated_at: knex.fn.now()
+    });
+};
+
+// Export templates for use elsewhere
+module.exports.APPLE_LIQUID_GLASS = APPLE_LIQUID_GLASS;
+module.exports.LIQUID_GLASS_DARK = LIQUID_GLASS_DARK;

backend/migrations/core/054_add_roles_table.js

@@ -0,0 +1,91 @@
+/**
+ * Migration: Add Roles Table
+ * Creates the roles table for RBAC multi-administrator support.
+ *
+ * Default roles:
+ * - super_admin (priority 100): Full system access including user management
+ * - admin (priority 80): Full event and photo management
+ * - editor (priority 50): Can edit events and photos but not create or delete
+ * - viewer (priority 20): Read-only access to dashboard and events
+ */
+
+exports.up = async function(knex) {
+  console.log('Creating roles table...');
+
+  // Check if table already exists
+  const hasRolesTable = await knex.schema.hasTable('roles');
+
+  if (!hasRolesTable) {
+    await knex.schema.createTable('roles', (table) => {
+      table.increments('id').primary();
+      table.string('name', 50).unique().notNullable(); // 'super_admin', 'admin', 'editor', 'viewer'
+      table.string('display_name', 100).notNullable(); // 'Super Admin', 'Admin', etc.
+      table.text('description');
+      table.boolean('is_system').defaultTo(false); // System roles cannot be deleted
+      table.integer('priority').defaultTo(0); // Higher = more privileged (for hierarchy)
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+
+      // Index for name lookups
+      table.index(['name']);
+      // Index for priority-based ordering
+      table.index(['priority']);
+    });
+
+    console.log('Roles table created');
+  }
+
+  // Insert default system roles
+  const existingRoles = await knex('roles').select('name');
+  const existingRoleNames = existingRoles.map(r => r.name);
+
+  const defaultRoles = [
+    {
+      name: 'super_admin',
+      display_name: 'Super Admin',
+      description: 'Full system access including user management',
+      is_system: true,
+      priority: 100
+    },
+    {
+      name: 'admin',
+      display_name: 'Admin',
+      description: 'Full event and photo management',
+      is_system: true,
+      priority: 80
+    },
+    {
+      name: 'editor',
+      display_name: 'Editor',
+      description: 'Can edit events and photos but not create or delete',
+      is_system: true,
+      priority: 50
+    },
+    {
+      name: 'viewer',
+      display_name: 'Viewer',
+      description: 'Read-only access to dashboard and events',
+      is_system: true,
+      priority: 20
+    }
+  ];
+
+  const rolesToInsert = defaultRoles.filter(role => !existingRoleNames.includes(role.name));
+
+  if (rolesToInsert.length > 0) {
+    await knex('roles').insert(rolesToInsert);
+    console.log(`Inserted ${rolesToInsert.length} default roles`);
+  }
+
+  console.log('Roles table migration completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing roles table...');
+
+  // Note: This will fail if there are foreign key references
+  // The role_permissions and admin_users tables must be rolled back first
+  await knex.schema.dropTableIfExists('roles');
+
+  console.log('Roles table removed');
+};

backend/migrations/core/055_add_permissions_table.js

@@ -0,0 +1,122 @@
+/**
+ * Migration: Add Permissions Table
+ * Creates the permissions table for granular access control.
+ *
+ * Permission categories:
+ * - events: View, create, edit, delete, archive events
+ * - photos: View, upload, edit, delete, download photos
+ * - archives: View, restore, download, delete archives
+ * - analytics: View analytics and statistics
+ * - email: View, edit, send emails
+ * - branding: View and edit branding settings
+ * - cms: View and edit CMS pages
+ * - settings: View and edit application settings
+ * - backup: View, create, restore, delete backups
+ * - users: View, create, edit, delete admin users (Super Admin only)
+ * - activity: View and export activity logs
+ */
+
+exports.up = async function(knex) {
+  console.log('Creating permissions table...');
+
+  // Check if table already exists
+  const hasPermissionsTable = await knex.schema.hasTable('permissions');
+
+  if (!hasPermissionsTable) {
+    await knex.schema.createTable('permissions', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).unique().notNullable(); // 'events.create', 'users.manage', etc.
+      table.string('display_name', 150).notNullable();
+      table.string('category', 50).notNullable(); // 'events', 'photos', 'users', 'settings'
+      table.text('description');
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+
+      // Indexes for efficient lookups
+      table.index(['name']);
+      table.index(['category']);
+    });
+
+    console.log('Permissions table created');
+  }
+
+  // Check for existing permissions
+  const existingPermissions = await knex('permissions').select('name');
+  const existingPermissionNames = existingPermissions.map(p => p.name);
+
+  // Define all permissions
+  const permissions = [
+    // Events
+    { name: 'events.view', display_name: 'View Events', category: 'events', description: 'View event list and details' },
+    { name: 'events.create', display_name: 'Create Events', category: 'events', description: 'Create new events' },
+    { name: 'events.edit', display_name: 'Edit Events', category: 'events', description: 'Edit existing events' },
+    { name: 'events.delete', display_name: 'Delete Events', category: 'events', description: 'Delete events' },
+    { name: 'events.archive', display_name: 'Archive Events', category: 'events', description: 'Archive and restore events' },
+
+    // Photos
+    { name: 'photos.view', display_name: 'View Photos', category: 'photos', description: 'View photos in events' },
+    { name: 'photos.upload', display_name: 'Upload Photos', category: 'photos', description: 'Upload photos to events' },
+    { name: 'photos.edit', display_name: 'Edit Photos', category: 'photos', description: 'Edit photo metadata and categories' },
+    { name: 'photos.delete', display_name: 'Delete Photos', category: 'photos', description: 'Delete photos from events' },
+    { name: 'photos.download', display_name: 'Download Photos', category: 'photos', description: 'Download photos and bulk export' },
+
+    // Archives
+    { name: 'archives.view', display_name: 'View Archives', category: 'archives', description: 'View archived events' },
+    { name: 'archives.restore', display_name: 'Restore Archives', category: 'archives', description: 'Restore archived events' },
+    { name: 'archives.download', display_name: 'Download Archives', category: 'archives', description: 'Download archive files' },
+    { name: 'archives.delete', display_name: 'Delete Archives', category: 'archives', description: 'Permanently delete archives' },
+
+    // Analytics
+    { name: 'analytics.view', display_name: 'View Analytics', category: 'analytics', description: 'View analytics and statistics' },
+
+    // Email
+    { name: 'email.view', display_name: 'View Email Settings', category: 'email', description: 'View email configuration' },
+    { name: 'email.edit', display_name: 'Edit Email Settings', category: 'email', description: 'Configure email settings and templates' },
+    { name: 'email.send', display_name: 'Send Emails', category: 'email', description: 'Send and resend gallery emails' },
+
+    // Branding & CMS
+    { name: 'branding.view', display_name: 'View Branding', category: 'branding', description: 'View branding settings' },
+    { name: 'branding.edit', display_name: 'Edit Branding', category: 'branding', description: 'Edit branding and theme settings' },
+    { name: 'cms.view', display_name: 'View CMS Pages', category: 'cms', description: 'View CMS content pages' },
+    { name: 'cms.edit', display_name: 'Edit CMS Pages', category: 'cms', description: 'Edit CMS content pages' },
+
+    // Settings
+    { name: 'settings.view', display_name: 'View Settings', category: 'settings', description: 'View application settings' },
+    { name: 'settings.edit', display_name: 'Edit Settings', category: 'settings', description: 'Modify application settings' },
+
+    // Backup
+    { name: 'backup.view', display_name: 'View Backups', category: 'backup', description: 'View backup status and history' },
+    { name: 'backup.create', display_name: 'Create Backups', category: 'backup', description: 'Create new backups' },
+    { name: 'backup.restore', display_name: 'Restore Backups', category: 'backup', description: 'Restore from backups' },
+    { name: 'backup.delete', display_name: 'Delete Backups', category: 'backup', description: 'Delete backup files' },
+
+    // User Management (Super Admin only)
+    { name: 'users.view', display_name: 'View Users', category: 'users', description: 'View admin user list' },
+    { name: 'users.create', display_name: 'Create Users', category: 'users', description: 'Invite new admin users' },
+    { name: 'users.edit', display_name: 'Edit Users', category: 'users', description: 'Edit admin user details and roles' },
+    { name: 'users.delete', display_name: 'Delete Users', category: 'users', description: 'Deactivate or delete admin users' },
+
+    // Activity Logs
+    { name: 'activity.view', display_name: 'View Activity Logs', category: 'activity', description: 'View system activity logs' },
+    { name: 'activity.export', display_name: 'Export Activity Logs', category: 'activity', description: 'Export activity logs' }
+  ];
+
+  // Filter out already existing permissions
+  const permissionsToInsert = permissions.filter(p => !existingPermissionNames.includes(p.name));
+
+  if (permissionsToInsert.length > 0) {
+    await knex('permissions').insert(permissionsToInsert);
+    console.log(`Inserted ${permissionsToInsert.length} permissions`);
+  }
+
+  console.log('Permissions table migration completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing permissions table...');
+
+  // Note: This will fail if there are foreign key references
+  // The role_permissions table must be rolled back first
+  await knex.schema.dropTableIfExists('permissions');
+
+  console.log('Permissions table removed');
+};

backend/migrations/core/056_add_role_permissions_table.js

@@ -0,0 +1,134 @@
+/**
+ * Migration: Add Role Permissions Junction Table
+ * Creates the junction table mapping permissions to roles.
+ *
+ * Role permission mappings:
+ * - super_admin: All permissions
+ * - admin: Events, Photos, Archives, Analytics, Email, Branding, CMS, Settings (view), Backup (view/create), Activity (view)
+ * - editor: View/Create/Edit own events and photos, Analytics (view), Activity (view)
+ * - viewer: View-only access to events, photos, archives, analytics, branding, cms
+ */
+
+exports.up = async function(knex) {
+  console.log('Creating role_permissions junction table...');
+
+  // Check if table already exists
+  const hasRolePermissionsTable = await knex.schema.hasTable('role_permissions');
+
+  if (!hasRolePermissionsTable) {
+    await knex.schema.createTable('role_permissions', (table) => {
+      table.integer('role_id').unsigned().references('id').inTable('roles').onDelete('CASCADE');
+      table.integer('permission_id').unsigned().references('id').inTable('permissions').onDelete('CASCADE');
+      table.primary(['role_id', 'permission_id']);
+
+      // Indexes for efficient lookups
+      table.index(['role_id']);
+      table.index(['permission_id']);
+    });
+
+    console.log('Role permissions junction table created');
+  }
+
+  // Get role and permission IDs
+  const roles = await knex('roles').select('id', 'name');
+  const permissions = await knex('permissions').select('id', 'name');
+
+  if (roles.length === 0 || permissions.length === 0) {
+    console.log('No roles or permissions found, skipping permission mappings');
+    return;
+  }
+
+  const roleMap = Object.fromEntries(roles.map(r => [r.name, r.id]));
+  const permMap = Object.fromEntries(permissions.map(p => [p.name, p.id]));
+
+  // Define role-permission mappings
+  const rolePermissions = {
+    super_admin: permissions.map(p => p.name), // All permissions
+    admin: [
+      // Events - full access
+      'events.view', 'events.create', 'events.edit', 'events.delete', 'events.archive',
+      // Photos - full access
+      'photos.view', 'photos.upload', 'photos.edit', 'photos.delete', 'photos.download',
+      // Archives - full access
+      'archives.view', 'archives.restore', 'archives.download', 'archives.delete',
+      // Analytics - view only
+      'analytics.view',
+      // Email - full access
+      'email.view', 'email.edit', 'email.send',
+      // Branding - full access
+      'branding.view', 'branding.edit',
+      // CMS - full access
+      'cms.view', 'cms.edit',
+      // Settings - view only
+      'settings.view',
+      // Backup - view and create only
+      'backup.view', 'backup.create',
+      // Activity - view only
+      'activity.view'
+    ],
+    editor: [
+      // Events - view, create, and edit (can only see their own events)
+      'events.view', 'events.create', 'events.edit',
+      // Photos - view, upload, edit (no delete)
+      'photos.view', 'photos.upload', 'photos.edit',
+      // Analytics - view only
+      'analytics.view',
+      // Activity - view only
+      'activity.view'
+    ],
+    viewer: [
+      // Events - view only
+      'events.view',
+      // Photos - view only
+      'photos.view',
+      // Archives - view only
+      'archives.view',
+      // Analytics - view only
+      'analytics.view',
+      // Branding - view only
+      'branding.view',
+      // CMS - view only
+      'cms.view'
+    ]
+  };
+
+  // Check for existing mappings to avoid duplicates
+  const existingMappings = await knex('role_permissions').select('role_id', 'permission_id');
+  const existingSet = new Set(existingMappings.map(m => `${m.role_id}-${m.permission_id}`));
+
+  // Build insert list
+  const inserts = [];
+  for (const [roleName, perms] of Object.entries(rolePermissions)) {
+    for (const permName of perms) {
+      if (roleMap[roleName] && permMap[permName]) {
+        const key = `${roleMap[roleName]}-${permMap[permName]}`;
+        if (!existingSet.has(key)) {
+          inserts.push({
+            role_id: roleMap[roleName],
+            permission_id: permMap[permName]
+          });
+        }
+      }
+    }
+  }
+
+  if (inserts.length > 0) {
+    // Insert in batches to avoid hitting database limits
+    const batchSize = 50;
+    for (let i = 0; i < inserts.length; i += batchSize) {
+      const batch = inserts.slice(i, i + batchSize);
+      await knex('role_permissions').insert(batch);
+    }
+    console.log(`Inserted ${inserts.length} role-permission mappings`);
+  }
+
+  console.log('Role permissions junction table migration completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing role_permissions junction table...');
+
+  await knex.schema.dropTableIfExists('role_permissions');
+
+  console.log('Role permissions junction table removed');
+};

backend/migrations/core/057_add_role_to_admin_users.js

@@ -0,0 +1,115 @@
+/**
+ * Migration: Add Role to Admin Users
+ * Adds RBAC-related columns to the admin_users table:
+ * - role_id: Foreign key to roles table
+ * - created_by: Foreign key to admin_users (who invited this user)
+ * - invite_token: Token for invitation acceptance (64 chars = 256 bits)
+ * - invite_expires_at: When the invitation token expires
+ * - invite_accepted_at: When the user accepted the invitation
+ *
+ * Also migrates existing admin users to super_admin role.
+ */
+
+exports.up = async function(knex) {
+  console.log('Adding role columns to admin_users table...');
+
+  // Check if columns already exist
+  const hasRoleId = await knex.schema.hasColumn('admin_users', 'role_id');
+  const hasCreatedBy = await knex.schema.hasColumn('admin_users', 'created_by');
+  const hasInviteToken = await knex.schema.hasColumn('admin_users', 'invite_token');
+  const hasInviteExpiresAt = await knex.schema.hasColumn('admin_users', 'invite_expires_at');
+  const hasInviteAcceptedAt = await knex.schema.hasColumn('admin_users', 'invite_accepted_at');
+
+  // Add new columns if they don't exist
+  if (!hasRoleId || !hasCreatedBy || !hasInviteToken || !hasInviteExpiresAt || !hasInviteAcceptedAt) {
+    await knex.schema.alterTable('admin_users', (table) => {
+      if (!hasRoleId) {
+        // Note: We add as nullable first, then set values, then alter to not null
+        table.integer('role_id').unsigned().references('id').inTable('roles').onDelete('SET NULL');
+      }
+      if (!hasCreatedBy) {
+        table.integer('created_by').unsigned().references('id').inTable('admin_users').onDelete('SET NULL');
+      }
+      if (!hasInviteToken) {
+        // 64 characters = 32 bytes hex = 256 bits of entropy (cryptographically secure)
+        table.string('invite_token', 64);
+      }
+      if (!hasInviteExpiresAt) {
+        table.timestamp('invite_expires_at');
+      }
+      if (!hasInviteAcceptedAt) {
+        table.timestamp('invite_accepted_at');
+      }
+    });
+
+    console.log('Role columns added to admin_users table');
+  }
+
+  // Add index on invite_token for fast lookup
+  const hasInviteTokenIndex = await knex.schema.hasColumn('admin_users', 'invite_token');
+  if (hasInviteTokenIndex) {
+    // Create index if it doesn't exist (safe for both PostgreSQL and SQLite)
+    try {
+      await knex.schema.alterTable('admin_users', (table) => {
+        table.index(['invite_token']);
+      });
+    } catch (e) {
+      // Index may already exist
+      if (!e.message.includes('already exists')) {
+        console.log('Note: invite_token index may already exist');
+      }
+    }
+  }
+
+  // Get super_admin role ID
+  const superAdminRole = await knex('roles').where('name', 'super_admin').first();
+
+  if (superAdminRole) {
+    // Migrate existing admin users without a role to super_admin
+    const usersWithoutRole = await knex('admin_users')
+      .whereNull('role_id')
+      .select('id');
+
+    if (usersWithoutRole.length > 0) {
+      await knex('admin_users')
+        .whereNull('role_id')
+        .update({ role_id: superAdminRole.id });
+
+      console.log(`Migrated ${usersWithoutRole.length} existing admin user(s) to super_admin role`);
+    }
+  } else {
+    console.log('Warning: super_admin role not found. Run migration 054 first.');
+  }
+
+  console.log('Admin users role migration completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing role columns from admin_users table...');
+
+  const hasRoleId = await knex.schema.hasColumn('admin_users', 'role_id');
+  const hasCreatedBy = await knex.schema.hasColumn('admin_users', 'created_by');
+  const hasInviteToken = await knex.schema.hasColumn('admin_users', 'invite_token');
+  const hasInviteExpiresAt = await knex.schema.hasColumn('admin_users', 'invite_expires_at');
+  const hasInviteAcceptedAt = await knex.schema.hasColumn('admin_users', 'invite_accepted_at');
+
+  await knex.schema.alterTable('admin_users', (table) => {
+    if (hasInviteAcceptedAt) {
+      table.dropColumn('invite_accepted_at');
+    }
+    if (hasInviteExpiresAt) {
+      table.dropColumn('invite_expires_at');
+    }
+    if (hasInviteToken) {
+      table.dropColumn('invite_token');
+    }
+    if (hasCreatedBy) {
+      table.dropColumn('created_by');
+    }
+    if (hasRoleId) {
+      table.dropColumn('role_id');
+    }
+  });
+
+  console.log('Role columns removed from admin_users table');
+};

backend/migrations/core/058_add_admin_invitations_table.js

@@ -0,0 +1,68 @@
+/**
+ * Migration: Add Admin Invitations Table
+ * Creates the admin_invitations table for managing pending admin user invitations.
+ *
+ * Security features:
+ * - Token is 64 characters (32 bytes hex = 256 bits of entropy)
+ * - Tokens are unique and indexed for fast lookup
+ * - Invitations have expiration timestamps
+ * - Tracks who invited whom and when accepted
+ * - Foreign key constraints with appropriate CASCADE behavior
+ */
+
+exports.up = async function(knex) {
+  console.log('Creating admin_invitations table...');
+
+  // Check if table already exists
+  const hasAdminInvitationsTable = await knex.schema.hasTable('admin_invitations');
+
+  if (!hasAdminInvitationsTable) {
+    await knex.schema.createTable('admin_invitations', (table) => {
+      table.increments('id').primary();
+
+      // Email of the invited user
+      table.string('email', 255).notNullable();
+
+      // Invitation token - 64 characters = 32 bytes hex = 256 bits of entropy
+      // Cryptographically secure for one-time use tokens
+      table.string('token', 64).unique().notNullable();
+
+      // Role to assign when invitation is accepted
+      table.integer('role_id').unsigned().references('id').inTable('roles').onDelete('CASCADE').notNullable();
+
+      // Who created this invitation
+      table.integer('invited_by').unsigned().references('id').inTable('admin_users').onDelete('CASCADE').notNullable();
+
+      // When the invitation expires (typically 7 days from creation)
+      table.timestamp('expires_at').notNullable();
+
+      // When the invitation was accepted (null if pending)
+      table.timestamp('accepted_at');
+
+      // The admin_user ID created when invitation was accepted (for audit trail)
+      table.integer('accepted_user_id').unsigned().references('id').inTable('admin_users').onDelete('SET NULL');
+
+      // When the invitation was created
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+
+      // Indexes for efficient lookups
+      table.index(['token']); // Fast token validation
+      table.index(['email']); // Check for existing invitations by email
+      table.index(['expires_at']); // Cleanup expired invitations
+      table.index(['invited_by']); // List invitations by inviter
+      table.index(['accepted_at']); // Filter pending vs accepted
+    });
+
+    console.log('Admin invitations table created');
+  }
+
+  console.log('Admin invitations table migration completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing admin_invitations table...');
+
+  await knex.schema.dropTableIfExists('admin_invitations');
+
+  console.log('Admin invitations table removed');
+};

backend/migrations/core/059_add_admin_email_templates.js

@@ -0,0 +1,314 @@
+/**
+ * Migration to add email templates for admin invitation and password reset
+ * These templates support the RBAC (Role-Based Access Control) feature
+ */
+exports.up = async function(knex) {
+  // First, ensure the email_templates table has multilingual columns
+  // This is needed for fresh installations where legacy migrations don't run
+  const columnInfo = await knex('email_templates').columnInfo();
+
+  if (!columnInfo.subject_en) {
+    // Need to add multilingual columns
+    console.log('Adding multilingual columns to email_templates table...');
+
+    // Check if we're using SQLite or PostgreSQL
+    const client = knex.client.config.client;
+    const isSqlite = client === 'sqlite3' || client === 'better-sqlite3';
+
+    if (isSqlite) {
+      // SQLite doesn't support column rename directly in all versions
+      // We need to recreate the table with new structure
+
+      // Get existing data
+      const existingData = await knex('email_templates').select('*');
+
+      // Drop the old table
+      await knex.schema.dropTable('email_templates');
+
+      // Create new table with multilingual columns
+      await knex.schema.createTable('email_templates', (table) => {
+        table.increments('id').primary();
+        table.string('template_key').unique().notNullable();
+        table.string('subject_en');
+        table.string('subject_de');
+        table.text('body_html_en');
+        table.text('body_html_de');
+        table.text('body_text_en');
+        table.text('body_text_de');
+        table.json('variables');
+        table.datetime('updated_at').defaultTo(knex.fn.now());
+      });
+
+      // Re-insert existing data with column mapping
+      for (const row of existingData) {
+        await knex('email_templates').insert({
+          template_key: row.template_key,
+          subject_en: row.subject,
+          subject_de: row.subject, // Copy to German as default
+          body_html_en: row.body_html,
+          body_html_de: row.body_html,
+          body_text_en: row.body_text,
+          body_text_de: row.body_text,
+          variables: row.variables,
+          updated_at: row.updated_at
+        });
+      }
+
+      console.log('Migrated email_templates table to multilingual structure');
+    } else {
+      // PostgreSQL supports ALTER TABLE for column operations
+      await knex.schema.alterTable('email_templates', (table) => {
+        table.renameColumn('subject', 'subject_en');
+        table.renameColumn('body_html', 'body_html_en');
+        table.renameColumn('body_text', 'body_text_en');
+      });
+
+      await knex.schema.alterTable('email_templates', (table) => {
+        table.string('subject_de');
+        table.text('body_html_de');
+        table.text('body_text_de');
+      });
+
+      // Copy English values to German as defaults
+      await knex('email_templates').update({
+        subject_de: knex.raw('subject_en'),
+        body_html_de: knex.raw('body_html_en'),
+        body_text_de: knex.raw('body_text_en')
+      });
+    }
+  }
+
+  // Check which templates already exist
+  const existingTemplates = await knex('email_templates')
+    .select('template_key')
+    .whereIn('template_key', ['admin_invitation', 'admin_password_reset']);
+
+  const existingKeys = existingTemplates.map(t => t.template_key);
+
+  // Admin Invitation Email Template
+  if (!existingKeys.includes('admin_invitation')) {
+    await knex('email_templates').insert({
+      template_key: 'admin_invitation',
+      subject_en: 'You have been invited to join PicPeak as {{role_name}}',
+      subject_de: 'Sie wurden eingeladen, PicPeak als {{role_name}} beizutreten',
+      body_html_en: `
+<h2>Welcome to PicPeak!</h2>
+
+<p>You have been invited to join the PicPeak photo sharing platform as a <strong>{{role_name}}</strong>.</p>
+
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Your Role:</strong> {{role_name}}</p>
+  <p style="margin: 10px 0 0 0;">This role grants you access to manage and administer the photo sharing platform.</p>
+</div>
+
+<p>To accept this invitation and set up your account, click the button below:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{invite_link}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Accept Invitation</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Important:</strong> This invitation expires on <strong>{{expires_at}}</strong>. Please accept the invitation before this date.</p>
+</div>
+
+<p>If you did not expect this invitation or believe it was sent in error, you can safely ignore this email.</p>
+
+<p style="color: #666; font-size: 13px; margin-top: 30px;">
+  If the button above does not work, copy and paste this link into your browser:<br>
+  <a href="{{invite_link}}" style="color: #5C8762; word-break: break-all;">{{invite_link}}</a>
+</p>
+
+<p>Best regards,<br>
+The PicPeak Team</p>`,
+      body_text_en: `Welcome to PicPeak!
+
+You have been invited to join the PicPeak photo sharing platform as a {{role_name}}.
+
+Your Role: {{role_name}}
+This role grants you access to manage and administer the photo sharing platform.
+
+To accept this invitation and set up your account, visit the following link:
+{{invite_link}}
+
+IMPORTANT: This invitation expires on {{expires_at}}. Please accept the invitation before this date.
+
+If you did not expect this invitation or believe it was sent in error, you can safely ignore this email.
+
+Best regards,
+The PicPeak Team`,
+      body_html_de: `
+<h2>Willkommen bei PicPeak!</h2>
+
+<p>Sie wurden eingeladen, der PicPeak Foto-Sharing-Plattform als <strong>{{role_name}}</strong> beizutreten.</p>
+
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Ihre Rolle:</strong> {{role_name}}</p>
+  <p style="margin: 10px 0 0 0;">Diese Rolle gewahrt Ihnen Zugang zur Verwaltung und Administration der Foto-Sharing-Plattform.</p>
+</div>
+
+<p>Um diese Einladung anzunehmen und Ihr Konto einzurichten, klicken Sie auf die Schaltflache unten:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{invite_link}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Einladung annehmen</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Wichtig:</strong> Diese Einladung lauft am <strong>{{expires_at}}</strong> ab. Bitte nehmen Sie die Einladung vor diesem Datum an.</p>
+</div>
+
+<p>Wenn Sie diese Einladung nicht erwartet haben oder glauben, dass sie irrtumlicherweise gesendet wurde, konnen Sie diese E-Mail ignorieren.</p>
+
+<p style="color: #666; font-size: 13px; margin-top: 30px;">
+  Wenn die Schaltflache oben nicht funktioniert, kopieren Sie diesen Link in Ihren Browser:<br>
+  <a href="{{invite_link}}" style="color: #5C8762; word-break: break-all;">{{invite_link}}</a>
+</p>
+
+<p>Mit freundlichen Grussen,<br>
+Ihr PicPeak-Team</p>`,
+      body_text_de: `Willkommen bei PicPeak!
+
+Sie wurden eingeladen, der PicPeak Foto-Sharing-Plattform als {{role_name}} beizutreten.
+
+Ihre Rolle: {{role_name}}
+Diese Rolle gewahrt Ihnen Zugang zur Verwaltung und Administration der Foto-Sharing-Plattform.
+
+Um diese Einladung anzunehmen und Ihr Konto einzurichten, besuchen Sie den folgenden Link:
+{{invite_link}}
+
+WICHTIG: Diese Einladung lauft am {{expires_at}} ab. Bitte nehmen Sie die Einladung vor diesem Datum an.
+
+Wenn Sie diese Einladung nicht erwartet haben oder glauben, dass sie irrtumlicherweise gesendet wurde, konnen Sie diese E-Mail ignorieren.
+
+Mit freundlichen Grussen,
+Ihr PicPeak-Team`,
+      variables: JSON.stringify(['invite_link', 'role_name', 'expires_at'])
+    });
+  }
+
+  // Admin Password Reset Email Template
+  if (!existingKeys.includes('admin_password_reset')) {
+    await knex('email_templates').insert({
+      template_key: 'admin_password_reset',
+      subject_en: 'Your PicPeak administrator password has been reset',
+      subject_de: 'Ihr PicPeak-Administratorpasswort wurde zuruckgesetzt',
+      body_html_en: `
+<h2>Password Reset Notification</h2>
+
+<p>Hello <strong>{{username}}</strong>,</p>
+
+<p>Your administrator password for PicPeak has been reset by a system administrator.</p>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Your New Login Credentials:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Username:</strong> {{username}}</li>
+    <li style="margin-bottom: 10px;"><strong>Temporary Password:</strong> <code style="background-color: #e9ecef; padding: 4px 8px; border-radius: 4px; font-family: monospace; font-size: 14px;">{{new_password}}</code></li>
+  </ul>
+</div>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">Security Notice</p>
+  <ul style="margin: 10px 0 0 0; padding-left: 20px;">
+    <li>This is a temporary password. Please change it immediately after logging in.</li>
+    <li>Never share your password with anyone.</li>
+    <li>If you did not request this password reset, please contact your system administrator immediately.</li>
+  </ul>
+</div>
+
+<p>To log in to the admin panel, click the button below:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{admin_login_url}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Log In Now</a>
+</div>
+
+<p style="color: #666; font-size: 13px;">After logging in, navigate to your profile settings to change your password to something secure that only you know.</p>
+
+<p>Best regards,<br>
+The PicPeak Team</p>`,
+      body_text_en: `Password Reset Notification
+
+Hello {{username}},
+
+Your administrator password for PicPeak has been reset by a system administrator.
+
+Your New Login Credentials:
+- Username: {{username}}
+- Temporary Password: {{new_password}}
+
+SECURITY NOTICE:
+- This is a temporary password. Please change it immediately after logging in.
+- Never share your password with anyone.
+- If you did not request this password reset, please contact your system administrator immediately.
+
+To log in to the admin panel, visit: {{admin_login_url}}
+
+After logging in, navigate to your profile settings to change your password to something secure that only you know.
+
+Best regards,
+The PicPeak Team`,
+      body_html_de: `
+<h2>Benachrichtigung uber Passwortzurucksetzung</h2>
+
+<p>Hallo <strong>{{username}}</strong>,</p>
+
+<p>Ihr Administratorpasswort fur PicPeak wurde von einem Systemadministrator zuruckgesetzt.</p>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Ihre neuen Anmeldedaten:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Benutzername:</strong> {{username}}</li>
+    <li style="margin-bottom: 10px;"><strong>Vorlaufiges Passwort:</strong> <code style="background-color: #e9ecef; padding: 4px 8px; border-radius: 4px; font-family: monospace; font-size: 14px;">{{new_password}}</code></li>
+  </ul>
+</div>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">Sicherheitshinweis</p>
+  <ul style="margin: 10px 0 0 0; padding-left: 20px;">
+    <li>Dies ist ein vorlaufiges Passwort. Bitte andern Sie es sofort nach der Anmeldung.</li>
+    <li>Teilen Sie Ihr Passwort niemals mit anderen.</li>
+    <li>Wenn Sie diese Passwortzurucksetzung nicht angefordert haben, wenden Sie sich bitte umgehend an Ihren Systemadministrator.</li>
+  </ul>
+</div>
+
+<p>Um sich im Admin-Panel anzumelden, klicken Sie auf die Schaltflache unten:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{admin_login_url}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Jetzt anmelden</a>
+</div>
+
+<p style="color: #666; font-size: 13px;">Nach der Anmeldung navigieren Sie zu Ihren Profileinstellungen, um Ihr Passwort in ein sicheres Passwort zu andern, das nur Sie kennen.</p>
+
+<p>Mit freundlichen Grussen,<br>
+Ihr PicPeak-Team</p>`,
+      body_text_de: `Benachrichtigung uber Passwortzurucksetzung
+
+Hallo {{username}},
+
+Ihr Administratorpasswort fur PicPeak wurde von einem Systemadministrator zuruckgesetzt.
+
+Ihre neuen Anmeldedaten:
+- Benutzername: {{username}}
+- Vorlaufiges Passwort: {{new_password}}
+
+SICHERHEITSHINWEIS:
+- Dies ist ein vorlaufiges Passwort. Bitte andern Sie es sofort nach der Anmeldung.
+- Teilen Sie Ihr Passwort niemals mit anderen.
+- Wenn Sie diese Passwortzurucksetzung nicht angefordert haben, wenden Sie sich bitte umgehend an Ihren Systemadministrator.
+
+Um sich im Admin-Panel anzumelden, besuchen Sie: {{admin_login_url}}
+
+Nach der Anmeldung navigieren Sie zu Ihren Profileinstellungen, um Ihr Passwort in ein sicheres Passwort zu andern, das nur Sie kennen.
+
+Mit freundlichen Grussen,
+Ihr PicPeak-Team`,
+      variables: JSON.stringify(['username', 'new_password', 'admin_login_url'])
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove the admin email templates
+  await knex('email_templates')
+    .whereIn('template_key', ['admin_invitation', 'admin_password_reset'])
+    .delete();
+};

backend/migrations/core/060_add_events_created_by.js

@@ -0,0 +1,23 @@
+/**
+ * Migration: Add created_by column to events table
+ * This allows filtering events by owner for role-based access control
+ */
+
+exports.up = async function(knex) {
+  // Add created_by column to events table
+  await knex.schema.alterTable('events', (table) => {
+    table.integer('created_by').unsigned().references('id').inTable('admin_users').onDelete('SET NULL');
+  });
+  
+  // Set existing events to be owned by the first admin (super_admin)
+  const superAdmin = await knex('admin_users').where('role_id', 1).first();
+  if (superAdmin) {
+    await knex('events').update({ created_by: superAdmin.id });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('events', (table) => {
+    table.dropColumn('created_by');
+  });
+};

backend/migrations/core/061_add_event_types_table.js

@@ -0,0 +1,107 @@
+/**
+ * Migration: Add event_types table
+ *
+ * Creates a customizable event types system to replace hardcoded event types.
+ * This allows users to:
+ * - Rename existing event types (wedding, birthday, corporate, other)
+ * - Create custom event types with custom slug prefixes
+ * - Associate default theme presets with event types
+ *
+ * Backward compatible: Existing events keep their event_type strings.
+ * New events can use either legacy strings or custom event type slug_prefix.
+ */
+
+const { createTableIfNotExists, insertIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Creating event_types table...');
+
+  // Create event_types table
+  const hasEventTypesTable = await knex.schema.hasTable('event_types');
+  if (!hasEventTypesTable) {
+    await knex.schema.createTable('event_types', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).notNullable(); // Display name: "Family Shoot"
+      table.string('slug_prefix', 50).unique().notNullable(); // URL prefix: "family"
+      table.string('emoji', 10); // Icon emoji: "👨‍👩‍👧"
+      table.string('theme_preset', 50); // Default theme: "elegantWedding"
+      table.text('theme_config'); // Custom theme JSON overrides (optional)
+      table.integer('display_order').defaultTo(0); // Sorting in dropdowns
+      table.boolean('is_system').defaultTo(false); // Protect default types
+      table.boolean('is_active').defaultTo(true); // Allow hiding types
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+
+      // Indexes for performance
+      table.index('slug_prefix');
+      table.index('display_order');
+      table.index('is_active');
+    });
+    console.log('event_types table created');
+  } else {
+    console.log('event_types table already exists, skipping creation');
+  }
+
+  // Seed default event types (matching current hardcoded values)
+  const existingTypes = await knex('event_types').select('slug_prefix');
+  const existingSlugs = existingTypes.map(t => t.slug_prefix);
+
+  const defaultTypes = [
+    {
+      name: 'Wedding',
+      slug_prefix: 'wedding',
+      emoji: '💒',
+      theme_preset: 'elegantWedding',
+      display_order: 1,
+      is_system: true,
+      is_active: true
+    },
+    {
+      name: 'Birthday',
+      slug_prefix: 'birthday',
+      emoji: '🎂',
+      theme_preset: 'birthdayFun',
+      display_order: 2,
+      is_system: true,
+      is_active: true
+    },
+    {
+      name: 'Corporate',
+      slug_prefix: 'corporate',
+      emoji: '🏢',
+      theme_preset: 'corporateTimeline',
+      display_order: 3,
+      is_system: true,
+      is_active: true
+    },
+    {
+      name: 'Other',
+      slug_prefix: 'other',
+      emoji: '📸',
+      theme_preset: 'default',
+      display_order: 4,
+      is_system: true,
+      is_active: true
+    }
+  ];
+
+  const typesToInsert = defaultTypes.filter(type => !existingSlugs.includes(type.slug_prefix));
+
+  if (typesToInsert.length > 0) {
+    await knex('event_types').insert(typesToInsert);
+    console.log(`Inserted ${typesToInsert.length} default event types`);
+  } else {
+    console.log('Default event types already exist, skipping seed');
+  }
+
+  console.log('Migration 061_add_event_types_table completed successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Rolling back event_types table...');
+
+  // Drop the table (data will be lost)
+  await knex.schema.dropTableIfExists('event_types');
+
+  console.log('event_types table dropped');
+};

backend/migrations/core/061_add_optional_date_expiration_settings.js

@@ -0,0 +1,53 @@
+/**
+ * Migration: Add optional event date and expiration settings
+ * These settings control whether event_date and expiration are required
+ * when creating new events, supporting non-event use cases like portraits.
+ */
+
+exports.up = async function(knex) {
+  // Add new settings for optional date and expiration
+  const settings = [
+    { setting_key: 'event_require_event_date', setting_value: JSON.stringify(true), setting_type: 'boolean' },
+    { setting_key: 'event_require_expiration', setting_value: JSON.stringify(true), setting_type: 'boolean' }
+  ];
+
+  for (const setting of settings) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+
+  // Make event_date and expires_at columns nullable
+  // PostgreSQL supports ALTER COLUMN ... DROP NOT NULL
+  // SQLite requires table recreation (handled differently)
+  const client = knex.client.config.client;
+
+  if (client === 'pg' || client === 'postgresql') {
+    // PostgreSQL: directly alter columns
+    await knex.raw('ALTER TABLE events ALTER COLUMN event_date DROP NOT NULL');
+    await knex.raw('ALTER TABLE events ALTER COLUMN expires_at DROP NOT NULL');
+  } else if (client === 'sqlite3' || client === 'better-sqlite3') {
+    // SQLite: columns are already effectively nullable in most cases
+    // SQLite doesn't enforce NOT NULL as strictly, and altering requires table recreation
+    // For safety, we'll skip the schema change for SQLite as it's complex
+    // The application logic will handle null values appropriately
+    console.log('SQLite detected - skipping schema alteration (columns will accept NULL values)');
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove the settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'event_require_event_date',
+      'event_require_expiration'
+    ])
+    .del();
+
+  // Note: We don't restore NOT NULL constraints as that could fail
+  // if there are existing NULL values in the database
+};

backend/migrations/core/061_add_watermark_path.js

@@ -0,0 +1,28 @@
+/**
+ * Migration 061: Add pre-generated watermark path to photos table
+ * - photos.watermark_path: path to pre-generated watermarked image
+ * - photos.watermark_generated_at: timestamp of watermark generation
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 061_add_watermark_path');
+
+  // photos.watermark_path (nullable - path to pre-generated watermarked image)
+  await addColumnIfNotExists(knex, 'photos', 'watermark_path', (table) => {
+    table.string('watermark_path', 512);
+  });
+
+  // photos.watermark_generated_at (nullable - when watermark was last generated)
+  await addColumnIfNotExists(knex, 'photos', 'watermark_generated_at', (table) => {
+    table.timestamp('watermark_generated_at');
+  });
+
+  console.log('Migration 061_add_watermark_path completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 061_add_watermark_path');
+  // Keep columns (safe rollback not removing data). Intentionally no-op.
+};

backend/migrations/core/062_add_hero_logo_settings.js

@@ -0,0 +1,70 @@
+/**
+ * Migration: Add hero logo customization settings to events table
+ *
+ * Allows per-event customization of the hero gallery logo:
+ * - hero_logo_visible: Show/hide the logo overlay
+ * - hero_logo_size: Logo size (small, medium, large, xlarge)
+ * - hero_logo_position: Logo position (top, center, bottom)
+ *
+ * Addresses GitHub Issue #138: Add Option to customize the Hero gallery layout
+ */
+
+exports.up = async function (knex) {
+  console.log('Adding hero logo settings to events table...');
+
+  // Add hero_logo_visible column
+  const hasVisibleColumn = await knex.schema.hasColumn('events', 'hero_logo_visible');
+  if (!hasVisibleColumn) {
+    await knex.schema.table('events', (table) => {
+      table.boolean('hero_logo_visible').notNullable().defaultTo(true);
+    });
+    console.log('Added hero_logo_visible column');
+  }
+
+  // Add hero_logo_size column
+  const hasSizeColumn = await knex.schema.hasColumn('events', 'hero_logo_size');
+  if (!hasSizeColumn) {
+    await knex.schema.table('events', (table) => {
+      table.string('hero_logo_size', 20).notNullable().defaultTo('medium');
+    });
+    console.log('Added hero_logo_size column');
+  }
+
+  // Add hero_logo_position column
+  const hasPositionColumn = await knex.schema.hasColumn('events', 'hero_logo_position');
+  if (!hasPositionColumn) {
+    await knex.schema.table('events', (table) => {
+      table.string('hero_logo_position', 20).notNullable().defaultTo('top');
+    });
+    console.log('Added hero_logo_position column');
+  }
+
+  console.log('Migration 062_add_hero_logo_settings completed successfully');
+};
+
+exports.down = async function (knex) {
+  console.log('Rolling back hero logo settings...');
+
+  const hasVisibleColumn = await knex.schema.hasColumn('events', 'hero_logo_visible');
+  if (hasVisibleColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('hero_logo_visible');
+    });
+  }
+
+  const hasSizeColumn = await knex.schema.hasColumn('events', 'hero_logo_size');
+  if (hasSizeColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('hero_logo_size');
+    });
+  }
+
+  const hasPositionColumn = await knex.schema.hasColumn('events', 'hero_logo_position');
+  if (hasPositionColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('hero_logo_position');
+    });
+  }
+
+  console.log('Hero logo settings columns dropped');
+};

backend/migrations/core/062_add_original_filename.js

@@ -0,0 +1,23 @@
+/**
+ * Migration 062: Add original_filename to photos table
+ * - photos.original_filename: preserves the original filename from upload
+ *   This enables Lightroom integration by exporting filtered filenames
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 062_add_original_filename');
+
+  // photos.original_filename (nullable - original filename before renaming)
+  await addColumnIfNotExists(knex, 'photos', 'original_filename', (table) => {
+    table.string('original_filename', 512);
+  });
+
+  console.log('Migration 062_add_original_filename completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 062_add_original_filename');
+  // Keep column (safe rollback not removing data). Intentionally no-op.
+};

backend/migrations/core/063_add_event_custom_logo.js

@@ -0,0 +1,53 @@
+/**
+ * Migration: Add custom logo support to events table
+ *
+ * Allows per-event custom logo that overrides the global branding logo:
+ * - hero_logo_url: Public path to the uploaded custom logo
+ * - hero_logo_path: Full filesystem path to the custom logo
+ *
+ * Logo priority: Event custom logo > Global branding logo > Default PicPeak logo
+ *
+ * Addresses GitHub Issue #138: Per-event custom logo option
+ */
+
+exports.up = async function (knex) {
+  console.log('Adding custom logo columns to events table...');
+
+  const hasUrlColumn = await knex.schema.hasColumn('events', 'hero_logo_url');
+  if (!hasUrlColumn) {
+    await knex.schema.table('events', (table) => {
+      table.string('hero_logo_url', 500).nullable().defaultTo(null);
+    });
+    console.log('Added hero_logo_url column');
+  }
+
+  const hasPathColumn = await knex.schema.hasColumn('events', 'hero_logo_path');
+  if (!hasPathColumn) {
+    await knex.schema.table('events', (table) => {
+      table.string('hero_logo_path', 500).nullable().defaultTo(null);
+    });
+    console.log('Added hero_logo_path column');
+  }
+
+  console.log('Migration 063_add_event_custom_logo completed successfully');
+};
+
+exports.down = async function (knex) {
+  console.log('Rolling back custom logo columns...');
+
+  const hasUrlColumn = await knex.schema.hasColumn('events', 'hero_logo_url');
+  if (hasUrlColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('hero_logo_url');
+    });
+  }
+
+  const hasPathColumn = await knex.schema.hasColumn('events', 'hero_logo_path');
+  if (hasPathColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('hero_logo_path');
+    });
+  }
+
+  console.log('Custom logo columns dropped');
+};

backend/migrations/core/064_backfill_photo_dimensions.js

@@ -0,0 +1,105 @@
+/**
+ * Migration: Backfill photo dimensions
+ *
+ * This migration extracts width/height from existing photos that don't have
+ * these dimensions stored. This is needed for aspect-ratio-aware layouts
+ * (masonry, mosaic, justified) to work properly.
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+exports.up = async function(knex) {
+  // Check if the width/height columns exist
+  const hasWidth = await knex.schema.hasColumn('photos', 'width');
+  const hasHeight = await knex.schema.hasColumn('photos', 'height');
+
+  if (!hasWidth || !hasHeight) {
+    console.log('[Migration 064] Width/height columns not found, skipping backfill');
+    return;
+  }
+
+  // Get storage path
+  const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+  // Find photos without dimensions
+  const photos = await knex('photos')
+    .whereNull('width')
+    .orWhereNull('height')
+    .select('id', 'path', 'filename', 'media_type');
+
+  console.log(`[Migration 064] Found ${photos.length} photos without dimensions`);
+
+  if (photos.length === 0) {
+    return;
+  }
+
+  // Import sharp dynamically (only needed during migration)
+  let sharp;
+  try {
+    sharp = require('sharp');
+  } catch (err) {
+    console.error('[Migration 064] Sharp not available, skipping backfill:', err.message);
+    return;
+  }
+
+  let updated = 0;
+  let failed = 0;
+
+  for (const photo of photos) {
+    try {
+      // Skip videos - they need ffprobe for metadata
+      if (photo.media_type === 'video') {
+        continue;
+      }
+
+      // Construct the full file path
+      let fullPath;
+      if (photo.path) {
+        // Path is relative to events/active directory
+        fullPath = path.join(storagePath, 'events/active', photo.path);
+      } else {
+        console.warn(`[Migration 064] Photo ${photo.id} (${photo.filename}) has no path, skipping`);
+        continue;
+      }
+
+      // Check if file exists
+      if (!fs.existsSync(fullPath)) {
+        console.warn(`[Migration 064] Photo ${photo.id} file not found: ${fullPath}`);
+        failed++;
+        continue;
+      }
+
+      // Extract dimensions using sharp
+      const metadata = await sharp(fullPath).metadata();
+
+      if (metadata.width && metadata.height) {
+        await knex('photos')
+          .where('id', photo.id)
+          .update({
+            width: metadata.width,
+            height: metadata.height
+          });
+        updated++;
+
+        if (updated % 50 === 0) {
+          console.log(`[Migration 064] Updated ${updated} photos...`);
+        }
+      } else {
+        console.warn(`[Migration 064] Could not extract dimensions for photo ${photo.id}`);
+        failed++;
+      }
+    } catch (err) {
+      console.error(`[Migration 064] Error processing photo ${photo.id}:`, err.message);
+      failed++;
+    }
+  }
+
+  console.log(`[Migration 064] Completed: ${updated} updated, ${failed} failed`);
+};
+
+exports.down = async function(knex) {
+  // This migration only adds data, no rollback needed
+  // We don't want to null out dimensions on rollback as they're still valid
+  console.log('[Migration 064] Rollback: No action needed (data-only migration)');
+};

backend/migrations/core/065_add_header_style.js

@@ -0,0 +1,131 @@
+/**
+ * Migration: Add header_style and hero_divider_style columns
+ *
+ * This migration decouples the hero header style from gallery layout,
+ * allowing any combination of header style with any layout type.
+ */
+
+exports.up = async function(knex) {
+  console.log('[Migration 065] Adding header_style and hero_divider_style columns');
+
+  // Check if columns already exist
+  const hasHeaderStyle = await knex.schema.hasColumn('events', 'header_style');
+  const hasDividerStyle = await knex.schema.hasColumn('events', 'hero_divider_style');
+
+  if (!hasHeaderStyle) {
+    await knex.schema.alterTable('events', (table) => {
+      table.string('header_style', 20).defaultTo('standard');
+    });
+    console.log('[Migration 065] Added header_style column');
+  }
+
+  if (!hasDividerStyle) {
+    await knex.schema.alterTable('events', (table) => {
+      table.string('hero_divider_style', 20).defaultTo('wave');
+    });
+    console.log('[Migration 065] Added hero_divider_style column');
+  }
+
+  // Migrate existing events with hero layout in color_theme
+  console.log('[Migration 065] Migrating existing hero layouts...');
+
+  const events = await knex('events')
+    .whereNotNull('color_theme')
+    .select('id', 'color_theme');
+
+  let migratedCount = 0;
+
+  for (const event of events) {
+    try {
+      // Skip if color_theme is not JSON
+      if (!event.color_theme || !event.color_theme.startsWith('{')) {
+        continue;
+      }
+
+      const theme = JSON.parse(event.color_theme);
+
+      // Check if this event uses hero layout
+      if (theme.galleryLayout === 'hero') {
+        // Migrate: set headerStyle to 'hero' and galleryLayout to 'grid'
+        const updatedTheme = {
+          ...theme,
+          headerStyle: 'hero',
+          galleryLayout: 'grid',
+          heroDividerStyle: theme.heroDividerStyle || 'wave'
+        };
+
+        await knex('events')
+          .where('id', event.id)
+          .update({
+            color_theme: JSON.stringify(updatedTheme),
+            header_style: 'hero',
+            hero_divider_style: theme.heroDividerStyle || 'wave'
+          });
+
+        migratedCount++;
+      }
+    } catch (err) {
+      // Invalid JSON in color_theme, skip
+      console.warn(`[Migration 065] Could not parse color_theme for event ${event.id}: ${err.message}`);
+    }
+  }
+
+  console.log(`[Migration 065] Migrated ${migratedCount} events from hero layout`);
+  console.log('[Migration 065] Completed');
+};
+
+exports.down = async function(knex) {
+  console.log('[Migration 065] Removing header_style and hero_divider_style columns');
+
+  // First, migrate any hero header styles back to hero layout
+  const events = await knex('events')
+    .where('header_style', 'hero')
+    .whereNotNull('color_theme')
+    .select('id', 'color_theme');
+
+  for (const event of events) {
+    try {
+      if (!event.color_theme || !event.color_theme.startsWith('{')) {
+        continue;
+      }
+
+      const theme = JSON.parse(event.color_theme);
+
+      // Revert: set galleryLayout back to 'hero'
+      const revertedTheme = {
+        ...theme,
+        galleryLayout: 'hero'
+      };
+
+      // Remove the new properties
+      delete revertedTheme.headerStyle;
+      delete revertedTheme.heroDividerStyle;
+
+      await knex('events')
+        .where('id', event.id)
+        .update({
+          color_theme: JSON.stringify(revertedTheme)
+        });
+    } catch (err) {
+      console.warn(`[Migration 065] Could not revert color_theme for event ${event.id}: ${err.message}`);
+    }
+  }
+
+  // Remove the columns
+  const hasHeaderStyle = await knex.schema.hasColumn('events', 'header_style');
+  const hasDividerStyle = await knex.schema.hasColumn('events', 'hero_divider_style');
+
+  if (hasHeaderStyle) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('header_style');
+    });
+  }
+
+  if (hasDividerStyle) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('hero_divider_style');
+    });
+  }
+
+  console.log('[Migration 065] Rollback completed');
+};

backend/migrations/core/066_add_hero_anchor_and_category_hero.js

@@ -0,0 +1,48 @@
+/**
+ * Migration: Add hero image anchor position and category-specific hero images
+ *
+ * Issue #162: Add hero_image_anchor column to events table for controlling
+ *             how hero images are cropped (top/center/bottom)
+ *
+ * Issue #163: Add hero_photo_id column to photo_categories table for
+ *             category-specific hero images
+ */
+
+exports.up = async function(knex) {
+  // Add hero_image_anchor to events table (Issue #162)
+  const hasHeroAnchor = await knex.schema.hasColumn('events', 'hero_image_anchor');
+  if (!hasHeroAnchor) {
+    await knex.schema.alterTable('events', function(table) {
+      // Values: 'top', 'center', 'bottom' - defaults to 'center' for backward compatibility
+      table.string('hero_image_anchor', 10).defaultTo('center');
+    });
+    console.log('Added hero_image_anchor column to events table');
+  }
+
+  // Add hero_photo_id to photo_categories table (Issue #163)
+  const hasCategoryHero = await knex.schema.hasColumn('photo_categories', 'hero_photo_id');
+  if (!hasCategoryHero) {
+    await knex.schema.alterTable('photo_categories', function(table) {
+      table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
+    });
+    console.log('Added hero_photo_id column to photo_categories table');
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove hero_image_anchor from events table
+  const hasHeroAnchor = await knex.schema.hasColumn('events', 'hero_image_anchor');
+  if (hasHeroAnchor) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('hero_image_anchor');
+    });
+  }
+
+  // Remove hero_photo_id from photo_categories table
+  const hasCategoryHero = await knex.schema.hasColumn('photo_categories', 'hero_photo_id');
+  if (hasCategoryHero) {
+    await knex.schema.alterTable('photo_categories', function(table) {
+      table.dropColumn('hero_photo_id');
+    });
+  }
+};

backend/migrations/core/067_expand_hero_image_anchor.js

@@ -0,0 +1,32 @@
+/**
+ * Migration: Expand hero_image_anchor column to support focal point percentages
+ *
+ * Changes string(10) to string(20) so values like "100% 100%" (9 chars) fit
+ * with room to spare. Existing 'top', 'center', 'bottom' values are preserved.
+ */
+
+exports.up = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'hero_image_anchor');
+  if (!hasColumn) {
+    // Column doesn't exist yet – nothing to expand
+    return;
+  }
+
+  // SQLite doesn't truly support ALTER COLUMN, but Knex handles the
+  // rebuild-table strategy internally when we call alterTable.
+  await knex.schema.alterTable('events', function(table) {
+    table.string('hero_image_anchor', 20).defaultTo('center').alter();
+  });
+  console.log('Expanded hero_image_anchor column to string(20)');
+};
+
+exports.down = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'hero_image_anchor');
+  if (!hasColumn) {
+    return;
+  }
+
+  await knex.schema.alterTable('events', function(table) {
+    table.string('hero_image_anchor', 10).defaultTo('center').alter();
+  });
+};

backend/migrations/core/068_add_seo_robots_settings.js

@@ -0,0 +1,54 @@
+const DEFAULT_AI_AGENTS = [
+  'GPTBot',
+  'ChatGPT-User',
+  'Google-Extended',
+  'Claude-Web',
+  'Anthropic-AI',
+  'CCBot',
+  'Bytespider',
+  'FacebookBot',
+  'Omgilibot',
+  'Diffbot',
+  'PetalBot',
+  'Amazonbot',
+  'PerplexityBot',
+  'YouBot',
+  'Applebot-Extended'
+];
+
+exports.up = async function(knex) {
+  const defaults = [
+    { setting_key: 'seo_allow_indexing', setting_value: JSON.stringify(false), setting_type: 'seo' },
+    { setting_key: 'seo_block_ai_crawlers', setting_value: JSON.stringify(true), setting_type: 'seo' },
+    { setting_key: 'seo_block_social_bots', setting_value: JSON.stringify(false), setting_type: 'seo' },
+    { setting_key: 'seo_blocked_ai_agents', setting_value: JSON.stringify(DEFAULT_AI_AGENTS), setting_type: 'seo' },
+    { setting_key: 'seo_custom_rules', setting_value: JSON.stringify([]), setting_type: 'seo' },
+    { setting_key: 'seo_meta_noindex', setting_value: JSON.stringify(true), setting_type: 'seo' },
+    { setting_key: 'seo_meta_nofollow', setting_value: JSON.stringify(false), setting_type: 'seo' },
+    { setting_key: 'seo_meta_noai', setting_value: JSON.stringify(true), setting_type: 'seo' },
+    { setting_key: 'seo_sitemap_url', setting_value: JSON.stringify(''), setting_type: 'seo' }
+  ];
+
+  for (const setting of defaults) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({ ...setting, updated_at: knex.fn.now() });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'seo_allow_indexing',
+      'seo_block_ai_crawlers',
+      'seo_block_social_bots',
+      'seo_blocked_ai_agents',
+      'seo_custom_rules',
+      'seo_meta_noindex',
+      'seo_meta_nofollow',
+      'seo_meta_noai',
+      'seo_sitemap_url'
+    ])
+    .del();
+};

backend/migrations/core/069_add_hero_path.js

@@ -0,0 +1,22 @@
+/**
+ * Migration 069: Add hero image path to photos table
+ * - photos.hero_path: path to hero-optimized image (1920x1080) for gallery headers
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 069_add_hero_path');
+
+  // photos.hero_path (nullable - path to hero-optimized image)
+  await addColumnIfNotExists(knex, 'photos', 'hero_path', (table) => {
+    table.string('hero_path', 512);
+  });
+
+  console.log('Migration 069_add_hero_path completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 069_add_hero_path');
+  // Keep columns (safe rollback not removing data). Intentionally no-op.
+};

backend/migrations/core/070_add_update_notification_settings.js

@@ -0,0 +1,161 @@
+/**
+ * Migration 070: Add update notification settings and email template
+ * - Settings for email notifications when new versions are available
+ * - Email template for version update notifications
+ */
+
+exports.up = async function(knex) {
+  console.log('Running migration: 070_add_update_notification_settings');
+
+  // Add app_settings for update notifications
+  const settings = [
+    {
+      setting_key: 'update_email_notifications_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'notifications'
+    },
+    {
+      setting_key: 'update_email_recipients',
+      setting_value: JSON.stringify(''), // Comma-separated emails, or empty for all admin emails
+      setting_type: 'notifications'
+    },
+    {
+      setting_key: 'last_notified_version',
+      setting_value: JSON.stringify(''),
+      setting_type: 'notifications'
+    }
+  ];
+
+  for (const setting of settings) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({ ...setting, updated_at: knex.fn.now() });
+    }
+  }
+
+  // Check if email template already exists
+  const existingTemplate = await knex('email_templates')
+    .where('template_key', 'version_update_available')
+    .first();
+
+  if (!existingTemplate) {
+    await knex('email_templates').insert({
+      template_key: 'version_update_available',
+      subject_en: 'PicPeak Update Available: Version {{new_version}}',
+      subject_de: 'PicPeak Update verfugbar: Version {{new_version}}',
+      body_html_en: `
+<h2>A New Version of PicPeak is Available</h2>
+
+<p>Great news! A new version of PicPeak is available for your installation.</p>
+
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Current Version:</strong> {{current_version}}</p>
+  <p style="margin: 10px 0 0 0;"><strong>New Version:</strong> {{new_version}}</p>
+  <p style="margin: 10px 0 0 0;"><strong>Channel:</strong> {{channel}}</p>
+</div>
+
+<h3>What's New?</h3>
+<p>Check the release notes to see what's included in this update:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{release_notes_url}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">View Release Notes</a>
+</div>
+
+<h3>How to Update</h3>
+<p>To update your installation, log in to the admin panel and click on the "Update Available" notification. You'll find environment-specific instructions there.</p>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Reminder:</strong> Always backup your database before updating to ensure you can recover if anything goes wrong.</p>
+</div>
+
+<p>Best regards,<br>
+Your PicPeak Installation</p>`,
+      body_text_en: `A New Version of PicPeak is Available
+
+Great news! A new version of PicPeak is available for your installation.
+
+Current Version: {{current_version}}
+New Version: {{new_version}}
+Channel: {{channel}}
+
+What's New?
+Check the release notes to see what's included in this update:
+{{release_notes_url}}
+
+How to Update
+To update your installation, log in to the admin panel and click on the "Update Available" notification. You'll find environment-specific instructions there.
+
+REMINDER: Always backup your database before updating to ensure you can recover if anything goes wrong.
+
+Best regards,
+Your PicPeak Installation`,
+      body_html_de: `
+<h2>Eine neue Version von PicPeak ist verfugbar</h2>
+
+<p>Gute Neuigkeiten! Eine neue Version von PicPeak ist fur Ihre Installation verfugbar.</p>
+
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Aktuelle Version:</strong> {{current_version}}</p>
+  <p style="margin: 10px 0 0 0;"><strong>Neue Version:</strong> {{new_version}}</p>
+  <p style="margin: 10px 0 0 0;"><strong>Kanal:</strong> {{channel}}</p>
+</div>
+
+<h3>Was ist neu?</h3>
+<p>Schauen Sie sich die Versionshinweise an, um zu sehen, was in diesem Update enthalten ist:</p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{release_notes_url}}" style="display: inline-block; padding: 14px 35px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Versionshinweise anzeigen</a>
+</div>
+
+<h3>So aktualisieren Sie</h3>
+<p>Um Ihre Installation zu aktualisieren, melden Sie sich im Admin-Panel an und klicken Sie auf die Benachrichtigung "Update verfugbar". Dort finden Sie umgebungsspezifische Anweisungen.</p>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Erinnerung:</strong> Erstellen Sie immer ein Backup Ihrer Datenbank, bevor Sie aktualisieren, um sicherzustellen, dass Sie im Fehlerfall wiederherstellen konnen.</p>
+</div>
+
+<p>Mit freundlichen Grussen,<br>
+Ihre PicPeak-Installation</p>`,
+      body_text_de: `Eine neue Version von PicPeak ist verfugbar
+
+Gute Neuigkeiten! Eine neue Version von PicPeak ist fur Ihre Installation verfugbar.
+
+Aktuelle Version: {{current_version}}
+Neue Version: {{new_version}}
+Kanal: {{channel}}
+
+Was ist neu?
+Schauen Sie sich die Versionshinweise an, um zu sehen, was in diesem Update enthalten ist:
+{{release_notes_url}}
+
+So aktualisieren Sie
+Um Ihre Installation zu aktualisieren, melden Sie sich im Admin-Panel an und klicken Sie auf die Benachrichtigung "Update verfugbar". Dort finden Sie umgebungsspezifische Anweisungen.
+
+ERINNERUNG: Erstellen Sie immer ein Backup Ihrer Datenbank, bevor Sie aktualisieren, um sicherzustellen, dass Sie im Fehlerfall wiederherstellen konnen.
+
+Mit freundlichen Grussen,
+Ihre PicPeak-Installation`,
+      variables: JSON.stringify(['current_version', 'new_version', 'channel', 'release_notes_url'])
+    });
+  }
+
+  console.log('Migration 070_add_update_notification_settings completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 070_add_update_notification_settings');
+
+  // Remove settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'update_email_notifications_enabled',
+      'update_email_recipients',
+      'last_notified_version'
+    ])
+    .del();
+
+  // Remove email template
+  await knex('email_templates')
+    .where('template_key', 'version_update_available')
+    .del();
+};

backend/migrations/core/071_add_captured_at.js

@@ -0,0 +1,42 @@
+/**
+ * Migration 071: Add captured_at column to photos table
+ * - Stores the original capture date from EXIF metadata
+ * - Enables sorting photos by capture date instead of upload date
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 071_add_captured_at');
+
+  // Add captured_at column to photos table
+  await addColumnIfNotExists(knex, 'photos', 'captured_at', (table) => {
+    table.datetime('captured_at').nullable();
+  });
+
+  // Add index for sorting performance
+  const indexExists = await knex.schema.hasIndex
+    ? await knex.schema.hasIndex('photos', 'idx_photos_captured_at')
+    : false;
+
+  if (!indexExists) {
+    // Use raw query for index creation with IF NOT EXISTS
+    const client = knex.client.config.client;
+    if (client === 'pg') {
+      await knex.raw('CREATE INDEX IF NOT EXISTS idx_photos_captured_at ON photos(captured_at)');
+    } else if (client === 'sqlite3' || client === 'better-sqlite3') {
+      // SQLite doesn't support IF NOT EXISTS for indexes, so we need to check first
+      const existingIndexes = await knex.raw("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_photos_captured_at'");
+      if (existingIndexes.length === 0) {
+        await knex.raw('CREATE INDEX idx_photos_captured_at ON photos(captured_at)');
+      }
+    }
+  }
+
+  console.log('Migration 071_add_captured_at completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 071_add_captured_at');
+  // Keep column for safe rollback (intentionally no-op)
+};

backend/migrations/core/073_make_event_emails_nullable.js

@@ -0,0 +1,13 @@
+exports.up = async function(knex) {
+  await knex.schema.alterTable('events', (table) => {
+    table.string('host_email', 255).nullable().alter();
+    table.string('admin_email', 255).nullable().alter();
+  });
+};
+
+exports.down = async function(knex) {
+  await knex.schema.alterTable('events', (table) => {
+    table.string('host_email', 255).notNullable().defaultTo('').alter();
+    table.string('admin_email', 255).notNullable().defaultTo('').alter();
+  });
+};

backend/migrations/core/074_add_photo_cap.js

@@ -0,0 +1,13 @@
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 074_add_photo_cap');
+  await addColumnIfNotExists(knex, 'events', 'photo_cap', (table) => {
+    table.integer('photo_cap').nullable().defaultTo(null);
+  });
+  console.log('Migration 074_add_photo_cap completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 074_add_photo_cap');
+};

backend/migrations/core/074_photo_visibility_client_access.js

@@ -0,0 +1,28 @@
+const { addColumnIfNotExists, createIndexIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  // Add visibility column to photos table
+  await addColumnIfNotExists(knex, 'photos', 'visibility', (table) => {
+    table.string('visibility', 20).defaultTo('visible').notNullable();
+  });
+
+  // Add client access columns to events table
+  await addColumnIfNotExists(knex, 'events', 'client_access_enabled', (table) => {
+    table.boolean('client_access_enabled').defaultTo(false);
+  });
+
+  await addColumnIfNotExists(knex, 'events', 'client_password_hash', (table) => {
+    table.string('client_password_hash', 255).nullable();
+  });
+
+  await addColumnIfNotExists(knex, 'events', 'client_share_token', (table) => {
+    table.string('client_share_token', 64).nullable().unique();
+  });
+
+  // Index for filtering photos by visibility
+  await createIndexIfNotExists(knex, 'photos', ['event_id', 'visibility'], 'idx_photos_event_visibility');
+};
+
+exports.down = async function(knex) {
+  // Safe rollback - intentionally no-op to avoid data loss
+};

backend/migrations/core/075_email_template_translations.js

@@ -0,0 +1,281 @@
+/**
+ * Migration to create email_template_translations table
+ * Moves from per-column language support (subject_en, subject_de) to a
+ * normalized translations table where each language is a row.
+ * This allows adding new languages without schema changes.
+ */
+exports.up = async function(knex) {
+  // 1. Create the email_template_translations table
+  await knex.schema.createTable('email_template_translations', (table) => {
+    table.increments('id').primary();
+    table.integer('template_id').unsigned().notNullable()
+      .references('id').inTable('email_templates').onDelete('CASCADE');
+    table.string('language', 10).notNullable();
+    table.text('subject');
+    table.text('body_html');
+    table.text('body_text');
+    table.datetime('created_at').defaultTo(knex.fn.now());
+    table.datetime('updated_at').defaultTo(knex.fn.now());
+    table.unique(['template_id', 'language']);
+  });
+
+  console.log('Created email_template_translations table');
+
+  // 2. Migrate existing data from email_templates columns into rows
+  const templates = await knex('email_templates').select('*');
+  const columnInfo = await knex('email_templates').columnInfo();
+  const hasLangColumns = !!columnInfo.subject_en;
+
+  for (const template of templates) {
+    // Extract EN translation
+    const enSubject = hasLangColumns
+      ? (template.subject_en || template.subject || '')
+      : (template.subject || '');
+    const enHtml = hasLangColumns
+      ? (template.body_html_en || template.body_html || '')
+      : (template.body_html || '');
+    const enText = hasLangColumns
+      ? (template.body_text_en || template.body_text || '')
+      : (template.body_text || '');
+
+    // Insert EN translation
+    if (enSubject || enHtml) {
+      await knex('email_template_translations').insert({
+        template_id: template.id,
+        language: 'en',
+        subject: enSubject,
+        body_html: enHtml,
+        body_text: enText,
+        created_at: new Date(),
+        updated_at: new Date(),
+      });
+    }
+
+    // Extract DE translation (only if lang columns exist)
+    if (hasLangColumns) {
+      const deSubject = template.subject_de || '';
+      const deHtml = template.body_html_de || '';
+      const deText = template.body_text_de || '';
+
+      // Only insert if DE content differs from EN or has content
+      if (deSubject || deHtml) {
+        await knex('email_template_translations').insert({
+          template_id: template.id,
+          language: 'de',
+          subject: deSubject,
+          body_html: deHtml,
+          body_text: deText,
+          created_at: new Date(),
+          updated_at: new Date(),
+        });
+      }
+    }
+  }
+
+  console.log(`Migrated ${templates.length} templates to translations table`);
+
+  // 3. Seed NL, PT, RU translations for customer-facing templates
+  // Look up template IDs
+  const customerTemplates = await knex('email_templates')
+    .whereIn('template_key', [
+      'gallery_created', 'expiration_warning', 'gallery_expired', 'archive_complete'
+    ])
+    .select('id', 'template_key');
+
+  const templateMap = {};
+  customerTemplates.forEach(t => { templateMap[t.template_key] = t.id; });
+
+  const seedTranslations = [];
+
+  // --- gallery_created ---
+  if (templateMap.gallery_created) {
+    const id = templateMap.gallery_created;
+    seedTranslations.push(
+      {
+        template_id: id, language: 'nl',
+        subject: 'Uw fotogalerij is klaar!',
+        body_html: `<h2>Galerij succesvol aangemaakt</h2>
+<p>Beste {{host_name}},</p>
+<p>Uw fotogalerij "{{event_name}}" is succesvol aangemaakt!</p>
+<p><strong>Galerij details:</strong></p>
+<ul>
+  <li>Evenementdatum: {{event_date}}</li>
+  <li>Galerij link: <a href="{{gallery_link}}">{{gallery_link}}</a></li>
+  <li>Wachtwoord: {{gallery_password}}</li>
+  <li>Verloopt op: {{expiry_date}}</li>
+</ul>
+<p>Deel deze link en het wachtwoord met uw gasten zodat zij de foto's kunnen bekijken en downloaden.</p>
+{{#if welcome_message}}<p><em>{{welcome_message}}</em></p>{{/if}}`,
+        body_text: `Galerij succesvol aangemaakt\n\nBeste {{host_name}},\n\nUw fotogalerij "{{event_name}}" is succesvol aangemaakt!\n\nGalerij link: {{gallery_link}}\nWachtwoord: {{gallery_password}}\nVerloopt op: {{expiry_date}}`,
+      },
+      {
+        template_id: id, language: 'pt',
+        subject: 'Sua galeria de fotos está pronta!',
+        body_html: `<h2>Galeria criada com sucesso</h2>
+<p>Prezado(a) {{host_name}},</p>
+<p>Sua galeria de fotos "{{event_name}}" foi criada com sucesso!</p>
+<p><strong>Detalhes da galeria:</strong></p>
+<ul>
+  <li>Data do evento: {{event_date}}</li>
+  <li>Link da galeria: <a href="{{gallery_link}}">{{gallery_link}}</a></li>
+  <li>Senha: {{gallery_password}}</li>
+  <li>Expira em: {{expiry_date}}</li>
+</ul>
+<p>Compartilhe este link e senha com seus convidados para que possam visualizar e baixar as fotos.</p>
+{{#if welcome_message}}<p><em>{{welcome_message}}</em></p>{{/if}}`,
+        body_text: `Galeria criada com sucesso\n\nPrezado(a) {{host_name}},\n\nSua galeria de fotos "{{event_name}}" foi criada com sucesso!\n\nLink da galeria: {{gallery_link}}\nSenha: {{gallery_password}}\nExpira em: {{expiry_date}}`,
+      },
+      {
+        template_id: id, language: 'ru',
+        subject: 'Ваша фотогалерея готова!',
+        body_html: `<h2>Галерея успешно создана</h2>
+<p>Уважаемый(ая) {{host_name}},</p>
+<p>Ваша фотогалерея "{{event_name}}" была успешно создана!</p>
+<p><strong>Детали галереи:</strong></p>
+<ul>
+  <li>Дата события: {{event_date}}</li>
+  <li>Ссылка на галерею: <a href="{{gallery_link}}">{{gallery_link}}</a></li>
+  <li>Пароль: {{gallery_password}}</li>
+  <li>Срок действия: {{expiry_date}}</li>
+</ul>
+<p>Поделитесь этой ссылкой и паролем с вашими гостями, чтобы они могли просматривать и скачивать фотографии.</p>
+{{#if welcome_message}}<p><em>{{welcome_message}}</em></p>{{/if}}`,
+        body_text: `Галерея успешно создана\n\nУважаемый(ая) {{host_name}},\n\nВаша фотогалерея "{{event_name}}" была успешно создана!\n\nСсылка: {{gallery_link}}\nПароль: {{gallery_password}}\nСрок действия: {{expiry_date}}`,
+      },
+    );
+  }
+
+  // --- expiration_warning ---
+  if (templateMap.expiration_warning) {
+    const id = templateMap.expiration_warning;
+    seedTranslations.push(
+      {
+        template_id: id, language: 'nl',
+        subject: 'Uw fotogalerij verloopt binnenkort',
+        body_html: `<h2>Galerij verloopt binnenkort</h2>
+<p>Beste {{host_name}},</p>
+<p>Uw fotogalerij "{{event_name}}" verloopt over {{days_remaining}} dagen.</p>
+<p>Na het verlopen wordt de galerij gearchiveerd en is niet meer toegankelijk voor gasten.</p>
+<p><a href="{{gallery_link}}">Galerij bezoeken</a></p>`,
+        body_text: `Galerij verloopt binnenkort\n\nBeste {{host_name}},\n\nUw fotogalerij "{{event_name}}" verloopt over {{days_remaining}} dagen.\n\nGalerij: {{gallery_link}}`,
+      },
+      {
+        template_id: id, language: 'pt',
+        subject: 'Sua galeria de fotos expira em breve',
+        body_html: `<h2>Galeria expirando em breve</h2>
+<p>Prezado(a) {{host_name}},</p>
+<p>Sua galeria de fotos "{{event_name}}" expirará em {{days_remaining}} dias.</p>
+<p>Após a expiração, a galeria será arquivada e não estará mais acessível aos convidados.</p>
+<p><a href="{{gallery_link}}">Visitar galeria</a></p>`,
+        body_text: `Galeria expirando em breve\n\nPrezado(a) {{host_name}},\n\nSua galeria de fotos "{{event_name}}" expirará em {{days_remaining}} dias.\n\nGaleria: {{gallery_link}}`,
+      },
+      {
+        template_id: id, language: 'ru',
+        subject: 'Срок действия вашей фотогалереи скоро истекает',
+        body_html: `<h2>Срок действия галереи истекает</h2>
+<p>Уважаемый(ая) {{host_name}},</p>
+<p>Срок действия вашей фотогалереи "{{event_name}}" истекает через {{days_remaining}} дней.</p>
+<p>После истечения срока галерея будет архивирована и станет недоступна для гостей.</p>
+<p><a href="{{gallery_link}}">Перейти в галерею</a></p>`,
+        body_text: `Срок действия галереи истекает\n\nУважаемый(ая) {{host_name}},\n\nСрок действия вашей фотогалереи "{{event_name}}" истекает через {{days_remaining}} дней.\n\nГалерея: {{gallery_link}}`,
+      },
+    );
+  }
+
+  // --- gallery_expired ---
+  if (templateMap.gallery_expired) {
+    const id = templateMap.gallery_expired;
+    seedTranslations.push(
+      {
+        template_id: id, language: 'nl',
+        subject: 'Uw fotogalerij {{event_name}} is verlopen',
+        body_html: `<h2>Galerij verlopen</h2>
+<p>Beste {{host_name}},</p>
+<p>Uw fotogalerij "{{event_name}}" is verlopen en niet meer toegankelijk.</p>
+<p>De foto's zijn gearchiveerd. Als u toegang nodig heeft, neem dan contact op met de beheerder via {{admin_email}}.</p>`,
+        body_text: `Galerij verlopen\n\nBeste {{host_name}},\n\nUw fotogalerij "{{event_name}}" is verlopen en niet meer toegankelijk.\n\nNeem contact op met: {{admin_email}}`,
+      },
+      {
+        template_id: id, language: 'pt',
+        subject: 'Sua galeria de fotos {{event_name}} expirou',
+        body_html: `<h2>Galeria expirada</h2>
+<p>Prezado(a) {{host_name}},</p>
+<p>Sua galeria de fotos "{{event_name}}" expirou e não está mais acessível.</p>
+<p>As fotos foram arquivadas. Se precisar de acesso, entre em contato com o administrador em {{admin_email}}.</p>`,
+        body_text: `Galeria expirada\n\nPrezado(a) {{host_name}},\n\nSua galeria de fotos "{{event_name}}" expirou e não está mais acessível.\n\nContato: {{admin_email}}`,
+      },
+      {
+        template_id: id, language: 'ru',
+        subject: 'Срок действия фотогалереи {{event_name}} истёк',
+        body_html: `<h2>Срок действия галереи истёк</h2>
+<p>Уважаемый(ая) {{host_name}},</p>
+<p>Срок действия вашей фотогалереи "{{event_name}}" истёк, и она больше недоступна.</p>
+<p>Фотографии были архивированы. Если вам нужен доступ, свяжитесь с администратором: {{admin_email}}.</p>`,
+        body_text: `Срок действия галереи истёк\n\nУважаемый(ая) {{host_name}},\n\nСрок действия вашей фотогалереи "{{event_name}}" истёк.\n\nКонтакт: {{admin_email}}`,
+      },
+    );
+  }
+
+  // --- archive_complete ---
+  if (templateMap.archive_complete) {
+    const id = templateMap.archive_complete;
+    seedTranslations.push(
+      {
+        template_id: id, language: 'nl',
+        subject: 'Archivering voltooid: {{event_name}}',
+        body_html: `<h2>Archivering voltooid</h2>
+<p>Beste {{host_name}},</p>
+<p>De fotogalerij "{{event_name}}" is succesvol gearchiveerd.</p>
+<p><strong>Archief details:</strong></p>
+<ul>
+  <li>Aantal foto's: {{photo_count}}</li>
+  <li>Archiefgrootte: {{archive_size}}</li>
+  <li>Archiefdatum: {{archive_date}}</li>
+</ul>`,
+        body_text: `Archivering voltooid\n\nBeste {{host_name}},\n\nDe fotogalerij "{{event_name}}" is succesvol gearchiveerd.\n\nAantal foto's: {{photo_count}}\nGrootte: {{archive_size}}`,
+      },
+      {
+        template_id: id, language: 'pt',
+        subject: 'Arquivamento concluído: {{event_name}}',
+        body_html: `<h2>Arquivamento concluído</h2>
+<p>Prezado(a) {{host_name}},</p>
+<p>A galeria de fotos "{{event_name}}" foi arquivada com sucesso.</p>
+<p><strong>Detalhes do arquivo:</strong></p>
+<ul>
+  <li>Número de fotos: {{photo_count}}</li>
+  <li>Tamanho do arquivo: {{archive_size}}</li>
+  <li>Data do arquivamento: {{archive_date}}</li>
+</ul>`,
+        body_text: `Arquivamento concluído\n\nPrezado(a) {{host_name}},\n\nA galeria de fotos "{{event_name}}" foi arquivada com sucesso.\n\nFotos: {{photo_count}}\nTamanho: {{archive_size}}`,
+      },
+      {
+        template_id: id, language: 'ru',
+        subject: 'Архивация завершена: {{event_name}}',
+        body_html: `<h2>Архивация завершена</h2>
+<p>Уважаемый(ая) {{host_name}},</p>
+<p>Фотогалерея "{{event_name}}" была успешно архивирована.</p>
+<p><strong>Детали архива:</strong></p>
+<ul>
+  <li>Количество фото: {{photo_count}}</li>
+  <li>Размер архива: {{archive_size}}</li>
+  <li>Дата архивации: {{archive_date}}</li>
+</ul>`,
+        body_text: `Архивация завершена\n\nУважаемый(ая) {{host_name}},\n\nФотогалерея "{{event_name}}" была успешно архивирована.\n\nФото: {{photo_count}}\nРазмер: {{archive_size}}`,
+      },
+    );
+  }
+
+  // Insert all seed translations
+  const now = new Date();
+  for (const trans of seedTranslations) {
+    trans.created_at = now;
+    trans.updated_at = now;
+    await knex('email_template_translations').insert(trans);
+  }
+
+  console.log(`Seeded ${seedTranslations.length} translations for customer-facing templates`);
+};
+
+exports.down = async function(knex) {
+  await knex.schema.dropTableIfExists('email_template_translations');
+};

backend/migrations/core/076_add_is_draft_column.js

@@ -0,0 +1,21 @@
+/**
+ * Migration to add is_draft column to events table.
+ * Draft events are not visible to gallery visitors until published.
+ */
+exports.up = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'is_draft');
+  if (!hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.boolean('is_draft').defaultTo(false);
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'is_draft');
+  if (hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('is_draft');
+    });
+  }
+};

backend/migrations/core/077_add_default_photo_sort.js

@@ -0,0 +1,17 @@
+exports.up = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'default_photo_sort');
+  if (!hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.string('default_photo_sort', 50).defaultTo('upload_date_desc');
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'default_photo_sort');
+  if (hasColumn) {
+    await knex.schema.alterTable('events', (table) => {
+      table.dropColumn('default_photo_sort');
+    });
+  }
+};

backend/migrations/core/078_add_guest_identity.js

@@ -0,0 +1,120 @@
+/**
+ * Add guest identity layer for per-person photo selections (issue #292).
+ *
+ * Adds:
+ *   - gallery_guests              — persistent guest profiles per event
+ *   - guest_invites               — pre-minted invite tokens (Phase 3.3)
+ *   - guest_verification_codes    — email-based identity recovery (Phase 3.2)
+ *   - event_feedback_settings.identity_mode ('simple' | 'guest', default 'simple')
+ *   - photo_feedback.guest_id FK  — links feedback to gallery_guests (nullable)
+ *
+ * All changes are additive. Existing events default to 'simple' mode so behavior
+ * is unchanged. Legacy photo_feedback rows keep NULL guest_id.
+ */
+
+exports.up = async function(knex) {
+  // 1. gallery_guests — persistent per-person identity within an event.
+  const hasGalleryGuests = await knex.schema.hasTable('gallery_guests');
+  if (!hasGalleryGuests) {
+    await knex.schema.createTable('gallery_guests', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable().references('id').inTable('events').onDelete('CASCADE');
+      table.string('name', 100).notNullable();
+      table.string('email', 255);
+      table.string('identifier', 64).notNullable(); // UUIDv4 issued server-side
+      table.string('ip_address_last', 45);
+      table.text('user_agent_last');
+      table.timestamp('email_verified_at');
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('last_seen_at').defaultTo(knex.fn.now());
+      table.boolean('is_deleted').defaultTo(false);
+
+      table.unique(['event_id', 'identifier']);
+      table.index(['event_id']);
+      table.index(['event_id', 'email']);
+    });
+  }
+
+  // 2. guest_invites — pre-minted one-time-use tokens for invited guests.
+  const hasGuestInvites = await knex.schema.hasTable('guest_invites');
+  if (!hasGuestInvites) {
+    await knex.schema.createTable('guest_invites', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable().references('id').inTable('events').onDelete('CASCADE');
+      table.integer('guest_id').notNullable().references('id').inTable('gallery_guests').onDelete('CASCADE');
+      table.string('token', 64).notNullable().unique();
+      table.integer('created_by_admin_id').references('id').inTable('admin_users');
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('redeemed_at');
+      table.timestamp('revoked_at');
+
+      table.index(['event_id']);
+      table.index(['guest_id']);
+    });
+  }
+
+  // 3. guest_verification_codes — short-lived codes for email-based recovery.
+  const hasGuestVerificationCodes = await knex.schema.hasTable('guest_verification_codes');
+  if (!hasGuestVerificationCodes) {
+    await knex.schema.createTable('guest_verification_codes', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable().references('id').inTable('events').onDelete('CASCADE');
+      table.string('email', 255).notNullable();
+      table.string('code_hash', 128).notNullable(); // bcrypt hash of 6-digit code
+      table.integer('attempts').defaultTo(0);
+      table.timestamp('expires_at').notNullable();
+      table.timestamp('consumed_at');
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+
+      table.index(['event_id', 'email']);
+      table.index(['expires_at']);
+    });
+  }
+
+  // 4. event_feedback_settings.identity_mode
+  const hasIdentityMode = await knex.schema.hasColumn('event_feedback_settings', 'identity_mode');
+  if (!hasIdentityMode) {
+    await knex.schema.alterTable('event_feedback_settings', (table) => {
+      table.string('identity_mode', 16).notNullable().defaultTo('simple');
+    });
+    if (knex.client.config.client === 'pg') {
+      await knex.raw(`
+        ALTER TABLE event_feedback_settings
+        ADD CONSTRAINT event_feedback_settings_identity_mode_check
+        CHECK (identity_mode IN ('simple','guest'))
+      `);
+    }
+  }
+
+  // 5. photo_feedback.guest_id FK
+  const hasGuestIdColumn = await knex.schema.hasColumn('photo_feedback', 'guest_id');
+  if (!hasGuestIdColumn) {
+    await knex.schema.alterTable('photo_feedback', (table) => {
+      table.integer('guest_id').references('id').inTable('gallery_guests').onDelete('SET NULL');
+      table.index(['guest_id']);
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  const hasGuestIdColumn = await knex.schema.hasColumn('photo_feedback', 'guest_id');
+  if (hasGuestIdColumn) {
+    await knex.schema.alterTable('photo_feedback', (table) => {
+      table.dropColumn('guest_id');
+    });
+  }
+
+  if (knex.client.config.client === 'pg') {
+    await knex.raw('ALTER TABLE event_feedback_settings DROP CONSTRAINT IF EXISTS event_feedback_settings_identity_mode_check');
+  }
+  const hasIdentityMode = await knex.schema.hasColumn('event_feedback_settings', 'identity_mode');
+  if (hasIdentityMode) {
+    await knex.schema.alterTable('event_feedback_settings', (table) => {
+      table.dropColumn('identity_mode');
+    });
+  }
+
+  await knex.schema.dropTableIfExists('guest_verification_codes');
+  await knex.schema.dropTableIfExists('guest_invites');
+  await knex.schema.dropTableIfExists('gallery_guests');
+};

backend/migrations/legacy/006_add_photo_counter_to_categories.js

@@ -1,22 +1,27 @@
 exports.up = async function(knex) {
-  // Add photo_counter column to photo_categories table
-  await knex.schema.alterTable('photo_categories', function(table) {
-    table.integer('photo_counter').defaultTo(0).notNullable();
-  });
+  // Check if photo_counter column already exists to make migration idempotent
+  const hasPhotoCounter = await knex.schema.hasColumn('photo_categories', 'photo_counter');
 
-  // Initialize counters based on existing photos
-  const categories = await knex('photo_categories').select('id');
-  
-  for (const category of categories) {
-    const photoCount = await knex('photos')
-      .where('category_id', category.id)
-      .count('id as count')
-      .first();
-    
-    if (photoCount && photoCount.count > 0) {
-      await knex('photo_categories')
-        .where('id', category.id)
-        .update({ photo_counter: photoCount.count });
+  if (!hasPhotoCounter) {
+    // Add photo_counter column to photo_categories table
+    await knex.schema.alterTable('photo_categories', function(table) {
+      table.integer('photo_counter').defaultTo(0).notNullable();
+    });
+
+    // Initialize counters based on existing photos
+    const categories = await knex('photo_categories').select('id');
+
+    for (const category of categories) {
+      const photoCount = await knex('photos')
+        .where('category_id', category.id)
+        .count('id as count')
+        .first();
+
+      if (photoCount && photoCount.count > 0) {
+        await knex('photo_categories')
+          .where('id', category.id)
+          .update({ photo_counter: photoCount.count });
+      }
     }
   }
 };

backend/migrations/legacy/008_add_language_support_to_email_templates.js

@@ -1,23 +1,33 @@
 exports.up = async function(knex) {
-  // Add language-specific columns to email_templates
-  await knex.schema.alterTable('email_templates', function(table) {
-    // Add English versions (rename existing columns for consistency)
-    table.renameColumn('subject', 'subject_en');
-    table.renameColumn('body_html', 'body_html_en');
-    table.renameColumn('body_text', 'body_text_en');
-    
-    // Add German versions
-    table.string('subject_de');
-    table.text('body_html_de');
-    table.text('body_text_de');
-  });
+  // Check which columns already exist to make migration idempotent
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubjectDe = await knex.schema.hasColumn('email_templates', 'subject_de');
+  const hasSubjectOriginal = await knex.schema.hasColumn('email_templates', 'subject');
 
-  // Copy existing values to German columns as defaults
-  await knex('email_templates').update({
-    subject_de: knex.raw('subject_en'),
-    body_html_de: knex.raw('body_html_en'),
-    body_text_de: knex.raw('body_text_en')
-  });
+  // Only rename columns if they haven't been renamed yet
+  if (hasSubjectOriginal && !hasSubjectEn) {
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.renameColumn('subject', 'subject_en');
+      table.renameColumn('body_html', 'body_html_en');
+      table.renameColumn('body_text', 'body_text_en');
+    });
+  }
+
+  // Only add German columns if they don't exist
+  if (!hasSubjectDe) {
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.string('subject_de');
+      table.text('body_html_de');
+      table.text('body_text_de');
+    });
+
+    // Copy existing values to German columns as defaults
+    await knex('email_templates').update({
+      subject_de: knex.raw('subject_en'),
+      body_html_de: knex.raw('body_html_en'),
+      body_text_de: knex.raw('body_text_en')
+    });
+  }
 };
 
 exports.down = async function(knex) {

backend/migrations/legacy/011_add_user_upload_settings.js

@@ -1,23 +1,56 @@
 exports.up = async function(knex) {
-  // Add user upload settings to events table
-  await knex.schema.alterTable('events', function(table) {
-    table.boolean('allow_user_uploads').defaultTo(false);
-    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
-  });
-  
+  // Add user upload settings to events table (check if columns exist first)
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (!hasAllowUserUploads) {
+    console.log('Adding allow_user_uploads column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.boolean('allow_user_uploads').defaultTo(false);
+    });
+  } else {
+    console.log('Column allow_user_uploads already exists in events table, skipping...');
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (!hasUploadCategoryId) {
+    console.log('Adding upload_category_id column to events table...');
+    await knex.schema.alterTable('events', function(table) {
+      table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
+    });
+  } else {
+    console.log('Column upload_category_id already exists in events table, skipping...');
+  }
+
   // Add uploaded_by field to photos table to track who uploaded
-  await knex.schema.alterTable('photos', function(table) {
-    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
-  });
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (!hasUploadedBy) {
+    console.log('Adding uploaded_by column to photos table...');
+    await knex.schema.alterTable('photos', function(table) {
+      table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
+    });
+  } else {
+    console.log('Column uploaded_by already exists in photos table, skipping...');
+  }
 };
 
 exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
-    table.dropColumn('allow_user_uploads');
-    table.dropColumn('upload_category_id');
-  });
-  
-  await knex.schema.alterTable('photos', function(table) {
-    table.dropColumn('uploaded_by');
-  });
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
+  if (hasAllowUserUploads) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('allow_user_uploads');
+    });
+  }
+
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
+  if (hasUploadCategoryId) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('upload_category_id');
+    });
+  }
+
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
+  if (hasUploadedBy) {
+    await knex.schema.alterTable('photos', function(table) {
+      table.dropColumn('uploaded_by');
+    });
+  }
 };

backend/migrations/run-migrations-safe.js

@@ -67,26 +67,37 @@ async function runMigrationSafely(filepath) {
     const migrationPath = path.join(__dirname, filepath);
     const migration = require(migrationPath);
     const filename = path.basename(filepath);
-    
+
     if (migration.up) {
       console.log(`Running migration: ${filepath}`);
-      
+
       // Run migration in a transaction if possible
+      // IMPORTANT: Include the migrations table insert INSIDE the transaction
+      // to ensure atomicity between schema changes and tracking
       if (db.client.config.client === 'pg') {
         await db.transaction(async (trx) => {
           await migration.up(trx);
+          // Insert migration record inside transaction for atomicity
+          await trx('migrations').insert({ filename });
         });
       } else {
         await migration.up(db);
+        await db('migrations').insert({ filename });
       }
-      
-      await db('migrations').insert({ filename });
+
       console.log(`Migration ${filepath} completed successfully`);
     }
   } catch (error) {
     // Check if error is because schema already exists
-    if (error.code === '42P07' || // PostgreSQL: relation already exists
-        error.code === 'SQLITE_ERROR' && error.message.includes('already exists')) {
+    // PostgreSQL error codes:
+    // - 42P07: duplicate_table (relation already exists)
+    // - 42701: duplicate_column (column already exists)
+    // - 42710: duplicate_object (constraint, index, etc. already exists)
+    // - 23505: unique_violation (migration record already exists)
+    const schemaExistsErrors = ['42P07', '42701', '42710', '23505'];
+    const isSQLiteAlreadyExists = error.code === 'SQLITE_ERROR' && error.message.includes('already exists');
+
+    if (schemaExistsErrors.includes(error.code) || isSQLiteAlreadyExists) {
       console.log(`Migration ${filepath} - schema already exists, marking as applied`);
       await markMigrationAsApplied(path.basename(filepath));
     } else {

backend/migrations/run-migrations.js

@@ -26,11 +26,22 @@ async function runMigration(filepath) {
   const migrationPath = path.join(__dirname, filepath);
   const migration = require(migrationPath);
   const filename = path.basename(filepath);
-  
+
   if (migration.up) {
     console.log(`Running migration: ${filepath}`);
-    await migration.up(db);
-    await db('migrations').insert({ filename });
+
+    // Run migration in a transaction if PostgreSQL to ensure atomicity
+    // between schema changes and migration tracking
+    if (db.client.config.client === 'pg') {
+      await db.transaction(async (trx) => {
+        await migration.up(trx);
+        await trx('migrations').insert({ filename });
+      });
+    } else {
+      await migration.up(db);
+      await db('migrations').insert({ filename });
+    }
+
     console.log(`Migration ${filepath} completed`);
   }
 }

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.1.5",
+  "version": "3.28.3-beta.0",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -8,6 +8,7 @@
     "dev": "nodemon server.js",
     "migrate": "node migrations/run-migrations.js",
     "migrate:safe": "node migrations/run-migrations-safe.js",
+    "generate:watermarks": "node scripts/generate-watermarks.js",
     "test": "jest",
     "lint": "eslint src/"
   },
@@ -15,31 +16,35 @@
     "@aws-sdk/client-s3": "^3.850.0",
     "@aws-sdk/lib-storage": "^3.850.0",
     "@aws-sdk/s3-request-presigner": "^3.850.0",
+    "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
-    "axios": "^1.12.2",
+    "axios": "1.14.0",
     "bcrypt": "6.0.0",
     "chokidar": "4.0.3",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
+    "exifr": "^7.1.3",
     "express": "^4.18.2",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
+    "fluent-ffmpeg": "^2.1.3",
     "form-data": "^4.0.4",
-    "handlebars": "^4.7.8",
+    "handlebars": "^4.7.9",
     "helmet": "^7.0.0",
     "i18next": "25.3.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
+    "ipaddr.js": "^2.3.0",
     "joi": "^17.9.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
     "multer": "^2.0.2",
     "node-cron": "^3.0.2",
-    "nodemailer": "^7.0.10",
+    "nodemailer": "^7.0.13",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
     "sanitize-html": "^2.17.0",
@@ -55,5 +60,19 @@
     "mock-fs": "^5.5.0",
     "nodemon": "^3.1.10",
     "supertest": "^6.3.3"
+  },
+  "overrides": {
+    "prebuild-install": {
+      "tar-fs": "2.1.4"
+    },
+    "glob": "^11.1.0",
+    "js-yaml": "^4.1.1",
+    "fast-xml-parser": ">=5.5.10",
+    "qs": ">=6.14.2",
+    "tar": ">=7.5.13",
+    "brace-expansion": ">=5.0.5",
+    "minimatch": ">=9.0.7",
+    "path-to-regexp": "0.1.13",
+    "lodash": ">=4.18.1"
   }
 }

backend/scripts/create-admin.js

@@ -44,28 +44,39 @@ async function createAdmin() {
       .orWhere('username', username)
       .first();
 
-    if (existingUser) {
-      console.error(`Error: User with email "${email}" or username "${username}" already exists`);
-      process.exit(1);
-    }
-
     // Hash password
     const passwordHash = await bcrypt.hash(password, 10);
 
-    // Create admin user
-    await db('admin_users').insert({
-      username,
-      email,
-      password_hash: passwordHash,
-      is_active: true,
-      created_at: new Date(),
-      updated_at: new Date()
-    });
+    if (existingUser) {
+      // Update existing user's password
+      await db('admin_users')
+        .where('id', existingUser.id)
+        .update({
+          password_hash: passwordHash,
+          updated_at: new Date()
+        });
 
-    console.log(`✅ Admin user created successfully!`);
-    console.log(`   Email: ${email}`);
-    console.log(`   Username: ${username}`);
-    console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+      console.log(`✅ Admin user updated successfully!`);
+      console.log(`   Email: ${existingUser.email}`);
+      console.log(`   Username: ${existingUser.username}`);
+      console.log(`   Password has been reset to the provided value`);
+      console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    } else {
+      // Create new admin user
+      await db('admin_users').insert({
+        username,
+        email,
+        password_hash: passwordHash,
+        is_active: true,
+        created_at: new Date(),
+        updated_at: new Date()
+      });
+
+      console.log(`✅ Admin user created successfully!`);
+      console.log(`   Email: ${email}`);
+      console.log(`   Username: ${username}`);
+      console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    }
     
     process.exit(0);
   } catch (error) {

backend/scripts/generate-watermarks.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+
+/**
+ * Script to generate pre-watermarked versions for existing photos
+ * This is a one-time migration script to populate watermarks for photos
+ * that existed before the pre-generation feature was implemented.
+ *
+ * Usage: node scripts/generate-watermarks.js [eventId]
+ *
+ * Options:
+ *   eventId - Optional: Only generate watermarks for a specific event
+ *
+ * Examples:
+ *   node scripts/generate-watermarks.js          # Generate for all photos
+ *   node scripts/generate-watermarks.js 5        # Generate for event ID 5
+ */
+
+const path = require('path');
+const { db } = require('../src/database/db');
+const watermarkService = require('../src/services/watermarkService');
+const watermarkGeneratorService = require('../src/services/watermarkGeneratorService');
+
+async function generateWatermarks(eventId = null) {
+  try {
+    console.log('='.repeat(60));
+    console.log('PicPeak Watermark Generation Script');
+    console.log('='.repeat(60));
+
+    // Check if watermarking is enabled
+    const settings = await watermarkService.getWatermarkSettings();
+
+    if (!settings || !settings.enabled) {
+      console.log('\nWatermarking is currently DISABLED in settings.');
+      console.log('Enable watermarking in Admin > Branding settings first.');
+      console.log('Exiting without generating watermarks.');
+      process.exit(0);
+    }
+
+    console.log('\nWatermark Settings:');
+    console.log(`  Enabled: ${settings.enabled}`);
+    console.log(`  Position: ${settings.position}`);
+    console.log(`  Opacity: ${settings.opacity}%`);
+    console.log(`  Size: ${settings.size}%`);
+    console.log(`  Logo: ${settings.logoPath || '(using text fallback)'}`);
+
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .whereNull('photos.watermark_path')
+      .whereNot(function() {
+        this.where('photos.media_type', 'video')
+          .orWhere('photos.mime_type', 'like', 'video/%');
+      })
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.event_id',
+        'events.event_name'
+      );
+
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`\nFiltering to event ID: ${eventId}`);
+    }
+
+    const photos = await query;
+
+    if (photos.length === 0) {
+      console.log('\nNo photos found without watermarks.');
+      if (eventId) {
+        console.log(`(Checked event ID: ${eventId})`);
+      }
+      console.log('All photos already have pre-generated watermarks or watermarking is disabled.');
+      process.exit(0);
+    }
+
+    console.log(`\nFound ${photos.length} photos without watermarks.`);
+
+    // Group by event for display
+    const eventCounts = {};
+    photos.forEach(p => {
+      eventCounts[p.event_name] = (eventCounts[p.event_name] || 0) + 1;
+    });
+
+    console.log('\nPhotos by event:');
+    Object.entries(eventCounts).forEach(([name, count]) => {
+      console.log(`  ${name}: ${count} photos`);
+    });
+
+    console.log('\nStarting watermark generation...\n');
+
+    let successCount = 0;
+    let failCount = 0;
+    const startTime = Date.now();
+
+    // Process photos with progress display
+    for (let i = 0; i < photos.length; i++) {
+      const photo = photos[i];
+      const progress = Math.round(((i + 1) / photos.length) * 100);
+
+      process.stdout.write(`\r[${progress}%] Processing photo ${i + 1}/${photos.length}: ${photo.filename.substring(0, 30)}...`);
+
+      try {
+        const result = await watermarkGeneratorService.generateForPhoto(photo.id);
+
+        if (result.success) {
+          successCount++;
+        } else {
+          failCount++;
+          console.log(`\n  Failed: ${photo.filename} - ${result.error}`);
+        }
+      } catch (error) {
+        failCount++;
+        console.log(`\n  Error: ${photo.filename} - ${error.message}`);
+      }
+    }
+
+    const duration = ((Date.now() - startTime) / 1000).toFixed(1);
+
+    console.log('\n');
+    console.log('='.repeat(60));
+    console.log('Watermark Generation Complete');
+    console.log('='.repeat(60));
+    console.log(`  Total processed: ${photos.length}`);
+    console.log(`  Successful: ${successCount}`);
+    console.log(`  Failed: ${failCount}`);
+    console.log(`  Duration: ${duration} seconds`);
+    console.log(`  Average: ${(photos.length / parseFloat(duration)).toFixed(1)} photos/second`);
+
+    if (failCount > 0) {
+      console.log('\nSome watermarks failed to generate. Check the errors above.');
+      console.log('You can re-run this script to retry failed photos.');
+    }
+
+    process.exit(failCount > 0 ? 1 : 0);
+  } catch (error) {
+    console.error('\nFatal error:', error.message);
+    console.error(error.stack);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const eventId = args[0] ? parseInt(args[0], 10) : null;
+
+if (args[0] && isNaN(eventId)) {
+  console.error('Error: eventId must be a number');
+  console.log('Usage: node scripts/generate-watermarks.js [eventId]');
+  process.exit(1);
+}
+
+// Run the script
+generateWatermarks(eventId)
+  .then(() => {
+    process.exit(0);
+  })
+  .catch(error => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+  });

backend/scripts/set-admin-password.js

@@ -1,5 +1,15 @@
 #!/usr/bin/env node
 
+/**
+ * Script to set/reset admin password
+ *
+ * Usage:
+ *   node set-admin-password.js <new-password>
+ *   node set-admin-password.js --env  (uses ADMIN_PASSWORD environment variable)
+ *
+ * Security: Password must be at least 8 characters with mixed case, numbers, and special characters
+ */
+
 const bcrypt = require('bcrypt');
 const path = require('path');
 require('dotenv').config({ path: path.join(__dirname, '../.env') });
@@ -16,22 +26,108 @@ const db = knex({
   }
 });
 
+/**
+ * Validate password strength
+ */
+function validatePassword(password) {
+  if (!password || password.length < 8) {
+    return { valid: false, error: 'Password must be at least 8 characters long' };
+  }
+  if (!/[a-z]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one lowercase letter' };
+  }
+  if (!/[A-Z]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one uppercase letter' };
+  }
+  if (!/[0-9]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one number' };
+  }
+  if (!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)) {
+    return { valid: false, error: 'Password must contain at least one special character' };
+  }
+  return { valid: true };
+}
+
+function printUsage() {
+  console.log(`
+Usage:
+  node set-admin-password.js <new-password>
+  node set-admin-password.js --env
+
+Options:
+  <new-password>  The new password to set (must meet security requirements)
+  --env           Use ADMIN_PASSWORD environment variable
+
+Security Requirements:
+  - At least 8 characters
+  - At least one lowercase letter
+  - At least one uppercase letter
+  - At least one number
+  - At least one special character (!@#$%^&*()_+-=[]{}|;':\",./<>?)
+
+Examples:
+  node set-admin-password.js "MySecure@Pass123"
+  ADMIN_PASSWORD="MySecure@Pass123" node set-admin-password.js --env
+`);
+}
+
 async function setAdminPassword() {
   try {
-    const password = 'admin123';
-    const hashedPassword = await bcrypt.hash(password, 10);
-    
-    await db('admin_users')
+    // Get password from argument or environment
+    const args = process.argv.slice(2);
+    let password;
+
+    if (args.length === 0) {
+      console.error('❌ Error: No password provided\n');
+      printUsage();
+      process.exit(1);
+    }
+
+    if (args[0] === '--env') {
+      password = process.env.ADMIN_PASSWORD;
+      if (!password) {
+        console.error('❌ Error: ADMIN_PASSWORD environment variable not set');
+        process.exit(1);
+      }
+    } else if (args[0] === '--help' || args[0] === '-h') {
+      printUsage();
+      process.exit(0);
+    } else {
+      password = args[0];
+    }
+
+    // Validate password strength
+    const validation = validatePassword(password);
+    if (!validation.valid) {
+      console.error(`❌ Error: ${validation.error}`);
+      process.exit(1);
+    }
+
+    // Hash password
+    const hashedPassword = await bcrypt.hash(password, 12);
+
+    // Update database
+    const updated = await db('admin_users')
       .where('username', 'admin')
       .update({
         password_hash: hashedPassword,
+        password_changed_at: new Date(),
         updated_at: new Date()
       });
-    
-    console.log('✅ Admin password set to: admin123');
+
+    if (updated === 0) {
+      console.error('❌ Error: Admin user not found');
+      process.exit(1);
+    }
+
+    console.log('✅ Admin password updated successfully');
+    console.log('   Note: All existing sessions have been invalidated');
+
+    await db.destroy();
     process.exit(0);
   } catch (error) {
-    console.error('❌ Error setting password:', error);
+    console.error('❌ Error setting password:', error.message);
+    await db.destroy();
     process.exit(1);
   }
 }

backend/scripts/show-admin-credentials.js

@@ -36,12 +36,14 @@ async function showAdminCredentials(resetPassword = false) {
         .where('id', admin.id)
         .update({
           password_hash: passwordHash,
+          must_change_password: true,
           updated_at: new Date()
         });
-      
-      // Password logging removed for security - check logs or database if needed
-      console.log('Password: [NEWLY RESET - stored in database]');
-      console.log('\n⚠️  IMPORTANT: New password has been set in database!');
+
+      console.log(`Password: ${newPassword}`);
+      console.log('\n⚠️  IMPORTANT:');
+      console.log('1. Save this password securely - it will not be shown again');
+      console.log('2. You will be required to change it on next login');
     } else {
       console.log('Password: [hidden - use --reset flag to generate new password]');
     }

backend/server.js

@@ -25,6 +25,7 @@ const { startBackupService } = require('./src/services/backupService');
 const { startScheduledBackups } = require('./src/services/databaseBackup');
 const { maintenanceMiddleware } = require('./src/middleware/maintenance');
 const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
+const { errorHandler, notFoundHandler } = require('./src/middleware/errorHandler');
 const { createRateLimiter, createAuthRateLimiter } = require('./src/services/rateLimitService');
 const { getPublicSitePayload } = require('./src/services/publicSiteService');
 const cookieParser = require('cookie-parser');
@@ -34,7 +35,7 @@ const {
 } = require('./src/utils/tokenUtils');
 
 // Import routes
-const authRoutes = require('./src/routes/auth-enhanced');
+const authRoutes = require('./src/routes/auth');
 const eventRoutes = require('./src/routes/events');
 const galleryRoutes = require('./src/routes/gallery');
 const adminRoutes = require('./src/routes/admin');
@@ -193,13 +194,23 @@ function composeInlineStyles(payload) {
   return cssSegments.join('\n\n');
 }
 
+function escapeHtml(str) {
+  if (!str) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 function renderBrandHeader(branding) {
-  const displayName = branding.companyName || 'PicPeak';
-  const logoSrc = branding.logoUrl || '/picpeak-logo-transparent.png';
+  const displayName = escapeHtml(branding.companyName || 'PicPeak');
+  const logoSrc = encodeURI(branding.logoUrl || '/picpeak-logo-transparent.png');
   const logo = `<img src="${logoSrc}" alt="${displayName}" class="brand-logo" loading="lazy" decoding="async" />`;
 
   const tagline = branding.companyTagline
-    ? `<p class="brand-tagline">${branding.companyTagline}</p>`
+    ? `<p class="brand-tagline">${escapeHtml(branding.companyTagline)}</p>`
     : '';
 
   return `<header class="site-header">
@@ -223,13 +234,14 @@ function renderBrandHeader(branding) {
 }
 
 function renderBrandFooter(branding) {
-  const displayName = branding.companyName || 'PicPeak';
+  const displayName = escapeHtml(branding.companyName || 'PicPeak');
   const footerNote = branding.footerText
-    ? `<p>${branding.footerText}</p>`
+    ? `<p>${escapeHtml(branding.footerText)}</p>`
     : '<p>Powered by PicPeak to keep every celebration beautifully organised.</p>';
 
-  const supportLink = branding.supportEmail
-    ? `<a href="mailto:${branding.supportEmail}">Support</a>`
+  const supportEmail = escapeHtml(branding.supportEmail || '');
+  const supportLink = supportEmail
+    ? `<a href="mailto:${supportEmail}">Support</a>`
     : '';
 
   const legalLinks = `
@@ -251,10 +263,29 @@ function renderBrandFooter(branding) {
 </footer>`;
 }
 
+function buildSeoMetaTags(seoSettings) {
+  const tags = [];
+  const robotsDirectives = [];
+
+  if (seoSettings.seo_meta_noindex) robotsDirectives.push('noindex');
+  if (seoSettings.seo_meta_nofollow) robotsDirectives.push('nofollow');
+
+  if (robotsDirectives.length > 0) {
+    tags.push(`<meta name="robots" content="${robotsDirectives.join(', ')}" />`);
+  }
+
+  if (seoSettings.seo_meta_noai) {
+    tags.push('<meta name="robots" content="noai, noimageai" />');
+  }
+
+  return tags.join('\n  ');
+}
+
 function buildPublicSiteDocument(payload) {
   const inlineStyles = composeInlineStyles(payload);
   const header = renderBrandHeader(payload.branding);
   const footer = renderBrandFooter(payload.branding);
+  const seoMeta = payload.seoSettings ? buildSeoMetaTags(payload.seoSettings) : '';
 
   return `<!DOCTYPE html>
 <html lang="en">
@@ -262,8 +293,9 @@ function buildPublicSiteDocument(payload) {
   <meta charset="utf-8" />
   <meta http-equiv="X-UA-Compatible" content="IE=edge" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${payload.title}</title>
+  <title>${escapeHtml(payload.title)}</title>
   <meta name="description" content="Curated photo galleries and stories from unforgettable celebrations." />
+  ${seoMeta}
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
@@ -295,6 +327,21 @@ async function handlePublicSiteRequest(req, res, next) {
       return;
     }
 
+    // Inject SEO meta settings into payload
+    try {
+      const seoRows = await db('app_settings')
+        .where('setting_type', 'seo')
+        .whereIn('setting_key', ['seo_meta_noindex', 'seo_meta_nofollow', 'seo_meta_noai'])
+        .select('setting_key', 'setting_value');
+      const seoSettings = {};
+      for (const row of seoRows) {
+        let val = row.setting_value;
+        if (typeof val === 'string') { try { val = JSON.parse(val); } catch {} }
+        seoSettings[row.setting_key] = val;
+      }
+      payload.seoSettings = seoSettings;
+    } catch {}
+
     const document = buildPublicSiteDocument(payload);
 
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
@@ -323,10 +370,22 @@ async function initializeRateLimiters() {
 }
 
 // Note: Rate limiters will be initialized after database connection
+app.use(express.json({ limit: '50mb' }));
+app.use(express.urlencoded({ extended: true, limit: '50mb' }));
 
-// Body parsing middleware with increased limits for large uploads
-app.use(express.json({ limit: '100mb' }));
-app.use(express.urlencoded({ extended: true, limit: '100mb' }));
+// CSRF protection: require JSON Content-Type on mutating API requests
+// This blocks cross-origin form submissions which cannot set Content-Type: application/json
+app.use('/api', (req, res, next) => {
+  if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) {
+    const contentType = req.headers['content-type'] || '';
+    const contentLength = parseInt(req.headers['content-length'] || '0', 10);
+    // Allow empty-body requests (e.g. logout), multipart for uploads, and JSON for API calls
+    if (contentLength > 0 && !contentType.includes('application/json') && !contentType.includes('multipart/form-data')) {
+      return res.status(415).json({ error: 'Unsupported Content-Type. Use application/json or multipart/form-data.' });
+    }
+  }
+  next();
+});
 
 // Request logging for API routes (with timestamps)
 const apiRequestLogger = (req, res, next) => {
@@ -352,8 +411,23 @@ app.use('/api/admin', sessionTimeoutMiddleware);
 
 // Middleware to set CORS headers for static files
 const setCorsHeaders = (req, res, next) => {
-  res.header('Access-Control-Allow-Origin', req.headers.origin || '*');
-  res.header('Access-Control-Allow-Credentials', 'true');
+  const origin = req.headers.origin;
+  const staticAllowedOrigins = [
+    process.env.FRONTEND_URL || 'http://localhost:3005',
+    process.env.ADMIN_URL || 'http://localhost:3005'
+  ];
+  if (process.env.NODE_ENV === 'development') {
+    staticAllowedOrigins.push(
+      'http://localhost:5173',
+      'http://localhost:3002',
+      'http://localhost:3001',
+      'http://localhost:3000'
+    );
+  }
+  if (origin && staticAllowedOrigins.indexOf(origin) !== -1) {
+    res.header('Access-Control-Allow-Origin', origin);
+    res.header('Access-Control-Allow-Credentials', 'true');
+  }
   res.header('Cross-Origin-Resource-Policy', 'cross-origin');
   next();
 };
@@ -396,24 +470,37 @@ if (process.env.NODE_ENV === 'development') {
   });
 }
 
+// robots.txt endpoint (dynamic, served from DB settings)
+const { generateRobotsTxt } = require('./src/services/robotsTxtService');
+app.get('/robots.txt', async (req, res) => {
+  try {
+    const robotsTxt = await generateRobotsTxt();
+    res.setHeader('Content-Type', 'text/plain');
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.status(200).send(robotsTxt);
+  } catch (error) {
+    logger.error('Failed to generate robots.txt', { error: error.message });
+    // Safe default for a private photo platform
+    res.setHeader('Content-Type', 'text/plain');
+    res.status(200).send('User-agent: *\nDisallow: /\n');
+  }
+});
+
 // Health check endpoint
 app.get('/health', async (req, res) => {
   try {
     // Check database connectivity
     await db.raw('SELECT 1');
-    
-    res.json({ 
-      status: 'ok', 
-      database: 'connected',
-      timestamp: new Date().toISOString() 
+
+    res.json({
+      status: 'ok',
+      timestamp: new Date().toISOString()
     });
   } catch (error) {
     logger.error('Health check failed:', error);
-    res.status(503).json({ 
-      status: 'error', 
-      database: 'disconnected',
-      error: error.message,
-      timestamp: new Date().toISOString() 
+    res.status(503).json({
+      status: 'error',
+      timestamp: new Date().toISOString()
     });
   }
 });
@@ -425,15 +512,24 @@ app.use('/api/auth', authRoutes);
 // Gallery routes - main routes first, then feedback routes
 app.use('/api/gallery', galleryRoutes);
 app.use('/api/gallery', require('./src/routes/galleryFeedback'));
+app.use('/api/gallery', require('./src/routes/galleryGuests'));
 app.use('/api/admin', adminRoutes);
 app.use('/api/admin/auth', adminAuthRoutes);
 app.use('/api/admin/system', require('./src/routes/adminSystem'));
 app.use('/api/admin/backup', require('./src/routes/adminBackup'));
 app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
 app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
+app.use('/api/admin', require('./src/routes/adminGuests'));
 app.use('/api/admin/image-security', require('./src/routes/adminImageSecurity'));
 app.use('/api/admin/thumbnails', require('./src/routes/adminThumbnails'));
+app.use('/api/admin/photos', require('./src/routes/adminPhotoDimensions'));
 app.use('/api/admin/photos', require('./src/routes/adminPhotos'));
+app.use('/api/admin/photo-export', require('./src/routes/adminPhotoExport'));
+app.use('/api/admin/css-templates', require('./src/routes/adminCssTemplates'));
+app.use('/api/admin/events', require('./src/routes/adminEventRename'));
+app.use('/api/admin/users', require('./src/routes/adminUsers'));
+app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
+app.use('/api/invite', require('./src/routes/acceptInvite'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));
@@ -470,20 +566,11 @@ try {
   logger.warn('Failed to enable frontend static serving', { error: e.message });
 }
 
-// Error handling middleware
-app.use((err, req, res, next) => {
-  console.error('EXPRESS ERROR HANDLER:', err);
-  console.error('Error stack:', err.stack);
-  console.error('Request URL:', req.url);
-  console.error('Request method:', req.method);
-  logger.error('Express error handler:', {
-    message: err.message,
-    stack: err.stack,
-    url: req.url,
-    method: req.method
-  });
-  res.status(500).json({ error: 'Something went wrong!', details: err.message });
-});
+// 404 handler for undefined API routes
+app.use('/api', notFoundHandler);
+
+// Global error handler (must be last)
+app.use(errorHandler);
 
 // Initialize services
 async function startServer() {

backend/src/config/multerConfig.js

@@ -0,0 +1,255 @@
+/**
+ * Centralized Multer Configuration Factory
+ * Provides pre-configured multer instances for different upload scenarios
+ *
+ * @module config/multerConfig
+ */
+
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs');
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
+/**
+ * Get the storage path from environment or default
+ * @returns {string}
+ */
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+/**
+ * Default allowed MIME types for different upload types
+ */
+const ALLOWED_TYPES = {
+  photos: ['image/jpeg', 'image/png', 'image/webp', 'image/gif'],
+  videos: ['video/mp4', 'video/quicktime', 'video/x-msvideo', 'video/webm'],
+  media: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'video/mp4', 'video/quicktime', 'video/x-msvideo', 'video/webm'],
+  logos: ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'],
+  favicons: ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'],
+  documents: ['application/pdf', 'text/plain']
+};
+
+/**
+ * Default file size limits (in bytes)
+ */
+const SIZE_LIMITS = {
+  small: 1 * 1024 * 1024,      // 1MB
+  medium: 5 * 1024 * 1024,     // 5MB
+  large: 50 * 1024 * 1024,     // 50MB
+  xlarge: 500 * 1024 * 1024,   // 500MB
+  huge: 10 * 1024 * 1024 * 1024 // 10GB (for large videos)
+};
+
+/**
+ * Create a disk storage configuration
+ *
+ * @param {Object} options - Storage options
+ * @param {string} options.subdir - Subdirectory within storage path
+ * @param {Function} [options.filename] - Custom filename generator
+ * @param {boolean} [options.useTemp] - Use temp directory instead
+ * @returns {multer.StorageEngine}
+ */
+const createDiskStorage = (options = {}) => {
+  const { subdir, filename, useTemp = false } = options;
+
+  return multer.diskStorage({
+    destination: async (req, file, cb) => {
+      try {
+        let uploadDir;
+        if (useTemp) {
+          uploadDir = path.join(getStoragePath(), 'temp', `upload_${Date.now()}_${Math.random().toString(36).substring(7)}`);
+        } else {
+          uploadDir = path.join(getStoragePath(), subdir || 'uploads');
+        }
+        // Create directory synchronously to prevent race conditions
+        fs.mkdirSync(uploadDir, { recursive: true });
+        cb(null, uploadDir);
+      } catch (error) {
+        cb(error);
+      }
+    },
+    filename: filename || ((req, file, cb) => {
+      const uniqueSuffix = `${Date.now()}-${Math.random().toString(36).substring(7)}`;
+      const ext = path.extname(file.originalname);
+      const baseName = path.basename(file.originalname, ext).replace(/[^a-zA-Z0-9-_]/g, '_');
+      cb(null, `${baseName}-${uniqueSuffix}${ext}`);
+    })
+  });
+};
+
+/**
+ * Create a file filter function
+ *
+ * @param {string[]} allowedTypes - Array of allowed MIME types
+ * @param {Object} [options] - Filter options
+ * @param {boolean} [options.validateMagicNumbers] - Whether to validate file magic numbers
+ * @param {string[]} [options.skipMagicValidation] - MIME types to skip magic number validation for
+ * @returns {Function} Multer file filter function
+ */
+const createFileFilter = (allowedTypes, options = {}) => {
+  const { validateMagicNumbers = true, skipMagicValidation = [] } = options;
+
+  return (req, file, cb) => {
+    // Basic MIME type check
+    if (!allowedTypes.includes(file.mimetype)) {
+      return cb(new Error(`File type ${file.mimetype} not allowed. Allowed types: ${allowedTypes.join(', ')}`));
+    }
+
+    // Validate file type with magic numbers (if enabled and not skipped)
+    if (validateMagicNumbers && !skipMagicValidation.includes(file.mimetype)) {
+      if (validateFileType && !validateFileType(file.originalname, file.mimetype, allowedTypes)) {
+        return cb(new Error('File content does not match file type'));
+      }
+    }
+
+    cb(null, true);
+  };
+};
+
+/**
+ * Create a multer instance for photo uploads
+ *
+ * @param {Object} [options] - Override options
+ * @returns {multer.Multer}
+ */
+const createPhotoUploader = (options = {}) => {
+  const defaults = {
+    storage: createDiskStorage({ useTemp: true }),
+    limits: {
+      fileSize: options.maxSize || SIZE_LIMITS.huge,
+      files: options.maxFiles || 2000,
+      fieldSize: 10 * 1024 * 1024,
+      parts: 10000,
+      headerPairs: 2000
+    },
+    fileFilter: createFileFilter(ALLOWED_TYPES.media, {
+      validateMagicNumbers: true
+    })
+  };
+
+  return multer({ ...defaults, ...options });
+};
+
+/**
+ * Create a multer instance for logo uploads
+ *
+ * @param {Object} [options] - Override options
+ * @returns {multer.Multer}
+ */
+const createLogoUploader = (options = {}) => {
+  const defaults = {
+    storage: createDiskStorage({
+      subdir: 'uploads/logos',
+      filename: (req, file, cb) => {
+        const ext = path.extname(file.originalname);
+        cb(null, `logo-${Date.now()}${ext}`);
+      }
+    }),
+    limits: {
+      fileSize: options.maxSize || SIZE_LIMITS.medium
+    },
+    fileFilter: createFileFilter(ALLOWED_TYPES.logos, {
+      skipMagicValidation: ['image/svg+xml']
+    })
+  };
+
+  return multer({ ...defaults, ...options });
+};
+
+/**
+ * Create a multer instance for favicon uploads
+ *
+ * @param {Object} [options] - Override options
+ * @returns {multer.Multer}
+ */
+const createFaviconUploader = (options = {}) => {
+  const defaults = {
+    storage: createDiskStorage({
+      subdir: 'uploads/favicons',
+      filename: (req, file, cb) => {
+        const ext = path.extname(file.originalname);
+        cb(null, `favicon-${Date.now()}${ext}`);
+      }
+    }),
+    limits: {
+      fileSize: options.maxSize || SIZE_LIMITS.small
+    },
+    fileFilter: createFileFilter(ALLOWED_TYPES.favicons, {
+      skipMagicValidation: ['image/x-icon', 'image/vnd.microsoft.icon']
+    })
+  };
+
+  return multer({ ...defaults, ...options });
+};
+
+/**
+ * Create a multer instance for gallery user uploads
+ *
+ * @param {string} destDir - Destination directory
+ * @param {Object} [options] - Override options
+ * @returns {multer.Multer}
+ */
+const createGalleryUploader = (destDir, options = {}) => {
+  const defaults = {
+    dest: destDir,
+    limits: {
+      fileSize: options.maxSize || SIZE_LIMITS.large,
+      files: options.maxFiles || 10
+    },
+    fileFilter: createFileFilter(ALLOWED_TYPES.photos)
+  };
+
+  return multer({ ...defaults, ...options });
+};
+
+/**
+ * Create a custom multer instance
+ *
+ * @param {Object} config - Full multer configuration
+ * @returns {multer.Multer}
+ */
+const createCustomUploader = (config) => {
+  return multer(config);
+};
+
+/**
+ * Upload timeout middleware
+ *
+ * @param {number} [timeout=300000] - Timeout in milliseconds (default 5 minutes)
+ * @returns {Function} Express middleware
+ */
+const uploadTimeoutMiddleware = (timeout = 300000) => {
+  return (req, res, next) => {
+    req.setTimeout(timeout, () => {
+      console.error('Upload request timed out');
+      if (!res.headersSent) {
+        res.status(408).json({ error: 'Upload request timed out' });
+      }
+    });
+
+    res.setTimeout(timeout, () => {
+      console.error('Upload response timed out');
+    });
+
+    next();
+  };
+};
+
+module.exports = {
+  // Pre-configured uploaders
+  createPhotoUploader,
+  createLogoUploader,
+  createFaviconUploader,
+  createGalleryUploader,
+  createCustomUploader,
+
+  // Building blocks for custom configurations
+  createDiskStorage,
+  createFileFilter,
+
+  // Middleware
+  uploadTimeoutMiddleware,
+
+  // Constants
+  ALLOWED_TYPES,
+  SIZE_LIMITS
+};

backend/src/database/db.js

@@ -3,6 +3,7 @@ const path = require('path');
 const knex = require('knex');
 const knexConfig = require('../../knexfile');
 const logger = require('../utils/logger');
+const { extractShareToken } = require('../utils/shareLinkUtils');
 
 // Ensure SQLite directory exists when using file-based DB (native installs)
 try {
@@ -63,12 +64,16 @@ async function initializeDatabase() {
       table.string('event_type').notNullable();
       table.string('event_name').notNullable();
       table.date('event_date').notNullable();
+      table.string('customer_name');
+      table.string('customer_email');
       table.string('host_email').notNullable();
+      table.string('host_name');
       table.string('admin_email').notNullable();
       table.string('password_hash').notNullable();
       table.text('welcome_message');
       table.text('color_theme');
       table.string('share_link').unique().notNullable();
+      table.string('share_token').unique();
       table.datetime('created_at').defaultTo(db.fn.now());
       table.datetime('expires_at').notNullable();
       table.boolean('is_active').defaultTo(true);
@@ -99,12 +104,16 @@ async function initializeDatabase() {
             event_type TEXT NOT NULL,
             event_name TEXT NOT NULL,
             event_date DATE NOT NULL,
+            customer_name TEXT,
+            customer_email TEXT,
+            host_name TEXT,
             host_email TEXT NOT NULL,
             admin_email TEXT NOT NULL,
             password_hash TEXT NOT NULL,
             welcome_message TEXT,
             color_theme TEXT,
             share_link TEXT UNIQUE NOT NULL,
+            share_token TEXT UNIQUE,
             created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
             expires_at DATETIME NOT NULL,
             is_active BOOLEAN DEFAULT 1,
@@ -157,6 +166,37 @@ async function initializeDatabase() {
     }
   }
 
+  const hasShareTokenColumn = await db.schema.hasColumn('events', 'share_token');
+  if (!hasShareTokenColumn) {
+    await db.schema.table('events', (table) => {
+      table.string('share_token').unique();
+    });
+  }
+
+  const hasHostNameColumn = await db.schema.hasColumn('events', 'host_name');
+  if (!hasHostNameColumn) {
+    await db.schema.table('events', (table) => {
+      table.string('host_name');
+    });
+  }
+
+  try {
+    const eventsWithoutToken = await db('events')
+      .whereNull('share_token')
+      .select('id', 'share_link');
+
+    for (const event of eventsWithoutToken) {
+      const token = extractShareToken(event.share_link);
+      if (token) {
+        await db('events')
+          .where({ id: event.id })
+          .update({ share_token: token });
+      }
+    }
+  } catch (error) {
+    logger.warn('Share token backfill skipped', { error: error.message });
+  }
+
   // Photo metadata table
   const hasPhotosTable = await db.schema.hasTable('photos');
   if (!hasPhotosTable) {

backend/src/middleware/auth-enhanced-v2.js

@@ -1,169 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const { isTokenRevoked } = require('../utils/tokenRevocation');
-const logger = require('../utils/logger');
-const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
-
-/**
- * Enhanced admin authentication middleware with revocation checking
- */
-async function adminAuth(req, res, next) {
-  try {
-    const token = getAdminTokenFromRequest(req);
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      logger.warn('Revoked token used', {
-        userId: decoded.id,
-        tokenType: decoded.type
-      });
-      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'admin') {
-      logger.warn('Non-admin token used for admin endpoint', { 
-        userId: decoded.id,
-        tokenType: decoded.type 
-      });
-      return res.status(403).json({ error: 'Insufficient permissions' });
-    }
-    
-    // IP validation (optional - can be strict or just log)
-    const currentIp = req.ip || req.connection.remoteAddress;
-    if (decoded.ip && decoded.ip !== currentIp) {
-      logger.warn('Token used from different IP', {
-        userId: decoded.id,
-        tokenIp: decoded.ip,
-        currentIp: currentIp
-      });
-    }
-    
-    // Check if admin still exists and is active
-    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: formatBoolean(true) })
-      .first();
-    
-    if (!admin) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if password was changed after token was issued
-    if (admin.password_changed_at) {
-      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
-      if (decoded.iat < passwordChangedTime) {
-        logger.warn('Token used after password change', { userId: decoded.id });
-        return res.status(401).json({ 
-          error: 'Token invalid due to password change',
-          code: 'PASSWORD_CHANGED'
-        });
-      }
-    }
-    
-    // Add user info to request
-    req.admin = {
-      id: admin.id,
-      username: admin.username,
-      email: admin.email
-    };
-    req.token = token; // Store token for potential revocation
-    
-    next();
-  } catch (error) {
-    logger.error('Auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Enhanced gallery authentication middleware with revocation checking
- */
-async function galleryAuth(req, res, next) {
-  try {
-    const slug = req.params?.slug || req.requestedSlug;
-    const token = getGalleryTokenFromRequest(req, slug);
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid session' });
-    }
-    
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'gallery') {
-      return res.status(403).json({ error: 'Invalid access token' });
-    }
-    
-    // Check if event still exists and is active
-    const event = await db('events')
-      .where({ 
-        id: decoded.eventId, 
-        is_active: true, 
-        is_archived: false 
-      })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    // Check if gallery has expired
-    if (new Date(event.expires_at) < new Date()) {
-      return res.status(410).json({ 
-        error: 'Gallery has expired',
-        code: 'GALLERY_EXPIRED'
-      });
-    }
-    
-    // Add event info to request
-    req.event = event;
-    req.galleryToken = decoded;
-    req.token = token;
-    
-    next();
-  } catch (error) {
-    logger.error('Gallery auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-// Export other middleware functions from original file...
-module.exports = { 
-  adminAuth, 
-  galleryAuth,
-  // ... other exports
-};

backend/src/middleware/auth-enhanced.js

@@ -1,241 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const logger = require('../utils/logger');
-const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
-
-/**
- * Enhanced admin authentication middleware
- * Adds additional security checks beyond basic JWT validation
- */
-async function adminAuth(req, res, next) {
-  try {
-    const token = getAdminTokenFromRequest(req);
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload; // Extract payload when using complete: true
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'admin') {
-      logger.warn('Non-admin token used for admin endpoint', { 
-        userId: decoded.id,
-        tokenType: decoded.type 
-      });
-      return res.status(403).json({ error: 'Insufficient permissions' });
-    }
-    
-    // IP validation (optional - can be strict or just log)
-    const currentIp = req.ip || req.connection.remoteAddress;
-    if (decoded.ip && decoded.ip !== currentIp) {
-      logger.warn('Token used from different IP', {
-        userId: decoded.id,
-        tokenIp: decoded.ip,
-        currentIp: currentIp
-      });
-      // Optional: Reject if IP doesn't match
-      // return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if admin still exists and is active
-    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: formatBoolean(true) })
-      .first();
-    
-    if (!admin) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if password was changed after token was issued
-    if (admin.password_changed_at) {
-      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
-      if (decoded.iat < passwordChangedTime) {
-        logger.warn('Token used after password change', { userId: decoded.id });
-        return res.status(401).json({ 
-          error: 'Token invalid due to password change',
-          code: 'PASSWORD_CHANGED'
-        });
-      }
-    }
-    
-    // Add user info to request
-    req.admin = {
-      id: admin.id,
-      username: admin.username,
-      email: admin.email
-    };
-    
-    next();
-  } catch (error) {
-    logger.error('Auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Enhanced gallery authentication middleware
- */
-async function galleryAuth(req, res, next) {
-  try {
-    const slug = req.params?.slug || req.requestedSlug;
-    const token = getGalleryTokenFromRequest(req, slug);
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid session' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'gallery') {
-      return res.status(403).json({ error: 'Invalid access token' });
-    }
-    
-    // Check if event still exists and is active
-    const event = await db('events')
-      .where({ 
-        id: decoded.eventId, 
-        is_active: true, 
-        is_archived: false 
-      })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    // Check if gallery has expired
-    if (new Date(event.expires_at) < new Date()) {
-      return res.status(410).json({ 
-        error: 'Gallery has expired',
-        code: 'GALLERY_EXPIRED'
-      });
-    }
-    
-    // Add event info to request
-    req.event = event;
-    req.galleryToken = decoded;
-    
-    next();
-  } catch (error) {
-    logger.error('Gallery auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Photo access authentication
- * Validates both admin and gallery tokens for photo access
- */
-async function photoAuth(req, res, next) {
-  try {
-    const slug = req.params?.slug || req.requestedSlug;
-    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
-    if (!token) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET);
-    } catch (err) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Allow both admin and gallery tokens
-    if (decoded.type === 'admin') {
-      const admin = await db('admin_users')
-        .where({ id: decoded.id, is_active: formatBoolean(true) })
-        .first();
-      
-      if (!admin) {
-        return res.status(401).json({ error: 'Invalid token' });
-      }
-      
-      req.auth = { type: 'admin', user: admin };
-    } else if (decoded.type === 'gallery') {
-      const event = await db('events')
-        .where({ 
-          id: decoded.eventId, 
-          is_active: true, 
-          is_archived: false 
-        })
-        .first();
-      
-      if (!event) {
-        return res.status(404).json({ error: 'Gallery not found' });
-      }
-      
-      // For gallery tokens, ensure they can only access their event's photos
-      req.auth = { type: 'gallery', event: event };
-    } else {
-      return res.status(403).json({ error: 'Invalid token type' });
-    }
-    
-    next();
-  } catch (error) {
-    logger.error('Photo auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Verify gallery access for specific operations
- */
-async function verifyGalleryAccess(req, res, next) {
-  try {
-    if (!req.auth) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
-    const { eventId } = req.params;
-    
-    // Admins can access any gallery
-    if (req.auth.type === 'admin') {
-      return next();
-    }
-    
-    // Gallery tokens can only access their own event
-    if (req.auth.type === 'gallery') {
-      if (req.auth.event.id !== parseInt(eventId)) {
-        return res.status(403).json({ error: 'Access denied' });
-      }
-      return next();
-    }
-    
-    res.status(403).json({ error: 'Access denied' });
-  } catch (error) {
-    res.status(500).json({ error: 'Access verification failed' });
-  }
-}
-
-module.exports = { 
-  adminAuth, 
-  galleryAuth,
-  photoAuth,
-  verifyGalleryAccess
-};

backend/src/middleware/auth.js

@@ -1,98 +1,288 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
+const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
-const { getAdminTokenFromRequest } = require('../utils/tokenUtils');
+const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
 
+/**
+ * Enhanced admin authentication middleware with revocation checking
+ */
 async function adminAuth(req, res, next) {
   try {
     const token = getAdminTokenFromRequest(req);
     if (!token) {
-      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
-                     req.headers['x-real-ip'] || 
-                     req.connection.remoteAddress || 
-                     req.ip;
-      logger.warn('Admin auth attempt without token', {
-        ip: clientIp,
-        path: req.path,
-        method: req.method,
-        userAgent: req.headers['user-agent']
-      });
       return res.status(401).json({ error: 'No token provided' });
     }
     
     let decoded;
     try {
-      // Try to verify with issuer first, fallback to no issuer for backward compatibility
-      try {
-        decoded = jwt.verify(token, process.env.JWT_SECRET, {
-          issuer: 'picpeak-auth'
-        });
-      } catch (issuerError) {
-        // If verification fails with issuer, try without issuer (backward compatibility)
-        if (issuerError.name === 'JsonWebTokenError' && issuerError.message.includes('jwt issuer invalid')) {
-          decoded = jwt.verify(token, process.env.JWT_SECRET);
-        } else {
-          throw issuerError;
-        }
-      }
-    } catch (jwtError) {
-      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
-                     req.headers['x-real-ip'] || 
-                     req.connection.remoteAddress || 
-                     req.ip;
-      
-      logger.warn('JWT validation failed', {
-        ip: clientIp,
-        path: req.path,
-        method: req.method,
-        userAgent: req.headers['user-agent'],
-        error: jwtError.name,
-        message: jwtError.message,
-        timestamp: new Date().toISOString()
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
       });
-      
-      if (jwtError.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token expired' });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
       }
       return res.status(401).json({ error: 'Invalid token' });
     }
     
-    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
-    
-    if (!admin) {
-      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
-                     req.headers['x-real-ip'] || 
-                     req.connection.remoteAddress || 
-                     req.ip;
-      
-      logger.warn('Admin auth failed - user not found or inactive', {
-        ip: clientIp,
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      logger.warn('Revoked token used', {
         userId: decoded.id,
-        path: req.path,
-        method: req.method,
-        timestamp: new Date().toISOString()
+        tokenType: decoded.type
       });
-      return res.status(401).json({ error: 'Invalid token' });
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
     }
     
-    req.admin = admin;
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+    }
+    
+    // Check if admin still exists and is active, including role info
+    // Use try/catch to handle case where roles table doesn't exist yet (upgrade scenario)
+    let admin;
+    try {
+      admin = await db('admin_users')
+        .leftJoin('roles', 'roles.id', 'admin_users.role_id')
+        .where({ 'admin_users.id': decoded.id, 'admin_users.is_active': formatBoolean(true) })
+        .select(
+          'admin_users.id',
+          'admin_users.username',
+          'admin_users.email',
+          'admin_users.password_changed_at',
+          'roles.id as role_id',
+          'roles.name as role_name'
+        )
+        .first();
+    } catch (joinError) {
+      // Fallback: roles table may not exist yet during upgrade
+      // Query without role join - user will have no role info but can still authenticate
+      logger.debug('Roles table not available, falling back to basic auth', { error: joinError.message });
+      admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
+        .select('id', 'username', 'email', 'password_changed_at')
+        .first();
+      if (admin) {
+        admin.role_id = null;
+        admin.role_name = 'super_admin'; // Assume super_admin for existing users during upgrade
+      }
+    }
+
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+
+    // Add user info to request (enhanced with role)
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email,
+      roleId: admin.role_id,
+      roleName: admin.role_name
+    };
+    req.token = token; // Store token for potential revocation
+    
     next();
   } catch (error) {
-    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
-                   req.headers['x-real-ip'] || 
-                   req.connection.remoteAddress || 
-                   req.ip;
-    
-    logger.error('Admin auth middleware error', {
-      ip: clientIp,
-      path: req.path,
-      error: error.message,
-      stack: error.stack,
-      timestamp: new Date().toISOString()
-    });
-    res.status(401).json({ error: 'Invalid token' });
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
   }
 }
 
-module.exports = { adminAuth };
+/**
+ * Enhanced gallery authentication middleware with revocation checking
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const slug = req.params?.slug || req.requestedSlug;
+    const token = getGalleryTokenFromRequest(req, slug);
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired (only if expires_at is set)
+    // Galleries with null expires_at never expire
+    if (event.expires_at && new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    req.token = token;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Photo access authentication
+ * Validates both admin and gallery tokens for photo access
+ */
+async function photoAuth(req, res, next) {
+  try {
+    const slug = req.params?.slug || req.requestedSlug;
+    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (err) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+
+    // Check if token is revoked
+    if (await isTokenRevoked(decoded)) {
+      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
+    }
+
+    // Allow both admin and gallery tokens
+    if (decoded.type === 'admin') {
+      const admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
+        .first();
+
+      if (!admin) {
+        return res.status(401).json({ error: 'Invalid token' });
+      }
+
+      req.auth = { type: 'admin', user: admin };
+    } else if (decoded.type === 'gallery') {
+      const event = await db('events')
+        .where({
+          id: decoded.eventId,
+          is_active: true,
+          is_archived: false
+        })
+        .first();
+
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+
+      // For gallery tokens, ensure they can only access their event's photos
+      req.auth = { type: 'gallery', event: event };
+    } else {
+      return res.status(403).json({ error: 'Invalid token type' });
+    }
+
+    next();
+  } catch (error) {
+    logger.error('Photo auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Verify gallery access for specific operations
+ */
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    if (!req.auth) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
+    const { eventId } = req.params;
+
+    // Admins can access any gallery
+    if (req.auth.type === 'admin') {
+      return next();
+    }
+
+    // Gallery tokens can only access their own event
+    if (req.auth.type === 'gallery') {
+      if (req.auth.event.id !== parseInt(eventId)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      return next();
+    }
+
+    res.status(403).json({ error: 'Access denied' });
+  } catch (error) {
+    res.status(500).json({ error: 'Access verification failed' });
+  }
+}
+
+module.exports = {
+  adminAuth,
+  galleryAuth,
+  photoAuth,
+  verifyGalleryAccess
+};

backend/src/middleware/errorHandler.js

@@ -0,0 +1,183 @@
+/**
+ * Global error handler middleware.
+ * Catches all errors and returns standardized responses.
+ * Distinguishes between operational errors (expected) and programming errors (bugs).
+ */
+
+const logger = require('../utils/logger');
+const { AppError } = require('../utils/errors');
+
+/**
+ * Determines if an error is operational (expected) or a programming error (bug).
+ * Operational errors are expected failures like validation errors, not found, etc.
+ * Programming errors are bugs that should be logged and investigated.
+ *
+ * @param {Error} err - The error to check
+ * @returns {boolean} True if operational error
+ */
+const isOperationalError = (err) => {
+  return err instanceof AppError && err.isOperational;
+};
+
+/**
+ * Formats error for development environment (includes stack trace).
+ *
+ * @param {Error} err - The error object
+ * @returns {Object} Formatted error response
+ */
+const formatDevError = (err) => {
+  return {
+    error: err.message,
+    code: err.code || 'INTERNAL_ERROR',
+    stack: err.stack,
+    ...(err.details && { details: err.details }),
+    ...(err.field && { field: err.field })
+  };
+};
+
+/**
+ * Formats error for production environment (hides sensitive details).
+ *
+ * @param {Error} err - The error object
+ * @param {boolean} isOperational - Whether this is an operational error
+ * @returns {Object} Formatted error response
+ */
+const formatProdError = (err, isOperational) => {
+  // For operational errors, show the message
+  if (isOperational) {
+    return {
+      error: err.message,
+      code: err.code || 'ERROR',
+      ...(err.details && { details: err.details }),
+      ...(err.field && { field: err.field })
+    };
+  }
+
+  // For programming errors, hide details
+  return {
+    error: 'An unexpected error occurred',
+    code: 'INTERNAL_ERROR'
+  };
+};
+
+/**
+ * Handles specific error types and converts them to AppError format.
+ *
+ * @param {Error} err - The error to handle
+ * @returns {Error} Converted error or original error
+ */
+const handleKnownErrors = (err) => {
+  // Handle Knex/Database errors
+  if (err.code === 'SQLITE_CONSTRAINT' || err.code === '23505') {
+    const { AppError } = require('../utils/errors');
+    const error = new AppError('A record with this value already exists', 409, 'DUPLICATE_ENTRY');
+    error.isOperational = true;
+    return error;
+  }
+
+  // Handle JSON parsing errors
+  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
+    const { ValidationError } = require('../utils/errors');
+    return new ValidationError('Invalid JSON in request body');
+  }
+
+  // Handle multer file upload errors
+  if (err.code === 'LIMIT_FILE_SIZE') {
+    const { ValidationError } = require('../utils/errors');
+    return new ValidationError('File size exceeds the maximum allowed limit');
+  }
+
+  if (err.code === 'LIMIT_UNEXPECTED_FILE') {
+    const { ValidationError } = require('../utils/errors');
+    return new ValidationError('Unexpected file field');
+  }
+
+  return err;
+};
+
+/**
+ * Global error handler middleware.
+ * Must be registered last, after all routes.
+ *
+ * @param {Error} err - The error object
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {Function} next - Express next function
+ */
+const errorHandler = (err, req, res, next) => {
+  // If headers already sent, delegate to Express default handler
+  if (res.headersSent) {
+    return next(err);
+  }
+
+  // Convert known error types
+  const error = handleKnownErrors(err);
+
+  // Determine error status code
+  const statusCode = error.statusCode || error.status || 500;
+  const operational = isOperationalError(error);
+
+  // Log the error
+  const logContext = {
+    url: req.originalUrl,
+    method: req.method,
+    ip: req.ip,
+    statusCode,
+    errorCode: error.code,
+    operational,
+    ...(req.admin && { adminId: req.admin.id }),
+    ...(req.gallerySlug && { gallerySlug: req.gallerySlug })
+  };
+
+  if (operational) {
+    // Operational errors are expected, log at warn level
+    logger.warn('Operational error', {
+      ...logContext,
+      message: error.message
+    });
+  } else {
+    // Programming errors are bugs, log at error level with stack
+    logger.error('Unhandled error', {
+      ...logContext,
+      message: error.message,
+      stack: error.stack
+    });
+  }
+
+  // Format and send response
+  const isDev = process.env.NODE_ENV === 'development';
+  const response = isDev ? formatDevError(error) : formatProdError(error, operational);
+
+  res.status(statusCode).json(response);
+};
+
+/**
+ * 404 handler for undefined routes.
+ * Should be registered after all routes but before errorHandler.
+ *
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {Function} next - Express next function
+ */
+const notFoundHandler = (req, res, next) => {
+  const { NotFoundError } = require('../utils/errors');
+  next(new NotFoundError('Route', req.originalUrl));
+};
+
+/**
+ * Async handler that catches unhandled promise rejections.
+ * Use this to wrap async route handlers.
+ *
+ * @param {Function} fn - Async function to wrap
+ * @returns {Function} Wrapped function
+ */
+const asyncHandler = (fn) => (req, res, next) => {
+  Promise.resolve(fn(req, res, next)).catch(next);
+};
+
+module.exports = {
+  errorHandler,
+  notFoundHandler,
+  asyncHandler,
+  isOperationalError
+};

backend/src/middleware/feedbackRateLimit.js

@@ -3,9 +3,20 @@ const { db } = require('../database/db');
 const logger = require('../utils/logger');
 
 /**
- * Generate a unique identifier for the guest
+ * Generate a unique identifier for the guest.
+ *
+ * In guest identity mode, `req.guest.identifier` is a server-issued UUID
+ * unique per person per event (set by the resolveGuest middleware). When
+ * present it takes precedence, so rate limits and deduplication become
+ * per-person instead of per-device.
+ *
+ * In simple (legacy) mode, the identifier falls back to a hash of IP + UA,
+ * matching prior behavior.
  */
 function generateGuestIdentifier(req) {
+  if (req.guest && req.guest.identifier) {
+    return req.guest.identifier;
+  }
   const ip = req.ip || req.connection.remoteAddress || 'unknown';
   const userAgent = req.headers['user-agent'] || 'unknown';
   return crypto

backend/src/middleware/gallery.js

@@ -4,6 +4,18 @@ const { formatBoolean } = require('../utils/dbCompat');
 const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
 const logger = require('../utils/logger');
 
+// Check if the request carries a valid admin preview token (Feature 3)
+function isAdminPreview(req) {
+  const previewToken = req.query?.preview;
+  if (!previewToken) return false;
+  try {
+    const decoded = jwt.verify(previewToken, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+    return decoded.type === 'admin';
+  } catch {
+    return false;
+  }
+}
+
 // Middleware to verify gallery access
 async function verifyGalleryAccess(req, res, next) {
   try {
@@ -16,15 +28,18 @@ async function verifyGalleryAccess(req, res, next) {
         return res.status(401).json({ error: 'No token provided' });
       }
 
+      const adminPreview = isAdminPreview(req);
       event = await withRetry(async () => {
-        return await db('events')
-          .where({ 
+        const q = db('events')
+          .where({
             slug: requestedSlug,
             is_active: formatBoolean(true),
             is_archived: formatBoolean(false)
-          })
-          .select('*')
-          .first();
+          });
+        if (!adminPreview) {
+          q.where({ is_draft: formatBoolean(false) });
+        }
+        return await q.select('*').first();
       });
 
       if (!event) {
@@ -66,15 +81,18 @@ async function verifyGalleryAccess(req, res, next) {
     // If we have a slug in the URL params or from pre-middleware, verify it matches
     if (requestedSlug) {
       // Verify by slug and ensure it matches the token's event
+      const adminPreviewToken = isAdminPreview(req);
       event = await withRetry(async () => {
-        return await db('events')
-          .where({ 
+        const q = db('events')
+          .where({
             slug: requestedSlug,
             is_active: formatBoolean(true),
             is_archived: formatBoolean(false)
-          })
-          .select('*')
-          .first();
+          });
+        if (!adminPreviewToken) {
+          q.where({ is_draft: formatBoolean(false) });
+        }
+        return await q.select('*').first();
       });
       
       // Verify the token's eventId matches
@@ -83,15 +101,18 @@ async function verifyGalleryAccess(req, res, next) {
       }
     } else {
       // Fallback to using eventId from token
+      const adminPreviewFallback = isAdminPreview(req);
       event = await withRetry(async () => {
-        return await db('events')
-          .where({ 
-            id: decoded.eventId, 
+        const q = db('events')
+          .where({
+            id: decoded.eventId,
             is_active: formatBoolean(true),
             is_archived: formatBoolean(false)
-          })
-          .select('*')
-          .first();
+          });
+        if (!adminPreviewFallback) {
+          q.where({ is_draft: formatBoolean(false) });
+        }
+        return await q.select('*').first();
       });
     }
     
@@ -102,8 +123,9 @@ async function verifyGalleryAccess(req, res, next) {
     
     logger.debug('[verifyGalleryAccess] Event located', { eventId: event.id, slug: event.slug });
     req.event = event;
+    req.accessLevel = decoded.accessLevel || 'guest';
     req.sessionID = decoded.sessionId || `gallery_${event.id}_${Date.now()}`;
-    
+
     // Create client info for logging (similar to secureImageMiddleware but simpler)
     req.clientInfo = {
       ip: req.ip || req.connection.remoteAddress || 'unknown',
@@ -121,5 +143,6 @@ async function verifyGalleryAccess(req, res, next) {
 }
 
 module.exports = {
-  verifyGalleryAccess
+  verifyGalleryAccess,
+  isAdminPreview
 };

backend/src/middleware/guestAuth.js

@@ -0,0 +1,105 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+const { getGuestTokenFromRequest } = require('../utils/tokenUtils');
+
+/**
+ * Non-blocking middleware. Reads an optional guest token from the request and,
+ * if present and valid, populates req.guest with { id, identifier, name, eventId }.
+ *
+ * If the token is missing, malformed, or expired → req.guest = null and the
+ * request continues. Downstream handlers (e.g. feedback submission) enforce
+ * presence explicitly based on event feedback settings (identity_mode).
+ */
+async function resolveGuest(req, res, next) {
+  try {
+    const slug = req.params?.slug;
+    const token = getGuestTokenFromRequest(req, slug);
+    if (!token) {
+      req.guest = null;
+      return next();
+    }
+
+    let decoded;
+    try {
+      const verified = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true,
+      });
+      decoded = verified.payload;
+    } catch (err) {
+      // Invalid or expired guest tokens are silently ignored so that public
+      // gallery browsing continues to work even if the token is stale.
+      logger.debug('Invalid guest token', { reason: err.message });
+      req.guest = null;
+      return next();
+    }
+
+    if (decoded.type !== 'guest') {
+      req.guest = null;
+      return next();
+    }
+
+    // Verify the guest row still exists and is not soft-deleted.
+    const guest = await db('gallery_guests')
+      .where({ id: decoded.guestId, event_id: decoded.eventId, is_deleted: false })
+      .first();
+
+    if (!guest) {
+      req.guest = null;
+      return next();
+    }
+
+    req.guest = {
+      id: guest.id,
+      eventId: guest.event_id,
+      identifier: guest.identifier,
+      name: guest.name,
+      email: guest.email || null,
+    };
+
+    return next();
+  } catch (error) {
+    logger.error('resolveGuest middleware error', { error: error.message });
+    req.guest = null;
+    return next();
+  }
+}
+
+/**
+ * Blocking middleware that 401s if no guest identity was resolved.
+ * Use this on endpoints that require a valid guest session.
+ */
+function requireGuest(req, res, next) {
+  if (!req.guest) {
+    return res.status(401).json({ error: 'Guest identity required' });
+  }
+  return next();
+}
+
+/**
+ * Sign a new guest JWT. Scoped to a specific event and guest row.
+ * Expiry matches the gallery token default (24h).
+ */
+function signGuestToken({ guestId, eventId, identifier, name }, expiresIn = '24h') {
+  return jwt.sign(
+    {
+      type: 'guest',
+      guestId,
+      eventId,
+      identifier,
+      name,
+    },
+    process.env.JWT_SECRET,
+    {
+      issuer: 'picpeak-auth',
+      expiresIn,
+    }
+  );
+}
+
+module.exports = {
+  resolveGuest,
+  requireGuest,
+  signGuestToken,
+};

backend/src/middleware/ownership.js

@@ -0,0 +1,35 @@
+const { db } = require('../database/db');
+
+/**
+ * Middleware to enforce event ownership for non-super_admin users.
+ * Super admins bypass the check. Other admins can only access events they created.
+ */
+function requireEventOwnership(req, res, next) {
+  if (req.admin.roleName === 'super_admin') {
+    return next();
+  }
+
+  const eventId = req.params.eventId || req.params.id;
+  if (!eventId) {
+    return res.status(400).json({ error: 'Event ID is required' });
+  }
+
+  db('events')
+    .where('id', eventId)
+    .first()
+    .then((event) => {
+      if (!event) {
+        return res.status(404).json({ error: 'Event not found' });
+      }
+      // Allow access if: event has no owner (legacy/system), or admin owns it
+      if (event.created_by && event.created_by !== req.admin.id) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      next();
+    })
+    .catch((err) => {
+      res.status(500).json({ error: 'Failed to verify ownership' });
+    });
+}
+
+module.exports = { requireEventOwnership };

backend/src/middleware/permissions.js

@@ -0,0 +1,242 @@
+/**
+ * Permission Checking Middleware for RBAC
+ * Provides role-based access control with caching for performance
+ */
+
+const { db } = require('../database/db');
+const { ForbiddenError } = require('../utils/errors');
+const logger = require('../utils/logger');
+
+// Cache for role permissions (refreshed periodically)
+let permissionCache = new Map();
+let cacheLastUpdated = 0;
+const CACHE_TTL = 60000; // 1 minute
+
+/**
+ * Refresh permission cache from database
+ * Handles upgrade scenario where RBAC tables may not exist yet
+ */
+async function refreshPermissionCache() {
+  const now = Date.now();
+  if (now - cacheLastUpdated < CACHE_TTL && permissionCache.size > 0) {
+    return;
+  }
+
+  try {
+    const rolePermissions = await db('role_permissions')
+      .join('roles', 'roles.id', 'role_permissions.role_id')
+      .join('permissions', 'permissions.id', 'role_permissions.permission_id')
+      .select('roles.name as role_name', 'permissions.name as permission_name');
+
+    const newCache = new Map();
+    for (const rp of rolePermissions) {
+      if (!newCache.has(rp.role_name)) {
+        newCache.set(rp.role_name, new Set());
+      }
+      newCache.get(rp.role_name).add(rp.permission_name);
+    }
+
+    permissionCache = newCache;
+    cacheLastUpdated = now;
+  } catch (error) {
+    // Handle case where RBAC tables don't exist yet (upgrade scenario)
+    // Grant super_admin all permissions by default during upgrade window
+    if (error.message.includes('no such table') || error.message.includes('does not exist') || error.message.includes('relation')) {
+      logger.warn('RBAC tables not available yet - granting full access to authenticated users during upgrade');
+      const allPermissions = new Set([
+        'events.view', 'events.create', 'events.edit', 'events.delete', 'events.archive',
+        'photos.view', 'photos.upload', 'photos.edit', 'photos.delete', 'photos.download',
+        'archives.view', 'archives.restore', 'archives.download', 'archives.delete',
+        'analytics.view', 'email.view', 'email.edit', 'email.send',
+        'branding.view', 'branding.edit', 'cms.view', 'cms.edit',
+        'settings.view', 'settings.edit', 'backup.view', 'backup.create', 'backup.restore', 'backup.delete',
+        'users.view', 'users.create', 'users.edit', 'users.delete',
+        'activity.view', 'activity.export'
+      ]);
+      permissionCache.set('super_admin', allPermissions);
+      cacheLastUpdated = now;
+    } else {
+      logger.error('Failed to refresh permission cache', { error: error.message });
+    }
+  }
+}
+
+/**
+ * Check if a role has a specific permission
+ * @param {string} roleName - Role name to check
+ * @param {string} permissionName - Permission name to check
+ * @returns {Promise<boolean>}
+ */
+async function roleHasPermission(roleName, permissionName) {
+  await refreshPermissionCache();
+  const rolePerms = permissionCache.get(roleName);
+  return rolePerms ? rolePerms.has(permissionName) : false;
+}
+
+/**
+ * Check if user has any of the specified permissions
+ * @param {number} userId - User ID to check
+ * @param {string[]} permissions - Array of permission names
+ * @returns {Promise<boolean>}
+ */
+async function userHasAnyPermission(userId, permissions) {
+  const user = await db('admin_users')
+    .join('roles', 'roles.id', 'admin_users.role_id')
+    .where('admin_users.id', userId)
+    .select('roles.name as role_name')
+    .first();
+
+  if (!user) return false;
+
+  for (const perm of permissions) {
+    if (await roleHasPermission(user.role_name, perm)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Check if user has all specified permissions
+ * @param {number} userId - User ID to check
+ * @param {string[]} permissions - Array of permission names
+ * @returns {Promise<boolean>}
+ */
+async function userHasAllPermissions(userId, permissions) {
+  const user = await db('admin_users')
+    .join('roles', 'roles.id', 'admin_users.role_id')
+    .where('admin_users.id', userId)
+    .select('roles.name as role_name')
+    .first();
+
+  if (!user) return false;
+
+  for (const perm of permissions) {
+    if (!(await roleHasPermission(user.role_name, perm))) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Middleware factory: require specific permission(s)
+ * @param {string|string[]} permissions - Permission name(s) required
+ * @param {object} options - { requireAll: boolean }
+ * @returns {Function} Express middleware
+ */
+function requirePermission(permissions, options = { requireAll: false }) {
+  const permArray = Array.isArray(permissions) ? permissions : [permissions];
+
+  return async (req, res, next) => {
+    try {
+      if (!req.admin || !req.admin.id) {
+        throw new ForbiddenError('Authentication required');
+      }
+
+      const hasPermission = options.requireAll
+        ? await userHasAllPermissions(req.admin.id, permArray)
+        : await userHasAnyPermission(req.admin.id, permArray);
+
+      if (!hasPermission) {
+        logger.warn('Permission denied', {
+          userId: req.admin.id,
+          username: req.admin.username,
+          requiredPermissions: permArray,
+          path: req.path,
+          method: req.method
+        });
+        throw new ForbiddenError('Insufficient permissions');
+      }
+
+      next();
+    } catch (error) {
+      if (error instanceof ForbiddenError) {
+        return res.status(403).json({ error: error.message, code: 'FORBIDDEN' });
+      }
+      next(error);
+    }
+  };
+}
+
+/**
+ * Middleware: require super_admin role
+ * @returns {Function} Express middleware
+ */
+function requireSuperAdmin() {
+  return async (req, res, next) => {
+    try {
+      if (!req.admin || !req.admin.id) {
+        throw new ForbiddenError('Authentication required');
+      }
+
+      const user = await db('admin_users')
+        .join('roles', 'roles.id', 'admin_users.role_id')
+        .where('admin_users.id', req.admin.id)
+        .select('roles.name as role_name')
+        .first();
+
+      if (!user || user.role_name !== 'super_admin') {
+        logger.warn('Super admin access denied', {
+          userId: req.admin.id,
+          username: req.admin.username,
+          path: req.path,
+          method: req.method
+        });
+        throw new ForbiddenError('Super Admin access required');
+      }
+
+      next();
+    } catch (error) {
+      if (error instanceof ForbiddenError) {
+        return res.status(403).json({ error: error.message, code: 'FORBIDDEN' });
+      }
+      next(error);
+    }
+  };
+}
+
+/**
+ * Get user's permissions for client
+ * @param {number} userId - User ID
+ * @returns {Promise<{role: object|null, permissions: string[]}>}
+ */
+async function getUserPermissions(userId) {
+  const user = await db('admin_users')
+    .join('roles', 'roles.id', 'admin_users.role_id')
+    .where('admin_users.id', userId)
+    .select('roles.name as role_name', 'roles.display_name as role_display_name')
+    .first();
+
+  if (!user) return { role: null, permissions: [] };
+
+  await refreshPermissionCache();
+  const permissions = permissionCache.get(user.role_name) || new Set();
+
+  return {
+    role: {
+      name: user.role_name,
+      displayName: user.role_display_name
+    },
+    permissions: Array.from(permissions)
+  };
+}
+
+/**
+ * Clear permission cache (useful for testing or when permissions change)
+ */
+function clearPermissionCache() {
+  permissionCache.clear();
+  cacheLastUpdated = 0;
+}
+
+module.exports = {
+  requirePermission,
+  requireSuperAdmin,
+  getUserPermissions,
+  userHasAnyPermission,
+  userHasAllPermissions,
+  roleHasPermission,
+  refreshPermissionCache,
+  clearPermissionCache
+};

backend/src/middleware/sessionTimeout.js

@@ -85,18 +85,28 @@ async function sessionTimeoutMiddleware(req, res, next) {
     const now = Date.now();
     const lastActivity = sessions.get(token);
     const timeout = await getSessionTimeout();
-    
-    // If session exists, check if it's expired
+
     if (lastActivity) {
+      // Existing session — check if idle too long
       if (now - lastActivity > timeout) {
         sessions.delete(token);
-        return res.status(401).json({ 
-          error: 'Session expired', 
-          code: 'SESSION_TIMEOUT' 
+        return res.status(401).json({
+          error: 'Session expired',
+          code: 'SESSION_TIMEOUT'
+        });
+      }
+    } else {
+      // First request with this token — check if token was issued longer ago than the timeout
+      // This prevents old/stolen tokens from bypassing session timeout after server restart
+      const tokenIssuedAt = (decoded.iat || 0) * 1000; // iat is in seconds
+      if (now - tokenIssuedAt > timeout) {
+        return res.status(401).json({
+          error: 'Session expired',
+          code: 'SESSION_TIMEOUT'
         });
       }
     }
-    
+
     // Update last activity
     sessions.set(token, now);
     

backend/src/routes/__tests__/adminAuth.test.js

@@ -27,7 +27,7 @@ jest.mock('../../database/db', () => {
   };
 });
 
-jest.mock('../../middleware/auth-enhanced-v2', () => ({
+jest.mock('../../middleware/auth', () => ({
   adminAuth: (_req, _res, next) => {
     _req.admin = { id: 1, username: 'admin' };
     next();

backend/src/routes/__tests__/adminNotifications.test.js

@@ -24,7 +24,7 @@ jest.mock('../../database/db', () => {
   return { db: dbMock };
 });
 
-jest.mock('../../middleware/auth-enhanced-v2', () => ({
+jest.mock('../../middleware/auth', () => ({
   adminAuth: (_req, _res, next) => next(),
 }));
 

backend/src/routes/acceptInvite.js

@@ -0,0 +1,75 @@
+/**
+ * Accept Invitation Routes (Public)
+ * Handles invitation token validation and account creation
+ */
+
+const express = require('express');
+const { body, param } = require('express-validator');
+const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const userManagementService = require('../services/userManagementService');
+const router = express.Router();
+
+/**
+ * GET /:token
+ * Validate invitation token
+ * Public endpoint - no auth required
+ */
+router.get('/:token', [
+  param('token').isLength({ min: 64, max: 64 }).withMessage('Invalid invitation token')
+], handleAsync(async (req, res) => {
+  validateRequest(req);
+
+  const invitation = await userManagementService.validateInvitationToken(req.params.token);
+
+  if (!invitation) {
+    return res.status(404).json({ error: 'Invalid or expired invitation' });
+  }
+
+  res.json({
+    valid: true,
+    email: invitation.email,
+    role: invitation.role_name,
+    expiresAt: invitation.expires_at
+  });
+}));
+
+/**
+ * POST /:token
+ * Accept invitation and create account
+ * Public endpoint - no auth required
+ */
+router.post('/:token', [
+  param('token').isLength({ min: 64, max: 64 }).withMessage('Invalid invitation token'),
+  body('username')
+    .trim()
+    .isLength({ min: 3, max: 50 })
+    .withMessage('Username must be 3-50 characters')
+    .matches(/^[a-zA-Z0-9_-]+$/)
+    .withMessage('Username can only contain letters, numbers, underscores, and hyphens'),
+  body('password')
+    .isLength({ min: 12 })
+    .withMessage('Password must be at least 12 characters')
+    .custom((value) => {
+      const validation = validatePasswordStrength(value);
+      if (!validation.isValid) {
+        throw new Error(validation.messages.join(', '));
+      }
+      return true;
+    })
+], handleAsync(async (req, res) => {
+  validateRequest(req);
+
+  const result = await userManagementService.acceptInvitation({
+    token: req.params.token,
+    username: req.body.username,
+    password: req.body.password
+  });
+
+  successResponse(res, {
+    message: 'Account created successfully. You can now log in.',
+    email: result.email
+  }, 201);
+}));
+
+module.exports = router;

backend/src/routes/adminArchives.js

@@ -3,13 +3,15 @@ const path = require('path');
 const fs = require('fs').promises;
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { adminAuth } = require('../middleware/auth');
+const { requirePermission } = require('../middleware/permissions');
 const archiver = require('archiver');
 const AdmZip = require('adm-zip');
+const { requireEventOwnership } = require('../middleware/ownership');
 const router = express.Router();
 
 // Get all archived events
-router.get('/', adminAuth, async (req, res) => {
+router.get('/', adminAuth, requirePermission('archives.view'), async (req, res) => {
   try {
     const page = parseInt(req.query.page) || 1;
     const limit = parseInt(req.query.limit) || 20;
@@ -81,7 +83,7 @@ router.get('/', adminAuth, async (req, res) => {
 });
 
 // Get single archive details
-router.get('/:id', adminAuth, async (req, res) => {
+router.get('/:id', adminAuth, requirePermission('archives.view'), requireEventOwnership, async (req, res) => {
   try {
     const archive = await db('events')
       .where('id', req.params.id)
@@ -137,7 +139,7 @@ router.get('/:id', adminAuth, async (req, res) => {
 });
 
 // Restore archive
-router.post('/:id/restore', adminAuth, async (req, res) => {
+router.post('/:id/restore', adminAuth, requirePermission('archives.restore'), requireEventOwnership, async (req, res) => {
   try {
     const archive = await db('events')
       .where('id', req.params.id)
@@ -300,7 +302,7 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
 });
 
 // Download archive
-router.get('/:id/download', adminAuth, async (req, res) => {
+router.get('/:id/download', adminAuth, requirePermission('archives.download'), requireEventOwnership, async (req, res) => {
   try {
     const archive = await db('events')
       .where('id', req.params.id)
@@ -349,7 +351,7 @@ router.get('/:id/download', adminAuth, async (req, res) => {
 });
 
 // Delete archive permanently
-router.delete('/:id', adminAuth, async (req, res) => {
+router.delete('/:id', adminAuth, requirePermission('archives.delete'), requireEventOwnership, async (req, res) => {
   try {
     const archive = await db('events')
       .where('id', req.params.id)

backend/src/routes/adminAuth.js

@@ -1,161 +1,186 @@
 const express = require('express');
 const bcrypt = require('bcrypt');
-const { body, validationResult } = require('express-validator');
+const jwt = require('jsonwebtoken');
+const { body } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { adminAuth } = require('../middleware/auth');
 const { endSession } = require('../middleware/sessionTimeout');
 const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
+const { NotFoundError, ConflictError, ValidationError } = require('../utils/errors');
+const { setAdminAuthCookie } = require('../utils/tokenUtils');
 const router = express.Router();
 
+// Get admin profile
+router.get('/profile', adminAuth, handleAsync(async (req, res) => {
+  const admin = await db('admin_users')
+    .where('id', req.admin.id)
+    .select('id', 'username', 'email', 'last_login', 'last_login_ip', 'created_at', 'updated_at', 'must_change_password as mustChangePassword')
+    .first();
+
+  if (!admin) {
+    throw new NotFoundError('Admin user');
+  }
+
+  res.json(admin);
+}));
+
+// Update admin profile
+router.put('/profile', [
+  adminAuth,
+  body('username')
+    .trim()
+    .isLength({ min: 3, max: 50 })
+    .withMessage('Username must be between 3 and 50 characters'),
+  body('email')
+    .trim()
+    .isEmail()
+    .withMessage('A valid email address is required')
+    .normalizeEmail()
+], handleAsync(async (req, res) => {
+  validateRequest(req);
+
+  const username = req.body.username.trim();
+  const email = req.body.email.trim().toLowerCase();
+  const adminId = req.admin.id;
+
+  // Check for username conflict
+  const existingUsername = await db('admin_users')
+    .where('username', username)
+    .whereNot('id', adminId)
+    .first();
+
+  if (existingUsername) {
+    throw new ConflictError('Username is already in use', 'username');
+  }
+
+  // Check for email conflict
+  const existingEmail = await db('admin_users')
+    .where('email', email)
+    .whereNot('id', adminId)
+    .first();
+
+  if (existingEmail) {
+    throw new ConflictError('Email address is already in use', 'email');
+  }
+
+  await db('admin_users')
+    .where('id', adminId)
+    .update({
+      username,
+      email,
+      updated_at: new Date()
+    });
+
+  await logActivity('admin_profile_updated',
+    { username, email },
+    null,
+    { type: 'admin', id: adminId, name: req.admin.username }
+  );
+
+  const updatedAdmin = await db('admin_users')
+    .where('id', adminId)
+    .select('id', 'username', 'email', 'must_change_password as mustChangePassword')
+    .first();
+
+  successResponse(res, {
+    message: 'Admin profile updated successfully',
+    user: updatedAdmin
+  });
+}));
+
 // Change password
 router.post('/change-password', [
   adminAuth,
   body('currentPassword').notEmpty().withMessage('Current password is required'),
   body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
+], handleAsync(async (req, res) => {
+  validateRequest(req);
 
-    const { currentPassword, newPassword } = req.body;
-    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
+  const { currentPassword, newPassword } = req.body;
+  const userId = req.admin.id;
 
-    // Validate new password strength
-    const passwordValidation = validatePasswordStrength(newPassword);
-    if (!passwordValidation.isValid) {
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.messages
-      });
-    }
-
-    // Get user from database
-    const user = await db('admin_users')
-      .where('id', userId)
-      .first();
-
-    if (!user) {
-      return res.status(404).json({ error: 'User not found' });
-    }
-
-    // Verify current password
-    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
-    if (!validPassword) {
-      return res.status(400).json({ error: 'Current password is incorrect' });
-    }
-
-    // Hash new password with more rounds
-    const newPasswordHash = await bcrypt.hash(newPassword, 12);
-
-    // Update password and clear must_change_password flag
-    await db('admin_users')
-      .where('id', userId)
-      .update({
-        password_hash: newPasswordHash,
-        must_change_password: false,
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await logActivity('password_changed', 
-      { admin_id: userId }, 
-      null,
-      { type: 'admin', id: userId, name: user.username }
-    );
-
-    res.json({ message: 'Password changed successfully' });
-  } catch (error) {
-    console.error('Password change error:', error);
-    res.status(500).json({ error: 'Failed to change password' });
+  // Validate new password strength
+  const passwordValidation = validatePasswordStrength(newPassword);
+  if (!passwordValidation.isValid) {
+    throw new ValidationError('Password does not meet security requirements', passwordValidation.messages);
   }
-});
 
-// Update admin profile
-router.put('/profile', [
-  adminAuth,
-  body('username').trim().notEmpty().withMessage('Username is required'),
-  body('email').trim().isEmail().withMessage('Valid email is required')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
+  // Get user from database
+  const user = await db('admin_users')
+    .where('id', userId)
+    .first();
 
-    const { username, email } = req.body;
-    const userId = req.admin.id;
-
-    // Check for email conflicts
-    const existingEmail = await db('admin_users')
-      .where('email', email)
-      .whereNot('id', userId)
-      .first();
-
-    if (existingEmail) {
-      return res.status(409).json({ error: 'Email is already in use by another admin' });
-    }
-
-    // Check username conflict (if multiple admins are supported)
-    const existingUsername = await db('admin_users')
-      .where('username', username)
-      .whereNot('id', userId)
-      .first();
-
-    if (existingUsername) {
-      return res.status(409).json({ error: 'Username is already in use by another admin' });
-    }
-
-    await db('admin_users')
-      .where('id', userId)
-      .update({
-        username,
-        email,
-        updated_at: new Date()
-      });
-
-    const updatedUser = await db('admin_users')
-      .select('id', 'username', 'email', 'must_change_password')
-      .where('id', userId)
-      .first();
-
-    await logActivity(
-      'admin_profile_updated',
-      { admin_id: userId, updated_fields: ['username', 'email'] },
-      null,
-      { type: 'admin', id: userId, name: username }
-    );
-
-    res.json({ user: updatedUser });
-  } catch (error) {
-    console.error('Admin profile update error:', error);
-    res.status(500).json({ error: 'Failed to update admin profile' });
+  if (!user) {
+    throw new NotFoundError('User');
   }
-});
+
+  // Verify current password
+  const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
+  if (!validPassword) {
+    throw new ValidationError('Current password is incorrect');
+  }
+
+  // Hash new password with more rounds
+  const newPasswordHash = await bcrypt.hash(newPassword, 12);
+
+  // Update password, set password_changed_at to invalidate existing tokens, and clear must_change_password flag
+  const now = new Date();
+  await db('admin_users')
+    .where('id', userId)
+    .update({
+      password_hash: newPasswordHash,
+      password_changed_at: now,
+      must_change_password: false,
+      updated_at: now
+    });
+
+  // Issue a new token so the session remains valid after password_changed_at invalidated the old one.
+  // Set iat to 1 second after password_changed_at to guarantee the token passes the
+  // "iat < password_changed_at" check in auth middleware (password_changed_at has ms precision
+  // but JWT iat is floored to seconds, which can cause the new token to be rejected).
+  const iatAfterPasswordChange = Math.floor(now.getTime() / 1000) + 1;
+  const newToken = jwt.sign({
+    id: user.id,
+    username: user.username,
+    type: 'admin',
+    role: user.role_name,
+    iat: iatAfterPasswordChange,
+    loginTime: Date.now()
+  }, process.env.JWT_SECRET, {
+    expiresIn: '24h',
+    issuer: 'picpeak-auth'
+  });
+
+  setAdminAuthCookie(res, newToken);
+
+  // Log activity
+  await logActivity('password_changed',
+    { admin_id: userId },
+    null,
+    { type: 'admin', id: userId, name: user.username }
+  );
+
+  successResponse(res, { message: 'Password changed successfully' });
+}));
 
 // Logout
-router.post('/logout', adminAuth, async (req, res) => {
-  try {
-    // Get token from header
-    const token = req.headers.authorization?.split(' ')[1];
-    if (token) {
-      // End the session
-      endSession(token);
-    }
-    
-    // Log activity
-    await logActivity('admin_logout', 
-      { admin_id: req.admin.id }, 
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({ message: 'Logged out successfully' });
-  } catch (error) {
-    console.error('Logout error:', error);
-    res.status(500).json({ error: 'Failed to logout' });
+router.post('/logout', adminAuth, handleAsync(async (req, res) => {
+  // Get token from header
+  const token = req.headers.authorization?.split(' ')[1];
+  if (token) {
+    // End the session
+    endSession(token);
   }
-});
+
+  // Log activity
+  await logActivity('admin_logout',
+    { admin_id: req.admin.id },
+    null,
+    { type: 'admin', id: req.admin.id, name: req.admin.username }
+  );
+
+  successResponse(res, { message: 'Logged out successfully' });
+}));
 
 module.exports = router;