chore: bump frontend version to 1.0.76

- Change default import to named import for api from config/api.ts
- Fixes build error: 'default' is not exported by src/config/api.ts
- Affected files: BackupHistory.jsx, RestoreWizard.jsx, BackupManagement.jsx

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

.claudedocs/scans/security-20250713.md

@@ -0,0 +1,286 @@
+# Security Scan Report - Wedding Photo Sharing Application
+**Date**: July 13, 2025  
+**Scanner**: Claude Security Audit with --security --validate flags  
+**Overall Risk Level**: MEDIUM-HIGH  
+
+## Executive Summary
+
+The wedding photo sharing application demonstrates strong security fundamentals with comprehensive input validation, proper authentication mechanisms, and good file security practices. However, several critical issues require immediate attention, particularly around hardcoded secrets, token storage, and Content Security Policy configuration.
+
+### Security Score: 6.5/10
+
+**Strengths**: Excellent input validation, parameterized queries, file security, rate limiting  
+**Critical Issues**: Hardcoded JWT secrets, localStorage token storage, weak CSP, console logging in production
+
+---
+
+## 🔴 CRITICAL FINDINGS (Immediate Action Required)
+
+### 1. Hardcoded JWT Secret in Development
+- **Location**: Backend `.env` file
+- **Risk**: Token forgery, authentication bypass
+- **Impact**: Complete authentication compromise
+- **Remediation**: 
+  ```bash
+  # Generate secure secret
+  openssl rand -base64 32
+  # Never commit to repository
+  echo ".env" >> .gitignore
+  ```
+
+### 2. Gallery Tokens in localStorage
+- **Location**: Frontend `api.ts` and auth contexts
+- **Risk**: XSS token theft
+- **Impact**: Gallery access compromise
+- **Remediation**: Move to httpOnly cookies:
+  ```typescript
+  Cookies.set(`gallery_token_${slug}`, token, {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict'
+  });
+  ```
+
+### 3. Weak Content Security Policy
+- **Location**: Frontend `nginx.conf`
+- **Risk**: XSS, code injection
+- **Current**: `unsafe-inline` and `unsafe-eval` allowed
+- **Remediation**: Implement strict CSP (see detailed recommendations below)
+
+---
+
+## 🟠 HIGH SEVERITY FINDINGS
+
+### 1. Console Logging in Production
+- **Locations**: 61 instances across frontend
+- **Risk**: Information disclosure
+- **Impact**: Leaking sensitive data, debugging info
+- **Remediation**: Implement environment-aware logging
+
+### 2. Token Revocation Vulnerability
+- **Location**: Backend `tokenRevocation.js`
+- **Risk**: Token manipulation
+- **Impact**: Bypass revocation checks
+- **Remediation**: Verify token signature before decoding
+
+### 3. Source Maps in Production
+- **Location**: Frontend build configuration
+- **Risk**: Source code exposure
+- **Impact**: Reveals application structure
+- **Remediation**: Disable in production builds
+
+### 4. Missing Security Headers
+- **Location**: nginx configuration
+- **Missing**: HSTS, Permissions-Policy
+- **Impact**: Various client-side attacks
+- **Remediation**: Add comprehensive security headers
+
+---
+
+## 🟡 MEDIUM SEVERITY FINDINGS
+
+### 1. Rate Limiting Bypass Potential
+- **Location**: Backend rate limiter
+- **Risk**: DoS attacks
+- **Current**: JWT validation in rate limiter
+- **Remediation**: Use IP-based limiting only
+
+### 2. Incomplete SQL Injection Protection
+- **Location**: Complex dashboard queries
+- **Risk**: Potential injection in edge cases
+- **Current**: Mostly parameterized
+- **Remediation**: Use query builder exclusively
+
+### 3. Session Management
+- **Issue**: No gallery token invalidation on password change
+- **Risk**: Persistent access after compromise
+- **Remediation**: Implement token revocation
+
+### 4. Path Traversal in Gallery Slugs
+- **Location**: Frontend gallery routes
+- **Risk**: Directory traversal attempts
+- **Remediation**: Validate and sanitize slugs
+
+---
+
+## 🟢 LOW SEVERITY FINDINGS
+
+### 1. Verbose Error Messages
+- **Location**: Multiple API endpoints
+- **Risk**: Information disclosure
+- **Remediation**: Generic client errors, detailed server logs
+
+### 2. Weak Gallery Passwords
+- **Current**: zxcvbn score 2/4 allowed
+- **Risk**: Brute force attacks
+- **Remediation**: Increase to score 3/4
+
+### 3. Missing File Size Validation
+- **Location**: Frontend upload components
+- **Risk**: DoS via large uploads
+- **Remediation**: Add client-side size checks
+
+---
+
+## ✅ SECURITY STRENGTHS
+
+### Authentication & Authorization
+- JWT with proper expiration (24h/7d)
+- Token type validation
+- IP tracking and validation
+- Password change detection
+- Token revocation system
+- Bcrypt with 12 rounds
+- zxcvbn password strength checking
+
+### Input Validation & SQL Security
+- express-validator on all endpoints
+- Parameterized queries via Knex
+- SQL injection protection utilities
+- Path traversal prevention
+- Comprehensive input sanitization
+
+### File Security
+- Magic number verification
+- MIME type validation
+- Safe filename generation
+- Directory traversal protection
+- File extension whitelist
+
+### Rate Limiting & DoS Protection
+- General: 100 req/15min
+- Auth endpoints: 5 req/15min
+- Account lockout after failed attempts
+- Suspicious activity detection
+
+### Frontend Security
+- React's built-in XSS protection
+- DOMPurify for HTML content
+- No eval() or innerHTML usage
+- Proper error boundaries
+- ReCAPTCHA integration
+
+---
+
+## 📊 DEPENDENCY ANALYSIS
+
+### Current Status
+- **Backend**: 0 vulnerabilities (691 packages)
+- **Frontend**: 0 vulnerabilities (434 packages)
+
+### Recommended Updates
+1. **bcrypt** 5.1.1 → 6.0.0 (performance, compatibility)
+2. **helmet** 7.2.0 → 8.1.0 (new security features)
+3. **@tiptap** 2.x → 3.x (security improvements)
+
+### Supply Chain Assessment
+- All major dependencies from trusted sources
+- No typosquatting detected
+- Regular maintenance observed
+- MIT/ISC/Apache licenses only
+
+---
+
+## 🛠️ REMEDIATION PLAN
+
+### Phase 1: Critical (Within 24 hours)
+1. Replace hardcoded JWT secret with secure random value
+2. Move gallery tokens from localStorage to httpOnly cookies
+3. Implement strict CSP without unsafe-eval
+4. Remove or wrap console.log statements
+
+### Phase 2: High Priority (Within 1 week)
+1. Disable source maps in production
+2. Add missing security headers (HSTS, Permissions-Policy)
+3. Fix token revocation vulnerability
+4. Update critical dependencies (bcrypt, helmet)
+
+### Phase 3: Medium Priority (Within 1 month)
+1. Implement comprehensive logging strategy
+2. Add gallery slug validation
+3. Enhance rate limiting logic
+4. Implement session invalidation on password change
+
+### Phase 4: Ongoing
+1. Weekly dependency scanning
+2. Implement security testing in CI/CD
+3. Regular penetration testing
+4. Security awareness training
+
+---
+
+## 🔒 RECOMMENDED CSP CONFIGURATION
+
+```nginx
+add_header Content-Security-Policy "
+  default-src 'self';
+  script-src 'self' 'nonce-{RANDOM}' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
+  style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob: https:;
+  font-src 'self';
+  connect-src 'self' https://analytics.domain.com;
+  frame-src https://www.google.com/recaptcha/;
+  object-src 'none';
+  base-uri 'self';
+  form-action 'self';
+  frame-ancestors 'none';
+  upgrade-insecure-requests;
+" always;
+```
+
+---
+
+## 🚀 SECURITY IMPROVEMENTS ROADMAP
+
+### Immediate Implementation
+```bash
+# 1. Generate secure secrets
+openssl rand -base64 32 > jwt-secret.txt
+
+# 2. Update dependencies
+cd backend && npm install bcrypt@^6.0.0 helmet@^8.1.0
+cd ../frontend && npm update
+
+# 3. Add security scanning
+npm install -D npm-audit-resolver
+```
+
+### CI/CD Integration
+```yaml
+# Add to CI pipeline
+- name: Security Scan
+  run: |
+    npm audit --audit-level=moderate
+    npm run test:security
+```
+
+### Monitoring & Alerting
+1. Implement fail2ban for repeated auth failures
+2. Set up log analysis for suspicious patterns
+3. Configure alerts for security events
+4. Regular vulnerability scanning
+
+---
+
+## 📋 COMPLIANCE CHECKLIST
+
+- [ ] OWASP Top 10 addressed
+- [ ] GDPR compliance (data minimization, right to erasure)
+- [ ] Security headers implemented
+- [ ] Dependency scanning automated
+- [ ] Incident response plan documented
+- [ ] Security documentation maintained
+- [ ] Regular security reviews scheduled
+
+---
+
+## 🎯 CONCLUSION
+
+The wedding photo sharing application has a solid security foundation with excellent input validation and authentication mechanisms. However, operational security practices need immediate attention. The critical issues around secret management and token storage must be addressed before production deployment.
+
+Implementing the recommended fixes will raise the security score from 6.5/10 to approximately 8.5/10, providing a robust and secure platform for wedding photo sharing.
+
+---
+
+*Generated by Claude Security Scanner v1.0*  
+*Next scan recommended: After Phase 1 remediation completion*

.drone.yml

@@ -108,6 +108,18 @@ steps:
         - VERSION=${DRONE_TAG}
         - VITE_API_URL=${VITE_API_URL:-/api}
 
+  # -------- NEW: Create GitHub Release --------
+  - name: github-release
+    image: plugins/github-release
+    settings:
+      api_key:
+        from_secret: GITHUB_TOKEN
+      files: ["CHANGELOG.md"]
+      title: "PicPeak ${DRONE_TAG}"
+      note: |
+        Release ${DRONE_TAG}
+        
+        See CHANGELOG.md for full details.
 
 trigger:
   event:

.env.example

@@ -1,53 +1,47 @@
-# PicPeak Environment Configuration
-# Copy this file to .env and update with your values
+# PicPeak Development Environment Configuration
+# Copy this file to .env for local development
 
-# Environment
-NODE_ENV=production
+# SECURITY WARNING: This configuration is for development only!
+# For production, use .env.production.example
 
-# JWT Secret (generate with: openssl rand -base64 64)
-JWT_SECRET=your_very_long_random_jwt_secret_here
+# JWT Secret (Change in production!)
+# Generate secure secret with: openssl rand -base64 32
+JWT_SECRET=dev-secret-DO-NOT-USE-IN-PRODUCTION
 
-# Database Configuration (PostgreSQL)
-DATABASE_CLIENT=pg
-DB_USER=picpeak
-# IMPORTANT: Avoid $ character in passwords - Docker Compose interprets it as variable substitution
-# If you must use $, escape it as $$ (e.g., Pass$$word instead of Pass$word)
-DB_PASSWORD=your_secure_postgres_password_here
-DB_NAME=picpeak_prod
+# Application URLs (Docker Compose development setup)
+ADMIN_URL=http://localhost:3005
+FRONTEND_URL=http://localhost:3005
+BACKEND_URL=http://localhost:3001
 
-# Redis Configuration
-# IMPORTANT: Same warning applies - avoid $ or escape as $$
-REDIS_PASSWORD=your_secure_redis_password_here
+# Database Configuration (SQLite for development)
+DATABASE_CLIENT=sqlite3
+DATABASE_PATH=./data/photo_sharing.db
 
-# Admin Account (initial setup)
-ADMIN_USERNAME=admin
-ADMIN_EMAIL=admin@yourdomain.com
-
-# Email Configuration
-# For Gmail: use app-specific password
-# For SendGrid: SMTP_USER=apikey, SMTP_PASS=your-api-key
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
+# Email Configuration (Mailhog for development)
+# Access Mailhog UI at: http://localhost:8025
+SMTP_HOST=mailhog
+SMTP_PORT=1025
 SMTP_SECURE=false
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-specific-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_USER=
+SMTP_PASS=
+EMAIL_FROM=noreply@localhost
 
-# Application URLs
-FRONTEND_URL=https://yourdomain.com
-ADMIN_URL=https://yourdomain.com:3001
-VITE_API_URL=https://yourdomain.com:3001/api
+# Backend Port Configuration
+PORT=3001
 
-# Port Configuration (optional)
-# BACKEND_PORT=3001
-# FRONTEND_PORT=3000
-# DB_PORT=5432
-# REDIS_PORT=6379
+# Optional: Umami Analytics Backend Config
+# NOTE: Primary configuration through Admin UI > Settings > Analytics
+# These are fallback values for server-side tracking
+# UMAMI_URL=https://analytics.example.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
 
-# Timezone
-TZ=UTC
+# Development Features
+NODE_ENV=development
+LOG_LEVEL=debug
 
-# Analytics (Optional - Umami)
-VITE_UMAMI_URL=
-VITE_UMAMI_WEBSITE_ID=
-VITE_UMAMI_SHARE_URL=
+# Admin Setup Notes:
+# 1. Run 'npm run migrate' in backend folder
+# 2. Admin credentials will be auto-generated
+# 3. Check ADMIN_CREDENTIALS.txt for login details
+# 4. Change password on first login (required)

.env.production.example

@@ -0,0 +1,100 @@
+# PicPeak Production Configuration
+# Copy this file to .env and update with your production values
+
+# ============================================
+# CRITICAL SECURITY - MUST CHANGE ALL VALUES!
+# ============================================
+
+# JWT Secret - REQUIRED (minimum 32 characters)
+# Generate with: openssl rand -base64 32
+JWT_SECRET=CHANGE-THIS-PRODUCTION-SECRET-USE-OPENSSL-COMMAND
+
+# Application URLs - REQUIRED (your actual domain)
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+ADMIN_URL=https://your-domain.com
+
+# ============================================
+# DATABASE CONFIGURATION - REQUIRED
+# ============================================
+
+# PostgreSQL Configuration (Recommended for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or your database host
+DB_PORT=5432
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=CHANGE-THIS-SECURE-DATABASE-PASSWORD
+
+# ============================================
+# EMAIL CONFIGURATION - REQUIRED
+# ============================================
+
+# Example: Gmail with App Password
+# SMTP_HOST=smtp.gmail.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@gmail.com
+# SMTP_PASS=your-16-char-app-password
+# EMAIL_FROM=Your Name <your-email@gmail.com>
+
+# Example: SendGrid
+SMTP_HOST=smtp.sendgrid.net
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=apikey
+SMTP_PASS=YOUR-SENDGRID-API-KEY
+EMAIL_FROM=PicPeak <noreply@your-domain.com>
+
+# ============================================
+# ADMIN SETUP - AUTO-GENERATED
+# ============================================
+# NOTE: Admin credentials are automatically generated during setup
+# DO NOT set ADMIN_EMAIL or ADMIN_PASSWORD anymore!
+# Run 'npm run migrate' and check ADMIN_CREDENTIALS.txt
+
+# ============================================
+# OPTIONAL CONFIGURATION
+# ============================================
+
+# Umami Analytics (Optional - Fallback values)
+# Primary config via Admin UI > Settings > Analytics
+# UMAMI_URL=https://analytics.your-domain.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
+
+# Frontend Analytics (Optional - Fallback values)
+# VITE_UMAMI_URL=https://analytics.your-domain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+# VITE_UMAMI_SHARE_URL=https://analytics.your-domain.com/share/xyz/gallery
+
+# ============================================
+# PERFORMANCE & SECURITY TUNING
+# ============================================
+
+NODE_ENV=production
+PORT=3001
+LOG_LEVEL=info
+
+# Security Settings (Defaults are secure)
+BCRYPT_ROUNDS=12
+SESSION_TIMEOUT_MINUTES=60
+RATE_LIMIT_WINDOW_MS=900000     # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100      # per window
+
+# Connection Pool (Adjust based on load)
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+
+# ============================================
+# DOCKER COMPOSE SPECIFIC
+# ============================================
+
+# Traefik Configuration (if using Traefik)
+DOMAIN=your-domain.com
+LETSENCRYPT_EMAIL=admin@your-domain.com
+
+# Volume Paths (Docker)
+STORAGE_PATH=/app/storage
+EVENTS_PATH=/app/storage/events
+ARCHIVE_PATH=/app/storage/events/archived

.gitattributes-github

@@ -0,0 +1,12 @@
+# Files to exclude from GitHub mirror
+.env* export-ignore
+docker-compose.prod.yml export-ignore
+.claudedocs/ export-ignore
+backend/data/ export-ignore
+backend/storage/ export-ignore
+backend/.env* export-ignore
+frontend/.env* export-ignore
+secrets/ export-ignore
+*.key export-ignore
+*.pem export-ignore
+.gitea/ export-ignore

.gitea/workflows/mirror-to-github.yml

@@ -10,32 +10,145 @@ jobs:
   mirror:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
+      - name: Checkout repository with full history
         uses: actions/checkout@v3
         with:
-          fetch-depth: 0  # Full history for proper mirroring
+          fetch-depth: 0  # Full history needed for finding the commit
 
       - name: Setup Git
         run: |
           git config --global user.name "the-luap"
           git config --global user.email "paul-nothaft@hotmail.de"
 
+      - name: Debug - Show current branch and status
+        run: |
+          echo "Current branch:"
+          git branch -a
+          echo "Git status:"
+          git status
+          echo "Remote info:"
+          git remote -v
+          echo "Checking target commit exists:"
+          git show --oneline 7aca927937 || echo "Target commit not found!"
+
+      - name: Create completely new history from specific commit
+        run: |
+          TARGET_COMMIT="7aca927937"
+          
+          # Verify the target commit exists
+          if ! git cat-file -e $TARGET_COMMIT^{commit}; then
+            echo "ERROR: Target commit $TARGET_COMMIT does not exist!"
+            exit 1
+          fi
+          
+          echo "✅ Target commit found: $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          # Clean up any existing github-mirror branch
+          git branch -D github-mirror || true
+          
+          # Create a completely new orphan branch (no history)
+          git checkout --orphan github-mirror
+          
+          # Clear the staging area completely
+          git rm -rf . || true
+          
+          # Get the file tree from the target commit and create initial commit
+          echo "Creating new history starting from $TARGET_COMMIT..."
+          git read-tree $TARGET_COMMIT
+          git commit -m "Initial commit - imported from $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          echo "✅ Created new initial commit: $(git log --oneline -1)"
+          
+          # Now get all commits after the target commit and apply their changes
+          COMMITS_AFTER_TARGET=$(git rev-list --reverse --no-merges $TARGET_COMMIT..main)
+          
+          if [ -n "$COMMITS_AFTER_TARGET" ]; then
+            echo "📋 Applying changes from commits after $TARGET_COMMIT (excluding Claude commits):"
+            
+            for commit in $COMMITS_AFTER_TARGET; do
+              # Get the commit author name
+              COMMIT_AUTHOR_NAME=$(git log --format="%an" -n 1 $commit)
+              
+              # Skip commits by Claude
+              if [ "$COMMIT_AUTHOR_NAME" = "Claude" ]; then
+                echo "⚠️ Skipping commit by Claude: $(git log --oneline -1 $commit)"
+                continue
+              fi
+              
+              echo "Processing: $(git log --oneline -1 $commit)"
+              
+              # Get the commit message and author info
+              COMMIT_MSG=$(git log --format="%B" -n 1 $commit)
+              COMMIT_AUTHOR=$(git log --format="%an <%ae>" -n 1 $commit)
+              COMMIT_DATE=$(git log --format="%ad" -n 1 $commit)
+              
+              # Apply the changes from this commit
+              if git diff-tree --no-commit-id --name-only -r $commit | xargs -I {} git show $commit:{} > /dev/null 2>&1; then
+                # Apply file changes
+                git checkout $commit -- . || true
+                
+                # Stage all changes
+                git add -A
+                
+                # Only commit if there are changes
+                if ! git diff --cached --quiet; then
+                  # Create new commit with original metadata but new SHA
+                  GIT_AUTHOR_NAME=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f1 | xargs)
+                  GIT_AUTHOR_EMAIL=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f2 | cut -d'>' -f1)
+                  GIT_AUTHOR_DATE="$COMMIT_DATE"
+                  
+                  export GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_AUTHOR_DATE
+                  git commit -m "$COMMIT_MSG"
+                  echo "✅ Applied changes as new commit: $(git log --oneline -1)"
+                else
+                  echo "⚠️ No changes to commit for $commit"
+                fi
+              else
+                echo "⚠️ Skipping problematic commit $commit"
+              fi
+            done
+            
+            echo "✅ Finished creating new history"
+          else
+            echo "✅ No commits after target commit - history starts fresh"
+          fi
+          
+          echo ""
+          echo "=== New History Summary ==="
+          echo "Total commits in new history: $(git rev-list --count github-mirror)"
+          echo "History starts with: $(git log --oneline --reverse | head -1)"
+          echo "Latest commit: $(git log --oneline -1)"
+
       - name: Remove sensitive files and directories
         run: |
+          # Switch to the github-mirror branch
+          git checkout github-mirror
+          
           echo "Current files before cleanup:"
           ls -la | head -10 || true
           echo "..."
           
           # Remove sensitive files/directories if they exist
           echo "Removing sensitive files..."
+          rm -rf .env || true
+          rm -rf backend/.env* || true
+          rm -rf frontend/.env* || true
+          rm -rf docker-compose.prod.yml || true
+          rm -rf .claudedocs/ || true
+          rm -rf backend/data/ || true
+          rm -rf backend/storage/ || true
           rm -rf .gitea/ || true
-          rm -rf scripts/ || true
+          rm -rf scripts/install-gitea-runner.sh || true
           rm -rf .drone* || true
+          rm -rf .github-mirror-exclude || true
+          rm -rf .gitattributes-github || true
           rm -rf photo-sharing-prd.md || true
           rm -rf CLAUDE.md || true
+          rm -rf PRODUCTION_DEPLOYMENT_GUIDE.md || true
+          rm -rf logs/ || true
+          rm -rf frontend/.claudedocs/ || true
+          rm -rf test-maintenance.sh || true
           rm -rf storage/ || true
-
-
           
           echo "Sensitive files removal completed"
           
@@ -51,6 +164,18 @@ jobs:
           echo "Final file structure (top level):"
           ls -la | head -10 || true
 
+      - name: Verify completely new history
+        run: |
+          git checkout github-mirror
+          echo "=== Final History Verification ==="
+          echo "Total commits in new github-mirror branch: $(git rev-list --count github-mirror)"
+          echo ""
+          echo "Complete commit history (should start from target commit content):"
+          git log --oneline --reverse
+          echo ""
+          echo "⚠️ Note: This is a completely NEW history with new commit SHAs"
+          echo "🔍 Original target commit content preserved but with new commit ID"
+
       - name: Check GitHub token
         env:
           GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
@@ -62,10 +187,13 @@ jobs:
             echo "GitHub token is available (length: ${#GITHUBTOKEN})"
           fi
 
-      - name: Push to GitHub
+      - name: Force push completely new history to GitHub
         env:
           GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
         run: |
+          # Switch to github-mirror branch
+          git checkout github-mirror
+          
           # Remove existing github remote if it exists
           git remote remove github || true
           
@@ -76,13 +204,17 @@ jobs:
           echo "GitHub remote added:"
           git remote -v
           
-          # Push to GitHub main branch
-          echo "Pushing to GitHub..."
-          git push github main --force
-          echo "✅ Push to GitHub completed!"
+          # Force push the completely new history to GitHub main
+          echo "🔥 FORCE PUSHING completely new history to GitHub..."
+          echo "⚠️ This will COMPLETELY REPLACE all history on GitHub!"
+          git push github github-mirror:main --force
+          echo "✅ Force push completed - GitHub now has completely new history!"
 
       - name: Workflow completed
         run: |
           echo "✅ Mirror to GitHub workflow completed successfully!"
-          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
-          echo "🔒 Sensitive files have been removed from the mirror"
+          echo "🔥 COMPLETE HISTORY REPLACEMENT: GitHub now has entirely new history"
+          echo "📊 History starts from commit content: 7aca927937"
+          echo "🔍 Check https://github.com/the-luap/picpeak to verify the new history"
+          echo "📈 Total commits pushed: $(git rev-list --count github-mirror)"
+          echo "🆕 All commit SHAs are NEW - no connection to previous history"

.github-mirror-exclude

@@ -0,0 +1,24 @@
+# Exclude patterns for GitHub mirror
+.env
+.env.*
+.env*
+docker-compose.prod.yml
+docker-compose.traefik.yml
+.claudedocs/
+backend/data/
+backend/storage/
+backend/.env*
+frontend/.env*
+secrets/
+*.key
+*.pem
+.gitea/
+node_modules/
+dist/
+build/
+*.log
+.DS_Store
+deploy/
+certbot/
+nginx/
+photo-sharing-prd.md

.gitignore

@@ -11,9 +11,6 @@ yarn-error.log*
 .env.test.local
 .env.production.local
 
-# Docker override file
-docker-compose.override.yml
-
 # Security - Never commit credentials
 ADMIN_CREDENTIALS.txt
 ADMIN_PASSWORD_RESET.txt
@@ -51,10 +48,6 @@ coverage/
 *.tmp
 *.temp
 
-# Backup and test directories
-backups/
-test-archiver/
-
 # Keep directory structure
 !storage/events/active/.gitkeep
 !storage/events/archived/.gitkeep
@@ -62,13 +55,4 @@ test-archiver/
 !data/.gitkeep
 !logs/.gitkeep
 
-# development files
-backend/.swarm/
-.claudedocs/
-backend/data/
-backend/docs/
-backend/logs/
-logs/
-storage/
-data/
-certbot/
+PRODUCTION_DEPLOYMENT_GUIDE.md

CLAUDE.md

@@ -33,14 +33,11 @@ npm test -- path/to/test.test.js
 npm test -- --testNamePattern="test name"
 ```
 
-### Production Deployment
-See [DEPLOYMENT_GUIDE.md](./DEPLOYMENT_GUIDE.md) for comprehensive deployment instructions including:
-- Docker Compose deployment
-- PM2 deployment
-- Manual installation
-- Non-nginx deployment options
-- SSL/HTTPS setup
-- Troubleshooting guide
+### Production
+```bash
+docker-compose -f docker-compose.prod.yml up -d  # Production deployment
+pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
+```
 
 **⚠️ CRITICAL PRODUCTION NOTICE:**
 - Production runs on a SEPARATE SERVER - never assume local changes affect production

CODE_OF_CONDUCT.md

@@ -20,7 +20,7 @@ We are committed to providing a welcoming and inspiring community for all photog
 
 ## Enforcement
 
-Instances of unacceptable behavior may be reported by [opening an issue](https://github.com/the-luap/picpeak/issues/new?labels=conduct) on GitHub. All complaints will be reviewed and investigated promptly and fairly.
+Instances of unacceptable behavior may be reported to the project team at conduct@example.com. All complaints will be reviewed and investigated promptly and fairly.
 
 ## Attribution
 

CONTRIBUTING.md

@@ -153,8 +153,8 @@ picpeak/
 
 ## 📮 Contact
 
-- Create an [issue](https://github.com/the-luap/picpeak/issues) for bugs or features
-- Join [discussions](https://github.com/the-luap/picpeak/discussions) for questions
-- Security issues: Open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+- Create an issue for bugs or features
+- Join discussions for questions
+- Email: picpeak@example.com for security issues
 
 Thank you for contributing! 🎉

DEPLOYMENT.md

@@ -0,0 +1,220 @@
+# 🚀 PicPeak Deployment Guide
+
+This guide will help you deploy PicPeak in production. The entire process takes about 10-15 minutes.
+
+## 📋 Prerequisites
+
+- A server with Docker and Docker Compose installed
+- A domain name (for SSL certificates)
+- SMTP credentials for sending emails
+- Basic command line knowledge
+
+## 🏃 Quick Deploy (Recommended)
+
+### 1. Clone and Configure
+
+```bash
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy environment template
+cp .env.production.example .env
+
+# Generate a secure JWT secret
+echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
+
+# Edit configuration
+nano .env
+```
+
+### 2. Required Environment Variables
+
+Edit your `.env` file with these essential settings:
+
+```env
+# Application URLs
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+
+# Email Configuration (Required for notifications)
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+SMTP_FROM=your-email@gmail.com
+
+# Admin Configuration
+ADMIN_EMAIL=admin@your-domain.com
+ADMIN_PASSWORD=your-secure-password
+
+# Database (PostgreSQL for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=secure-db-password
+```
+
+### 3. Deploy with Docker Compose
+
+```bash
+# Start all services
+docker-compose -f docker-compose.prod.yml up -d
+
+# Check logs
+docker-compose logs -f
+
+# Access your site at https://your-domain.com
+```
+
+## 🔧 Configuration Options
+
+### Storage Settings
+
+```env
+# Storage paths (default: ./storage)
+STORAGE_PATH=./storage
+ARCHIVE_PATH=./storage/archives
+
+# Gallery expiration (days)
+DEFAULT_EXPIRATION_DAYS=30
+WARNING_DAYS_BEFORE_EXPIRY=7
+```
+
+### Security Settings
+
+```env
+# Session timeout (minutes)
+SESSION_TIMEOUT=60
+
+# Rate limiting
+RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100
+```
+
+### Analytics (Optional)
+
+```env
+# Umami Analytics
+VITE_UMAMI_URL=https://analytics.your-domain.com
+VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+## 🔒 SSL/TLS Setup
+
+The production Docker Compose includes automatic SSL via Let's Encrypt:
+
+1. **Ensure your domain points to your server**
+2. **Update nginx configuration**:
+   ```bash
+   nano nginx/nginx.conf
+   # Replace your-domain.com with your actual domain
+   ```
+3. **Start services** - Certbot will automatically obtain certificates
+
+## 📁 Directory Structure
+
+After deployment, your directory structure will be:
+
+```
+picpeak/
+├── backend/          # API server
+├── frontend/         # React app
+├── storage/          # Photo storage
+│   ├── events/       # Active galleries
+│   │   ├── active/   # Current photos
+│   │   └── archived/ # Expired galleries
+│   ├── thumbnails/   # Generated thumbnails
+│   └── uploads/      # User uploads
+├── data/            # Database files
+└── logs/            # Application logs
+```
+
+## 🔄 Maintenance
+
+### Backup
+
+```bash
+# Backup database and photos
+./scripts/backup.sh
+
+# Backups are stored in ./backups/
+```
+
+### Update
+
+```bash
+# Pull latest changes
+git pull
+
+# Rebuild and restart
+docker-compose -f docker-compose.prod.yml up -d --build
+```
+
+### Logs
+
+```bash
+# View all logs
+docker-compose logs
+
+# View specific service
+docker-compose logs backend
+docker-compose logs frontend
+```
+
+## 🚨 Troubleshooting
+
+### Common Issues
+
+**Photos not appearing:**
+- Check storage permissions: `chmod -R 755 storage/`
+- Verify file watcher is running: `docker-compose logs backend | grep watcher`
+
+**Email not sending:**
+- Test SMTP settings: Admin Panel → Settings → Email → Send Test
+- Check email queue: Admin Panel → System → Email Queue
+
+**Can't access admin panel:**
+- Default login: Use email/password from `.env`
+- Reset password: `docker exec picpeak-backend npm run reset-admin`
+
+### Health Check
+
+```bash
+# Check service status
+docker-compose ps
+
+# Test backend API
+curl https://your-domain.com/api/health
+
+# Check disk space
+df -h storage/
+```
+
+## 🐳 Alternative Deployment Methods
+
+### Using Docker Swarm
+
+For high availability deployments, see [Docker Swarm Setup](deploy/README.md).
+
+### Manual Installation
+
+If you prefer not to use Docker:
+
+1. Install Node.js 18+
+2. Install PostgreSQL
+3. Clone repository
+4. Install dependencies: `npm install` in both `/backend` and `/frontend`
+5. Build frontend: `cd frontend && npm run build`
+6. Start services with PM2
+
+## 📞 Support
+
+- 📘 [Documentation](https://github.com/the-luap/picpeak)
+- 🐛 [Report Issues](https://github.com/the-luap/picpeak/issues)
+- 💬 [Discussions](https://github.com/the-luap/picpeak/discussions)
+
+---
+
+**Need help?** Open an issue on GitHub and we'll assist you!

DEPLOYMENT_GUIDE.md

@@ -1,527 +0,0 @@
-# 🚀 PicPeak Deployment Guide
-
-This guide covers deploying PicPeak using Docker Compose with direct port exposure. For internet-facing deployments, you'll need to add a reverse proxy (nginx, Traefik, Caddy, etc.) for SSL/HTTPS.
-
-## 📋 Table of Contents
-
-- [Prerequisites](#prerequisites)
-- [Quick Start](#quick-start)
-- [Configuration](#configuration)
-- [Deployment](#deployment)
-- [Reverse Proxy Setup](#reverse-proxy-setup)
-- [Maintenance](#maintenance)
-- [Troubleshooting](#troubleshooting)
-
-## Prerequisites
-
-- Docker and Docker Compose installed
-- Domain name (for production)
-- SMTP server credentials for emails
-- At least 2GB RAM and 20GB storage
-
-## 🚀 Quick Start
-
-1. **Clone the repository**
-   ```bash
-   git clone https://github.com/the-luap/picpeak.git
-   cd picpeak
-   ```
-
-2. **Set up environment**
-   ```bash
-   cp .env.example .env
-   nano .env  # Edit with your values
-   ```
-
-3. **Create required directories**
-   ```bash
-   mkdir -p events/active events/archived data logs backup storage
-   chmod -R 755 events data logs backup storage
-   ```
-
-4. **Deploy**
-   ```bash
-   docker compose up -d
-   ```
-
-5. **Check logs**
-   ```bash
-   docker compose logs -f
-   ```
-
-## 🔧 Configuration
-
-### Essential Environment Variables
-
-Generate secure values:
-```bash
-# JWT Secret
-openssl rand -base64 64
-
-# Database Password (avoid $ character - see warning below)
-openssl rand -base64 32 | tr -d '$'
-
-# Redis Password (avoid $ character - see warning below)
-openssl rand -base64 32 | tr -d '$'
-```
-
-⚠️ **PASSWORD WARNING**: Docker Compose interprets `$` as variable substitution. Either:
-- Avoid `$` in passwords (recommended - use the commands above)
-- Escape `$` as `$$` (e.g., `Pass$$word` instead of `Pass$word`)
-- Quote the entire value: `DB_PASSWORD='Pass$word'` (less reliable)
-
-Update `.env` with:
-- `JWT_SECRET` - Authentication secret (REQUIRED - generate a secure random value)
-- `DB_PASSWORD` - PostgreSQL password
-- `REDIS_PASSWORD` - Redis password
-- `SMTP_*` - Email configuration
-- **CRITICAL URL Configuration** (must match your deployment):
-  - `FRONTEND_URL` - Frontend URL with port (e.g., `http://yourdomain.com:3000`)
-  - `ADMIN_URL` - Backend URL with port (e.g., `http://yourdomain.com:3001`)
-  - `VITE_API_URL` - Backend API URL (e.g., `http://yourdomain.com:3001/api`)
-
-⚠️ **IMPORTANT**: These URLs MUST include the correct ports and match exactly how users will access your site. Mismatched URLs will cause CORS errors and login failures!
-
-### Email Configuration Examples
-
-#### Gmail
-```env
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-specific-password
-```
-
-#### SendGrid
-```env
-SMTP_HOST=smtp.sendgrid.net
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=your-sendgrid-api-key
-```
-
-## 📦 Deployment
-
-### Build and Start Services
-
-```bash
-# Build images
-docker compose build
-
-# Start all services
-docker compose up -d
-
-# View running containers
-docker compose ps
-```
-
-### Access Points
-
-By default, services are exposed on:
-- Frontend: http://localhost:3000
-- Backend/API: http://localhost:3001
-- PostgreSQL: localhost:5432 (if needed)
-- Redis: localhost:6379 (if needed)
-
-### Initial Admin Setup
-
-When deploying for the first time, an admin account is automatically created with a secure random password. You need to retrieve this password to access the admin panel.
-
-#### Finding the Admin Password
-
-**Option 1: Check the backend logs** (recommended)
-```bash
-# View the initial setup logs
-docker compose logs backend | grep -A 10 "Admin user created"
-```
-
-You should see output like:
-```
-========================================
-✅ Admin user created successfully!
-========================================
-Email: admin@example.com
-Password: BraveTiger6231!
-
-⚠️  IMPORTANT:
-1. Save these credentials securely
-2. Please change the password after first login
-========================================
-```
-
-**Note**: You login with the **email address**, not a username!
-
-**Option 2: Check the saved credentials file**
-```bash
-# The password is saved in the backend container
-docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
-```
-
-**Option 3: Use the helper script**
-```bash
-# Show current admin username and email (password is hidden)
-docker exec picpeak-backend node scripts/show-admin-credentials.js
-
-# Reset the admin password to a new random password
-docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
-```
-
-#### Important Notes
-
-- **Login requires the email address**, not username
-- The admin password is only shown once during initial setup
-- If you lose the password, use the `--reset` option to generate a new one
-- You must change the password on first login (enforced by the system)
-- Password requirements: minimum 12 characters, mixed case, numbers, and special characters
-
-#### Configuring Admin Email
-
-By default, the admin email is `admin@example.com`. To use a different email address, set it in your `.env` file before first deployment:
-
-```env
-# .env
-ADMIN_EMAIL=your-email@yourdomain.com
-```
-
-**Note**: This only works on first deployment. To change the admin email after deployment, you'll need to update it in the database or create a new admin user through the admin panel.
-
-## 🔒 Reverse Proxy Setup
-
-For production deployments, you should use a reverse proxy for SSL/HTTPS. The application exposes ports directly, allowing you to use any reverse proxy solution.
-
-### Option 1: Nginx
-
-Install nginx and create `/etc/nginx/sites-available/picpeak`:
-
-```nginx
-server {
-    listen 80;
-    server_name your-domain.com;
-    return 301 https://$server_name$request_uri;
-}
-
-server {
-    listen 443 ssl http2;
-    server_name your-domain.com;
-
-    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
-
-    # Frontend
-    location / {
-        proxy_pass http://localhost:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Backend API
-    location /api {
-        proxy_pass http://localhost:3001;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Protected photos and uploads
-    location ~ ^/(photos|thumbnails|uploads) {
-        proxy_pass http://localhost:3001;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
-    # Admin routes
-    location /admin {
-        proxy_pass http://localhost:3001;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
-```
-
-Enable the site:
-```bash
-sudo ln -s /etc/nginx/sites-available/picpeak /etc/nginx/sites-enabled/
-sudo nginx -t
-sudo systemctl reload nginx
-```
-
-### Option 2: Traefik
-
-Add labels to `docker-compose.override.yml`:
-
-```yaml
-version: '3.8'
-
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`your-domain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-
-  backend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-api.rule=Host(`your-domain.com`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3001"
-```
-
-### Option 3: Caddy
-
-Create a `Caddyfile`:
-
-```caddyfile
-your-domain.com {
-    # Frontend
-    handle /* {
-        reverse_proxy localhost:3000
-    }
-
-    # Backend API and admin
-    handle /api/* {
-        reverse_proxy localhost:3001
-    }
-    
-    handle /admin/* {
-        reverse_proxy localhost:3001
-    }
-
-    # Protected resources
-    handle /photos/* {
-        reverse_proxy localhost:3001
-    }
-
-    handle /thumbnails/* {
-        reverse_proxy localhost:3001
-    }
-
-    handle /uploads/* {
-        reverse_proxy localhost:3001
-    }
-}
-```
-
-### SSL Certificates
-
-For any reverse proxy, you can use Let's Encrypt:
-
-```bash
-# With Certbot
-sudo certbot certonly --webroot -w /var/www/certbot -d your-domain.com
-
-# Or use your reverse proxy's built-in ACME support
-```
-
-## 🔧 Maintenance
-
-### Viewing Logs
-
-```bash
-# All services
-docker compose logs -f
-
-# Specific service
-docker compose logs -f backend
-docker compose logs -f frontend
-```
-
-### Backup
-
-#### Manual Backup
-```bash
-# Database backup
-docker exec picpeak-postgres pg_dump -U picpeak picpeak_prod > backup/db_$(date +%Y%m%d_%H%M%S).sql
-
-# Files backup
-tar -czf backup/photos_$(date +%Y%m%d_%H%M%S).tar.gz events/
-```
-
-#### Automated Backup
-The application includes a built-in backup service. Configure it in the admin panel:
-1. Login to admin panel
-2. Go to Settings → Backup
-3. Configure destination and schedule
-4. Enable backup service
-
-### Updates
-
-```bash
-# Pull latest changes
-git pull
-
-# Rebuild and restart
-docker compose down
-docker compose build
-docker compose up -d
-```
-
-### Database Migrations
-
-Migrations run automatically on startup, but you can run them manually:
-
-```bash
-docker exec picpeak-backend npm run migrate
-```
-
-## 🚨 Troubleshooting
-
-### Common Issues
-
-#### 502 Bad Gateway / Login Failures
-**This is the most common deployment issue!** Usually caused by misconfigured URLs or network problems:
-
-1. **CORS Configuration Errors**:
-   ```bash
-   # WRONG - Missing port will cause CORS errors
-   FRONTEND_URL=http://10.0.252.12
-   
-   # CORRECT - Include the port you're accessing from
-   FRONTEND_URL=http://10.0.252.12:3000
-   ```
-   
-   The backend validates Origin headers against `FRONTEND_URL` for CORS. If they don't match exactly, you'll get 500 errors on login.
-
-2. **After Container Restarts**:
-   - Nginx may have cached old container IPs
-   - Solution: `docker restart picpeak-frontend`
-   - Always wait 30-60 seconds for health checks
-
-3. **Backend Not Starting After Migrations**:
-   - The logs may only show migrations completed
-   - Check if server is actually running: `docker exec picpeak-backend ps aux | grep node`
-   - Should see `node server.js` process
-
-4. **Login After Fresh Install**:
-   - Check migration logs for generated credentials
-   - Username: `admin` or the email shown in logs
-   - Password: Shown during first migration (e.g., `SharpPhoenix9920$`)
-
-5. **Complete Fix Sequence**:
-   ```bash
-   # 1. Fix your .env file URLs
-   # 2. Full restart
-   docker-compose down
-   docker-compose up -d
-   
-   # 3. Wait for healthy status
-   sleep 60
-   docker ps  # All should show (healthy)
-   
-   # 4. Test backend directly
-   curl http://localhost:3001/health
-   
-   # 5. Test through frontend
-   curl http://localhost:3000/api/public/settings
-   ```
-
-#### Port Already in Use
-```bash
-# Check what's using the port
-sudo lsof -i :3000
-sudo lsof -i :3001
-
-# Change ports in .env
-FRONTEND_PORT=3002
-BACKEND_PORT=3003
-```
-
-#### Docker Compose Variable Substitution Errors
-If you see warnings like:
-```
-WARN[0000] The "fgbf" variable is not set. Defaulting to a blank string.
-```
-
-This means your password contains `$` which Docker Compose interprets as a variable. Solutions:
-1. **Best**: Generate passwords without `$`: `openssl rand -base64 32 | tr -d '$'`
-2. **Alternative**: Escape `$` as `$$` in your .env file
-3. **Example**: `DB_PASSWORD=Pass@#$$fgbf` instead of `DB_PASSWORD=Pass@#$fgbf`
-
-#### Permission Errors
-```bash
-# Fix ownership
-sudo chown -R 1000:1000 events data logs backup storage
-chmod -R 755 events data logs backup storage
-```
-
-#### Database Connection Issues
-```bash
-# Check if database is running
-docker compose ps
-docker compose logs postgres
-
-# Test connection
-docker exec picpeak-postgres pg_isready
-```
-
-#### Email Not Sending
-- Verify SMTP settings in .env
-- Check email queue: `docker exec picpeak-backend psql -U picpeak -d picpeak_prod -c "SELECT * FROM email_queue ORDER BY created_at DESC LIMIT 10;"`
-- For Gmail, use app-specific password
-- Check logs: `docker compose logs backend | grep email`
-
-### Health Checks
-
-```bash
-# Backend health
-curl http://localhost:3001/api/health
-
-# Frontend health
-curl http://localhost:3000
-
-# Database health
-docker exec picpeak-postgres pg_isready
-```
-
-### Useful Commands
-
-```bash
-# Enter backend container
-docker exec -it picpeak-backend sh
-
-# Enter database
-docker exec -it picpeak-postgres psql -U picpeak picpeak_prod
-
-# Reset admin password
-docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
-
-# Check disk usage
-df -h
-du -sh events/ storage/ backup/
-
-# View running processes
-docker compose top
-```
-
-## Security Recommendations
-
-1. **Use HTTPS**: Always use a reverse proxy with SSL in production
-2. **Firewall**: Only expose necessary ports (80, 443)
-3. **Secure passwords**: Use strong, unique passwords for all services
-4. **Regular updates**: Keep Docker images and system packages updated
-5. **Backup strategy**: Set up automated backups and test restoration
-6. **Monitor logs**: Regularly check logs for suspicious activity
-7. **Rate limiting**: The app includes built-in rate limiting, configure as needed
-
-## Support
-
-For issues and questions:
-- Check logs first: `docker compose logs`
-- Review documentation in the repository
-- Check existing issues on GitHub
-- Create a new issue with:
-  - Error messages
-  - Log output
-  - Environment details (without secrets)
-  - Steps to reproduce

PRODUCTION_DEPLOYMENT_GUIDE.md

@@ -0,0 +1,378 @@
+# Production Deployment Guide
+
+This comprehensive guide addresses all production deployment scenarios and common issues.
+
+## Pre-Deployment Checklist
+
+### 1. Environment Variables
+Create a `.env` file with ALL required variables:
+
+```bash
+# CRITICAL - Must change these!
+JWT_SECRET=<generate-with-openssl-rand-base64-32>
+DB_PASSWORD=<strong-password>
+
+# Application URLs (your actual domain)
+ADMIN_URL=https://yourdomain.com
+FRONTEND_URL=https://yourdomain.com
+BACKEND_URL=https://yourdomain.com
+
+# Database (PostgreSQL)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or external host
+DB_PORT=5432
+DB_USER=picpeak
+DB_NAME=picpeak
+
+# Email Configuration (required for notifications)
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password  # Use app-specific password
+EMAIL_FROM=PicPeak <noreply@yourdomain.com>
+
+# Port Configuration
+PORT=3001
+
+# Performance Tuning
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+NODE_ENV=production
+LOG_LEVEL=info
+
+# Optional: Umami Analytics (configured via Admin UI)
+# UMAMI_URL=https://analytics.yourdomain.com
+# UMAMI_WEBSITE_ID=your-website-id
+```
+
+### 2. Generate Secrets
+
+```bash
+# Generate JWT Secret (REQUIRED)
+openssl rand -base64 32
+
+# Generate Database Password
+openssl rand -base64 24
+```
+
+## Frontend Configuration
+
+For production deployment behind a reverse proxy:
+
+### Frontend Environment
+```bash
+# frontend/.env.production
+VITE_API_URL=/api  # Uses relative path for reverse proxy
+
+# Optional: Umami fallback (primary config via Admin UI)
+# VITE_UMAMI_URL=https://analytics.yourdomain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+This ensures all API calls use the same domain/protocol as the frontend.
+
+### Nginx Proxy Configuration
+
+The frontend nginx configuration already includes proper proxy settings for:
+- `/api` → Backend API
+- `/photos` → Protected photo access
+- `/thumbnails` → Thumbnail images
+- `/uploads` → Public uploads (logos, favicons)
+
+All static assets are served through the nginx proxy, inheriting authentication headers.
+
+## Deployment Steps
+
+### 1. Initial Setup
+
+```bash
+# Clone repository
+git clone https://github.com/the-luap/wedding-photo-sharing.git
+cd wedding-photo-sharing
+
+# Create required directories
+mkdir -p storage/events/active storage/events/archived storage/thumbnails storage/uploads
+mkdir -p data logs
+mkdir -p certbot/conf certbot/www
+
+# Set permissions (important!)
+chmod -R 755 storage data logs
+```
+
+### 2. Fix Docker Volume Permissions
+
+Create `docker-compose.override.yml` for local volume configuration:
+
+```yaml
+version: '3.8'
+
+services:
+  backend:
+    volumes:
+      - ./storage:/app/storage:delegated
+      - ./data:/app/data:delegated
+      - ./logs:/app/logs:delegated
+    user: "1001:1001"  # nodejs user
+
+  db:
+    volumes:
+      - ./postgres-data:/var/lib/postgresql/data
+```
+
+### 3. Build and Deploy
+
+```bash
+# Build images
+docker-compose -f docker-compose.prod.yml build
+
+# Start services
+docker-compose -f docker-compose.prod.yml up -d
+
+# Check logs
+docker-compose -f docker-compose.prod.yml logs -f backend
+```
+
+### 4. Initial Admin Setup
+
+The admin user is automatically created during database migration:
+
+```bash
+# Run migrations (this creates admin user)
+docker-compose -f docker-compose.prod.yml exec backend npm run migrate
+
+# Admin credentials will be displayed in console and saved to ADMIN_CREDENTIALS.txt
+# Example output:
+# ========================================
+# ✅ Admin user created successfully!
+# ========================================
+# Username: admin
+# Password: SwiftEagle3847!
+# 
+# ⚠️  IMPORTANT: Change password on first login
+# ========================================
+
+# Retrieve credentials if needed
+docker-compose -f docker-compose.prod.yml exec backend cat ADMIN_CREDENTIALS.txt
+```
+
+**Important**: You MUST change the auto-generated password on first login.
+
+### 5. Configure Email (if using database config)
+
+1. Login to admin panel: https://yourdomain.com/admin
+2. Go to Settings > Email Configuration
+3. Enter SMTP details
+4. Test email sending
+
+## Common Issues and Solutions
+
+### Issue 1: Migration Failures
+
+**Error**: "relation already exists"
+
+**Solution**: The safe migration runner handles this automatically. If issues persist:
+
+```bash
+# Reset migrations tracking
+docker-compose -f docker-compose.prod.yml exec db psql -U picpeak -d picpeak
+
+# In PostgreSQL:
+DROP TABLE IF EXISTS migrations;
+\q
+
+# Re-run migrations
+docker-compose -f docker-compose.prod.yml exec backend npm run migrate:safe
+```
+
+### Issue 2: Permission Denied Errors
+
+**Error**: "EACCES: permission denied"
+
+**Solution**: Fix container permissions:
+
+```bash
+# Stop containers
+docker-compose -f docker-compose.prod.yml down
+
+# Fix permissions on host
+sudo chown -R 1001:1001 storage data logs
+
+# Restart
+docker-compose -f docker-compose.prod.yml up -d
+```
+
+### Issue 3: Database Connection Failed
+
+**Error**: "no pg_hba.conf entry"
+
+**Solution**: Already fixed in docker-compose.prod.yml with:
+- SSL disabled for internal Docker network
+- Proper authentication method (scram-sha-256)
+
+### Issue 4: Frontend Can't Connect to Backend
+
+**Error**: CORS errors or connection refused
+
+**Solution**: Ensure environment variables match:
+- Backend: `FRONTEND_URL` must match your frontend URL
+- Frontend: `VITE_API_URL` must be set during build
+
+### Issue 5: Email Not Sending
+
+**Solution**: Check email configuration:
+
+```bash
+# Check backend logs
+docker-compose -f docker-compose.prod.yml logs backend | grep email
+
+# Verify SMTP settings
+# Gmail users: Use app password, not regular password
+# Enable "Less secure app access" or use OAuth2
+```
+
+## SSL/HTTPS Setup
+
+### Option 1: Using Traefik (Recommended)
+
+Add these labels to your docker-compose override:
+
+```yaml
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
+      - "traefik.http.routers.picpeak.entrypoints=websecure"
+      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
+```
+
+### Option 2: Using Certbot
+
+1. Update `nginx/sites-enabled/default` with your domain
+2. Run certbot:
+
+```bash
+# Initial certificate
+docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
+  --webroot --webroot-path=/var/www/certbot \
+  -d yourdomain.com -d www.yourdomain.com
+
+# Auto-renewal is handled by the certbot container
+```
+
+## Monitoring
+
+### Health Checks
+
+```bash
+# Backend health
+curl http://localhost/api/health
+
+# Database connection
+docker-compose -f docker-compose.prod.yml exec backend \
+  psql -U picpeak -d picpeak -c "SELECT 1"
+```
+
+### Logs
+
+```bash
+# All services
+docker-compose -f docker-compose.prod.yml logs -f
+
+# Specific service
+docker-compose -f docker-compose.prod.yml logs -f backend
+```
+
+## Backup and Restore
+
+### Backup
+
+```bash
+#!/bin/bash
+# backup.sh
+DATE=$(date +%Y%m%d_%H%M%S)
+BACKUP_DIR="./backups/$DATE"
+
+mkdir -p $BACKUP_DIR
+
+# Database
+docker-compose -f docker-compose.prod.yml exec -T db \
+  pg_dump -U picpeak picpeak > $BACKUP_DIR/database.sql
+
+# Files
+tar -czf $BACKUP_DIR/storage.tar.gz storage/
+
+echo "Backup completed: $BACKUP_DIR"
+```
+
+### Restore
+
+```bash
+# Database
+docker-compose -f docker-compose.prod.yml exec -T db \
+  psql -U picpeak picpeak < ./backups/20240713_120000/database.sql
+
+# Files
+tar -xzf ./backups/20240713_120000/storage.tar.gz
+```
+
+## Production Best Practices
+
+1. **Always use named volumes** in production for better data persistence
+2. **Set up monitoring** with Prometheus/Grafana
+3. **Enable backups** with automated scripts
+4. **Use a reverse proxy** (Nginx) for SSL termination
+5. **Implement rate limiting** at the Nginx level
+6. **Regular updates** - Keep Docker images updated
+7. **Log rotation** - Configure log rotation for application logs
+
+## Troubleshooting Commands
+
+```bash
+# Check running containers
+docker-compose -f docker-compose.prod.yml ps
+
+# Restart a service
+docker-compose -f docker-compose.prod.yml restart backend
+
+# View real-time logs
+docker-compose -f docker-compose.prod.yml logs -f --tail=100
+
+# Execute commands in container
+docker-compose -f docker-compose.prod.yml exec backend sh
+
+# Database shell
+docker-compose -f docker-compose.prod.yml exec db psql -U picpeak
+
+# Clean restart
+docker-compose -f docker-compose.prod.yml down
+docker-compose -f docker-compose.prod.yml up -d
+```
+
+## Security Checklist
+
+- [ ] Strong JWT_SECRET (min 32 chars)
+- [ ] Strong database password
+- [ ] Admin password changed from auto-generated one
+- [ ] SSL/HTTPS enabled
+- [ ] Firewall configured (only 80/443 open)
+- [ ] Regular security updates
+- [ ] Backup encryption
+- [ ] Access logs monitored
+- [ ] Rate limiting enabled (built-in)
+- [ ] File upload restrictions configured
+- [ ] Password complexity requirements configured (Admin > Settings)
+- [ ] Session timeout configured (default 60 min)
+- [ ] Umami analytics configured (if using)
+- [ ] SMTP credentials secured with app-specific password
+
+## Support
+
+For issues not covered here:
+1. Check application logs
+2. Review error messages carefully
+3. Ensure all environment variables are set
+4. Verify file permissions
+5. Check Docker daemon logs

README.md

@@ -71,7 +71,7 @@ docker-compose up -d
 
 ## 📖 Documentation
 
-- 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
+- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
@@ -94,20 +94,6 @@ Perfect for:
 - **Email**: SMTP with customizable templates
 - **Analytics**: Privacy-focused with Umami integration
 
-## 💻 System Requirements
-
-### Minimum Requirements
-- **CPU**: 2 CPU cores
-- **RAM**: 2GB minimum
-- **Storage**: 20GB minimum (plus photo storage needs)
-- **OS**: Linux (Ubuntu 20.04+), macOS, or Windows with WSL2
-- **Node.js**: v18.0.0 or higher
-- **Database**: SQLite (included) or PostgreSQL 12+
-
-### Docker Requirements (Recommended)
-- **Docker**: v20.10.0+
-- **Docker Compose**: v2.0.0+
-
 ## 🤝 Contributing
 
 We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
@@ -138,7 +124,7 @@ PicPeak takes security seriously:
 - 📝 Activity logging
 - 🔒 Secure file access
 
-Found a security issue? Please open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
+Found a security issue? Please email security@example.com
 
 ## 📸 Screenshots
 
@@ -182,9 +168,8 @@ We're constantly improving PicPeak and welcome contributions from our community!
 | **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
 | **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
-| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented (not tested) |
+| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | 🔄 Open |
 | **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
-| **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
 
 **Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
 
@@ -192,16 +177,6 @@ We're constantly improving PicPeak and welcome contributions from our community!
 
 PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
 
-### 🤖 AI-Assisted Development
-
-This project was generated with the assistance of AI technology, but has been:
-- ✅ **Fully tested end-to-end** by human developers
-- 🔒 **Security audited** with comprehensive security checks
-- 👨‍💻 **Human-reviewed** for code quality and best practices
-- 🧪 **Production-tested** in real-world scenarios
-
-We believe in transparent development practices and the responsible use of AI as a tool to accelerate development while maintaining high standards of quality and security.
-
 ## 📄 License
 
 PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
@@ -209,7 +184,7 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
 ## 🚀 Ready to Get Started?
 
 1. ⭐ **Star this repository** to show your support
-2. 📖 Read the [Deployment Guide](DEPLOYMENT_GUIDE.md)
+2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
 3. 🐛 Report issues or request features
 4. 🤝 Join our community and contribute!
 
@@ -219,6 +194,6 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
   Made with ❤️ by photographers, for photographers
   <br>
   <a href="https://github.com/the-luap/picpeak">GitHub</a> •
-  <a href="DEPLOYMENT_GUIDE.md">Documentation</a> •
+  <a href="DEPLOYMENT.md">Documentation</a> •
   <a href="https://github.com/the-luap/picpeak/issues">Support</a>
 </p>

SECURITY.md

@@ -15,14 +15,11 @@ We take the security of PicPeak seriously. If you have discovered a security vul
 
 ### 1. **Do NOT create a public GitHub issue**
 
-### 2. Report the vulnerability by:
-- Opening a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
-- Mark it clearly as "SECURITY" in the title
-- Include:
-  - Description of the vulnerability
-  - Steps to reproduce
-  - Potential impact
-  - Suggested fix (if any)
+### 2. Email us at security@example.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
 
 ### 3. You can expect:
 - Acknowledgment within 48 hours
@@ -82,7 +79,7 @@ We believe in responsible disclosure. Once a vulnerability is fixed:
 
 ## Contact
 
-- Security issues: [Create a security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub
-- General support: [GitHub Issues](https://github.com/the-luap/picpeak/issues)
+- Security issues: security@example.com
+- General support: https://github.com/the-luap/picpeak/issues
 
 Thank you for helping keep PicPeak and its users safe!

backend/.env.example

@@ -12,7 +12,6 @@ JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456
 # URLs (adjust for your domain)
 ADMIN_URL=https://photos.example.com
 FRONTEND_URL=https://photos.example.com
-BACKEND_URL=https://photos.example.com  # Or https://api.photos.example.com if separate
 
 # Database Configuration
 DATABASE_CLIENT=pg

backend/migrations/004_add_categories_and_cms.js

@@ -1,4 +1,4 @@
-const { db } = require('../../src/database/db');
+const { db } = require('../src/database/db');
 
 async function up() {
   console.log('Adding photo categories and CMS tables...');
@@ -40,7 +40,7 @@ async function up() {
   // Add language preference to app_settings for global default
   await db('app_settings').insert({
     setting_key: 'default_language',
-    setting_value: JSON.stringify('en'),
+    setting_value: 'en',
     setting_type: 'general',
     updated_at: new Date()
   });

backend/migrations/014_add_default_welcome_message.js

@@ -8,7 +8,8 @@ exports.up = async function(knex) {
     await knex('app_settings').insert({
       setting_key: 'general_default_welcome_message',
       setting_value: JSON.stringify('Thank you for using our photo sharing service! We hope you enjoy your photos.'),
-      setting_type: 'general'
+      setting_type: 'general',
+      updated_at: new Date()
     });
   }
 

backend/migrations/014_add_host_name_to_events.js

@@ -1,4 +1,4 @@
-const { db } = require('../../src/database/db');
+const { db } = require('../src/database/db');
 
 async function up() {
   // Check if host_name column already exists

backend/migrations/027_add_rate_limit_settings.js

@@ -41,7 +41,8 @@ exports.up = async function(knex) {
     
     if (!exists) {
       await knex('app_settings').insert({
-        ...setting
+        ...setting,
+        updated_at: knex.fn.now()
       });
     }
   }

backend/migrations/029_add_backup_service_tables.js

@@ -1,4 +1,4 @@
-const { db } = require('../../src/database/db');
+const { db } = require('../src/database/db');
 
 async function up() {
   console.log('Adding backup service tables and settings...');
@@ -156,8 +156,9 @@ async function up() {
   const backupEmailTemplates = [
     {
       template_key: 'backup_failed',
-      subject: 'Backup Failed - Immediate Attention Required',
-      body_html: `<h2>Backup Failed</h2>
+      subject_en: 'Backup Failed - Immediate Attention Required',
+      subject_de: 'Backup fehlgeschlagen - Sofortige Aufmerksamkeit erforderlich',
+      body_html_en: `<h2>Backup Failed</h2>
 <p>The scheduled backup has failed and requires immediate attention.</p>
 <p><strong>Error Details:</strong></p>
 <ul>
@@ -166,13 +167,24 @@ async function up() {
   <li>Error: {{error_message}}</li>
 </ul>
 <p>Please check the system logs for more details and resolve the issue as soon as possible.</p>`,
-      body_text: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
+      body_html_de: `<h2>Backup fehlgeschlagen</h2>
+<p>Das geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und beheben Sie das Problem so schnell wie möglich.</p>`,
+      body_text_en: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
+      body_text_de: 'Backup fehlgeschlagen\n\nDas geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.\n\nStartzeit: {{start_time}}\nBackup-Typ: {{backup_type}}\nFehler: {{error_message}}\n\nBitte überprüfen Sie die Systemprotokolle für weitere Details.',
       variables: JSON.stringify(['start_time', 'backup_type', 'error_message'])
     },
     {
       template_key: 'backup_completed',
-      subject: 'Backup Completed Successfully',
-      body_html: `<h2>Backup Completed</h2>
+      subject_en: 'Backup Completed Successfully',
+      subject_de: 'Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Backup Completed</h2>
 <p>The scheduled backup has been completed successfully.</p>
 <p><strong>Backup Summary:</strong></p>
 <ul>
@@ -182,7 +194,18 @@ async function up() {
   <li>Total Size: {{total_size}}</li>
   <li>Backup Type: {{backup_type}}</li>
 </ul>`,
-      body_text: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
+      body_html_de: `<h2>Backup abgeschlossen</h2>
+<p>Das geplante Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Gesicherte Dateien: {{files_count}}</li>
+  <li>Gesamtgröße: {{total_size}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+</ul>`,
+      body_text_en: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
+      body_text_de: 'Backup abgeschlossen\n\nDas geplante Backup wurde erfolgreich abgeschlossen.\n\nStartzeit: {{start_time}}\nDauer: {{duration}}\nGesicherte Dateien: {{files_count}}\nGesamtgröße: {{total_size}}\nBackup-Typ: {{backup_type}}',
       variables: JSON.stringify(['start_time', 'duration', 'files_count', 'total_size', 'backup_type'])
     }
   ];

backend/migrations/030_add_database_backup_tables.js

@@ -1,4 +1,4 @@
-const { db } = require('../../src/database/db');
+const { db } = require('../src/database/db');
 
 async function up() {
   console.log('Adding database backup tables and settings...');
@@ -96,8 +96,9 @@ async function up() {
   const databaseBackupEmailTemplates = [
     {
       template_key: 'database_backup_failed',
-      subject: 'Database Backup Failed - Critical Alert',
-      body_html: `<h2>Database Backup Failed</h2>
+      subject_en: 'Database Backup Failed - Critical Alert',
+      subject_de: 'Datenbank-Backup fehlgeschlagen - Kritische Warnung',
+      body_html_en: `<h2>Database Backup Failed</h2>
 <p>The scheduled database backup has failed and requires immediate attention.</p>
 <p><strong>Error Details:</strong></p>
 <ul>
@@ -106,13 +107,24 @@ async function up() {
   <li>Error: {{error_message}}</li>
 </ul>
 <p>This is a critical issue that could affect disaster recovery. Please investigate immediately.</p>`,
-      body_text: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
+      body_html_de: `<h2>Datenbank-Backup fehlgeschlagen</h2>
+<p>Das geplante Datenbank-Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Zeitstempel: {{timestamp}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Dies ist ein kritisches Problem, das die Disaster-Recovery beeinträchtigen könnte. Bitte untersuchen Sie es sofort.</p>`,
+      body_text_en: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
+      body_text_de: 'Datenbank-Backup fehlgeschlagen\n\nDas geplante Datenbank-Backup ist fehlgeschlagen.\n\nBackup-Typ: {{backup_type}}\nZeitstempel: {{timestamp}}\nFehler: {{error_message}}\n\nDies ist kritisch - bitte sofort untersuchen.',
       variables: JSON.stringify(['backup_type', 'timestamp', 'error_message'])
     },
     {
       template_key: 'database_backup_completed',
-      subject: 'Database Backup Completed Successfully',
-      body_html: `<h2>Database Backup Completed</h2>
+      subject_en: 'Database Backup Completed Successfully',
+      subject_de: 'Datenbank-Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Database Backup Completed</h2>
 <p>The scheduled database backup has been completed successfully.</p>
 <p><strong>Backup Summary:</strong></p>
 <ul>
@@ -122,7 +134,18 @@ async function up() {
   <li>Compression Ratio: {{compression_ratio}}</li>
   <li>File Path: {{file_path}}</li>
 </ul>`,
-      body_text: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
+      body_html_de: `<h2>Datenbank-Backup abgeschlossen</h2>
+<p>Das geplante Datenbank-Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Dateigröße: {{file_size}}</li>
+  <li>Komprimierungsverhältnis: {{compression_ratio}}</li>
+  <li>Dateipfad: {{file_path}}</li>
+</ul>`,
+      body_text_en: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
+      body_text_de: 'Datenbank-Backup abgeschlossen\n\nDas geplante Datenbank-Backup wurde erfolgreich abgeschlossen.\n\nBackup-Typ: {{backup_type}}\nDauer: {{duration}}\nDateigröße: {{file_size}}\nKomprimierungsverhältnis: {{compression_ratio}}\nDateipfad: {{file_path}}',
       variables: JSON.stringify(['backup_type', 'duration', 'file_size', 'compression_ratio', 'file_path'])
     }
   ];

backend/migrations/031_add_backup_manifest_columns.js

@@ -1,5 +1,5 @@
-const { db } = require('../../src/database/db');
-const logger = require('../../src/utils/logger');
+const { db } = require('../src/database/db');
+const logger = require('../src/utils/logger');
 
 async function up() {
   console.log('Adding backup manifest columns...');

backend/migrations/031_enhance_backup_system.js

@@ -0,0 +1,131 @@
+exports.up = function(knex) {
+  return knex.schema
+    // Add new settings to app_settings table
+    .table('app_settings', table => {
+      // S3 configuration enhancements
+      table.boolean('backup_s3_force_path_style').defaultTo(false).comment('Force path-style S3 URLs (for MinIO/self-hosted)');
+      table.boolean('backup_s3_ssl_enabled').defaultTo(true).comment('Enable SSL/TLS for S3 connections');
+      table.string('backup_s3_prefix', 255).comment('S3 key prefix for organizing backups');
+      
+      // Backup features
+      table.boolean('backup_incremental').defaultTo(false).comment('Enable incremental backups');
+      table.boolean('backup_include_database').defaultTo(true).comment('Include database dumps in backups');
+      table.boolean('backup_manifest_enabled').defaultTo(true).comment('Generate backup manifests');
+      table.enum('backup_manifest_format', ['json', 'yaml']).defaultTo('json').comment('Manifest file format');
+      table.boolean('backup_encryption_enabled').defaultTo(false).comment('Enable backup encryption');
+      table.string('backup_database_schedule', 100).comment('Separate cron schedule for database-only backups');
+    })
+    
+    // Enhance backup_runs table
+    .table('backup_runs', table => {
+      // Manifest tracking
+      table.string('manifest_path', 500).comment('Path to backup manifest file');
+      table.uuid('manifest_id').comment('Unique identifier for the manifest');
+      table.enum('manifest_format', ['json', 'yaml']).comment('Format of the manifest file');
+      
+      // Incremental backup support
+      table.integer('parent_backup_id').unsigned().references('id').inTable('backup_runs').onDelete('SET NULL').comment('Parent backup for incremental backups');
+      table.enum('backup_mode', ['full', 'incremental', 'database']).defaultTo('full').comment('Type of backup performed');
+      
+      // Add indexes for better query performance
+      table.index(['backup_mode', 'status'], 'idx_backup_runs_mode_status');
+      table.index(['parent_backup_id'], 'idx_backup_runs_parent');
+      table.index(['created_at', 'backup_mode'], 'idx_backup_runs_created_mode');
+    })
+    
+    // Create backup_manifest table for storing detailed manifest metadata
+    .createTable('backup_manifest', table => {
+      table.increments('id').primary();
+      table.integer('backup_run_id').unsigned().notNullable().references('id').inTable('backup_runs').onDelete('CASCADE');
+      table.uuid('manifest_id').notNullable().unique().comment('Unique identifier matching backup_runs.manifest_id');
+      table.string('version', 20).notNullable().defaultTo('1.0.0').comment('Manifest schema version');
+      table.enum('format', ['json', 'yaml']).notNullable().defaultTo('json');
+      
+      // Backup metadata
+      table.timestamp('backup_start').notNullable();
+      table.timestamp('backup_end').notNullable();
+      table.bigInteger('total_size').unsigned().comment('Total size of backup in bytes');
+      table.integer('file_count').unsigned().comment('Number of files in backup');
+      table.integer('photo_count').unsigned().comment('Number of photos backed up');
+      table.integer('event_count').unsigned().comment('Number of events backed up');
+      
+      // Incremental backup metadata
+      table.boolean('is_incremental').defaultTo(false);
+      table.uuid('parent_manifest_id').comment('Parent manifest ID for incremental backups');
+      table.timestamp('incremental_since').comment('Timestamp for incremental backup baseline');
+      
+      // Content checksums
+      table.string('checksum_algorithm', 50).defaultTo('sha256').comment('Algorithm used for checksums');
+      table.text('manifest_checksum').comment('Checksum of the manifest file itself');
+      
+      // Storage information
+      table.string('storage_location', 500).comment('Primary storage location (local path or S3 URI)');
+      table.string('storage_provider', 50).comment('Storage provider (local, s3, etc.)');
+      
+      // Encryption metadata
+      table.boolean('is_encrypted').defaultTo(false);
+      table.string('encryption_algorithm', 100).comment('Encryption algorithm used');
+      table.string('encryption_key_id', 255).comment('ID of encryption key used');
+      
+      // Additional metadata as JSON
+      table.json('metadata').comment('Additional metadata as JSON');
+      
+      // Timestamps
+      table.timestamps(true, true);
+      
+      // Indexes
+      table.index(['backup_run_id'], 'idx_manifest_backup_run');
+      table.index(['manifest_id'], 'idx_manifest_uuid');
+      table.index(['parent_manifest_id'], 'idx_manifest_parent');
+      table.index(['backup_start', 'backup_end'], 'idx_manifest_time_range');
+      table.index(['is_incremental', 'created_at'], 'idx_manifest_incremental_created');
+    })
+    
+    // Add composite indexes for common query patterns
+    .raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_recent_successful 
+      ON backup_runs(created_at DESC) 
+      WHERE status = 'completed' AND backup_mode = 'full';
+    `)
+    .raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_incremental_chain 
+      ON backup_runs(parent_backup_id, created_at) 
+      WHERE backup_mode = 'incremental';
+    `);
+};
+
+exports.down = function(knex) {
+  return knex.schema
+    // Drop indexes first
+    .raw('DROP INDEX IF EXISTS idx_backup_runs_incremental_chain;')
+    .raw('DROP INDEX IF EXISTS idx_backup_runs_recent_successful;')
+    
+    // Drop backup_manifest table
+    .dropTableIfExists('backup_manifest')
+    
+    // Remove columns from backup_runs table
+    .table('backup_runs', table => {
+      table.dropIndex(['backup_mode', 'status'], 'idx_backup_runs_mode_status');
+      table.dropIndex(['parent_backup_id'], 'idx_backup_runs_parent');
+      table.dropIndex(['created_at', 'backup_mode'], 'idx_backup_runs_created_mode');
+      
+      table.dropColumn('manifest_path');
+      table.dropColumn('manifest_id');
+      table.dropColumn('manifest_format');
+      table.dropColumn('parent_backup_id');
+      table.dropColumn('backup_mode');
+    })
+    
+    // Remove columns from app_settings table
+    .table('app_settings', table => {
+      table.dropColumn('backup_s3_force_path_style');
+      table.dropColumn('backup_s3_ssl_enabled');
+      table.dropColumn('backup_s3_prefix');
+      table.dropColumn('backup_incremental');
+      table.dropColumn('backup_include_database');
+      table.dropColumn('backup_manifest_enabled');
+      table.dropColumn('backup_manifest_format');
+      table.dropColumn('backup_encryption_enabled');
+      table.dropColumn('backup_database_schedule');
+    });
+};

backend/migrations/032_add_restore_runs_table.js

@@ -1,13 +1,11 @@
-// No helpers needed for this migration
+const { formatBoolean, parseBoolean } = require('./helpers');
 
 /**
  * Add restore_runs table for tracking restore operations
  */
 exports.up = async function(knex) {
   // Create restore_runs table
-  const hasRestoreRunsTable = await knex.schema.hasTable('restore_runs');
-  if (!hasRestoreRunsTable) {
-    await knex.schema.createTable('restore_runs', table => {
+  await knex.schema.createTable('restore_runs', table => {
     table.increments('id').primary();
     
     // Timing
@@ -32,9 +30,9 @@ exports.up = async function(knex) {
     table.string('pre_restore_backup_path', 500); // Path to pre-restore safety backup
     
     // Flags
-    table.boolean('is_dry_run').defaultTo(false);
-    table.boolean('was_rollback_attempted').defaultTo(false);
-    table.boolean('was_successful').defaultTo(false);
+    table.boolean('is_dry_run').defaultTo(formatBoolean(false));
+    table.boolean('was_rollback_attempted').defaultTo(formatBoolean(false));
+    table.boolean('was_successful').defaultTo(formatBoolean(false));
     
     // Operator information
     table.string('operator_type', 50).defaultTo('manual'); // manual, scheduled, api
@@ -46,13 +44,10 @@ exports.up = async function(knex) {
     
     table.index(['status', 'started_at']);
     table.index(['restore_type', 'started_at']);
-    });
-  }
+  });
   
   // Create restore_file_operations table for tracking individual file operations
-  const hasRestoreFileOperationsTable = await knex.schema.hasTable('restore_file_operations');
-  if (!hasRestoreFileOperationsTable) {
-    await knex.schema.createTable('restore_file_operations', table => {
+  await knex.schema.createTable('restore_file_operations', table => {
     table.increments('id').primary();
     
     table.integer('restore_run_id').notNullable()
@@ -64,7 +59,7 @@ exports.up = async function(knex) {
     
     table.bigInteger('file_size');
     table.string('checksum', 64);
-    table.boolean('checksum_verified').defaultTo(false);
+    table.boolean('checksum_verified').defaultTo(formatBoolean(false));
     
     table.text('error_message');
     table.timestamp('started_at');
@@ -72,13 +67,10 @@ exports.up = async function(knex) {
     
     table.index(['restore_run_id', 'status']);
     table.index(['file_path']);
-    });
-  }
+  });
   
   // Create restore_validation_results table
-  const hasRestoreValidationResultsTable = await knex.schema.hasTable('restore_validation_results');
-  if (!hasRestoreValidationResultsTable) {
-    await knex.schema.createTable('restore_validation_results', table => {
+  await knex.schema.createTable('restore_validation_results', table => {
     table.increments('id').primary();
     
     table.integer('restore_run_id').notNullable()
@@ -94,59 +86,66 @@ exports.up = async function(knex) {
     table.timestamp('validated_at').notNullable().defaultTo(knex.fn.now());
     
     table.index(['restore_run_id', 'validation_type']);
-    });
-  }
+  });
   
   // Add restore-related settings to app_settings
-  const restoreSettings = [
+  await knex('app_settings').insert([
     {
       setting_key: 'restore_allow_force',
-      setting_value: JSON.stringify(false),
-      setting_type: 'restore'
+      setting_value: formatBoolean(false),
+      setting_type: 'restore',
+      description: 'Allow force restore with warnings',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
       setting_key: 'restore_require_pre_backup',
-      setting_value: JSON.stringify(true),
-      setting_type: 'restore'
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Require pre-restore backup',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
       setting_key: 'restore_max_file_size_mb',
       setting_value: '5000',
-      setting_type: 'restore'
+      setting_type: 'restore',
+      description: 'Maximum file size for restore (MB)',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
       setting_key: 'restore_verify_checksums',
-      setting_value: JSON.stringify(true),
-      setting_type: 'restore'
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Verify file checksums during restore',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
       setting_key: 'restore_email_on_completion',
-      setting_value: JSON.stringify(true),
-      setting_type: 'restore'
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Send email on restore completion',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
       setting_key: 'restore_retention_days',
       setting_value: '30',
-      setting_type: 'restore'
+      setting_type: 'restore',
+      description: 'Days to retain restore history',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     }
-  ];
-
-  for (const setting of restoreSettings) {
-    const exists = await knex('app_settings')
-      .where('setting_key', setting.setting_key)
-      .first();
-    
-    if (!exists) {
-      await knex('app_settings').insert(setting);
-    }
-  }
+  ]);
   
   // Add new email templates for restore notifications
   const emailTemplates = [
     {
-      template_key: 'restore_completed',
+      name: 'restore_completed',
       subject: '✅ Restore Completed Successfully',
-      body_html: `<h2>Restore Operation Completed</h2>
+      body: `<h2>Restore Operation Completed</h2>
 <p>A restore operation has completed successfully.</p>
 
 <h3>Details:</h3>
@@ -159,24 +158,15 @@ exports.up = async function(knex) {
 </ul>
 
 <p>Please verify that all systems are functioning correctly after the restore.</p>`,
-      body_text: `Restore Operation Completed
-
-A restore operation has completed successfully.
-
-Details:
-- Restore Type: {{restore_type}}
-- Duration: {{duration}}
-- Files Restored: {{files_restored}}
-- Backup ID: {{backup_id}}
-- Timestamp: {{timestamp}}
-
-Please verify that all systems are functioning correctly after the restore.`,
-      variables: JSON.stringify(['restore_type', 'duration', 'files_restored', 'backup_id', 'timestamp'])
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     },
     {
-      template_key: 'restore_failed',
+      name: 'restore_failed',
       subject: '❌ Restore Operation Failed',
-      body_html: `<h2>Restore Operation Failed</h2>
+      body: `<h2>Restore Operation Failed</h2>
 <p>A restore operation has failed and requires attention.</p>
 
 <h3>Details:</h3>
@@ -189,37 +179,62 @@ Please verify that all systems are functioning correctly after the restore.`,
 <p>Please check the system logs for more details and take appropriate action.</p>
 
 <p><strong>Important:</strong> If a pre-restore backup was created, it may be used for recovery.</p>`,
-      body_text: `Restore Operation Failed
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_completed',
+      subject: '✅ Wiederherstellung erfolgreich abgeschlossen',
+      body: `<h2>Wiederherstellungsvorgang abgeschlossen</h2>
+<p>Ein Wiederherstellungsvorgang wurde erfolgreich abgeschlossen.</p>
 
-A restore operation has failed and requires attention.
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Dauer:</strong> {{duration}}</li>
+  <li><strong>Wiederhergestellte Dateien:</strong> {{files_restored}}</li>
+  <li><strong>Backup-ID:</strong> {{backup_id}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
 
-Details:
-- Restore Type: {{restore_type}}
-- Error: {{error_message}}
-- Timestamp: {{timestamp}}
+<p>Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemäß funktionieren.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_failed',
+      subject: '❌ Wiederherstellungsvorgang fehlgeschlagen',
+      body: `<h2>Wiederherstellungsvorgang fehlgeschlagen</h2>
+<p>Ein Wiederherstellungsvorgang ist fehlgeschlagen und erfordert Ihre Aufmerksamkeit.</p>
 
-Please check the system logs for more details and take appropriate action.
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Fehler:</strong> {{error_message}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
 
-Important: If a pre-restore backup was created, it may be used for recovery.`,
-      variables: JSON.stringify(['restore_type', 'error_message', 'timestamp'])
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und ergreifen Sie entsprechende Maßnahmen.</p>
+
+<p><strong>Wichtig:</strong> Falls ein Backup vor der Wiederherstellung erstellt wurde, kann es zur Wiederherstellung verwendet werden.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
     }
   ];
   
-  for (const template of emailTemplates) {
-    const exists = await knex('email_templates')
-      .where('template_key', template.template_key)
-      .first();
-    
-    if (!exists) {
-      await knex('email_templates').insert(template);
-    }
-  }
+  await knex('email_templates').insert(emailTemplates);
 };
 
 exports.down = async function(knex) {
   // Remove email templates
   await knex('email_templates')
-    .whereIn('template_key', ['restore_completed', 'restore_failed'])
+    .whereIn('name', ['restore_completed', 'restore_failed'])
     .delete();
   
   // Remove settings

backend/migrations/README.md

@@ -1,46 +0,0 @@
-# Database Migrations
-
-This directory contains database migrations for the Wedding Photo Sharing platform.
-
-## Directory Structure
-
-### `/core`
-Essential migrations that are always run for new deployments. These include:
-- `init.js` - Initial database schema creation
-- Backup service tables (029-035)
-- Gallery feedback tables (033)
-
-### `/legacy`
-Migrations needed only when upgrading from older versions. New deployments can skip these as the core schema already includes all necessary tables and columns.
-
-## For New Deployments
-
-If you're deploying this application for the first time:
-1. The `initializeDatabase()` function in `src/database/db.js` will create all necessary tables
-2. Only migrations in the `/core` directory will be run
-3. This ensures a clean, optimized database schema
-
-## For Existing Deployments
-
-If you're upgrading from an older version:
-1. All migrations (both core and legacy) will be run in sequence
-2. The migration system tracks which migrations have been applied
-3. Only new migrations will be executed
-
-## Running Migrations
-
-```bash
-# Development
-npm run migrate
-
-# Production
-npm run migrate:prod
-```
-
-## Note on Duplicate Migration Numbers
-
-The legacy directory contains renamed duplicates:
-- `014_add_host_name_to_events_duplicate.js` (was duplicate of 014)
-- `027_add_rate_limit_settings_duplicate.js` (was duplicate of 027)
-
-These have been renamed to avoid conflicts while preserving the migration history.

backend/migrations/core/033_add_gallery_feedback.js

@@ -1,129 +0,0 @@
-// No helpers needed for boolean values
-
-exports.up = async function(knex) {
-  console.log('Adding gallery feedback tables...');
-  
-  // Create event_feedback_settings table
-  await knex.schema.createTable('event_feedback_settings', (table) => {
-    table.increments('id').primary();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.boolean('feedback_enabled').defaultTo(false);
-    table.boolean('allow_ratings').defaultTo(true);
-    table.boolean('allow_likes').defaultTo(true);
-    table.boolean('allow_comments').defaultTo(false);
-    table.boolean('allow_favorites').defaultTo(true);
-    table.boolean('require_name_email').defaultTo(false);
-    table.boolean('moderate_comments').defaultTo(true);
-    table.boolean('show_feedback_to_guests').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    table.unique(['event_id']);
-  });
-
-  // Create photo_feedback table
-  await knex.schema.createTable('photo_feedback', (table) => {
-    table.increments('id').primary();
-    table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('feedback_type', 20).notNullable();
-    table.integer('rating');
-    table.text('comment_text');
-    table.string('guest_name', 100);
-    table.string('guest_email', 255);
-    table.string('guest_identifier', 64);
-    table.string('ip_address', 45);
-    table.text('user_agent');
-    table.boolean('is_approved').defaultTo(true);
-    table.boolean('is_hidden').defaultTo(false);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['photo_id']);
-    table.index(['event_id']);
-    table.index(['feedback_type']);
-    table.index(['guest_identifier']);
-    
-    // Add check constraint for rating (PostgreSQL)
-    if (knex.client.config.client === 'pg') {
-      table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
-    }
-  });
-
-  // Create feedback_rate_limits table
-  await knex.schema.createTable('feedback_rate_limits', (table) => {
-    table.increments('id').primary();
-    table.string('identifier', 64).notNullable();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('action_type', 20).notNullable();
-    table.integer('action_count').defaultTo(1);
-    table.timestamp('window_start').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['identifier', 'event_id', 'action_type']);
-    table.index(['window_start']);
-  });
-
-  // Create feedback_word_filters table
-  await knex.schema.createTable('feedback_word_filters', (table) => {
-    table.increments('id').primary();
-    table.string('word', 100).notNullable();
-    table.string('severity', 20).defaultTo('moderate');
-    table.boolean('is_active').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.unique(['word']);
-  });
-
-  // Add feedback summary columns to photos table
-  await knex.schema.alterTable('photos', (table) => {
-    table.integer('feedback_count').defaultTo(0);
-    table.integer('like_count').defaultTo(0);
-    table.decimal('average_rating', 3, 2).defaultTo(0);
-    table.integer('favorite_count').defaultTo(0);
-  });
-
-  // Add feedback notification settings to app_settings
-  await knex('app_settings').insert([
-    {
-      setting_key: 'feedback_notification_email',
-      setting_value: JSON.stringify(''),
-      setting_type: 'feedback'
-    },
-    {
-      setting_key: 'feedback_rate_limits',
-      setting_value: JSON.stringify({
-        rating: { max: 100, window: 3600 }, // 100 ratings per hour
-        comment: { max: 20, window: 3600 }, // 20 comments per hour
-        like: { max: 200, window: 3600 } // 200 likes per hour
-      }),
-      setting_type: 'feedback'
-    }
-  ]);
-  
-  console.log('Gallery feedback tables created successfully');
-};
-
-exports.down = async function(knex) {
-  console.log('Removing gallery feedback tables...');
-  
-  // Remove feedback settings from app_settings
-  await knex('app_settings')
-    .whereIn('setting_key', ['feedback_notification_email', 'feedback_rate_limits'])
-    .delete();
-
-  // Remove feedback columns from photos table
-  await knex.schema.alterTable('photos', (table) => {
-    table.dropColumn('feedback_count');
-    table.dropColumn('like_count');
-    table.dropColumn('average_rating');
-    table.dropColumn('favorite_count');
-  });
-
-  // Drop tables in reverse order
-  await knex.schema.dropTableIfExists('feedback_word_filters');
-  await knex.schema.dropTableIfExists('feedback_rate_limits');
-  await knex.schema.dropTableIfExists('photo_feedback');
-  await knex.schema.dropTableIfExists('event_feedback_settings');
-  
-  console.log('Gallery feedback tables removed');
-};

backend/migrations/core/034_add_version_to_backups.js

@@ -1,139 +0,0 @@
-const { db } = require('../../src/database/db');
-
-async function up() {
-  console.log('Adding version tracking to backup tables...');
-  
-  // Add version columns to database_backup_runs table
-  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
-  if (hasDatabaseBackupRunsTable) {
-    const hasAppVersion = await db.schema.hasColumn('database_backup_runs', 'app_version');
-    if (!hasAppVersion) {
-      await db.schema.alterTable('database_backup_runs', (table) => {
-        table.string('app_version'); // Application version
-        table.string('node_version'); // Node.js version
-        table.string('db_schema_version'); // Database schema version (migration name)
-        table.json('environment_info'); // Additional environment information
-      });
-      console.log('Added version columns to database_backup_runs table');
-    }
-  }
-
-  // Add version columns to backup_runs table (file backups)
-  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
-  if (hasBackupRunsTable) {
-    const hasAppVersion = await db.schema.hasColumn('backup_runs', 'app_version');
-    if (!hasAppVersion) {
-      await db.schema.alterTable('backup_runs', (table) => {
-        table.string('app_version'); // Application version
-        table.string('node_version'); // Node.js version
-        table.string('db_schema_version'); // Database schema version
-        table.json('manifest_info'); // Manifest summary information
-      });
-      console.log('Added version columns to backup_runs table');
-    }
-  }
-
-  // Add restore tracking table
-  const hasRestoreHistoryTable = await db.schema.hasTable('restore_history');
-  if (!hasRestoreHistoryTable) {
-    await db.schema.createTable('restore_history', (table) => {
-      table.increments('id').primary();
-      table.datetime('started_at').notNullable();
-      table.datetime('completed_at');
-      table.string('status').defaultTo('running'); // running, completed, failed, partial
-      table.string('restore_type'); // database, files, full
-      table.string('backup_id'); // Reference to the backup that was restored
-      table.string('backup_app_version'); // Version of app that created the backup
-      table.string('restore_app_version'); // Version of app performing the restore
-      table.string('backup_node_version'); // Node version that created the backup
-      table.string('restore_node_version'); // Node version performing the restore
-      table.string('backup_schema_version'); // Schema version in the backup
-      table.string('restore_schema_version'); // Current schema version
-      table.json('version_compatibility'); // Compatibility check results
-      table.json('restore_options'); // Options used during restore
-      table.json('statistics'); // Restore statistics
-      table.text('warnings'); // Any warnings during restore
-      table.text('error_message'); // Error details if failed
-      table.string('restored_by'); // User who initiated the restore
-      table.index(['started_at'], 'idx_restore_started');
-      table.index(['backup_id'], 'idx_restore_backup_id');
-    });
-    console.log('Created restore_history table');
-  }
-
-  // Add version compatibility settings
-  const versionSettings = [
-    {
-      setting_key: 'backup_require_version_match',
-      setting_value: JSON.stringify(false), // If true, exact version match required for restore
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_allow_minor_version_mismatch',
-      setting_value: JSON.stringify(true), // Allow restoring from same major version
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_warn_on_version_mismatch',
-      setting_value: JSON.stringify(true), // Show warning when versions don't match
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_check_schema_compatibility',
-      setting_value: JSON.stringify(true), // Check if migrations are compatible
-      setting_type: 'backup'
-    }
-  ];
-
-  // Insert version settings if they don't exist
-  for (const setting of versionSettings) {
-    const exists = await db('app_settings')
-      .where('setting_key', setting.setting_key)
-      .first();
-    
-    if (!exists) {
-      await db('app_settings').insert(setting);
-    }
-  }
-
-  console.log('Version tracking for backups added successfully');
-}
-
-async function down() {
-  // Remove version columns from database_backup_runs
-  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
-  if (hasDatabaseBackupRunsTable) {
-    await db.schema.alterTable('database_backup_runs', (table) => {
-      table.dropColumn('app_version');
-      table.dropColumn('node_version');
-      table.dropColumn('db_schema_version');
-      table.dropColumn('environment_info');
-    });
-  }
-
-  // Remove version columns from backup_runs
-  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
-  if (hasBackupRunsTable) {
-    await db.schema.alterTable('backup_runs', (table) => {
-      table.dropColumn('app_version');
-      table.dropColumn('node_version');
-      table.dropColumn('db_schema_version');
-      table.dropColumn('manifest_info');
-    });
-  }
-
-  // Drop restore_history table
-  await db.schema.dropTableIfExists('restore_history');
-
-  // Remove version settings
-  await db('app_settings')
-    .whereIn('setting_key', [
-      'backup_require_version_match',
-      'backup_allow_minor_version_mismatch',
-      'backup_warn_on_version_mismatch',
-      'backup_check_schema_compatibility'
-    ])
-    .delete();
-}
-
-module.exports = { up, down };

backend/migrations/core/035_enhance_backup_system.js

@@ -1,221 +0,0 @@
-const { db } = require('../../src/database/db');
-
-async function up() {
-  console.log('Enhancing backup system...');
-  
-  // Add new settings to app_settings table if they don't exist
-  const backupSettings = [
-    {
-      setting_key: 'backup_s3_force_path_style',
-      setting_value: JSON.stringify(false),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_s3_ssl_enabled',
-      setting_value: JSON.stringify(true),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_s3_prefix',
-      setting_value: JSON.stringify(''),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_incremental',
-      setting_value: JSON.stringify(false),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_include_database',
-      setting_value: JSON.stringify(true),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_encryption_enabled',
-      setting_value: JSON.stringify(false),
-      setting_type: 'backup'
-    },
-    {
-      setting_key: 'backup_database_schedule',
-      setting_value: JSON.stringify(''),
-      setting_type: 'backup'
-    }
-  ];
-
-  // Insert settings if they don't exist
-  for (const setting of backupSettings) {
-    const exists = await db('app_settings')
-      .where('setting_key', setting.setting_key)
-      .first();
-    
-    if (!exists) {
-      await db('app_settings').insert(setting);
-    }
-  }
-
-  // Check and add columns to backup_runs table
-  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
-  if (hasBackupRunsTable) {
-    // Check for existing columns before adding
-    const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
-    const hasManifestId = await db.schema.hasColumn('backup_runs', 'manifest_id');
-    const hasManifestFormat = await db.schema.hasColumn('backup_runs', 'manifest_format');
-    const hasParentBackupId = await db.schema.hasColumn('backup_runs', 'parent_backup_id');
-    const hasBackupMode = await db.schema.hasColumn('backup_runs', 'backup_mode');
-    
-    if (!hasManifestPath || !hasManifestId || !hasManifestFormat || !hasParentBackupId || !hasBackupMode) {
-      await db.schema.alterTable('backup_runs', (table) => {
-        if (!hasManifestPath) {
-          table.string('manifest_path', 500).comment('Path to backup manifest file');
-        }
-        if (!hasManifestId) {
-          table.uuid('manifest_id').comment('Unique identifier for the manifest');
-        }
-        if (!hasManifestFormat) {
-          table.enum('manifest_format', ['json', 'yaml']).comment('Format of the manifest file');
-        }
-        if (!hasParentBackupId) {
-          table.integer('parent_backup_id').unsigned().references('id').inTable('backup_runs').onDelete('SET NULL').comment('Parent backup for incremental backups');
-        }
-        if (!hasBackupMode) {
-          table.enum('backup_mode', ['full', 'incremental', 'database']).defaultTo('full').comment('Type of backup performed');
-        }
-      });
-    }
-    
-    // Add indexes if they don't exist
-    try {
-      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_mode_status ON backup_runs(backup_mode, status)');
-      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_parent ON backup_runs(parent_backup_id)');
-      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_created_mode ON backup_runs(created_at, backup_mode)');
-    } catch (error) {
-      console.log('Note: Some indexes may already exist, continuing...');
-    }
-  }
-
-  // Create backup_manifest table if it doesn't exist
-  const hasManifestTable = await db.schema.hasTable('backup_manifest');
-  if (!hasManifestTable) {
-    await db.schema.createTable('backup_manifest', (table) => {
-      table.increments('id').primary();
-      table.integer('backup_run_id').unsigned().notNullable().references('id').inTable('backup_runs').onDelete('CASCADE');
-      table.uuid('manifest_id').notNullable().unique().comment('Unique identifier matching backup_runs.manifest_id');
-      table.string('version', 20).notNullable().defaultTo('1.0.0').comment('Manifest schema version');
-      table.enum('format', ['json', 'yaml']).notNullable().defaultTo('json');
-      
-      // Backup metadata
-      table.timestamp('backup_start').notNullable();
-      table.timestamp('backup_end').notNullable();
-      table.bigInteger('total_size').unsigned().comment('Total size of backup in bytes');
-      table.integer('file_count').unsigned().comment('Number of files in backup');
-      table.integer('photo_count').unsigned().comment('Number of photos backed up');
-      table.integer('event_count').unsigned().comment('Number of events backed up');
-      
-      // Incremental backup metadata
-      table.boolean('is_incremental').defaultTo(false);
-      table.uuid('parent_manifest_id').comment('Parent manifest ID for incremental backups');
-      table.timestamp('incremental_since').comment('Timestamp for incremental backup baseline');
-      
-      // Content checksums
-      table.string('checksum_algorithm', 50).defaultTo('sha256').comment('Algorithm used for checksums');
-      table.text('manifest_checksum').comment('Checksum of the manifest file itself');
-      
-      // Storage information
-      table.string('storage_location', 500).comment('Primary storage location (local path or S3 URI)');
-      table.string('storage_provider', 50).comment('Storage provider (local, s3, etc.)');
-      
-      // Encryption metadata
-      table.boolean('is_encrypted').defaultTo(false);
-      table.string('encryption_algorithm', 100).comment('Encryption algorithm used');
-      table.string('encryption_key_id', 255).comment('ID of encryption key used');
-      
-      // Additional metadata as JSON
-      table.json('metadata').comment('Additional metadata as JSON');
-      
-      // Timestamps
-      table.timestamps(true, true);
-      
-      // Indexes
-      table.index(['backup_run_id'], 'idx_manifest_backup_run');
-      table.index(['manifest_id'], 'idx_manifest_uuid');
-      table.index(['parent_manifest_id'], 'idx_manifest_parent');
-      table.index(['backup_start', 'backup_end'], 'idx_manifest_time_range');
-      table.index(['is_incremental', 'created_at'], 'idx_manifest_incremental_created');
-    });
-  }
-
-  // Add composite indexes for common query patterns
-  try {
-    await db.raw(`
-      CREATE INDEX IF NOT EXISTS idx_backup_runs_recent_successful 
-      ON backup_runs(created_at DESC) 
-      WHERE status = 'completed' AND backup_mode = 'full';
-    `);
-    await db.raw(`
-      CREATE INDEX IF NOT EXISTS idx_backup_runs_incremental_chain 
-      ON backup_runs(parent_backup_id, created_at) 
-      WHERE backup_mode = 'incremental';
-    `);
-  } catch (error) {
-    console.log('Note: Some composite indexes may already exist, continuing...');
-  }
-
-  console.log('Backup system enhancements completed');
-}
-
-async function down() {
-  // Drop indexes first
-  try {
-    await db.raw('DROP INDEX IF EXISTS idx_backup_runs_incremental_chain;');
-    await db.raw('DROP INDEX IF EXISTS idx_backup_runs_recent_successful;');
-  } catch (error) {
-    // Ignore errors if indexes don't exist
-  }
-
-  // Drop backup_manifest table
-  await db.schema.dropTableIfExists('backup_manifest');
-
-  // Remove columns from backup_runs if they exist
-  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
-  if (hasBackupRunsTable) {
-    const hasBackupMode = await db.schema.hasColumn('backup_runs', 'backup_mode');
-    const hasParentBackupId = await db.schema.hasColumn('backup_runs', 'parent_backup_id');
-    const hasManifestFormat = await db.schema.hasColumn('backup_runs', 'manifest_format');
-    const hasManifestId = await db.schema.hasColumn('backup_runs', 'manifest_id');
-    const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
-    
-    if (hasBackupMode || hasParentBackupId || hasManifestFormat || hasManifestId || hasManifestPath) {
-      await db.schema.alterTable('backup_runs', (table) => {
-        if (hasBackupMode) table.dropColumn('backup_mode');
-        if (hasParentBackupId) table.dropColumn('parent_backup_id');
-        if (hasManifestFormat) table.dropColumn('manifest_format');
-        if (hasManifestId) table.dropColumn('manifest_id');
-        if (hasManifestPath) table.dropColumn('manifest_path');
-      });
-    }
-    
-    // Drop indexes
-    try {
-      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_mode_status');
-      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_parent');
-      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_created_mode');
-    } catch (error) {
-      // Ignore errors if indexes don't exist
-    }
-  }
-
-  // Remove settings
-  await db('app_settings')
-    .whereIn('setting_key', [
-      'backup_s3_force_path_style',
-      'backup_s3_ssl_enabled',
-      'backup_s3_prefix',
-      'backup_incremental',
-      'backup_include_database',
-      'backup_encryption_enabled',
-      'backup_database_schedule'
-    ])
-    .delete();
-}
-
-module.exports = { up, down };

backend/migrations/init.js

@@ -1,38 +1,33 @@
 const bcrypt = require('bcrypt');
-const { initializeDatabase } = require('../../src/database/db');
-const { generateReadablePassword } = require('../../src/utils/passwordGenerator');
+const { db, initializeDatabase } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
 const fs = require('fs').promises;
 const path = require('path');
 
-exports.up = async function(knex) {
-  console.log('Initializing database schema...');
+async function runMigrations() {
+  console.log('Running database migrations...');
   
   try {
     // Initialize tables
     await initializeDatabase();
     
     // Create default admin user if none exists
-    const adminExists = await knex('admin_users').first();
+    const adminExists = await db('admin_users').first();
     if (!adminExists) {
       // Generate a secure random password
       const generatedPassword = generateReadablePassword();
       const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
-      // Get admin credentials from environment or use defaults
-      const adminUsername = process.env.ADMIN_USERNAME || 'admin';
-      const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
-      
-      await knex('admin_users').insert({
-        username: adminUsername,
-        email: adminEmail,
+      await db('admin_users').insert({
+        username: 'admin',
+        email: 'admin@example.com',
         password_hash: passwordHash,
+        must_change_password: true, // Flag for forcing password change
         created_at: new Date()
       });
       
-      // Try to save credentials to file, but don't fail if we can't
-      const dataDir = path.join(__dirname, '..', '..', 'data');
-      const setupInfoPath = path.join(dataDir, 'ADMIN_CREDENTIALS.txt');
-      
+      // Save the generated password to a file for the user to retrieve
+      const setupInfoPath = path.join(__dirname, '..', '..', 'ADMIN_CREDENTIALS.txt');
       const setupInfo = `
 ========================================
 PicPeak Admin Credentials
@@ -40,49 +35,39 @@ PicPeak Admin Credentials
 
 Your admin account has been created with these credentials:
 
-Email: ${adminEmail}
+Username: admin
 Password: ${generatedPassword}
 
 IMPORTANT SECURITY NOTES:
-1. Please change this password after first login
+1. You MUST change this password on first login
 2. This file will be created only once
 3. Store these credentials securely
 4. Delete this file after noting the password
 
 Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
 
-Login with the email address shown above
-
 Generated on: ${new Date().toISOString()}
 ========================================
 `;
       
-      try {
-        // Try to create directory and write file
-        await fs.mkdir(dataDir, { recursive: true });
-        await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
-        console.log(`📁 Credentials also saved to: data/ADMIN_CREDENTIALS.txt`);
-      } catch (error) {
-        // If we can't write the file, that's okay - credentials are shown in console
-        console.log('⚠️  Could not save credentials to file (permission denied)');
-        console.log('   Please copy the credentials shown above');
-      }
+      await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
       
       console.log('\n========================================');
       console.log('✅ Admin user created successfully!');
       console.log('========================================');
-      console.log(`Email: ${adminEmail}`);
+      console.log('Username: admin');
       console.log(`Password: ${generatedPassword}`);
       console.log('\n⚠️  IMPORTANT:');
       console.log('1. Save these credentials securely');
-      console.log('2. Please change the password after first login');
+      console.log('2. You will be required to change the password on first login');
+      console.log('3. Credentials are also saved in: ADMIN_CREDENTIALS.txt');
       console.log('========================================\n');
     }
     
     // Create default email templates if none exist
-    const templateExists = await knex('email_templates').first();
+    const templateExists = await db('email_templates').first();
     if (!templateExists) {
-      await knex('email_templates').insert([
+      await db('email_templates').insert([
         {
           template_key: 'gallery_created',
           subject: 'Your Photo Gallery is Ready!',
@@ -116,9 +101,9 @@ Generated on: ${new Date().toISOString()}
     }
 
     // Create default email config if none exists
-    const emailConfig = await knex('email_configs').first();
+    const emailConfig = await db('email_configs').first();
     if (!emailConfig) {
-      await knex('email_configs').insert({
+      await db('email_configs').insert({
         smtp_host: process.env.SMTP_HOST || 'mailhog',
         smtp_port: process.env.SMTP_PORT || 1025,
         smtp_secure: process.env.SMTP_SECURE === 'true',
@@ -131,13 +116,11 @@ Generated on: ${new Date().toISOString()}
     }
 
     console.log('Migrations completed successfully');
+    process.exit(0);
   } catch (error) {
-    console.error('Initial setup failed:', error);
-    throw error;
+    console.error('Migration failed:', error);
+    process.exit(1);
   }
-};
+}
 
-exports.down = async function(knex) {
-  // This migration cannot be rolled back as it creates the initial schema
-  console.log('Initial setup cannot be rolled back');
-};
+runMigrations();

backend/migrations/run-migrations-safe.js

@@ -27,12 +27,8 @@ async function isMigrationApplied(filename) {
 
 // Mark migration as applied without running it (for existing schema)
 async function markMigrationAsApplied(filename) {
-  // Check if already marked to avoid duplicate key error
-  const isApplied = await isMigrationApplied(filename);
-  if (!isApplied) {
-    await db('migrations').insert({ filename });
-    console.log(`Marked migration ${filename} as applied`);
-  }
+  await db('migrations').insert({ filename });
+  console.log(`Marked migration ${filename} as applied`);
 }
 
 // Detect existing schema and mark migrations as applied
@@ -40,14 +36,12 @@ async function detectExistingSchema() {
   console.log('Detecting existing schema...');
   
   const tableChecks = [
-    { table: 'events', migration: '001_init.js' },
-    { table: 'photos', migration: '001_init.js' },
+    { table: 'events', migration: 'init.js' },
+    { table: 'photos', migration: 'init.js' },
     { table: 'photo_categories', migration: '004_add_categories_and_cms.js' },
     { table: 'cms_pages', migration: '004_add_categories_and_cms.js' },
     { table: 'login_attempts', migration: '015_add_login_attempts_table.js' },
     { table: 'token_blacklist', migration: '017_add_token_revocation_tables.js' },
-    { table: 'backup_runs', migration: '029_add_backup_service_tables.js' },
-    { table: 'gallery_feedback', migration: '033_add_gallery_feedback.js' },
   ];
   
   for (const check of tableChecks) {
@@ -62,14 +56,13 @@ async function detectExistingSchema() {
 }
 
 // Run a single migration safely
-async function runMigrationSafely(filepath) {
+async function runMigrationSafely(filename) {
   try {
-    const migrationPath = path.join(__dirname, filepath);
+    const migrationPath = path.join(__dirname, filename);
     const migration = require(migrationPath);
-    const filename = path.basename(filepath);
     
     if (migration.up) {
-      console.log(`Running migration: ${filepath}`);
+      console.log(`Running migration: ${filename}`);
       
       // Run migration in a transaction if possible
       if (db.client.config.client === 'pg') {
@@ -81,14 +74,14 @@ async function runMigrationSafely(filepath) {
       }
       
       await db('migrations').insert({ filename });
-      console.log(`Migration ${filepath} completed successfully`);
+      console.log(`Migration ${filename} completed successfully`);
     }
   } catch (error) {
     // Check if error is because schema already exists
     if (error.code === '42P07' || // PostgreSQL: relation already exists
         error.code === 'SQLITE_ERROR' && error.message.includes('already exists')) {
-      console.log(`Migration ${filepath} - schema already exists, marking as applied`);
-      await markMigrationAsApplied(path.basename(filepath));
+      console.log(`Migration ${filename} - schema already exists, marking as applied`);
+      await markMigrationAsApplied(filename);
     } else {
       throw error;
     }
@@ -108,79 +101,26 @@ async function runMigrations() {
     // Create migrations tracking table
     await ensureMigrationsTable();
     
-    // Check if essential tables exist to determine if this is truly a new deployment
-    const hasEventsTable = await db.schema.hasTable('events');
-    const hasPhotosTable = await db.schema.hasTable('photos');
-    const hasAdminTable = await db.schema.hasTable('admin_users');
-    const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
+    // Detect and mark existing schema
+    await detectExistingSchema();
     
-    // Get applied migrations
-    const appliedMigrations = await db('migrations').select('filename');
-    const appliedFilenames = appliedMigrations.map(m => m.filename);
-    
-    // Check if this is a new deployment
-    // It's new if no essential tables exist OR no migrations have been applied
-    const isNewDeployment = (!hasEventsTable || !hasPhotosTable || !hasAdminTable || !hasActivityLogsTable) || appliedFilenames.length === 0;
-    
-    // Only detect existing schema for truly existing deployments
-    if (!isNewDeployment) {
-      await detectExistingSchema();
-    }
-    
-    // Get migration files from appropriate directories
-    let migrationFiles = [];
-    
-    if (isNewDeployment) {
-      // For new deployments, only run core migrations
-      console.log('New deployment detected - running core migrations only');
-      const coreDir = path.join(__dirname, 'core');
-      const coreFiles = await fs.readdir(coreDir);
-      migrationFiles = coreFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('core', f))
-        .sort((a, b) => {
-          const baseA = path.basename(a);
-          const baseB = path.basename(b);
-          const numA = parseInt(baseA.split('_')[0]);
-          const numB = parseInt(baseB.split('_')[0]);
-          return numA - numB;
-        });
-    } else {
-      // For existing deployments, run all migrations (legacy + core)
-      console.log('Existing deployment detected - checking all migrations');
-      
-      // Get legacy migrations
-      const legacyDir = path.join(__dirname, 'legacy');
-      const legacyFiles = await fs.readdir(legacyDir);
-      const legacyMigrations = legacyFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('legacy', f));
-      
-      // Get core migrations
-      const coreDir = path.join(__dirname, 'core');
-      const coreFiles = await fs.readdir(coreDir);
-      const coreMigrations = coreFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('core', f));
-      
-      // Combine and sort by number
-      migrationFiles = [...legacyMigrations, ...coreMigrations]
-        .sort((a, b) => {
-          const baseA = path.basename(a);
-          const baseB = path.basename(b);
-          const numA = parseInt(baseA.split('_')[0]);
-          const numB = parseInt(baseB.split('_')[0]);
-          return numA - numB;
-        });
-    }
+    // Get all migration files
+    const files = await fs.readdir(__dirname);
+    const migrationFiles = files
+      .filter(f => f.match(/^\d{3}_.*\.js$/) || f === 'init.js')
+      .sort((a, b) => {
+        // Ensure init.js runs first
+        if (a === 'init.js') return -1;
+        if (b === 'init.js') return 1;
+        return a.localeCompare(b);
+      });
     
     // Run pending migrations
     let pendingCount = 0;
     let skippedCount = 0;
     
     for (const file of migrationFiles) {
-      const filename = path.basename(file);
-      const isApplied = appliedFilenames.includes(filename);
+      const isApplied = await isMigrationApplied(file);
       if (!isApplied) {
         await runMigrationSafely(file);
         pendingCount++;

backend/migrations/run-migrations.js

@@ -22,16 +22,15 @@ async function getAppliedMigrations() {
 }
 
 // Run a single migration
-async function runMigration(filepath) {
-  const migrationPath = path.join(__dirname, filepath);
+async function runMigration(filename) {
+  const migrationPath = path.join(__dirname, filename);
   const migration = require(migrationPath);
-  const filename = path.basename(filepath);
   
   if (migration.up) {
-    console.log(`Running migration: ${filepath}`);
+    console.log(`Running migration: ${filename}`);
     await migration.up(db);
     await db('migrations').insert({ filename });
-    console.log(`Migration ${filepath} completed`);
+    console.log(`Migration ${filename} completed`);
   }
 }
 
@@ -51,62 +50,19 @@ async function runMigrations() {
     // Create migrations table
     await createMigrationsTable();
     
+    // Get all migration files
+    const files = await fs.readdir(__dirname);
+    const migrationFiles = files
+      .filter(f => f.match(/^\d{3}_.*\.js$/))
+      .sort();
+    
     // Get applied migrations
     const appliedMigrations = await getAppliedMigrations();
     
-    // Check if this is a new deployment (no migrations have been applied)
-    const isNewDeployment = appliedMigrations.length === 0;
-    
-    // Get migration files from appropriate directories
-    let migrationFiles = [];
-    
-    if (isNewDeployment) {
-      // For new deployments, only run core migrations
-      console.log('New deployment detected - running core migrations only');
-      const coreDir = path.join(__dirname, 'core');
-      const coreFiles = await fs.readdir(coreDir);
-      migrationFiles = coreFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('core', f))
-        .sort((a, b) => {
-          const baseA = path.basename(a);
-          const baseB = path.basename(b);
-          const numA = parseInt(baseA.split('_')[0]);
-          const numB = parseInt(baseB.split('_')[0]);
-          return numA - numB;
-        });
-    } else {
-      // For existing deployments, run all migrations (legacy + core)
-      console.log('Existing deployment detected - checking all migrations');
-      
-      // Get legacy migrations
-      const legacyDir = path.join(__dirname, 'legacy');
-      const legacyFiles = await fs.readdir(legacyDir);
-      const legacyMigrations = legacyFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('legacy', f));
-      
-      // Get core migrations
-      const coreDir = path.join(__dirname, 'core');
-      const coreFiles = await fs.readdir(coreDir);
-      const coreMigrations = coreFiles
-        .filter(f => f.match(/^\d{3}_.*\.js$/))
-        .map(f => path.join('core', f));
-      
-      // Combine and sort by number
-      migrationFiles = [...legacyMigrations, ...coreMigrations]
-        .sort((a, b) => {
-          const numA = parseInt(path.basename(a).split('_')[0]);
-          const numB = parseInt(path.basename(b).split('_')[0]);
-          return numA - numB;
-        });
-    }
-    
     // Run pending migrations
     let pendingCount = 0;
     for (const file of migrationFiles) {
-      const filename = path.basename(file);
-      if (!appliedMigrations.includes(filename)) {
+      if (!appliedMigrations.includes(file)) {
         await runMigration(file);
         pendingCount++;
       }

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.101",
+  "version": "1.0.75",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -21,17 +21,17 @@
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
     "axios": "^1.10.0",
-    "bcrypt": "6.0.0",
-    "chokidar": "4.0.3",
+    "bcrypt": "^5.1.0",
+    "chokidar": "^3.5.3",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
-    "form-data": "^4.0.4",
+    "form-data": "^4.0.3",
     "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
-    "i18next": "25.3.2",
+    "i18next": "^25.3.1",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
@@ -39,12 +39,12 @@
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
-    "multer": "^2.0.2",
+    "multer": "^2.0.1",
     "node-cron": "^3.0.2",
-    "nodemailer": "7.0.5",
+    "nodemailer": "^6.9.1",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
-    "sharp": "0.34.3",
+    "sharp": "^0.32.0",
     "sqlite3": "^5.1.6",
     "uuid": "^11.1.0",
     "winston": "^3.8.2",

backend/scripts/check-db-issues.js

@@ -0,0 +1,60 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkDatabaseIssues() {
+  console.log('Checking database issues...\n');
+  
+  try {
+    // Check email_templates table structure
+    console.log('1. Checking email_templates table structure:');
+    const emailTemplateColumns = await db('email_templates').columnInfo();
+    console.log('Columns:', Object.keys(emailTemplateColumns));
+    
+    // Check if any templates exist
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    // Check for specific template
+    const galleryCreatedTemplate = await db('email_templates')
+      .where('template_key', 'gallery_created')
+      .first();
+    console.log('gallery_created template exists:', !!galleryCreatedTemplate);
+    
+    // Check activity_logs table
+    console.log('\n2. Checking activity_logs table:');
+    const activityLogColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityLogColumns));
+    
+    // Check migrations table
+    console.log('\n3. Checking migrations status:');
+    const migrations = await db('migrations')
+      .orderBy('id', 'desc')
+      .limit(10);
+    console.log('Latest migrations:');
+    migrations.forEach(m => console.log(`  - ${m.filename}`));
+    
+    // Test a simple query from notifications route
+    console.log('\n4. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      console.log(`Found ${notifications.length} notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+checkDatabaseIssues();

backend/scripts/check-db-schema.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+
+const sqlite3 = require('sqlite3').verbose();
+
+// Connect to the database
+const dbPath = '/app/data/photo_sharing.db';
+console.log(`Connecting to database at: ${dbPath}`);
+
+const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
+  if (err) {
+    console.error('Error opening database:', err.message);
+    process.exit(1);
+  }
+  console.log('Connected to the SQLite database.\n');
+});
+
+// Get schema for events table
+console.log('=== EVENTS TABLE SCHEMA ===');
+db.all("PRAGMA table_info(events)", [], (err, rows) => {
+  if (err) {
+    console.error('Error getting events schema:', err.message);
+  } else {
+    rows.forEach(row => {
+      console.log(`${row.name} (${row.type})`);
+    });
+  }
+  
+  console.log('\n=== PHOTOS TABLE SCHEMA ===');
+  // Get schema for photos table
+  db.all("PRAGMA table_info(photos)", [], (err, rows) => {
+    if (err) {
+      console.error('Error getting photos schema:', err.message);
+    } else {
+      rows.forEach(row => {
+        console.log(`${row.name} (${row.type})`);
+      });
+    }
+    
+    // Close the database
+    db.close();
+  });
+});

backend/scripts/check-email-environment.js

@@ -0,0 +1,131 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailEnvironment() {
+  console.log('=== Email Environment Check ===\n');
+  
+  // 1. Check environment variables
+  console.log('1. Environment Variables:');
+  const envVars = [
+    'SMTP_HOST',
+    'SMTP_PORT',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'SMTP_FROM',
+    'SMTP_SECURE',
+    'EMAIL_PROCESSOR_ENABLED',
+    'NODE_ENV'
+  ];
+  
+  envVars.forEach(varName => {
+    const value = process.env[varName];
+    if (varName.includes('PASS')) {
+      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
+    } else {
+      console.log(`   ${varName}: ${value || 'NOT SET'}`);
+    }
+  });
+  
+  // 2. Check database configuration
+  console.log('\n2. Database Email Configuration:');
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig) {
+      console.log('   Email configuration found in database:');
+      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
+      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
+      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
+      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
+      console.log(`   - From Address: ${emailConfig.smtp_from}`);
+    } else {
+      console.log('   ⚠️  No email configuration found in database!');
+      console.log('   This will prevent the email processor from initializing.');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error reading email configuration: ${error.message}`);
+  }
+  
+  // 3. Check if the email processor should be disabled
+  console.log('\n3. Email Processor Status:');
+  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
+  if (isDisabled) {
+    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
+  } else {
+    console.log('   ✅ Email processor is enabled (default)');
+  }
+  
+  // 4. Check pending emails
+  console.log('\n4. Email Queue Status:');
+  try {
+    const pending = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count')
+      .first();
+    
+    const failed = await db('email_queue')
+      .where('status', 'failed')
+      .where('retry_count', '>=', 3)
+      .count('* as count')
+      .first();
+    
+    const sent = await db('email_queue')
+      .where('status', 'sent')
+      .count('* as count')
+      .first();
+    
+    console.log(`   - Pending emails: ${pending.count}`);
+    console.log(`   - Failed emails (max retries): ${failed.count}`);
+    console.log(`   - Sent emails: ${sent.count}`);
+  } catch (error) {
+    console.log(`   ❌ Error querying email queue: ${error.message}`);
+  }
+  
+  // 5. Test database connection
+  console.log('\n5. Database Connection:');
+  try {
+    await db.raw('SELECT 1');
+    console.log('   ✅ Database connection successful');
+  } catch (error) {
+    console.log(`   ❌ Database connection failed: ${error.message}`);
+  }
+  
+  // 6. Check for any recent errors
+  console.log('\n6. Recent Email Errors:');
+  try {
+    const recentErrors = await db('email_queue')
+      .whereNotNull('error_message')
+      .orderBy('id', 'desc')
+      .limit(3)
+      .select('id', 'email_type', 'error_message', 'retry_count');
+    
+    if (recentErrors.length > 0) {
+      recentErrors.forEach((email, index) => {
+        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
+        console.log(`      Retries: ${email.retry_count}`);
+        console.log(`      Error: ${email.error_message}`);
+      });
+    } else {
+      console.log('   No recent errors found');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error querying recent errors: ${error.message}`);
+  }
+  
+  console.log('\n=== Environment check complete ===');
+  console.log('\nRecommendations:');
+  
+  const emailConfig = await db('email_configs').first().catch(() => null);
+  if (!emailConfig) {
+    console.log('❗ Configure email settings in the admin panel or add email_configs record');
+  }
+  
+  if (!process.env.SMTP_HOST && !emailConfig) {
+    console.log('❗ Set SMTP environment variables or configure in database');
+  }
+  
+  await db.destroy();
+}
+
+checkEmailEnvironment().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

backend/scripts/check-email-processor.js

@@ -0,0 +1,157 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function checkEmailProcessor() {
+  try {
+    logger.info('=== Email Processor Diagnostic Check ===\n');
+    
+    // 1. Check pending emails
+    logger.info('1. Checking pending emails in queue...');
+    const pendingEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .orderBy('created_at', 'asc');
+    
+    logger.info(`Found ${pendingEmails.length} pending emails\n`);
+    
+    if (pendingEmails.length > 0) {
+      logger.info('Pending email details:');
+      pendingEmails.forEach((email, index) => {
+        logger.info(`\nEmail ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Recipient: ${email.recipient_email}`);
+        logger.info(`  Event ID: ${email.event_id}`);
+        logger.info(`  Status: ${email.status}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Scheduled At: ${email.scheduled_at}`);
+        logger.info(`  Created At: ${email.created_at}`);
+        logger.info(`  Error: ${email.error_message || 'None'}`);
+        
+        // Check if email_data needs parsing
+        logger.info(`  Email Data Type: ${typeof email.email_data}`);
+        if (email.email_data) {
+          try {
+            const data = typeof email.email_data === 'string' 
+              ? JSON.parse(email.email_data) 
+              : email.email_data;
+            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
+          } catch (e) {
+            logger.error(`  Failed to parse email_data: ${e.message}`);
+          }
+        }
+      });
+    }
+    
+    // 2. Check failed emails
+    logger.info('\n\n2. Checking failed emails...');
+    const failedEmails = await db('email_queue')
+      .where('status', 'failed')
+      .orderBy('created_at', 'desc')
+      .limit(5);
+    
+    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
+    
+    if (failedEmails.length > 0) {
+      failedEmails.forEach((email, index) => {
+        logger.info(`\nFailed Email ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Error: ${email.error_message || 'No error message'}`);
+        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
+      });
+    }
+    
+    // 3. Check if email processor should be running
+    logger.info('\n\n3. Checking email processor configuration...');
+    
+    // Check environment variables
+    const emailConfig = {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT,
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_FROM: process.env.SMTP_FROM,
+      SMTP_SECURE: process.env.SMTP_SECURE,
+      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
+    };
+    
+    logger.info('Email configuration:');
+    Object.entries(emailConfig).forEach(([key, value]) => {
+      if (key === 'SMTP_USER') {
+        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
+      } else {
+        logger.info(`  ${key}: ${value || 'NOT SET'}`);
+      }
+    });
+    
+    // 4. Test email processor functionality
+    logger.info('\n\n4. Testing email processor functionality...');
+    
+    // Import the email processor
+    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
+    
+    // Test email connection
+    logger.info('Testing email connection...');
+    try {
+      const connectionTest = await testEmailConnection();
+      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
+    } catch (error) {
+      logger.error(`Email connection test failed: ${error.message}`);
+    }
+    
+    // Try to process queue once manually
+    if (pendingEmails.length > 0) {
+      logger.info('\n\n5. Attempting to process email queue manually...');
+      try {
+        await processEmailQueue();
+        logger.info('Manual queue processing completed');
+        
+        // Check status after processing
+        const stillPending = await db('email_queue')
+          .where('status', 'pending')
+          .where('retry_count', '<', 3)
+          .count('* as count')
+          .first();
+        
+        logger.info(`Emails still pending after processing: ${stillPending.count}`);
+      } catch (error) {
+        logger.error(`Error processing queue: ${error.message}`);
+        logger.error(`Stack trace: ${error.stack}`);
+      }
+    }
+    
+    // 5. Check for any recent successful emails
+    logger.info('\n\n6. Checking recent successful emails...');
+    const recentSuccess = await db('email_queue')
+      .where('status', 'sent')
+      .orderBy('sent_at', 'desc')
+      .limit(3);
+    
+    if (recentSuccess.length > 0) {
+      logger.info(`Last ${recentSuccess.length} successful emails:`);
+      recentSuccess.forEach((email, index) => {
+        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
+      });
+    } else {
+      logger.info('No successfully sent emails found');
+    }
+    
+    logger.info('\n\n=== Diagnostic check complete ===');
+    
+  } catch (error) {
+    logger.error('Error running diagnostic check:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the check
+checkEmailProcessor();

backend/scripts/check-email-templates.js

@@ -0,0 +1,66 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailTemplates() {
+  try {
+    console.log('=== Email Templates Check ===\n');
+    
+    // 1. Check table columns
+    console.log('1. Checking email_templates table structure...');
+    
+    // Check which columns exist
+    const columnChecks = [
+      'subject', 'subject_en', 'subject_de',
+      'body_html', 'body_html_en', 'body_html_de',
+      'body_text', 'body_text_en', 'body_text_de'
+    ];
+    
+    const existingColumns = [];
+    for (const col of columnChecks) {
+      const exists = await db.schema.hasColumn('email_templates', col);
+      if (exists) existingColumns.push(col);
+    }
+    
+    console.log('   Existing columns:', existingColumns.join(', '));
+    
+    // 2. Get all templates
+    console.log('\n2. Current email templates:');
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n   Template: ${template.template_key}`);
+      console.log('   -------------------');
+      
+      // Check which fields have content
+      const fields = ['subject', 'subject_en', 'subject_de', 
+                     'body_html', 'body_html_en', 'body_html_de',
+                     'body_text', 'body_text_en', 'body_text_de'];
+      
+      for (const field of fields) {
+        if (template[field]) {
+          const preview = template[field].substring(0, 50) + '...';
+          console.log(`   ${field}: ${preview}`);
+        }
+      }
+      
+      // Check for German translations
+      const hasGermanSubject = template.subject_de || template.body_html_de;
+      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
+    }
+    
+    // 3. Summary
+    console.log('\n3. Summary:');
+    const totalTemplates = templates.length;
+    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
+    console.log(`   Total templates: ${totalTemplates}`);
+    console.log(`   Templates with German: ${templatesWithGerman}`);
+    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkEmailTemplates();

backend/scripts/check-german-templates.js

@@ -0,0 +1,53 @@
+const { db } = require('../src/database/db');
+
+async function checkGermanTemplates() {
+  try {
+    console.log('=== German Email Template Content Check ===\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\nTemplate: ${template.template_key}`);
+      console.log('=====================================');
+      
+      // Check German subject
+      console.log('\nGERMAN SUBJECT:');
+      console.log(template.subject_de || 'MISSING');
+      
+      // Check if German HTML body has English content
+      console.log('\nGERMAN HTML BODY:');
+      const germanHtml = template.body_html_de || '';
+      
+      // Check for English phrases in German template
+      const englishPhrases = [
+        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
+        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
+        'Thank you', 'Best regards', 'View Gallery', 'days'
+      ];
+      
+      const foundEnglish = englishPhrases.filter(phrase => 
+        germanHtml.toLowerCase().includes(phrase.toLowerCase())
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
+      }
+      
+      // Show first 500 chars of German HTML
+      console.log(germanHtml.substring(0, 500) + '...\n');
+      
+      // Check German text body
+      console.log('GERMAN TEXT BODY:');
+      const germanText = template.body_text_de || '';
+      console.log(germanText.substring(0, 300) + '...\n');
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkGermanTemplates();

backend/scripts/create-test-event.js

@@ -0,0 +1,58 @@
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '../.env') });
+const { db } = require('../src/database/db');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { v4: uuidv4 } = require('uuid');
+
+async function createTestEvent() {
+  try {
+    console.log('Creating test event...');
+    
+    // Hash a simple password
+    const passwordHash = await bcrypt.hash('test123', 10);
+    
+    // Generate share token
+    const shareToken = uuidv4().replace(/-/g, '');
+    const shareLink = `http://localhost:3005/gallery/wedding-test123-2025-07-07/${shareToken}`;
+    
+    // Create event
+    const eventData = {
+      slug: 'wedding-test123-2025-07-07',
+      event_type: 'wedding',
+      event_name: 'Test Wedding',
+      event_date: '2025-07-07',
+      host_email: 'host@example.com',
+      admin_email: 'admin@example.com',
+      password_hash: passwordHash,
+      welcome_message: 'Welcome to our test wedding gallery!',
+      color_theme: null, // Use global theme
+      is_active: 1,
+      expires_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
+      share_link: shareLink
+    };
+    
+    // Delete existing event if it exists
+    await db('events').where('slug', eventData.slug).delete();
+    
+    // Insert new event
+    const insertResult = await db('events').insert(eventData).returning('id');
+    const eventId = insertResult[0]?.id || insertResult[0];
+    console.log('Event created with ID:', eventId);
+    
+    console.log('\nTest event created successfully!');
+    console.log('Event details:');
+    console.log('- Name:', eventData.event_name);
+    console.log('- Slug:', eventData.slug);
+    console.log('- Password:', 'test123');
+    console.log('- Share link:', shareLink);
+    console.log('\nYou can now access the gallery at the share link above');
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Error creating test event:', error);
+    process.exit(1);
+  }
+}
+
+createTestEvent();

backend/scripts/debug-500-errors.js

@@ -0,0 +1,92 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function debugEndpoints() {
+  console.log('Debugging 500 errors...\n');
+  
+  try {
+    // Test email templates query
+    console.log('1. Testing email templates query:');
+    try {
+      const templates = await db('email_templates')
+        .select('*')
+        .orderBy('template_key');
+      
+      console.log(`Found ${templates.length} templates`);
+      if (templates.length > 0) {
+        console.log('First template columns:', Object.keys(templates[0]));
+        console.log('Template keys:', templates.map(t => t.template_key));
+      }
+    } catch (error) {
+      console.error('Email templates query failed:', error.message);
+      console.error('Error code:', error.code);
+    }
+    
+    // Test notifications query
+    console.log('\n2. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .whereNull('activity_logs.read_at')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      
+      console.log(`Found ${notifications.length} unread notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+      console.error('Error code:', error.code);
+      
+      // Check if it's a column issue
+      if (error.message.includes('column')) {
+        console.log('\nChecking activity_logs columns:');
+        const columns = await db('activity_logs').columnInfo();
+        console.log('Columns:', Object.keys(columns));
+      }
+    }
+    
+    // Test specific template query
+    console.log('\n3. Testing specific template query (gallery_created):');
+    try {
+      const template = await db('email_templates')
+        .where('template_key', 'gallery_created')
+        .first();
+      
+      if (template) {
+        console.log('Template found:', template.template_key);
+        console.log('Has subject_en?', template.subject_en !== undefined);
+        console.log('Has subject?', template.subject !== undefined);
+      } else {
+        console.log('Template not found');
+      }
+    } catch (error) {
+      console.error('Template query failed:', error.message);
+    }
+    
+    // Check CMS pages
+    console.log('\n4. Checking CMS pages:');
+    try {
+      const pages = await db('cms_pages')
+        .select('slug', 'title', 'is_published')
+        .orderBy('slug');
+      
+      console.log(`Found ${pages.length} CMS pages:`);
+      pages.forEach(page => {
+        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
+      });
+    } catch (error) {
+      console.error('CMS pages query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('General error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+debugEndpoints();

backend/scripts/debug-email-queue.js

@@ -0,0 +1,146 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function debugEmailQueue() {
+  try {
+    logger.info('=== Email Queue Debug Report ===\n');
+    
+    // 1. Count exactly like the admin dashboard does
+    logger.info('1. Admin Dashboard Query (ALL pending, no retry filter):');
+    const [adminCount] = await db('email_queue').where('status', 'pending').count('* as count');
+    logger.info(`   Pending emails (admin dashboard view): ${adminCount.count}\n`);
+    
+    // 2. Count like the email processor does
+    logger.info('2. Email Processor Query (pending with retry_count < 3):');
+    const [processorCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    logger.info(`   Pending emails (processor view): ${processorCount.count}\n`);
+    
+    // 3. Show the discrepancy
+    logger.info('3. Discrepancy Analysis:');
+    if (adminCount.count !== processorCount.count) {
+      logger.info(`   ⚠️  DISCREPANCY FOUND!`);
+      logger.info(`   Admin shows: ${adminCount.count}`);
+      logger.info(`   Processor will process: ${processorCount.count}`);
+      logger.info(`   Difference: ${adminCount.count - processorCount.count} email(s)\n`);
+      
+      // Find the problematic emails
+      logger.info('4. Emails with retry_count >= 3 (still pending):');
+      const stuckEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '>=', 3)
+        .select('*');
+      
+      if (stuckEmails.length > 0) {
+        logger.info(`   Found ${stuckEmails.length} stuck email(s):\n`);
+        stuckEmails.forEach((email, index) => {
+          logger.info(`   Email ${index + 1}:`);
+          logger.info(`     ID: ${email.id}`);
+          logger.info(`     Type: ${email.email_type}`);
+          logger.info(`     Recipient: ${email.recipient_email}`);
+          logger.info(`     Status: ${email.status}`);
+          logger.info(`     Retry Count: ${email.retry_count} ⚠️`);
+          logger.info(`     Created: ${email.created_at}`);
+          logger.info(`     Last Error: ${email.error_message || 'None'}\n`);
+        });
+      }
+    } else {
+      logger.info(`   ✅ No discrepancy - counts match\n`);
+    }
+    
+    // 5. Show ALL pending emails with details
+    logger.info('5. ALL Pending Emails (regardless of retry count):');
+    const allPending = await db('email_queue')
+      .where('status', 'pending')
+      .orderBy('retry_count', 'desc')
+      .orderBy('created_at', 'asc');
+    
+    if (allPending.length > 0) {
+      allPending.forEach((email, index) => {
+        const willProcess = email.retry_count < 3;
+        logger.info(`\n   Email ${index + 1}: ${willProcess ? '✅ WILL PROCESS' : '❌ STUCK (max retries)'}`);
+        logger.info(`     ID: ${email.id}`);
+        logger.info(`     Type: ${email.email_type}`);
+        logger.info(`     Recipient: ${email.recipient_email}`);
+        logger.info(`     Event ID: ${email.event_id}`);
+        logger.info(`     Retry Count: ${email.retry_count}/3`);
+        logger.info(`     Created: ${email.created_at}`);
+        logger.info(`     Scheduled: ${email.scheduled_at}`);
+        if (email.error_message) {
+          logger.info(`     Last Error: ${email.error_message}`);
+        }
+      });
+    } else {
+      logger.info('   No pending emails found');
+    }
+    
+    // 6. Show counts by status
+    logger.info('\n\n6. Email Queue Summary by Status:');
+    const statusCounts = await db('email_queue')
+      .select('status')
+      .count('* as count')
+      .groupBy('status')
+      .orderBy('status');
+    
+    statusCounts.forEach(row => {
+      logger.info(`   ${row.status}: ${row.count}`);
+    });
+    
+    // 7. Failed emails summary
+    logger.info('\n7. Failed Emails Summary:');
+    const failedSummary = await db('email_queue')
+      .where('status', 'failed')
+      .select('retry_count')
+      .count('* as count')
+      .groupBy('retry_count')
+      .orderBy('retry_count');
+    
+    if (failedSummary.length > 0) {
+      failedSummary.forEach(row => {
+        logger.info(`   Retry count ${row.retry_count}: ${row.count} email(s)`);
+      });
+    } else {
+      logger.info('   No failed emails');
+    }
+    
+    // 8. Recommendations
+    logger.info('\n\n=== RECOMMENDATIONS ===');
+    
+    if (adminCount.count > processorCount.count) {
+      logger.info('\n❗ You have emails stuck with retry_count >= 3');
+      logger.info('   These emails will NOT be processed automatically.');
+      logger.info('\n   To fix this, you can:');
+      logger.info('   1. Reset retry count: UPDATE email_queue SET retry_count = 0 WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   2. Mark as failed: UPDATE email_queue SET status = \'failed\' WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   3. Delete them: DELETE FROM email_queue WHERE status = \'pending\' AND retry_count >= 3;');
+    }
+    
+    const anyPending = adminCount.count > 0;
+    if (anyPending && processorCount.count === 0) {
+      logger.info('\n❗ All pending emails have exceeded retry limit');
+      logger.info('   The email processor will not attempt to send them.');
+    } else if (anyPending && processorCount.count > 0) {
+      logger.info('\n✅ Email processor should process the pending emails on next run');
+      logger.info('   Make sure the email processor service is running.');
+    }
+    
+    logger.info('\n=== Debug report complete ===');
+    
+  } catch (error) {
+    logger.error('Error running debug report:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the debug
+debugEmailQueue();

backend/scripts/diagnose-thumbnails.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose thumbnail serving issues
+ * Usage: node scripts/diagnose-thumbnails.js <eventId>
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function diagnoseThumbnails(eventId) {
+  if (!eventId) {
+    console.error('Usage: node scripts/diagnose-thumbnails.js <eventId>');
+    process.exit(1);
+  }
+  
+  console.log(`Diagnosing thumbnails for event ID: ${eventId}`);
+  console.log(`Storage path: ${STORAGE_PATH}`);
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}\n`);
+  
+  try {
+    // Get event info
+    const event = await db('events').where('id', eventId).first();
+    if (!event) {
+      console.error(`Event not found with ID: ${eventId}`);
+      return;
+    }
+    
+    console.log(`Event: ${event.event_name} (${event.slug})`);
+    console.log(`Active: ${event.is_active}, Archived: ${event.is_archived}\n`);
+    
+    // Get photos for this event
+    const photos = await db('photos')
+      .where('event_id', eventId)
+      .select('id', 'filename', 'path', 'thumbnail_path');
+    
+    console.log(`Found ${photos.length} photos in database\n`);
+    
+    let missingThumbnails = 0;
+    let existingThumbnails = 0;
+    let pathIssues = [];
+    
+    for (const photo of photos.slice(0, 10)) { // Check first 10 photos
+      console.log(`Photo ID ${photo.id}: ${photo.filename}`);
+      console.log(`  Photo path: ${photo.path}`);
+      console.log(`  Thumbnail path in DB: ${photo.thumbnail_path}`);
+      
+      if (photo.thumbnail_path) {
+        // Expected thumbnail filename
+        const expectedThumbName = `thumb_${photo.filename}`;
+        const expectedThumbPath = path.join(THUMBNAILS_DIR, expectedThumbName);
+        
+        // Check if thumbnail exists
+        try {
+          await fs.access(expectedThumbPath);
+          console.log(`  ✓ Thumbnail exists at: ${expectedThumbName}`);
+          existingThumbnails++;
+          
+          // Check if DB path matches expected path
+          const dbThumbName = path.basename(photo.thumbnail_path);
+          if (dbThumbName !== expectedThumbName) {
+            console.log(`  ⚠ Path mismatch! DB has: ${dbThumbName}, Expected: ${expectedThumbName}`);
+            pathIssues.push({
+              photoId: photo.id,
+              dbPath: photo.thumbnail_path,
+              expectedPath: `thumbnails/${expectedThumbName}`
+            });
+          }
+        } catch {
+          console.log(`  ✗ Thumbnail missing: ${expectedThumbName}`);
+          missingThumbnails++;
+        }
+      } else {
+        console.log(`  ✗ No thumbnail path in database`);
+        missingThumbnails++;
+      }
+      console.log('');
+    }
+    
+    console.log('--- Summary ---');
+    console.log(`Existing thumbnails: ${existingThumbnails}`);
+    console.log(`Missing thumbnails: ${missingThumbnails}`);
+    console.log(`Path issues: ${pathIssues.length}`);
+    
+    if (pathIssues.length > 0) {
+      console.log('\n--- Path Issues ---');
+      console.log('The following photos have incorrect thumbnail paths in the database:');
+      for (const issue of pathIssues) {
+        console.log(`Photo ID ${issue.photoId}:`);
+        console.log(`  Current: ${issue.dbPath}`);
+        console.log(`  Should be: ${issue.expectedPath}`);
+      }
+      
+      console.log('\nTo fix path issues, run:');
+      console.log(`UPDATE photos SET thumbnail_path = 'thumbnails/thumb_' || filename WHERE event_id = ${eventId};`);
+    }
+    
+    // Check for any thumbnails in the directory that match this event
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    const eventThumbnails = files.filter(f => {
+      // Try to match thumbnails for this event
+      for (const photo of photos) {
+        if (f === `thumb_${photo.filename}`) return true;
+      }
+      return false;
+    });
+    
+    console.log(`\n--- Filesystem Check ---`);
+    console.log(`Found ${eventThumbnails.length} thumbnails in directory for this event`);
+    
+  } catch (error) {
+    console.error('Error during diagnosis:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the diagnosis
+diagnoseThumbnails(eventId).then(async () => {
+  await db.destroy();
+  console.log('\nDiagnosis complete');
+}).catch(async error => {
+  console.error('Diagnosis failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/fix-email-queue-schema.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose and fix email_queue schema issues
+ * This helps resolve the "column updated_at does not exist" error
+ */
+
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkAndFixEmailQueueSchema() {
+  console.log('Checking email_queue table schema...');
+  
+  try {
+    // Get column information
+    const columns = await db('email_queue').columnInfo();
+    console.log('\nCurrent email_queue columns:', Object.keys(columns));
+    
+    // Check for updated_at column
+    if (columns.updated_at) {
+      console.log('\n⚠️  Found unexpected updated_at column in email_queue table!');
+      console.log('This column should not exist and is causing errors.');
+      
+      // Ask for confirmation before removing
+      console.log('\nRemoving updated_at column...');
+      await db.schema.table('email_queue', (table) => {
+        table.dropColumn('updated_at');
+      });
+      console.log('✅ Removed updated_at column from email_queue table');
+    } else {
+      console.log('✅ No updated_at column found (this is correct)');
+    }
+    
+    // Verify required columns exist
+    const requiredColumns = [
+      'id', 'event_id', 'recipient_email', 'email_type', 
+      'email_data', 'status', 'scheduled_at', 'sent_at', 
+      'error_message', 'retry_count', 'created_at'
+    ];
+    
+    const missingColumns = requiredColumns.filter(col => !columns[col]);
+    if (missingColumns.length > 0) {
+      console.log('\n⚠️  Missing required columns:', missingColumns);
+    } else {
+      console.log('✅ All required columns are present');
+    }
+    
+    // Check for any database triggers
+    if (process.env.DATABASE_CLIENT === 'pg') {
+      console.log('\nChecking for PostgreSQL triggers on email_queue...');
+      const triggers = await db.raw(`
+        SELECT trigger_name, event_manipulation, action_statement
+        FROM information_schema.triggers
+        WHERE event_object_table = 'email_queue'
+        AND trigger_schema = current_schema()
+      `);
+      
+      if (triggers.rows && triggers.rows.length > 0) {
+        console.log('⚠️  Found triggers on email_queue table:');
+        triggers.rows.forEach(trigger => {
+          console.log(`  - ${trigger.trigger_name} (${trigger.event_manipulation})`);
+        });
+      } else {
+        console.log('✅ No triggers found on email_queue table');
+      }
+    }
+    
+    // Test update query
+    console.log('\nTesting update query...');
+    const testEmail = await db('email_queue')
+      .where('status', 'pending')
+      .first();
+    
+    if (testEmail) {
+      try {
+        await db('email_queue')
+          .where('id', testEmail.id)
+          .update({
+            retry_count: testEmail.retry_count
+          });
+        console.log('✅ Update query works correctly');
+      } catch (error) {
+        console.log('❌ Update query failed:', error.message);
+      }
+    } else {
+      console.log('ℹ️  No pending emails to test with');
+    }
+    
+    console.log('\nSchema check complete!');
+    
+  } catch (error) {
+    console.error('Error checking schema:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the check
+checkAndFixEmailQueueSchema();

backend/scripts/fix-final-german-templates.js

@@ -0,0 +1,88 @@
+const { db } = require('../src/database/db');
+
+async function fixFinalGermanTemplates() {
+  try {
+    console.log('Fixing remaining English words in German templates...\n');
+    
+    // Get all templates
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      let updated = false;
+      let updates = {};
+      
+      // Fix subject_de
+      if (template.subject_de) {
+        updates.subject_de = template.subject_de;
+      }
+      
+      // Fix body_html_de
+      if (template.body_html_de) {
+        let html = template.body_html_de;
+        
+        // Replace English words with German
+        html = html.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Details:/g, 'Details:');
+        html = html.replace(/Link:/g, 'Link:');
+        html = html.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Archive-Details:/g, 'Archiv-Details:');
+        html = html.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (html !== template.body_html_de) {
+          updates.body_html_de = html;
+          updated = true;
+        }
+      }
+      
+      // Fix body_text_de
+      if (template.body_text_de) {
+        let text = template.body_text_de;
+        
+        text = text.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Details:/g, 'Details:');
+        text = text.replace(/Link:/g, 'Link:');
+        text = text.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Archive-Details:/g, 'Archiv-Details:');
+        text = text.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (text !== template.body_text_de) {
+          updates.body_text_de = text;
+          updated = true;
+        }
+      }
+      
+      // Also update the non-language-specific fields to match German
+      if (template.body_html_de) {
+        updates.body_html = template.body_html_de;
+      }
+      if (template.body_text_de) {
+        updates.body_text = template.body_text_de;
+      }
+      if (template.subject_de) {
+        updates.subject = template.subject_de;
+      }
+      
+      if (updated || Object.keys(updates).length > 0) {
+        await db('email_templates')
+          .where('template_key', template.template_key)
+          .update(updates);
+        console.log(`✅ Updated ${template.template_key}`);
+      } else {
+        console.log(`⏭️  No changes needed for ${template.template_key}`);
+      }
+    }
+    
+    console.log('\nDone!');
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+fixFinalGermanTemplates();

backend/scripts/fix-migration-state.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Fix migration state by marking migrations as applied if their tables already exist
- */
-
-const { db } = require('../src/database/db');
-
-async function fixMigrationState() {
-  try {
-    console.log('Checking migration state...');
-    
-    // Ensure migrations table exists
-    const hasMigrationsTable = await db.schema.hasTable('migrations');
-    if (!hasMigrationsTable) {
-      await db.schema.createTable('migrations', (table) => {
-        table.increments('id').primary();
-        table.string('filename').unique().notNullable();
-        table.timestamp('applied_at').defaultTo(db.fn.now());
-      });
-      console.log('Created migrations tracking table');
-    }
-    
-    // Check for specific tables and mark their migrations as applied
-    const tableChecks = [
-      { table: 'restore_runs', migration: '032_add_restore_runs_table.js' },
-      { table: 'restore_file_operations', migration: '032_add_restore_runs_table.js' },
-      { table: 'restore_validation_results', migration: '032_add_restore_runs_table.js' },
-      { table: 'gallery_feedback', migration: '033_add_gallery_feedback.js' },
-      { table: 'feedback_photos', migration: '033_add_gallery_feedback.js' },
-    ];
-    
-    for (const check of tableChecks) {
-      const tableExists = await db.schema.hasTable(check.table);
-      if (tableExists) {
-        const migrationApplied = await db('migrations')
-          .where('filename', check.migration)
-          .first();
-        
-        if (!migrationApplied) {
-          await db('migrations').insert({ 
-            filename: check.migration,
-            applied_at: new Date()
-          });
-          console.log(`✅ Marked ${check.migration} as applied (table ${check.table} exists)`);
-        } else {
-          console.log(`ℹ️  ${check.migration} already marked as applied`);
-        }
-      }
-    }
-    
-    console.log('\nMigration state fixed successfully!');
-  } catch (error) {
-    console.error('Error fixing migration state:', error.message);
-    process.exit(1);
-  } finally {
-    await db.destroy();
-  }
-}
-
-fixMigrationState();

backend/scripts/fix-production-issues.js

@@ -0,0 +1,145 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function fixProductionIssues() {
+  console.log('Fixing production database issues...\n');
+  
+  try {
+    // 1. Check and fix email_templates structure
+    console.log('1. Checking email_templates structure:');
+    const emailColumns = await db('email_templates').columnInfo();
+    console.log('Current columns:', Object.keys(emailColumns));
+    
+    // Check if we need to add basic columns back
+    const hasSubject = 'subject' in emailColumns;
+    const hasSubjectEn = 'subject_en' in emailColumns;
+    
+    if (hasSubjectEn && !hasSubject) {
+      console.log('Adding basic columns back to email_templates...');
+      await db.schema.alterTable('email_templates', (table) => {
+        table.string('subject');
+        table.text('body_html');
+        table.text('body_text');
+      });
+      
+      // Copy values from _en columns
+      await db('email_templates').update({
+        subject: db.raw('subject_en'),
+        body_html: db.raw('body_html_en'),
+        body_text: db.raw('body_text_en')
+      });
+      console.log('Basic columns added successfully');
+    }
+    
+    // 2. Ensure default templates exist
+    console.log('\n2. Checking email templates:');
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    if (templateCount[0].count === 0) {
+      console.log('No templates found, inserting defaults...');
+      const defaultTemplates = [
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: '<h2>Gallery Created Successfully</h2>...',
+          body_text: 'Gallery Created Successfully...',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: '<h2>Gallery Expiring Soon</h2>...',
+          body_text: 'Gallery Expiring Soon...',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        },
+        {
+          template_key: 'gallery_expired',
+          subject: 'Your Photo Gallery Has Expired',
+          body_html: '<h2>Gallery Expired</h2>...',
+          body_text: 'Gallery Expired...',
+          variables: JSON.stringify(['host_name', 'event_name'])
+        },
+        {
+          template_key: 'archive_complete',
+          subject: 'Gallery Archive Complete',
+          body_html: '<h2>Archive Complete</h2>...',
+          body_text: 'Archive Complete...',
+          variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+        }
+      ];
+      
+      for (const template of defaultTemplates) {
+        // Add language columns if they exist
+        if (hasSubjectEn) {
+          template.subject_en = template.subject;
+          template.body_html_en = template.body_html;
+          template.body_text_en = template.body_text;
+          template.subject_de = template.subject;
+          template.body_html_de = template.body_html;
+          template.body_text_de = template.body_text;
+        }
+        
+        await db('email_templates').insert(template);
+      }
+      console.log('Default templates inserted');
+    }
+    
+    // 3. Check activity_logs structure
+    console.log('\n3. Checking activity_logs structure:');
+    const activityColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityColumns));
+    
+    // Check if read_at exists
+    if (!('read_at' in activityColumns)) {
+      console.log('Adding read_at column to activity_logs...');
+      await db.schema.alterTable('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+      console.log('read_at column added');
+    }
+    
+    // 4. Check and add CMS pages
+    console.log('\n4. Checking CMS pages:');
+    const cmsColumns = await db('cms_pages').columnInfo();
+    console.log('CMS columns:', Object.keys(cmsColumns));
+    
+    const impressum = await db('cms_pages').where('slug', 'impressum').first();
+    const datenschutz = await db('cms_pages').where('slug', 'datenschutz').first();
+    
+    if (!impressum) {
+      console.log('Adding Impressum page...');
+      await db('cms_pages').insert({
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h1>Legal Notice</h1><p>Your legal information here...</p>',
+        content_de: '<h1>Impressum</h1><p>Ihre rechtlichen Informationen hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    if (!datenschutz) {
+      console.log('Adding Datenschutz page...');
+      await db('cms_pages').insert({
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h1>Privacy Policy</h1><p>Your privacy policy here...</p>',
+        content_de: '<h1>Datenschutzerklärung</h1><p>Ihre Datenschutzerklärung hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    console.log('\n✅ All fixes applied successfully!');
+    
+  } catch (error) {
+    console.error('Error fixing issues:', error);
+    console.error('Stack:', error.stack);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+fixProductionIssues();

backend/scripts/fix-stuck-emails.js

@@ -0,0 +1,126 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function fixStuckEmails() {
+  try {
+    logger.info('=== Fix Stuck Emails Script ===\n');
+    
+    // 1. Find stuck emails
+    logger.info('1. Finding stuck emails (pending with retry_count >= 3)...');
+    const stuckEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .select('*');
+    
+    if (stuckEmails.length === 0) {
+      logger.info('   ✅ No stuck emails found!');
+      logger.info('\n=== Script complete ===');
+      await db.destroy();
+      process.exit(0);
+    }
+    
+    logger.info(`   Found ${stuckEmails.length} stuck email(s)\n`);
+    
+    // 2. Show details
+    logger.info('2. Stuck email details:');
+    stuckEmails.forEach((email, index) => {
+      logger.info(`\n   Email ${index + 1}:`);
+      logger.info(`     ID: ${email.id}`);
+      logger.info(`     Type: ${email.email_type}`);
+      logger.info(`     Recipient: ${email.recipient_email}`);
+      logger.info(`     Retry Count: ${email.retry_count}`);
+      logger.info(`     Last Error: ${email.error_message || 'None'}`);
+    });
+    
+    // 3. Ask for action
+    logger.info('\n\n3. Choose an action:');
+    logger.info('   1. Reset retry count to 0 (emails will be retried)');
+    logger.info('   2. Mark as failed (emails will not be retried)');
+    logger.info('   3. Delete these emails');
+    logger.info('   4. Cancel (do nothing)');
+    
+    // Get command line argument
+    const action = process.argv[2];
+    
+    if (!action || !['reset', 'fail', 'delete'].includes(action)) {
+      logger.info('\n❗ No valid action specified');
+      logger.info('\nUsage:');
+      logger.info('  node fix-stuck-emails.js reset   - Reset retry count to 0');
+      logger.info('  node fix-stuck-emails.js fail    - Mark as failed');
+      logger.info('  node fix-stuck-emails.js delete  - Delete stuck emails');
+      await db.destroy();
+      process.exit(1);
+    }
+    
+    // 4. Execute action
+    logger.info(`\n4. Executing action: ${action.toUpperCase()}`);
+    
+    const emailIds = stuckEmails.map(e => e.id);
+    
+    switch (action) {
+      case 'reset':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            retry_count: 0,
+            error_message: null
+          });
+        logger.info(`   ✅ Reset retry count for ${emailIds.length} email(s)`);
+        logger.info('   These emails will be processed on the next run');
+        break;
+        
+      case 'fail':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            status: 'failed'
+          });
+        logger.info(`   ✅ Marked ${emailIds.length} email(s) as failed`);
+        logger.info('   These emails will not be retried');
+        break;
+        
+      case 'delete':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .delete();
+        logger.info(`   ✅ Deleted ${emailIds.length} email(s)`);
+        break;
+    }
+    
+    // 5. Show updated counts
+    logger.info('\n5. Updated email queue status:');
+    const [pendingCount] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    const [processableCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    
+    logger.info(`   Total pending: ${pendingCount.count}`);
+    logger.info(`   Processable (retry < 3): ${processableCount.count}`);
+    
+    if (pendingCount.count !== processableCount.count) {
+      logger.info(`   ⚠️  Still have ${pendingCount.count - processableCount.count} stuck email(s)`);
+    } else {
+      logger.info('   ✅ No stuck emails remaining');
+    }
+    
+    logger.info('\n=== Script complete ===');
+    
+  } catch (error) {
+    logger.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the fix
+fixStuckEmails();

backend/scripts/mark-migration-applied.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Mark a specific migration as applied without running it
- * Usage: node scripts/mark-migration-applied.js <migration-filename>
- */
-
-const { db } = require('../src/database/db');
-
-async function markMigrationAsApplied(filename) {
-  try {
-    // Check if migration is already marked
-    const existing = await db('migrations')
-      .where('filename', filename)
-      .first();
-    
-    if (existing) {
-      console.log(`Migration ${filename} is already marked as applied`);
-      return;
-    }
-    
-    // Mark as applied
-    await db('migrations').insert({ 
-      filename,
-      applied_at: new Date()
-    });
-    
-    console.log(`✅ Migration ${filename} marked as applied`);
-  } catch (error) {
-    console.error('Error marking migration:', error.message);
-    process.exit(1);
-  } finally {
-    await db.destroy();
-  }
-}
-
-// Get migration filename from command line
-const migrationFile = process.argv[2];
-
-if (!migrationFile) {
-  console.error('Usage: node scripts/mark-migration-applied.js <migration-filename>');
-  console.error('Example: node scripts/mark-migration-applied.js 032_add_restore_runs_table.js');
-  process.exit(1);
-}
-
-markMigrationAsApplied(migrationFile);

backend/scripts/run-email-processor.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const { db } = require('../src/database/db');
+const { 
+  initializeTransporter, 
+  processEmailQueue, 
+  testEmailConnection 
+} = require('../src/services/emailProcessor');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function runEmailProcessor(runOnce = false) {
+  try {
+    logger.info('=== Starting Email Processor ===\n');
+    
+    // Initialize transporter
+    logger.info('Initializing email transporter...');
+    await initializeTransporter();
+    
+    // Test connection
+    logger.info('Testing email connection...');
+    const connectionOk = await testEmailConnection();
+    
+    if (!connectionOk) {
+      logger.error('Email connection test failed! Check your SMTP configuration.');
+      logger.info('\nRequired environment variables:');
+      logger.info('- SMTP_HOST');
+      logger.info('- SMTP_PORT');
+      logger.info('- SMTP_USER');
+      logger.info('- SMTP_PASS');
+      logger.info('- SMTP_FROM');
+      process.exit(1);
+    }
+    
+    logger.info('Email connection test successful!\n');
+    
+    if (runOnce) {
+      // Process queue once
+      logger.info('Processing email queue once...');
+      await processEmailQueue();
+      logger.info('Email processing complete');
+      
+      // Show final status
+      const pendingCount = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '<', 3)
+        .count('* as count')
+        .first();
+      
+      logger.info(`\nEmails still pending: ${pendingCount.count}`);
+      
+      await db.destroy();
+      process.exit(0);
+    } else {
+      // Run continuously
+      logger.info('Starting continuous email processor...');
+      logger.info('Processing emails every 60 seconds. Press Ctrl+C to stop.\n');
+      
+      // Process immediately
+      await processEmailQueue();
+      
+      // Then every minute
+      setInterval(async () => {
+        try {
+          await processEmailQueue();
+        } catch (error) {
+          logger.error('Error processing email queue:', error);
+        }
+      }, 60000);
+    }
+    
+  } catch (error) {
+    logger.error('Fatal error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+// Handle graceful shutdown
+process.on('SIGINT', async () => {
+  logger.info('\n\nShutting down email processor...');
+  await db.destroy();
+  process.exit(0);
+});
+
+// Check command line arguments
+const args = process.argv.slice(2);
+const runOnce = args.includes('--once') || args.includes('-o');
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+Email Processor Runner
+
+Usage: node run-email-processor.js [options]
+
+Options:
+  --once, -o     Process the email queue once and exit
+  --help, -h     Show this help message
+
+By default, the processor runs continuously, checking for emails every 60 seconds.
+  `);
+  process.exit(0);
+}
+
+// Run the processor
+runEmailProcessor(runOnce);

backend/scripts/run-migrations.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+/**
+ * Run database migrations using existing db connection
+ */
+
+const { db } = require('../src/database/db');
+
+async function runMigrations() {
+  console.log('Running database migrations...\n');
+  
+  try {
+    // Run all pending migrations
+    const result = await db.migrate.latest({
+      directory: './migrations'
+    });
+    
+    if (result[1].length === 0) {
+      console.log('✓ Database is already up to date');
+    } else {
+      console.log(`✓ Ran ${result[1].length} migrations:`);
+      result[1].forEach(migration => {
+        console.log(`  - ${migration}`);
+      });
+    }
+    
+    // Show current migration status
+    const list = await db.migrate.list();
+    console.log(`\nCurrent status: ${list[0].length} completed migrations`);
+    
+    await db.destroy();
+    process.exit(0);
+  } catch (error) {
+    console.error('Migration error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+runMigrations();

backend/scripts/show-admin-credentials.js

@@ -1,66 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Show or reset admin credentials
- */
-
-const bcrypt = require('bcrypt');
-const { db } = require('../src/database/db');
-const { generateReadablePassword } = require('../src/utils/passwordGenerator');
-
-async function showAdminCredentials(resetPassword = false) {
-  try {
-    // Get admin user
-    const admin = await db('admin_users')
-      .where('username', 'admin')
-      .first();
-    
-    if (!admin) {
-      console.error('❌ No admin user found in database');
-      process.exit(1);
-    }
-    
-    console.log('\n========================================');
-    console.log('PicPeak Admin Credentials');
-    console.log('========================================');
-    console.log(`Username: ${admin.username}`);
-    console.log(`Email: ${admin.email}`);
-    
-    if (resetPassword) {
-      // Generate new password
-      const newPassword = generateReadablePassword();
-      const passwordHash = await bcrypt.hash(newPassword, 12);
-      
-      // Update password
-      await db('admin_users')
-        .where('id', admin.id)
-        .update({
-          password_hash: passwordHash,
-          updated_at: new Date()
-        });
-      
-      console.log(`Password: ${newPassword} (NEWLY RESET)`);
-      console.log('\n⚠️  IMPORTANT: Please save this password securely!');
-    } else {
-      console.log('Password: [hidden - use --reset flag to generate new password]');
-    }
-    
-    console.log('\nLogin URL: http://localhost:3001/admin');
-    console.log('========================================\n');
-    
-  } catch (error) {
-    console.error('Error:', error.message);
-    process.exit(1);
-  } finally {
-    await db.destroy();
-  }
-}
-
-// Check for reset flag
-const resetPassword = process.argv.includes('--reset');
-
-if (resetPassword) {
-  console.log('🔄 Resetting admin password...');
-}
-
-showAdminCredentials(resetPassword);

backend/scripts/test-backup-manifest.js

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+
+/**
+ * Test script for backup manifest generator
+ * Demonstrates all features of the manifest generator
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const backupManifest = require('../src/services/backupManifest');
+const logger = require('../src/utils/logger');
+
+async function testManifestGeneration() {
+  console.log('=== Testing Backup Manifest Generator ===\n');
+
+  try {
+    // 1. Generate a full backup manifest
+    console.log('1. Generating full backup manifest...');
+    
+    const fullManifestOptions = {
+      backupType: 'full',
+      backupPath: '/backup/full/2025-01-21',
+      files: [
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_001.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_001.jpg',
+          size: 2456789,
+          modified: new Date('2025-01-20T10:30:00Z'),
+          checksum: 'a1b2c3d4e5f6789012345678901234567890123456789012345678901234567890',
+          permissions: '644'
+        },
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_002.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_002.jpg',
+          size: 2156789,
+          modified: new Date('2025-01-20T10:31:00Z'),
+          checksum: 'b2c3d4e5f67890123456789012345678901234567890123456789012345678901',
+          permissions: '644'
+        },
+        {
+          path: '/storage/thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          relativePath: 'thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          size: 45678,
+          modified: new Date('2025-01-20T10:35:00Z'),
+          checksum: 'c3d4e5f678901234567890123456789012345678901234567890123456789012',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        type: 'sqlite',
+        backupFile: 'database-backup-20250121-103000.sql.gz',
+        size: 1048576,
+        checksum: 'd4e5f6789012345678901234567890123456789012345678901234567890123',
+        tables: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        },
+        rowCounts: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        }
+      },
+      format: 'json',
+      customMetadata: {
+        operator: 'admin@example.com',
+        reason: 'Scheduled daily backup',
+        retentionDays: 30,
+        compressionType: 'gzip'
+      }
+    };
+
+    const fullManifest = await backupManifest.generateManifest(fullManifestOptions);
+    
+    // Save in both formats
+    const jsonPath = path.join(__dirname, 'test-manifest-full.json');
+    const yamlPath = path.join(__dirname, 'test-manifest-full.yaml');
+    
+    await backupManifest.saveManifest(fullManifest, jsonPath, 'json');
+    await backupManifest.saveManifest(fullManifest, yamlPath, 'yaml');
+    
+    console.log('✓ Full backup manifest generated and saved\n');
+
+    // 2. Generate summary report
+    console.log('2. Generating summary report...');
+    const summaryReport = backupManifest.generateSummaryReport(fullManifest);
+    console.log(summaryReport);
+    console.log('\n');
+
+    // 3. Load and validate manifest
+    console.log('3. Loading and validating manifest...');
+    const loadedManifest = await backupManifest.loadManifest(jsonPath);
+    console.log('✓ Manifest loaded and validated successfully\n');
+
+    // 4. Generate incremental backup manifest
+    console.log('4. Generating incremental backup manifest...');
+    
+    const incrementalOptions = {
+      backupType: 'incremental',
+      backupPath: '/backup/incremental/2025-01-22',
+      parentBackupId: fullManifest.backup.id,
+      files: [
+        // Original files with same checksums (unchanged)
+        fullManifestOptions.files[0],
+        fullManifestOptions.files[2],
+        // Modified file
+        {
+          ...fullManifestOptions.files[1],
+          size: 2256789,
+          modified: new Date('2025-01-21T14:00:00Z'),
+          checksum: 'e5f678901234567890123456789012345678901234567890123456789012345'
+        },
+        // New file
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_003.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_003.jpg',
+          size: 2356789,
+          modified: new Date('2025-01-21T14:30:00Z'),
+          checksum: 'f6789012345678901234567890123456789012345678901234567890123456',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        ...fullManifestOptions.databaseInfo,
+        size: 1148576,
+        checksum: 'g7890123456789012345678901234567890123456789012345678901234567',
+        rowCounts: {
+          events: 158,
+          photos: 4567,
+          access_logs: 12789,
+          admin_users: 3
+        }
+      }
+    };
+
+    const incrementalManifest = await backupManifest.generateIncrementalManifest(
+      incrementalOptions, 
+      fullManifest
+    );
+    
+    const incrementalJsonPath = path.join(__dirname, 'test-manifest-incremental.json');
+    await backupManifest.saveManifest(incrementalManifest, incrementalJsonPath, 'json');
+    
+    console.log('✓ Incremental backup manifest generated');
+    console.log(`  - Added files: ${incrementalManifest.incremental.changes.added_files_count}`);
+    console.log(`  - Modified files: ${incrementalManifest.incremental.changes.modified_files_count}`);
+    console.log(`  - Deleted files: ${incrementalManifest.incremental.changes.deleted_files_count}`);
+    console.log(`  - Size difference: ${(incrementalManifest.incremental.changes.size_difference / 1024).toFixed(2)} KB\n`);
+
+    // 5. Compare manifests
+    console.log('5. Comparing manifests...');
+    const comparison = backupManifest.compareManifests(incrementalManifest, fullManifest);
+    console.log('Comparison results:');
+    console.log(`  - Added: ${comparison.added_files.length} files`);
+    console.log(`  - Modified: ${comparison.modified_files.length} files`);
+    console.log(`  - Deleted: ${comparison.deleted_files.length} files`);
+    console.log(`  - Unchanged: ${comparison.unchanged_files.length} files`);
+    console.log(`  - Database changed: ${comparison.database_changes.checksum_changed ? 'Yes' : 'No'}\n`);
+
+    // 6. Test manifest integrity
+    console.log('6. Testing manifest integrity...');
+    
+    // Corrupt the manifest
+    const corruptedManifest = JSON.parse(JSON.stringify(incrementalManifest));
+    corruptedManifest.files.manifest[0].size = 9999999; // Change a file size
+    
+    try {
+      backupManifest.validateManifest(corruptedManifest);
+      console.log('✗ Validation should have failed for corrupted manifest');
+    } catch (error) {
+      console.log('✓ Correctly detected corrupted manifest:', error.message);
+    }
+
+    console.log('\n=== All tests completed successfully! ===');
+    
+    // Clean up test files
+    await fs.unlink(jsonPath).catch(() => {});
+    await fs.unlink(yamlPath).catch(() => {});
+    await fs.unlink(incrementalJsonPath).catch(() => {});
+
+  } catch (error) {
+    console.error('Test failed:', error);
+    logger.error('Manifest test failed:', error);
+    process.exit(1);
+  }
+}
+
+// Run tests
+testManifestGeneration().catch(console.error);

backend/scripts/test-cms-formatting.js

@@ -0,0 +1,52 @@
+/**
+ * Test script to verify CMS and email formatting improvements
+ */
+
+const { formatWelcomeMessage, nl2br } = require('../src/utils/formatters');
+
+console.log('Testing CMS and Email Formatting Improvements\n');
+
+// Test 1: Basic line break conversion
+console.log('Test 1: Basic line break conversion');
+const basicText = `Hello,
+This is line 1.
+This is line 2.
+
+This is line 4 with an extra break.`;
+
+console.log('Input:');
+console.log(basicText);
+console.log('\nOutput (nl2br):');
+console.log(nl2br(basicText));
+console.log('\n---\n');
+
+// Test 2: Welcome message formatting
+console.log('Test 2: Welcome message formatting');
+const welcomeMessage = `Dear guests,
+
+We're so excited to share these special moments with you!
+
+Please note:
+- Download your photos before the expiration date
+- The password is case-sensitive
+- Contact us if you have any issues
+
+Thank you for being part of our special day!
+
+Best regards,
+Sarah & John`;
+
+console.log('Input:');
+console.log(welcomeMessage);
+console.log('\nOutput (formatWelcomeMessage):');
+console.log(formatWelcomeMessage(welcomeMessage));
+console.log('\n---\n');
+
+// Test 3: Empty and edge cases
+console.log('Test 3: Edge cases');
+console.log('Empty string:', formatWelcomeMessage(''));
+console.log('Null:', formatWelcomeMessage(null));
+console.log('Only spaces:', formatWelcomeMessage('   \n   \n   '));
+console.log('Single line:', formatWelcomeMessage('This is a single line message'));
+
+console.log('\nAll tests completed!');

backend/scripts/test-german-emails.js

@@ -0,0 +1,85 @@
+const { db } = require('../src/database/db');
+const { processTemplate } = require('../src/services/emailProcessor');
+
+async function testGermanEmails() {
+  try {
+    console.log('=== Testing German Email Templates ===\n');
+    
+    // Test variables
+    const testVars = {
+      host_name: 'Max Mustermann',
+      event_name: 'Hochzeit Schmidt',
+      event_date: '15.07.2024',
+      gallery_link: 'https://example.com/gallery/test',
+      gallery_password: 'test1234',
+      expiry_date: '15.08.2024',
+      days_remaining: '7',
+      welcome_message: 'Herzlich willkommen zu unserer Hochzeitsgalerie!',
+      archive_size: '250 MB',
+      archive_date: '16.08.2024',
+      photo_count: '347',
+      admin_email: 'support@example.com',
+      eventId: 1
+    };
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n========== ${template.template_key.toUpperCase()} ==========`);
+      
+      // Process German version
+      const germanResult = await processGermanTemplate(template, testVars);
+      
+      console.log('\n--- GERMAN VERSION ---');
+      console.log('Subject:', germanResult.subject);
+      console.log('\nHTML Preview (first 500 chars):');
+      console.log(germanResult.htmlBody.substring(0, 500) + '...\n');
+      
+      // Check for any remaining English text
+      const englishWords = ['Dear', 'Gallery', 'Details:', 'Link:', 'Password:', 'days', 'Thank you'];
+      const foundEnglish = englishWords.filter(word => 
+        germanResult.htmlBody.includes(word) || germanResult.subject.includes(word)
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  WARNING: Found English words:', foundEnglish.join(', '));
+      } else {
+        console.log('✅ No English words found in German template');
+      }
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+async function processGermanTemplate(template, variables) {
+  // Process template as German
+  const subjectField = 'subject_de';
+  const htmlField = 'body_html_de';
+  const textField = 'body_text_de';
+  
+  let subject = template[subjectField] || template.subject || '';
+  let htmlBody = template[htmlField] || template.body_html || '';
+  let textBody = template[textField] || template.body_text || '';
+  
+  // Replace variables
+  Object.keys(variables).forEach(key => {
+    const regex = new RegExp(`{{${key}}}`, 'g');
+    subject = subject.replace(regex, variables[key]);
+    htmlBody = htmlBody.replace(regex, variables[key]);
+    textBody = textBody.replace(regex, variables[key]);
+  });
+  
+  // Handle conditionals (simplified)
+  htmlBody = htmlBody.replace(/{{#if welcome_message}}[\s\S]*?{{\/if}}/g, (match) => {
+    return variables.welcome_message ? match.replace(/{{#if welcome_message}}|{{\/if}}/g, '') : '';
+  });
+  
+  return { subject, htmlBody, textBody };
+}
+
+testGermanEmails();

backend/scripts/test-photo-auth.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+/**
+ * Script to test photo authentication
+ * Usage: node scripts/test-photo-auth.js <jwt-token>
+ */
+
+const axios = require('axios');
+
+async function testPhotoAuth(token) {
+  if (!token) {
+    console.error('Usage: node scripts/test-photo-auth.js <jwt-token>');
+    console.error('\nTo get a token, login to a gallery and check localStorage for gallery_token_<slug>');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_URL || 'http://localhost:3001';
+  
+  console.log(`Testing photo authentication with token: ${token.substring(0, 20)}...`);
+  console.log(`Base URL: ${baseUrl}\n`);
+
+  // Test URLs
+  const tests = [
+    {
+      name: 'Thumbnail via static route',
+      url: `${baseUrl}/thumbnails/thumb_Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Photo via static route',
+      url: `${baseUrl}/photos/wedding-test-gallery-2025-07-14-1/Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Gallery photos API',
+      url: `${baseUrl}/api/gallery/wedding-test-gallery-2025-07-14-1/photos`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    }
+  ];
+
+  for (const test of tests) {
+    console.log(`Testing: ${test.name}`);
+    console.log(`URL: ${test.url}`);
+    
+    try {
+      const response = await axios.get(test.url, {
+        headers: test.headers,
+        validateStatus: () => true // Don't throw on any status
+      });
+      
+      console.log(`Status: ${response.status}`);
+      console.log(`Headers:`, response.headers['content-type']);
+      
+      if (response.status === 200) {
+        if (test.name.includes('API')) {
+          console.log(`Photos count: ${response.data.photos?.length || 0}`);
+        } else {
+          console.log(`Content length: ${response.headers['content-length']} bytes`);
+        }
+      } else {
+        console.log(`Error:`, response.data);
+      }
+    } catch (error) {
+      console.log(`Network error:`, error.message);
+    }
+    
+    console.log('---\n');
+  }
+  
+  // Decode token to show info
+  try {
+    const parts = token.split('.');
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    console.log('Token payload:', payload);
+  } catch (error) {
+    console.log('Failed to decode token');
+  }
+}
+
+// Get token from command line
+const token = process.argv[2];
+
+testPhotoAuth(token).catch(error => {
+  console.error('Test failed:', error);
+  process.exit(1);
+});

backend/scripts/test-security-logging.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify security logging is working correctly
+ * Run with: node scripts/test-security-logging.js
+ */
+
+require('dotenv').config({ path: '../.env' });
+const logger = require('../src/utils/logger');
+
+console.log('Testing Security Logging...\n');
+
+// Test 1: Basic logging
+console.log('1. Testing basic logging levels:');
+logger.info('Test info message', { test: true });
+logger.warn('Test warning message', { test: true });
+logger.error('Test error message', { test: true });
+
+// Test 2: Security event logging
+console.log('\n2. Testing security event logging:');
+
+// Rate limit exceeded
+logger.warn('Rate limit exceeded', {
+  ip: '192.168.1.100',
+  path: '/api/admin/login',
+  method: 'POST',
+  authenticated: false,
+  userAgent: 'Mozilla/5.0 Test',
+  timestamp: new Date().toISOString(),
+  rateLimitInfo: {
+    limit: 5,
+    current: 6,
+    remaining: 0,
+    resetTime: new Date(Date.now() + 900000).toISOString()
+  }
+});
+
+// Auth rate limit
+logger.warn('Auth rate limit exceeded', {
+  ip: '192.168.1.101',
+  path: '/api/auth/admin/login',
+  method: 'POST',
+  userAgent: 'Mozilla/5.0 Test',
+  authType: 'admin',
+  timestamp: new Date().toISOString()
+});
+
+// Failed login
+logger.warn('Failed login attempt', {
+  username: 'testuser',
+  ip: '192.168.1.102',
+  userAgent: 'Mozilla/5.0 Test',
+  reason: 'invalid_credentials',
+  timestamp: new Date().toISOString()
+});
+
+// JWT validation failure
+logger.warn('JWT validation failed', {
+  ip: '192.168.1.103',
+  path: '/api/admin/events',
+  method: 'GET',
+  userAgent: 'Mozilla/5.0 Test',
+  error: 'TokenExpiredError',
+  message: 'jwt expired',
+  timestamp: new Date().toISOString()
+});
+
+// Account lockout
+logger.warn('Login attempt on locked account', {
+  username: 'lockeduser',
+  ip: '192.168.1.104',
+  remainingLockTime: 1200,
+  timestamp: new Date().toISOString()
+});
+
+// Suspicious activity
+logger.warn('Suspicious login activity detected', {
+  username: 'suspicioususer',
+  ips: ['192.168.1.105', '192.168.1.106', '192.168.1.107'],
+  timeWindow: '15 minutes',
+  timestamp: new Date().toISOString()
+});
+
+console.log('\n3. Check log files:');
+console.log('- logs/security.log - Should contain all security warnings');
+console.log('- logs/error.log - Should contain error messages');
+console.log('- logs/combined.log - Should contain all messages');
+
+console.log('\n✅ Security logging test complete!');
+console.log('Review the log files to ensure all events are properly captured.');
+
+// Give logger time to flush
+setTimeout(() => {
+  process.exit(0);
+}, 1000);

backend/scripts/verify-template-equality.js

@@ -0,0 +1,110 @@
+const { db } = require('../src/database/db');
+
+async function verifyTemplateEquality() {
+  try {
+    console.log('Verifying template equality between German and English versions...\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n=== ${template.template_key.toUpperCase()} ===`);
+      
+      // Check subject length similarity
+      const subjectEnLength = template.subject_en?.length || 0;
+      const subjectDeLength = template.subject_de?.length || 0;
+      console.log(`Subject length - EN: ${subjectEnLength}, DE: ${subjectDeLength}`);
+      
+      // Check HTML content features
+      const htmlEn = template.body_html_en || '';
+      const htmlDe = template.body_html_de || '';
+      
+      // Check for key features in both versions
+      const features = [
+        { name: 'Handlebars conditionals', pattern: /{{#if/g },
+        { name: 'Styled divs', pattern: /style="/g },
+        { name: 'Background colors', pattern: /background-color:/g },
+        { name: 'Buttons/CTAs', pattern: /<a.*style.*background-color.*>/g },
+        { name: 'Icons/Emojis', pattern: /[📧📞✅⚠️]/g },
+        { name: 'Lists', pattern: /<ul/g },
+        { name: 'Strong emphasis', pattern: /<strong>/g }
+      ];
+      
+      console.log('\nFeature comparison:');
+      for (const feature of features) {
+        const enCount = (htmlEn.match(feature.pattern) || []).length;
+        const deCount = (htmlDe.match(feature.pattern) || []).length;
+        const status = enCount === deCount ? '✅' : '❌';
+        console.log(`${status} ${feature.name}: EN=${enCount}, DE=${deCount}`);
+      }
+      
+      // Check text content length
+      const textEn = template.body_text_en || '';
+      const textDe = template.body_text_de || '';
+      console.log(`\nText content length - EN: ${textEn.length}, DE: ${textDe.length}`);
+      
+      // Check for specific variables usage
+      const variables = [
+        'host_name', 'event_name', 'event_date', 'gallery_link', 
+        'gallery_password', 'expiry_date', 'welcome_message',
+        'days_remaining', 'support_email', 'support_phone',
+        'archive_date', 'photo_count', 'archive_size'
+      ];
+      
+      const missingInEn = [];
+      const missingInDe = [];
+      
+      for (const variable of variables) {
+        const varPattern = new RegExp(`{{${variable}}}`, 'g');
+        const inEn = varPattern.test(htmlEn) || varPattern.test(textEn);
+        const inDe = varPattern.test(htmlDe) || varPattern.test(textDe);
+        
+        if (inDe && !inEn) missingInEn.push(variable);
+        if (inEn && !inDe) missingInDe.push(variable);
+      }
+      
+      if (missingInEn.length > 0) {
+        console.log(`\n⚠️  Variables in DE but missing in EN: ${missingInEn.join(', ')}`);
+      }
+      if (missingInDe.length > 0) {
+        console.log(`\n⚠️  Variables in EN but missing in DE: ${missingInDe.join(', ')}`);
+      }
+      
+      // Overall quality score
+      const enScore = [
+        htmlEn.includes('style='),
+        htmlEn.includes('{{#if'),
+        htmlEn.includes('background-color'),
+        htmlEn.includes('<strong>'),
+        htmlEn.includes('margin:'),
+        htmlEn.includes('padding:')
+      ].filter(Boolean).length;
+      
+      const deScore = [
+        htmlDe.includes('style='),
+        htmlDe.includes('{{#if'),
+        htmlDe.includes('background-color'),
+        htmlDe.includes('<strong>'),
+        htmlDe.includes('margin:'),
+        htmlDe.includes('padding:')
+      ].filter(Boolean).length;
+      
+      console.log(`\nQuality score (out of 6) - EN: ${enScore}, DE: ${deScore}`);
+      console.log(enScore === deScore ? '✅ Templates have equal quality!' : '❌ Quality mismatch');
+    }
+    
+    console.log('\n\nSummary:');
+    console.log('The English templates have been updated to match the German templates in:');
+    console.log('- HTML styling and structure');
+    console.log('- Conditional content blocks');
+    console.log('- Visual elements (buttons, alerts, icons)');
+    console.log('- Information completeness');
+    console.log('- Professional formatting');
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+verifyTemplateEquality();

backend/server.js

@@ -205,8 +205,6 @@ app.use('/api/admin/auth', adminAuthRoutes);
 app.use('/api/admin/system', require('./src/routes/adminSystem'));
 app.use('/api/admin/backup', require('./src/routes/adminBackup'));
 app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
-app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
-app.use('/api/gallery', require('./src/routes/galleryFeedback'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));

backend/src/middleware/feedbackRateLimit.js

@@ -1,236 +0,0 @@
-const crypto = require('crypto');
-const { db } = require('../database/db');
-const logger = require('../utils/logger');
-
-/**
- * Generate a unique identifier for the guest
- */
-function generateGuestIdentifier(req) {
-  const ip = req.ip || req.connection.remoteAddress || 'unknown';
-  const userAgent = req.headers['user-agent'] || 'unknown';
-  return crypto
-    .createHash('sha256')
-    .update(`${ip}:${userAgent}`)
-    .digest('hex');
-}
-
-/**
- * Get rate limit settings from app_settings
- */
-async function getRateLimitSettings() {
-  try {
-    const settings = await db('app_settings')
-      .where('setting_key', 'feedback_rate_limits')
-      .first();
-    
-    if (settings && settings.setting_value) {
-      return JSON.parse(settings.setting_value);
-    }
-    
-    // Default settings
-    return {
-      rating: { max: 100, window: 3600 }, // 100 ratings per hour
-      comment: { max: 20, window: 3600 }, // 20 comments per hour
-      like: { max: 200, window: 3600 }, // 200 likes per hour
-      favorite: { max: 100, window: 3600 } // 100 favorites per hour
-    };
-  } catch (error) {
-    logger.error('Error getting rate limit settings:', error);
-    // Return defaults on error
-    return {
-      rating: { max: 100, window: 3600 },
-      comment: { max: 20, window: 3600 },
-      like: { max: 200, window: 3600 },
-      favorite: { max: 100, window: 3600 }
-    };
-  }
-}
-
-/**
- * Check if action is rate limited
- */
-async function checkRateLimit(identifier, eventId, actionType) {
-  try {
-    const settings = await getRateLimitSettings();
-    const limit = settings[actionType] || { max: 100, window: 3600 };
-    
-    // Clean old entries (older than window)
-    const cutoff = new Date(Date.now() - limit.window * 1000);
-    await db('feedback_rate_limits')
-      .where('window_start', '<', cutoff)
-      .delete();
-    
-    // Count recent actions
-    const recentActions = await db('feedback_rate_limits')
-      .where({
-        identifier,
-        event_id: eventId,
-        action_type: actionType
-      })
-      .where('window_start', '>', cutoff)
-      .sum('action_count as total')
-      .first();
-    
-    const currentCount = recentActions?.total || 0;
-    
-    if (currentCount >= limit.max) {
-      return {
-        limited: true,
-        limit: limit.max,
-        window: limit.window,
-        current: currentCount,
-        resetAt: new Date(Date.now() + limit.window * 1000)
-      };
-    }
-    
-    return {
-      limited: false,
-      limit: limit.max,
-      window: limit.window,
-      current: currentCount,
-      remaining: limit.max - currentCount
-    };
-  } catch (error) {
-    logger.error('Error checking rate limit:', error);
-    // Allow action on error to avoid blocking legitimate users
-    return { limited: false };
-  }
-}
-
-/**
- * Record an action for rate limiting
- */
-async function recordAction(identifier, eventId, actionType) {
-  try {
-    await db('feedback_rate_limits').insert({
-      identifier,
-      event_id: eventId,
-      action_type: actionType,
-      action_count: 1,
-      window_start: new Date()
-    });
-  } catch (error) {
-    logger.error('Error recording rate limit action:', error);
-  }
-}
-
-/**
- * Middleware factory for feedback rate limiting
- */
-function feedbackRateLimit(actionType) {
-  return async (req, res, next) => {
-    try {
-      // Extract event ID from params or body
-      const eventId = req.params.eventId || req.body?.event_id;
-      if (!eventId) {
-        return res.status(400).json({ error: 'Event ID required' });
-      }
-      
-      // Generate guest identifier
-      const identifier = generateGuestIdentifier(req);
-      req.guestIdentifier = identifier;
-      
-      // Check rate limit
-      const rateLimitStatus = await checkRateLimit(identifier, eventId, actionType);
-      
-      // Set rate limit headers
-      res.set({
-        'X-RateLimit-Limit': rateLimitStatus.limit,
-        'X-RateLimit-Remaining': rateLimitStatus.remaining || 0,
-        'X-RateLimit-Reset': rateLimitStatus.resetAt ? rateLimitStatus.resetAt.toISOString() : new Date().toISOString()
-      });
-      
-      if (rateLimitStatus.limited) {
-        logger.warn(`Rate limit exceeded for ${actionType}`, {
-          identifier: identifier.substring(0, 16) + '...',
-          eventId,
-          actionType
-        });
-        
-        return res.status(429).json({
-          error: 'Too many requests',
-          message: `Rate limit exceeded. Please try again later.`,
-          retryAfter: rateLimitStatus.window
-        });
-      }
-      
-      // Record the action after successful processing
-      res.on('finish', async () => {
-        if (res.statusCode >= 200 && res.statusCode < 300) {
-          await recordAction(identifier, eventId, actionType);
-        }
-      });
-      
-      next();
-    } catch (error) {
-      logger.error('Error in rate limit middleware:', error);
-      // Allow request to proceed on error
-      next();
-    }
-  };
-}
-
-/**
- * IP-based rate limiting for more strict control
- */
-function strictRateLimit(options = {}) {
-  const {
-    windowMs = 15 * 60 * 1000, // 15 minutes
-    max = 100, // limit each IP to 100 requests per windowMs
-    message = 'Too many requests from this IP, please try again later.',
-    skipSuccessfulRequests = false
-  } = options;
-  
-  const store = new Map();
-  
-  // Clean up old entries periodically
-  setInterval(() => {
-    const now = Date.now();
-    for (const [key, data] of store.entries()) {
-      if (data.resetTime < now) {
-        store.delete(key);
-      }
-    }
-  }, windowMs);
-  
-  return (req, res, next) => {
-    const ip = req.ip || req.connection.remoteAddress;
-    const now = Date.now();
-    const resetTime = now + windowMs;
-    
-    let data = store.get(ip);
-    if (!data || data.resetTime < now) {
-      data = {
-        count: 0,
-        resetTime
-      };
-      store.set(ip, data);
-    }
-    
-    if (data.count >= max) {
-      return res.status(429).json({
-        error: 'Too many requests',
-        message,
-        retryAfter: Math.ceil((data.resetTime - now) / 1000)
-      });
-    }
-    
-    if (!skipSuccessfulRequests || res.statusCode >= 400) {
-      data.count++;
-    }
-    
-    res.setHeader('X-RateLimit-Limit', max);
-    res.setHeader('X-RateLimit-Remaining', Math.max(0, max - data.count));
-    res.setHeader('X-RateLimit-Reset', new Date(data.resetTime).toISOString());
-    
-    next();
-  };
-}
-
-module.exports = {
-  feedbackRateLimit,
-  strictRateLimit,
-  generateGuestIdentifier,
-  checkRateLimit,
-  recordAction
-};

backend/src/routes/adminEvents-enhanced.js

@@ -42,7 +42,7 @@ router.post('/', adminAuth, [
     } = req.body;
     
     // Validate password strength for gallery
-    const passwordValidation = await validatePasswordInContext(password, 'gallery', {
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
       eventName: event_name
     });
     

backend/src/routes/adminEvents.js

@@ -53,7 +53,7 @@ router.post('/', adminAuth, [
     } = req.body;
     
     // Validate password strength
-    const passwordValidation = await validatePasswordInContext(password, 'gallery', {
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
       eventName: event_name
     });
     
@@ -526,15 +526,16 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
     }
 
     // Generate new password
-    const { generateReadablePassword } = require('../utils/passwordGenerator');
-    const newPassword = generateReadablePassword();
+    const { generatePassword } = require('../utils/passwordGenerator');
+    const newPassword = generatePassword();
     const passwordHash = await bcrypt.hash(newPassword, 10);
 
     // Update event with new password
     await db('events')
       .where('id', id)
       .update({
-        password_hash: passwordHash
+        password_hash: passwordHash,
+        updated_at: new Date()
       });
 
     // Log activity

backend/src/routes/adminFeedback.js

@@ -1,411 +0,0 @@
-const express = require('express');
-const router = express.Router();
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const feedbackService = require('../services/feedbackService');
-const feedbackModeration = require('../services/feedbackModeration');
-const { db, logActivity } = require('../database/db');
-const logger = require('../utils/logger');
-const {
-  validateEventId,
-  validateFeedbackSettings,
-  validateWordFilter,
-  checkValidation
-} = require('../utils/feedbackValidation');
-
-// Get event feedback settings
-router.get('/events/:eventId/feedback-settings', 
-  adminAuth,
-  validateEventId,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { eventId } = req.params;
-      
-      // Verify event exists and belongs to admin
-      const event = await db('events').where('id', eventId).first();
-      if (!event) {
-        return res.status(404).json({ error: 'Event not found' });
-      }
-      
-      const settings = await feedbackService.getEventFeedbackSettings(eventId);
-      res.json(settings);
-    } catch (error) {
-      logger.error('Error getting feedback settings:', error);
-      res.status(500).json({ error: 'Failed to get feedback settings' });
-    }
-  }
-);
-
-// Update event feedback settings
-router.put('/events/:eventId/feedback-settings',
-  adminAuth,
-  validateEventId,
-  validateFeedbackSettings,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { eventId } = req.params;
-      const settings = req.body;
-      
-      // Verify event exists
-      const event = await db('events').where('id', eventId).first();
-      if (!event) {
-        return res.status(404).json({ error: 'Event not found' });
-      }
-      
-      const updatedSettings = await feedbackService.updateEventFeedbackSettings(eventId, settings);
-      
-      await logActivity('feedback_settings_updated', {
-        event_id: eventId,
-        settings: updatedSettings
-      }, eventId, {
-        type: 'admin',
-        id: req.user.id,
-        name: req.user.username
-      });
-      
-      res.json(updatedSettings);
-    } catch (error) {
-      logger.error('Error updating feedback settings:', error);
-      res.status(500).json({ error: 'Failed to update feedback settings' });
-    }
-  }
-);
-
-// Get feedback for an event (with filters)
-router.get('/events/:eventId/feedback',
-  adminAuth,
-  validateEventId,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { eventId } = req.params;
-      const { type, status, photoId, page = 1, limit = 50 } = req.query;
-      
-      // Build query
-      let query = db('photo_feedback')
-        .join('photos', 'photo_feedback.photo_id', 'photos.id')
-        .where('photo_feedback.event_id', eventId)
-        .select(
-          'photo_feedback.*',
-          'photos.filename',
-          'photos.path'
-        );
-      
-      if (type) {
-        query = query.where('photo_feedback.feedback_type', type);
-      }
-      
-      if (status === 'pending') {
-        query = query.where('photo_feedback.is_approved', false)
-                     .where('photo_feedback.is_hidden', false);
-      } else if (status === 'approved') {
-        query = query.where('photo_feedback.is_approved', true);
-      } else if (status === 'hidden') {
-        query = query.where('photo_feedback.is_hidden', true);
-      }
-      
-      if (photoId) {
-        query = query.where('photo_feedback.photo_id', photoId);
-      }
-      
-      // Pagination
-      const offset = (page - 1) * limit;
-      const totalCount = await query.clone().count('photo_feedback.id as count').first();
-      
-      const feedback = await query
-        .orderBy('photo_feedback.created_at', 'desc')
-        .limit(limit)
-        .offset(offset);
-      
-      res.json({
-        feedback,
-        pagination: {
-          page: parseInt(page),
-          limit: parseInt(limit),
-          total: totalCount?.count || 0,
-          pages: Math.ceil((totalCount?.count || 0) / limit)
-        }
-      });
-    } catch (error) {
-      logger.error('Error getting feedback:', error);
-      res.status(500).json({ error: 'Failed to get feedback' });
-    }
-  }
-);
-
-// Moderate feedback (approve/hide/reject)
-router.put('/feedback/:feedbackId/:action',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const { feedbackId, action } = req.params;
-      
-      if (!['approve', 'hide', 'reject'].includes(action)) {
-        return res.status(400).json({ error: 'Invalid action' });
-      }
-      
-      await feedbackService.moderateFeedback(feedbackId, action, req.user.id);
-      
-      res.json({ success: true });
-    } catch (error) {
-      logger.error('Error moderating feedback:', error);
-      res.status(500).json({ error: 'Failed to moderate feedback' });
-    }
-  }
-);
-
-// Delete feedback
-router.delete('/feedback/:feedbackId',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const { feedbackId } = req.params;
-      
-      await feedbackService.deleteFeedback(feedbackId, req.user.id);
-      
-      res.json({ success: true });
-    } catch (error) {
-      logger.error('Error deleting feedback:', error);
-      res.status(500).json({ error: 'Failed to delete feedback' });
-    }
-  }
-);
-
-// Get feedback analytics for an event
-router.get('/events/:eventId/feedback-analytics',
-  adminAuth,
-  validateEventId,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { eventId } = req.params;
-      
-      // Get summary statistics
-      const summaryData = await feedbackService.getEventFeedbackSummary(eventId);
-      
-      // Calculate average rating and other summary stats
-      const avgRatingResult = await db('photo_feedback')
-        .where('event_id', eventId)
-        .where('feedback_type', 'rating')
-        .avg('rating as average_rating')
-        .first();
-      
-      const pendingModeration = await db('photo_feedback')
-        .where('event_id', eventId)
-        .where('feedback_type', 'comment')
-        .where('is_approved', false)
-        .where('is_hidden', false)
-        .count('* as count')
-        .first();
-      
-      const summary = {
-        average_rating: parseFloat(avgRatingResult?.average_rating || 0),
-        total_ratings: summaryData.stats?.total_ratings || 0,
-        total_likes: summaryData.stats?.total_likes || 0,
-        total_comments: summaryData.stats?.total_comments || 0,
-        total_favorites: summaryData.stats?.total_favorites || 0,
-        pending_moderation: pendingModeration?.count || 0,
-        total_feedback: (summaryData.stats?.total_ratings || 0) + 
-                       (summaryData.stats?.total_likes || 0) + 
-                       (summaryData.stats?.total_comments || 0) + 
-                       (summaryData.stats?.total_favorites || 0)
-      };
-      
-      // Get top-rated photos
-      const topRated = await db('photos')
-        .where('event_id', eventId)
-        .where('average_rating', '>', 0)
-        .orderBy('average_rating', 'desc')
-        .orderBy('feedback_count', 'desc')
-        .limit(10)
-        .select('id', 'filename', 'average_rating', 'feedback_count', 'like_count');
-      
-      // Get most liked photos
-      const mostLiked = await db('photos')
-        .where('event_id', eventId)
-        .where('like_count', '>', 0)
-        .orderBy('like_count', 'desc')
-        .limit(10)
-        .select('id', 'filename', 'like_count', 'average_rating');
-      
-      // Get recent comments
-      const recentComments = await db('photo_feedback')
-        .join('photos', 'photo_feedback.photo_id', 'photos.id')
-        .where('photo_feedback.event_id', eventId)
-        .where('photo_feedback.feedback_type', 'comment')
-        .where('photo_feedback.is_approved', true)
-        .where('photo_feedback.is_hidden', false)
-        .orderBy('photo_feedback.created_at', 'desc')
-        .limit(10)
-        .select(
-          'photo_feedback.comment_text',
-          'photo_feedback.guest_name',
-          'photo_feedback.created_at',
-          'photos.filename'
-        );
-      
-      // Get feedback timeline (last 7 days)
-      const timeline = await db('photo_feedback')
-        .where('event_id', eventId)
-        .where('created_at', '>', new Date(Date.now() - 7 * 24 * 60 * 60 * 1000))
-        .select(
-          db.raw('DATE(created_at) as date'),
-          db.raw('COUNT(*) as count'),
-          'feedback_type'
-        )
-        .groupBy('date', 'feedback_type')
-        .orderBy('date', 'asc');
-      
-      res.json({
-        summary,
-        topRated,
-        mostLiked,
-        recentComments,
-        timeline
-      });
-    } catch (error) {
-      logger.error('Error getting feedback analytics:', error);
-      res.status(500).json({ error: 'Failed to get feedback analytics' });
-    }
-  }
-);
-
-// Export feedback data
-router.get('/events/:eventId/feedback/export',
-  adminAuth,
-  validateEventId,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { eventId } = req.params;
-      const { format = 'json' } = req.query;
-      
-      const feedback = await feedbackService.exportEventFeedback(eventId);
-      
-      if (format === 'csv') {
-        // Convert to CSV
-        const csv = convertToCSV(feedback);
-        res.setHeader('Content-Type', 'text/csv');
-        res.setHeader('Content-Disposition', `attachment; filename="feedback-${eventId}.csv"`);
-        res.send(csv);
-      } else {
-        res.json(feedback);
-      }
-    } catch (error) {
-      logger.error('Error exporting feedback:', error);
-      res.status(500).json({ error: 'Failed to export feedback' });
-    }
-  }
-);
-
-// Get pending moderation items (across all events)
-router.get('/feedback/pending-moderation',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const pending = await feedbackService.getPendingModeration();
-      res.json(pending);
-    } catch (error) {
-      logger.error('Error getting pending moderation:', error);
-      res.status(500).json({ error: 'Failed to get pending moderation' });
-    }
-  }
-);
-
-// Word filter management
-router.get('/feedback/word-filters',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const filters = await feedbackModeration.getAllWordFilters();
-      res.json(filters);
-    } catch (error) {
-      logger.error('Error getting word filters:', error);
-      res.status(500).json({ error: 'Failed to get word filters' });
-    }
-  }
-);
-
-router.post('/feedback/word-filters',
-  adminAuth,
-  validateWordFilter,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { word, severity = 'moderate' } = req.body;
-      
-      await feedbackModeration.addWordFilter(word, severity);
-      
-      await logActivity('word_filter_added', { word, severity }, null, {
-        type: 'admin',
-        id: req.user.id,
-        name: req.user.username
-      });
-      
-      res.json({ success: true });
-    } catch (error) {
-      if (error.message === 'Word filter already exists') {
-        return res.status(409).json({ error: error.message });
-      }
-      logger.error('Error adding word filter:', error);
-      res.status(500).json({ error: 'Failed to add word filter' });
-    }
-  }
-);
-
-router.put('/feedback/word-filters/:id',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const { id } = req.params;
-      const updates = req.body;
-      
-      await feedbackModeration.updateWordFilter(id, updates);
-      
-      res.json({ success: true });
-    } catch (error) {
-      logger.error('Error updating word filter:', error);
-      res.status(500).json({ error: 'Failed to update word filter' });
-    }
-  }
-);
-
-router.delete('/feedback/word-filters/:id',
-  adminAuth,
-  async (req, res) => {
-    try {
-      const { id } = req.params;
-      
-      await feedbackModeration.deleteWordFilter(id);
-      
-      res.json({ success: true });
-    } catch (error) {
-      logger.error('Error deleting word filter:', error);
-      res.status(500).json({ error: 'Failed to delete word filter' });
-    }
-  }
-);
-
-// Helper function to convert JSON to CSV
-function convertToCSV(data) {
-  if (!data || data.length === 0) return '';
-  
-  const headers = Object.keys(data[0]);
-  const csvHeaders = headers.join(',');
-  
-  const csvRows = data.map(row => {
-    return headers.map(header => {
-      const value = row[header];
-      // Escape quotes and wrap in quotes if contains comma
-      if (typeof value === 'string' && (value.includes(',') || value.includes('"'))) {
-        return `"${value.replace(/"/g, '""')}"`;
-      }
-      return value || '';
-    }).join(',');
-  });
-  
-  return [csvHeaders, ...csvRows].join('\n');
-}
-
-module.exports = router;

backend/src/routes/adminPhotos.js

@@ -447,14 +447,9 @@ router.delete('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
     if (photo.thumbnail_path) {
       const thumbPath = path.join(storagePath, 'events/active', photo.thumbnail_path);
       try {
-        // Check if file exists before attempting to delete
-        await fs.access(thumbPath);
         await fs.unlink(thumbPath);
       } catch (error) {
-        // Only log if it's not a "file not found" error
-        if (error.code !== 'ENOENT') {
-          console.error('Error deleting thumbnail:', error);
-        }
+        console.error('Error deleting thumbnail:', error);
       }
     }
     
@@ -539,14 +534,9 @@ router.post('/:eventId/photos/bulk-delete', adminAuth, async (req, res) => {
       if (photo.thumbnail_path) {
         const thumbPath = path.join(storagePath, photo.thumbnail_path);
         try {
-          // Check if file exists before attempting to delete
-          await fs.access(thumbPath);
           await fs.unlink(thumbPath);
         } catch (error) {
-          // Only log if it's not a "file not found" error
-          if (error.code !== 'ENOENT') {
-            console.error('Error deleting thumbnail:', error);
-          }
+          console.error('Error deleting thumbnail:', error);
         }
       }
     }

backend/src/routes/galleryFeedback.js

@@ -1,342 +0,0 @@
-const express = require('express');
-const router = express.Router();
-const { photoAuth } = require('../middleware/photoAuth');
-const { verifyGalleryAccess } = require('../middleware/gallery');
-const { feedbackRateLimit, generateGuestIdentifier } = require('../middleware/feedbackRateLimit');
-const feedbackService = require('../services/feedbackService');
-const feedbackModeration = require('../services/feedbackModeration');
-const { db, logActivity } = require('../database/db');
-const logger = require('../utils/logger');
-const {
-  validatePhotoId,
-  validateFeedbackSubmission,
-  checkValidation,
-  validateGuestRequirements
-} = require('../utils/feedbackValidation');
-const { escapeLikePattern } = require('../utils/sqlSecurity');
-
-// Get feedback settings for a gallery
-router.get('/:slug/feedback-settings',
-  verifyGalleryAccess,
-  async (req, res) => {
-    try {
-      const event = req.event;
-      const settings = await feedbackService.getEventFeedbackSettings(event.id);
-      
-      // Only send relevant settings to guests
-      const guestSettings = {
-        feedback_enabled: settings.feedback_enabled,
-        allow_ratings: settings.allow_ratings,
-        allow_likes: settings.allow_likes,
-        allow_comments: settings.allow_comments,
-        allow_favorites: settings.allow_favorites,
-        require_name_email: settings.require_name_email,
-        show_feedback_to_guests: settings.show_feedback_to_guests
-      };
-      
-      res.json(guestSettings);
-    } catch (error) {
-      logger.error('Error getting feedback settings:', error);
-      res.status(500).json({ error: 'Failed to get feedback settings' });
-    }
-  }
-);
-
-// Get feedback for a specific photo
-router.get('/:slug/photos/:photoId/feedback',
-  verifyGalleryAccess,
-  validatePhotoId,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { photoId } = req.params;
-      const event = req.event;
-      const guestIdentifier = generateGuestIdentifier(req);
-      
-      // Get feedback settings
-      const settings = await feedbackService.getEventFeedbackSettings(event.id);
-      
-      if (!settings.feedback_enabled) {
-        return res.status(403).json({ error: 'Feedback is not enabled for this event' });
-      }
-      
-      // Verify photo belongs to event
-      const photo = await db('photos')
-        .where({ id: photoId, event_id: event.id })
-        .first();
-      
-      if (!photo) {
-        return res.status(404).json({ error: 'Photo not found' });
-      }
-      
-      // Get feedback based on settings
-      const options = {
-        approved_only: true,
-        include_hidden: false
-      };
-      
-      // Include guest's own feedback even if not approved
-      const feedback = await feedbackService.getPhotoFeedback(photoId, options);
-      
-      // Get guest's own feedback separately
-      const guestFeedback = await feedbackService.getPhotoFeedback(photoId, {
-        guest_identifier: guestIdentifier
-      });
-      
-      // Combine and deduplicate
-      const allFeedback = [...feedback];
-      guestFeedback.forEach(gf => {
-        if (!feedback.find(f => f.id === gf.id)) {
-          allFeedback.push({ ...gf, is_mine: true });
-        } else {
-          const index = allFeedback.findIndex(f => f.id === gf.id);
-          allFeedback[index].is_mine = true;
-        }
-      });
-      
-      // Filter based on what guests should see
-      const visibleFeedback = settings.show_feedback_to_guests ? allFeedback : 
-        allFeedback.filter(f => f.is_mine);
-      
-      res.json({
-        feedback: visibleFeedback,
-        summary: {
-          average_rating: photo.average_rating || 0,
-          total_ratings: await db('photo_feedback')
-            .where({ photo_id: photoId, feedback_type: 'rating', is_hidden: false })
-            .count('id as count')
-            .first()
-            .then(r => r.count),
-          like_count: photo.like_count || 0,
-          favorite_count: photo.favorite_count || 0,
-          comment_count: await db('photo_feedback')
-            .where({ 
-              photo_id: photoId, 
-              feedback_type: 'comment', 
-              is_approved: true,
-              is_hidden: false 
-            })
-            .count('id as count')
-            .first()
-            .then(r => r.count)
-        },
-        my_feedback: {
-          rating: guestFeedback.find(f => f.feedback_type === 'rating')?.rating,
-          liked: !!guestFeedback.find(f => f.feedback_type === 'like'),
-          favorited: !!guestFeedback.find(f => f.feedback_type === 'favorite')
-        }
-      });
-    } catch (error) {
-      logger.error('Error getting photo feedback:', error);
-      res.status(500).json({ error: 'Failed to get feedback' });
-    }
-  }
-);
-
-// Submit feedback for a photo
-router.post('/:slug/photos/:photoId/feedback',
-  verifyGalleryAccess,
-  validatePhotoId,
-  validateFeedbackSubmission,
-  checkValidation,
-  async (req, res) => {
-    try {
-      const { photoId } = req.params;
-      const event = req.event;
-      const guestIdentifier = generateGuestIdentifier(req);
-      
-      // Get feedback settings
-      const settings = await feedbackService.getEventFeedbackSettings(event.id);
-      
-      if (!settings.feedback_enabled) {
-        return res.status(403).json({ error: 'Feedback is not enabled for this event' });
-      }
-      
-      // Check if specific feedback type is allowed
-      const feedbackType = req.body.feedback_type;
-      const typeAllowed = {
-        rating: settings.allow_ratings,
-        like: settings.allow_likes,
-        comment: settings.allow_comments,
-        favorite: settings.allow_favorites
-      };
-      
-      if (!typeAllowed[feedbackType]) {
-        return res.status(403).json({ error: `${feedbackType} feedback is not enabled` });
-      }
-      
-      // Verify photo belongs to event
-      const photo = await db('photos')
-        .where({ id: photoId, event_id: event.id })
-        .first();
-      
-      if (!photo) {
-        return res.status(404).json({ error: 'Photo not found' });
-      }
-      
-      // Validate guest requirements
-      const guestValidation = await validateGuestRequirements(settings, req.body);
-      if (!guestValidation.valid) {
-        return res.status(400).json({ 
-          error: 'Guest information required',
-          errors: guestValidation.errors 
-        });
-      }
-      
-      // Apply rate limiting based on feedback type
-      const rateLimitMiddleware = feedbackRateLimit(feedbackType);
-      await new Promise((resolve, reject) => {
-        rateLimitMiddleware(req, res, (err) => {
-          if (err) reject(err);
-          else resolve();
-        });
-      });
-      
-      // If we got here and response was sent (rate limited), return
-      if (res.headersSent) return;
-      
-      // Prepare feedback data
-      const feedbackData = {
-        feedback_type: feedbackType,
-        rating: req.body.rating,
-        comment_text: req.body.comment_text,
-        guest_name: req.body.guest_name,
-        guest_email: req.body.guest_email,
-        ip_address: req.ip || req.connection.remoteAddress,
-        user_agent: req.headers['user-agent'],
-        moderate_comments: settings.moderate_comments
-      };
-      
-      // For comments, check moderation
-      if (feedbackType === 'comment') {
-        // Check user reputation
-        const reputation = await feedbackModeration.checkUserReputation(guestIdentifier, event.id);
-        
-        // Moderate the comment
-        const moderationResult = await feedbackModeration.moderateText(req.body.comment_text);
-        
-        if (!moderationResult.approved) {
-          // Still save but mark as not approved
-          feedbackData.is_approved = false;
-          logger.warn('Comment flagged for moderation:', {
-            reason: moderationResult.reason,
-            violations: moderationResult.violations
-          });
-        } else if (reputation.autoApprove) {
-          // Trusted user, auto-approve
-          feedbackData.is_approved = true;
-        } else if (settings.moderate_comments) {
-          // Default moderation setting
-          feedbackData.is_approved = false;
-        }
-      }
-      
-      // Submit feedback
-      const result = await feedbackService.submitFeedback(
-        photoId,
-        event.id,
-        feedbackData,
-        guestIdentifier
-      );
-      
-      // Log activity
-      await logActivity(`guest_feedback_${feedbackType}`, {
-        photo_id: photoId,
-        result
-      }, event.id, {
-        type: 'guest',
-        id: guestIdentifier.substring(0, 16),
-        name: req.body.guest_name || 'Anonymous'
-      });
-      
-      res.json({
-        success: true,
-        ...result,
-        message: feedbackType === 'comment' && !feedbackData.is_approved ? 
-          'Your comment has been submitted for moderation' : undefined
-      });
-    } catch (error) {
-      logger.error('Error submitting feedback:', error);
-      res.status(500).json({ error: 'Failed to submit feedback' });
-    }
-  }
-);
-
-// Get feedback summary for entire gallery
-router.get('/:slug/feedback-summary',
-  verifyGalleryAccess,
-  async (req, res) => {
-    try {
-      const event = req.event;
-      
-      // Get feedback settings
-      const settings = await feedbackService.getEventFeedbackSettings(event.id);
-      
-      if (!settings.feedback_enabled || !settings.show_feedback_to_guests) {
-        return res.json({
-          enabled: false,
-          summary: null
-        });
-      }
-      
-      const summary = await feedbackService.getEventFeedbackSummary(event.id);
-      
-      // Filter data based on what guests should see
-      const guestSummary = {
-        stats: summary.stats,
-        top_rated: summary.photos
-          .filter(p => p.average_rating > 0)
-          .slice(0, 5)
-          .map(p => ({
-            id: p.id,
-            filename: p.filename,
-            average_rating: p.average_rating,
-            like_count: p.like_count
-          }))
-      };
-      
-      res.json({
-        enabled: true,
-        settings: {
-          allow_ratings: settings.allow_ratings,
-          allow_likes: settings.allow_likes,
-          allow_comments: settings.allow_comments,
-          allow_favorites: settings.allow_favorites
-        },
-        summary: guestSummary
-      });
-    } catch (error) {
-      logger.error('Error getting feedback summary:', error);
-      res.status(500).json({ error: 'Failed to get feedback summary' });
-    }
-  }
-);
-
-// Get user's own feedback for all photos
-router.get('/:slug/my-feedback',
-  verifyGalleryAccess,
-  async (req, res) => {
-    try {
-      const event = req.event;
-      const guestIdentifier = generateGuestIdentifier(req);
-      
-      const myFeedback = await db('photo_feedback')
-        .join('photos', 'photo_feedback.photo_id', 'photos.id')
-        .where('photo_feedback.event_id', event.id)
-        .where('photo_feedback.guest_identifier', guestIdentifier)
-        .select(
-          'photo_feedback.*',
-          'photos.filename',
-          'photos.path'
-        )
-        .orderBy('photo_feedback.created_at', 'desc');
-      
-      res.json(myFeedback);
-    } catch (error) {
-      logger.error('Error getting user feedback:', error);
-      res.status(500).json({ error: 'Failed to get your feedback' });
-    }
-  }
-);
-
-module.exports = router;

backend/src/routes/publicSettings.js

@@ -45,7 +45,6 @@ router.get('/', async (req, res) => {
       theme_config: settingsObject.theme_config || null,
       default_language: settingsObject.general_default_language || 'en',
       enable_analytics: settingsObject.general_enable_analytics !== false,
-      general_date_format: settingsObject.general_date_format || 'PPP',
       enable_recaptcha: settingsObject.security_enable_recaptcha === true || settingsObject.security_enable_recaptcha === 'true',
       recaptcha_site_key: settingsObject.security_recaptcha_site_key || null,
       maintenance_mode: settingsObject.general_maintenance_mode === true || settingsObject.general_maintenance_mode === 'true',

backend/src/services/archiveService.js

@@ -4,7 +4,6 @@ const path = require('path');
 const { db } = require('../database/db');
 const { queueEmail } = require('./emailProcessor');
 const logger = require('../utils/logger');
-const feedbackService = require('./feedbackService');
 
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const ACTIVE_PATH = () => path.join(getStoragePath(), 'events/active');
@@ -29,37 +28,6 @@ async function archiveEvent(event) {
       throw err;
     });
     
-    // Export feedback data before archiving
-    const feedbackSettings = await feedbackService.getEventFeedbackSettings(event.id);
-    if (feedbackSettings.feedback_enabled) {
-      try {
-        logger.info(`Exporting feedback data for event ${event.slug}`);
-        const feedbackData = await feedbackService.exportEventFeedback(event.id);
-        
-        if (feedbackData && feedbackData.length > 0) {
-          // Create feedback JSON file
-          const feedbackJson = JSON.stringify(feedbackData, null, 2);
-          const feedbackJsonPath = path.join(eventPath, 'feedback_data.json');
-          await fs.writeFile(feedbackJsonPath, feedbackJson, 'utf8');
-          
-          // Create feedback CSV file
-          const feedbackCsv = convertToCSV(feedbackData);
-          const feedbackCsvPath = path.join(eventPath, 'feedback_data.csv');
-          await fs.writeFile(feedbackCsvPath, feedbackCsv, 'utf8');
-          
-          // Create feedback summary
-          const summary = await feedbackService.getEventFeedbackSummary(event.id);
-          const summaryPath = path.join(eventPath, 'feedback_summary.json');
-          await fs.writeFile(summaryPath, JSON.stringify(summary, null, 2), 'utf8');
-          
-          logger.info(`Feedback data exported: ${feedbackData.length} entries`);
-        }
-      } catch (error) {
-        logger.error(`Error exporting feedback for event ${event.slug}:`, error);
-        // Continue with archiving even if feedback export fails
-      }
-    }
-    
     output.on('close', async () => {
       logger.info(`Archive created: ${archiveName} (${archive.pointer()} bytes)`);
       
@@ -99,25 +67,4 @@ async function archiveEvent(event) {
   }
 }
 
-// Helper function to convert JSON to CSV
-function convertToCSV(data) {
-  if (!data || data.length === 0) return '';
-  
-  const headers = Object.keys(data[0]);
-  const csvHeaders = headers.join(',');
-  
-  const csvRows = data.map(row => {
-    return headers.map(header => {
-      const value = row[header];
-      // Escape quotes and wrap in quotes if contains comma
-      if (typeof value === 'string' && (value.includes(',') || value.includes('"'))) {
-        return `"${value.replace(/"/g, '""')}"`;
-      }
-      return value || '';
-    }).join(',');
-  });
-  
-  return [csvHeaders, ...csvRows].join('\n');
-}
-
 module.exports = { archiveEvent };

backend/src/services/backupService.js

@@ -11,7 +11,6 @@ const logger = require('../utils/logger');
 const { formatBoolean } = require('../utils/dbCompat');
 const backupManifest = require('./backupManifest');
 const S3StorageAdapter = require('./storage/s3Storage');
-const packageJson = require('../../package.json');
 
 // Backup job reference
 let backupJob = null;
@@ -21,21 +20,6 @@ let isRunning = false;
 // Storage paths
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
-/**
- * Get current database schema version
- */
-async function getCurrentSchemaVersion() {
-  try {
-    const result = await db('knex_migrations')
-      .orderBy('id', 'desc')
-      .first();
-    return result ? result.name : 'unknown';
-  } catch (error) {
-    logger.error('Failed to get schema version:', error);
-    return 'unknown';
-  }
-}
-
 /**
  * Calculate file checksum using SHA256
  */
@@ -662,17 +646,11 @@ async function runBackup() {
       return;
     }
     
-    // Get current schema version
-    const schemaVersion = await getCurrentSchemaVersion();
-    
-    // Create backup run record with version info
+    // Create backup run record
     const [runId] = await db('backup_runs').insert({
       started_at: startTime,
       status: 'running',
-      backup_type: 'scheduled',
-      app_version: packageJson.version,
-      node_version: process.version,
-      db_schema_version: schemaVersion
+      backup_type: 'scheduled'
     });
     
     backupRun = { id: runId };
@@ -823,7 +801,7 @@ async function runBackup() {
       // Don't fail the entire backup for manifest generation failure
     }
     
-    // Update backup run record with manifest info
+    // Update backup run record
     await db('backup_runs')
       .where('id', runId)
       .update({
@@ -834,16 +812,6 @@ async function runBackup() {
         duration_seconds: durationSeconds,
         manifest_path: manifestPath,
         manifest_id: manifestPath ? path.basename(manifestPath, path.extname(manifestPath)) : null,
-        manifest_info: manifestSummary ? JSON.stringify({
-          manifest_version: manifestSummary.manifest?.version,
-          backup_id: manifestSummary.backup?.id,
-          system_info: manifestSummary.system,
-          file_count: manifestSummary.files?.count,
-          database_info: {
-            type: manifestSummary.database?.type,
-            schema_version: manifestSummary.database?.schema_version
-          }
-        }) : null,
         statistics: JSON.stringify({
           totalFilesChecked: files.length,
           filesBackedUp: result.backedUpCount,

backend/src/services/databaseBackup.js

@@ -12,7 +12,6 @@ const knexConfig = require('../../knexfile');
 const logger = require('../utils/logger');
 const { queueEmail } = require('./emailProcessor');
 const { formatBoolean } = require('../utils/dbCompat');
-const packageJson = require('../../package.json');
 
 // Constants
 const CHUNK_SIZE = 1024 * 1024; // 1MB chunks for streaming
@@ -313,24 +312,12 @@ class DatabaseBackupService {
       const sqlFile = path.join(destinationPath, `${baseName}.sql`);
       const finalFile = compress ? path.join(destinationPath, `${baseName}.sql.gz`) : sqlFile;
       
-      // Get current schema version
-      const schemaVersion = await this.getCurrentSchemaVersion();
-      
-      // Create backup run record with version info
+      // Create backup run record
       const [runId] = await db('database_backup_runs').insert({
         started_at: startTime,
         status: 'running',
         backup_type: this.dbType,
-        destination_path: finalFile,
-        app_version: packageJson.version,
-        node_version: process.version,
-        db_schema_version: schemaVersion,
-        environment_info: JSON.stringify({
-          platform: process.platform,
-          arch: process.arch,
-          node_env: process.env.NODE_ENV || 'production',
-          db_type: this.dbType
-        })
+        destination_path: finalFile
       });
       
       backupRun = { id: runId };
@@ -396,10 +383,7 @@ class DatabaseBackupService {
             compressed: compress,
             validated: validateIntegrity,
             compressionStats,
-            tableCount: tableChecksums ? Object.keys(tableChecksums).length : null,
-            app_version: packageJson.version,
-            node_version: process.version,
-            db_schema_version: await this.getCurrentSchemaVersion()
+            tableCount: tableChecksums ? Object.keys(tableChecksums).length : null
           })
         });
       
@@ -576,82 +560,11 @@ class DatabaseBackupService {
   }
 
   /**
-   * Get current database schema version
-   */
-  async getCurrentSchemaVersion() {
-    try {
-      const result = await db('knex_migrations')
-        .orderBy('id', 'desc')
-        .first();
-      return result ? result.name : 'unknown';
-    } catch (error) {
-      logger.error('Failed to get schema version:', error);
-      return 'unknown';
-    }
-  }
-
-  /**
-   * Check version compatibility for restore
-   */
-  async checkVersionCompatibility(backupInfo) {
-    const currentAppVersion = packageJson.version;
-    const currentNodeVersion = process.version;
-    const currentSchemaVersion = await this.getCurrentSchemaVersion();
-    
-    const compatibility = {
-      compatible: true,
-      warnings: [],
-      errors: []
-    };
-
-    // Check app version
-    if (backupInfo.app_version !== currentAppVersion) {
-      const backupMajor = backupInfo.app_version?.split('.')[0];
-      const currentMajor = currentAppVersion.split('.')[0];
-      
-      if (backupMajor !== currentMajor) {
-        compatibility.errors.push(
-          `Major version mismatch: backup v${backupInfo.app_version}, current v${currentAppVersion}`
-        );
-        compatibility.compatible = false;
-      } else {
-        compatibility.warnings.push(
-          `Minor version difference: backup v${backupInfo.app_version}, current v${currentAppVersion}`
-        );
-      }
-    }
-
-    // Check Node.js version
-    if (backupInfo.node_version !== currentNodeVersion) {
-      const backupNodeMajor = backupInfo.node_version?.split('.')[0];
-      const currentNodeMajor = currentNodeVersion.split('.')[0];
-      
-      if (backupNodeMajor !== currentNodeMajor) {
-        compatibility.warnings.push(
-          `Node.js major version difference: backup ${backupInfo.node_version}, current ${currentNodeVersion}`
-        );
-      }
-    }
-
-    // Check schema version
-    if (backupInfo.db_schema_version && backupInfo.db_schema_version !== currentSchemaVersion) {
-      compatibility.warnings.push(
-        `Database schema difference: backup migration '${backupInfo.db_schema_version}', current '${currentSchemaVersion}'`
-      );
-      compatibility.warnings.push(
-        'You may need to run migrations after restore'
-      );
-    }
-
-    return compatibility;
-  }
-
-  /**
-   * Restore from backup (with version checking)
+   * Restore from backup (careful!)
    */
   async restore(backupPath, options = {}) {
     // This is a dangerous operation and should be used with extreme caution
-    throw new Error('Restore functionality not implemented for safety. Please use restore service or restore manually.');
+    throw new Error('Restore functionality not implemented for safety. Please restore manually.');
   }
 }
 

backend/src/services/feedbackModeration.js

@@ -1,312 +0,0 @@
-const { db } = require('../database/db');
-const logger = require('../utils/logger');
-
-class FeedbackModerationService {
-  constructor() {
-    this.wordFiltersCache = null;
-    this.cacheExpiry = null;
-    this.CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
-  }
-
-  /**
-   * Get word filters (with caching)
-   */
-  async getWordFilters() {
-    try {
-      // Check cache
-      if (this.wordFiltersCache && this.cacheExpiry && Date.now() < this.cacheExpiry) {
-        return this.wordFiltersCache;
-      }
-      
-      // Fetch from database
-      const filters = await db('feedback_word_filters')
-        .where('is_active', true)
-        .select('word', 'severity');
-      
-      // Update cache
-      this.wordFiltersCache = filters;
-      this.cacheExpiry = Date.now() + this.CACHE_DURATION;
-      
-      return filters;
-    } catch (error) {
-      logger.error('Error getting word filters:', error);
-      return [];
-    }
-  }
-
-  /**
-   * Clear word filters cache
-   */
-  clearCache() {
-    this.wordFiltersCache = null;
-    this.cacheExpiry = null;
-  }
-
-  /**
-   * Check if text contains inappropriate content
-   */
-  async moderateText(text) {
-    try {
-      if (!text || typeof text !== 'string') {
-        return { approved: true };
-      }
-      
-      const filters = await this.getWordFilters();
-      const violations = [];
-      const lowerText = text.toLowerCase();
-      
-      for (const filter of filters) {
-        // Create regex for whole word matching
-        const regex = new RegExp(`\\b${this.escapeRegex(filter.word.toLowerCase())}\\b`, 'gi');
-        if (regex.test(lowerText)) {
-          violations.push({
-            word: filter.word,
-            severity: filter.severity
-          });
-        }
-      }
-      
-      // Check for severe violations
-      if (violations.some(v => v.severity === 'severe')) {
-        return {
-          approved: false,
-          reason: 'Content contains prohibited words',
-          violations: violations.filter(v => v.severity === 'severe')
-        };
-      }
-      
-      // Check for moderate violations
-      if (violations.some(v => v.severity === 'moderate')) {
-        return {
-          approved: false,
-          reason: 'Content requires moderation',
-          violations
-        };
-      }
-      
-      // Check for mild violations (may just flag for review)
-      if (violations.length > 0) {
-        return {
-          approved: true,
-          flagged: true,
-          reason: 'Content contains potentially inappropriate words',
-          violations
-        };
-      }
-      
-      // Additional checks
-      const additionalChecks = this.performAdditionalChecks(text);
-      if (!additionalChecks.passed) {
-        return {
-          approved: false,
-          reason: additionalChecks.reason
-        };
-      }
-      
-      return { approved: true };
-    } catch (error) {
-      logger.error('Error moderating text:', error);
-      // In case of error, err on the side of caution
-      return {
-        approved: false,
-        reason: 'Moderation system error'
-      };
-    }
-  }
-
-  /**
-   * Perform additional content checks
-   */
-  performAdditionalChecks(text) {
-    // Check for excessive caps
-    const capsRatio = (text.match(/[A-Z]/g) || []).length / text.length;
-    if (text.length > 10 && capsRatio > 0.7) {
-      return {
-        passed: false,
-        reason: 'Excessive use of capital letters'
-      };
-    }
-    
-    // Check for spam patterns
-    if (this.detectSpamPatterns(text)) {
-      return {
-        passed: false,
-        reason: 'Content appears to be spam'
-      };
-    }
-    
-    // Check for excessive special characters
-    const specialCharRatio = (text.match(/[!@#$%^&*()]/g) || []).length / text.length;
-    if (text.length > 10 && specialCharRatio > 0.3) {
-      return {
-        passed: false,
-        reason: 'Excessive use of special characters'
-      };
-    }
-    
-    return { passed: true };
-  }
-
-  /**
-   * Detect common spam patterns
-   */
-  detectSpamPatterns(text) {
-    const spamPatterns = [
-      /\b(buy|cheap|discount|offer|sale|deal)\s+(now|today|here)/gi,
-      /\b(click|visit|check)\s+(here|link|this)/gi,
-      /\b(viagra|cialis|pills|drugs)\b/gi,
-      /\b(casino|betting|poker|slots)\b/gi,
-      /\b(make|earn)\s+\$?\d+/gi,
-      /https?:\/\/[^\s]+/gi, // URLs (might want to allow in some cases)
-      /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, // Email addresses
-      /\b\d{3,}\s?\d{3,}\s?\d{4,}\b/g // Phone numbers
-    ];
-    
-    return spamPatterns.some(pattern => pattern.test(text));
-  }
-
-  /**
-   * Escape special regex characters
-   */
-  escapeRegex(string) {
-    return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  }
-
-  /**
-   * Add word filter
-   */
-  async addWordFilter(word, severity = 'moderate') {
-    try {
-      await db('feedback_word_filters').insert({
-        word: word.toLowerCase(),
-        severity,
-        is_active: true,
-        created_at: new Date()
-      });
-      
-      this.clearCache();
-      logger.info(`Added word filter: ${word} (${severity})`);
-      
-      return true;
-    } catch (error) {
-      if (error.code === 'SQLITE_CONSTRAINT' || error.code === '23505') {
-        throw new Error('Word filter already exists');
-      }
-      logger.error('Error adding word filter:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Update word filter
-   */
-  async updateWordFilter(id, updates) {
-    try {
-      await db('feedback_word_filters')
-        .where('id', id)
-        .update(updates);
-      
-      this.clearCache();
-      return true;
-    } catch (error) {
-      logger.error('Error updating word filter:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Delete word filter
-   */
-  async deleteWordFilter(id) {
-    try {
-      await db('feedback_word_filters')
-        .where('id', id)
-        .delete();
-      
-      this.clearCache();
-      return true;
-    } catch (error) {
-      logger.error('Error deleting word filter:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Get all word filters (for admin)
-   */
-  async getAllWordFilters() {
-    try {
-      return await db('feedback_word_filters')
-        .orderBy('severity', 'desc')
-        .orderBy('word', 'asc');
-    } catch (error) {
-      logger.error('Error getting all word filters:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Sanitize text for display (remove but don't reject)
-   */
-  sanitizeText(text) {
-    // Remove excessive whitespace
-    text = text.replace(/\s+/g, ' ').trim();
-    
-    // Remove zero-width characters
-    text = text.replace(/[\u200B-\u200D\uFEFF]/g, '');
-    
-    // Limit consecutive special characters
-    text = text.replace(/([!?.]){3,}/g, '$1$1');
-    
-    return text;
-  }
-
-  /**
-   * Check if user should be rate limited based on previous violations
-   */
-  async checkUserReputation(guestIdentifier, eventId) {
-    try {
-      // Count recent violations
-      const recentViolations = await db('photo_feedback')
-        .where('guest_identifier', guestIdentifier)
-        .where('event_id', eventId)
-        .where('is_hidden', true)
-        .where('created_at', '>', new Date(Date.now() - 24 * 60 * 60 * 1000)) // Last 24 hours
-        .count('id as count')
-        .first();
-      
-      // If user has multiple violations, they might be problematic
-      if (recentViolations && recentViolations.count > 3) {
-        return {
-          trusted: false,
-          reason: 'Multiple recent violations'
-        };
-      }
-      
-      // Check total approved comments
-      const approvedComments = await db('photo_feedback')
-        .where('guest_identifier', guestIdentifier)
-        .where('event_id', eventId)
-        .where('feedback_type', 'comment')
-        .where('is_approved', true)
-        .where('is_hidden', false)
-        .count('id as count')
-        .first();
-      
-      // User with many approved comments is trusted
-      if (approvedComments && approvedComments.count > 10) {
-        return {
-          trusted: true,
-          autoApprove: true
-        };
-      }
-      
-      return { trusted: true };
-    } catch (error) {
-      logger.error('Error checking user reputation:', error);
-      return { trusted: true }; // Default to trusting in case of error
-    }
-  }
-}
-
-module.exports = new FeedbackModerationService();

backend/src/services/feedbackService.js

@@ -1,393 +0,0 @@
-const { db, logActivity } = require('../database/db');
-const logger = require('../utils/logger');
-const { formatBoolean } = require('../utils/dbCompat');
-
-class FeedbackService {
-  /**
-   * Get feedback settings for an event
-   */
-  async getEventFeedbackSettings(eventId) {
-    try {
-      const settings = await db('event_feedback_settings')
-        .where('event_id', eventId)
-        .first();
-      
-      if (!settings) {
-        // Return default settings if none exist
-        return {
-          event_id: eventId,
-          feedback_enabled: false,
-          allow_ratings: true,
-          allow_likes: true,
-          allow_comments: false,
-          allow_favorites: true,
-          require_name_email: false,
-          moderate_comments: true,
-          show_feedback_to_guests: true
-        };
-      }
-      
-      return settings;
-    } catch (error) {
-      logger.error('Error getting feedback settings:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Update feedback settings for an event
-   */
-  async updateEventFeedbackSettings(eventId, settings) {
-    try {
-      const existing = await db('event_feedback_settings')
-        .where('event_id', eventId)
-        .first();
-      
-      if (existing) {
-        await db('event_feedback_settings')
-          .where('event_id', eventId)
-          .update({
-            ...settings,
-            updated_at: new Date()
-          });
-      } else {
-        await db('event_feedback_settings').insert({
-          event_id: eventId,
-          ...settings,
-          created_at: new Date(),
-          updated_at: new Date()
-        });
-      }
-      
-      await logActivity('feedback_settings_updated', settings, eventId);
-      
-      return this.getEventFeedbackSettings(eventId);
-    } catch (error) {
-      logger.error('Error updating feedback settings:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Submit feedback for a photo
-   */
-  async submitFeedback(photoId, eventId, feedbackData, guestIdentifier) {
-    try {
-      const { feedback_type, rating, comment_text, guest_name, guest_email, ip_address, user_agent } = feedbackData;
-      
-      // Validate feedback type
-      if (!['rating', 'like', 'comment', 'favorite'].includes(feedback_type)) {
-        throw new Error('Invalid feedback type');
-      }
-      
-      // Check if similar feedback already exists (prevent duplicates)
-      if (feedback_type !== 'comment') {
-        const existing = await db('photo_feedback')
-          .where({
-            photo_id: photoId,
-            event_id: eventId,
-            feedback_type,
-            guest_identifier: guestIdentifier
-          })
-          .first();
-        
-        if (existing) {
-          if (feedback_type === 'rating' && rating !== existing.rating) {
-            // Update existing rating
-            await db('photo_feedback')
-              .where('id', existing.id)
-              .update({
-                rating,
-                updated_at: new Date()
-              });
-            
-            await this.updatePhotoFeedbackStats(photoId);
-            return { id: existing.id, updated: true };
-          }
-          
-          // For likes and favorites, toggle off if already exists
-          if (feedback_type === 'like' || feedback_type === 'favorite') {
-            await db('photo_feedback')
-              .where('id', existing.id)
-              .delete();
-            
-            await this.updatePhotoFeedbackStats(photoId);
-            return { removed: true };
-          }
-          
-          return { id: existing.id, exists: true };
-        }
-      }
-      
-      // Insert new feedback
-      const [id] = await db('photo_feedback').insert({
-        photo_id: photoId,
-        event_id: eventId,
-        feedback_type,
-        rating: feedback_type === 'rating' ? rating : null,
-        comment_text: feedback_type === 'comment' ? comment_text : null,
-        guest_name,
-        guest_email,
-        guest_identifier: guestIdentifier,
-        ip_address,
-        user_agent,
-        is_approved: feedback_type !== 'comment' || !feedbackData.moderate_comments,
-        created_at: new Date(),
-        updated_at: new Date()
-      });
-      
-      // Update photo stats
-      await this.updatePhotoFeedbackStats(photoId);
-      
-      // Log activity
-      await logActivity(`photo_${feedback_type}`, { photo_id: photoId }, eventId);
-      
-      return { id, created: true };
-    } catch (error) {
-      logger.error('Error submitting feedback:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Get feedback for a photo
-   */
-  async getPhotoFeedback(photoId, options = {}) {
-    try {
-      const query = db('photo_feedback')
-        .where('photo_id', photoId);
-      
-      if (options.feedback_type) {
-        query.where('feedback_type', options.feedback_type);
-      }
-      
-      if (options.approved_only) {
-        query.where('is_approved', true);
-      }
-      
-      if (!options.include_hidden) {
-        query.where('is_hidden', false);
-      }
-      
-      if (options.guest_identifier) {
-        query.where('guest_identifier', options.guest_identifier);
-      }
-      
-      const feedback = await query
-        .orderBy('created_at', 'desc')
-        .select('id', 'feedback_type', 'rating', 'comment_text', 'guest_name', 'created_at');
-      
-      return feedback;
-    } catch (error) {
-      logger.error('Error getting photo feedback:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Get feedback summary for an event
-   */
-  async getEventFeedbackSummary(eventId) {
-    try {
-      const photos = await db('photos')
-        .where('event_id', eventId)
-        .select('id', 'filename', 'feedback_count', 'like_count', 'average_rating', 'favorite_count')
-        .orderBy('average_rating', 'desc')
-        .orderBy('like_count', 'desc');
-      
-      const totalStats = await db('photo_feedback')
-        .where('event_id', eventId)
-        .select(
-          db.raw('COUNT(DISTINCT CASE WHEN feedback_type = ? THEN guest_identifier END) as unique_raters', ['rating']),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as total_ratings', ['rating']),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as total_likes', ['like']),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as total_comments', ['comment']),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as total_favorites', ['favorite'])
-        )
-        .first();
-      
-      return {
-        photos,
-        stats: totalStats
-      };
-    } catch (error) {
-      logger.error('Error getting feedback summary:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Update photo feedback statistics
-   */
-  async updatePhotoFeedbackStats(photoId) {
-    try {
-      // Get aggregated stats
-      const stats = await db('photo_feedback')
-        .where('photo_id', photoId)
-        .where('is_hidden', false)
-        .select(
-          db.raw('COUNT(CASE WHEN feedback_type = ? AND is_approved = ? THEN 1 END) as comment_count', ['comment', formatBoolean(true)]),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as like_count', ['like']),
-          db.raw('COUNT(CASE WHEN feedback_type = ? THEN 1 END) as favorite_count', ['favorite']),
-          db.raw('AVG(CASE WHEN feedback_type = ? THEN rating END) as average_rating', ['rating']),
-          db.raw('COUNT(DISTINCT guest_identifier) as feedback_count')
-        )
-        .first();
-      
-      // Update photo table
-      await db('photos')
-        .where('id', photoId)
-        .update({
-          feedback_count: stats.feedback_count || 0,
-          like_count: stats.like_count || 0,
-          average_rating: stats.average_rating || 0,
-          favorite_count: stats.favorite_count || 0
-        });
-    } catch (error) {
-      logger.error('Error updating photo feedback stats:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Moderate feedback (approve/hide)
-   */
-  async moderateFeedback(feedbackId, action, adminId) {
-    try {
-      const updates = {
-        updated_at: new Date()
-      };
-      
-      if (action === 'approve') {
-        updates.is_approved = true;
-        updates.is_hidden = false;
-      } else if (action === 'hide') {
-        updates.is_hidden = true;
-      } else if (action === 'reject') {
-        updates.is_approved = false;
-        updates.is_hidden = true;
-      }
-      
-      const feedback = await db('photo_feedback')
-        .where('id', feedbackId)
-        .first();
-      
-      if (!feedback) {
-        throw new Error('Feedback not found');
-      }
-      
-      await db('photo_feedback')
-        .where('id', feedbackId)
-        .update(updates);
-      
-      // Update photo stats if visibility changed
-      await this.updatePhotoFeedbackStats(feedback.photo_id);
-      
-      // Log moderation action
-      await logActivity('feedback_moderated', {
-        feedback_id: feedbackId,
-        action,
-        admin_id: adminId
-      }, feedback.event_id);
-      
-      return true;
-    } catch (error) {
-      logger.error('Error moderating feedback:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Delete feedback
-   */
-  async deleteFeedback(feedbackId, adminId) {
-    try {
-      const feedback = await db('photo_feedback')
-        .where('id', feedbackId)
-        .first();
-      
-      if (!feedback) {
-        throw new Error('Feedback not found');
-      }
-      
-      await db('photo_feedback')
-        .where('id', feedbackId)
-        .delete();
-      
-      // Update photo stats
-      await this.updatePhotoFeedbackStats(feedback.photo_id);
-      
-      // Log deletion
-      await logActivity('feedback_deleted', {
-        feedback_id: feedbackId,
-        feedback_type: feedback.feedback_type,
-        admin_id: adminId
-      }, feedback.event_id);
-      
-      return true;
-    } catch (error) {
-      logger.error('Error deleting feedback:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Get feedback requiring moderation
-   */
-  async getPendingModeration(eventId = null) {
-    try {
-      let query = db('photo_feedback')
-        .join('photos', 'photo_feedback.photo_id', 'photos.id')
-        .join('events', 'photo_feedback.event_id', 'events.id')
-        .where('photo_feedback.is_approved', false)
-        .where('photo_feedback.is_hidden', false)
-        .where('photo_feedback.feedback_type', 'comment');
-      
-      if (eventId) {
-        query = query.where('photo_feedback.event_id', eventId);
-      }
-      
-      const pending = await query
-        .select(
-          'photo_feedback.*',
-          'photos.filename as photo_filename',
-          'events.event_name'
-        )
-        .orderBy('photo_feedback.created_at', 'desc');
-      
-      return pending;
-    } catch (error) {
-      logger.error('Error getting pending moderation:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Export feedback data for an event
-   */
-  async exportEventFeedback(eventId) {
-    try {
-      const feedback = await db('photo_feedback')
-        .join('photos', 'photo_feedback.photo_id', 'photos.id')
-        .where('photo_feedback.event_id', eventId)
-        .select(
-          'photos.filename',
-          'photo_feedback.feedback_type',
-          'photo_feedback.rating',
-          'photo_feedback.comment_text',
-          'photo_feedback.guest_name',
-          'photo_feedback.guest_email',
-          'photo_feedback.created_at'
-        )
-        .orderBy('photos.filename')
-        .orderBy('photo_feedback.created_at');
-      
-      return feedback;
-    } catch (error) {
-      logger.error('Error exporting feedback:', error);
-      throw error;
-    }
-  }
-}
-
-module.exports = new FeedbackService();

backend/src/utils/authSecurity.js

@@ -20,12 +20,6 @@ const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempt
  */
 async function trackFailedAttempt(identifier, ipAddress, userAgent) {
   try {
-    // Check if table exists first
-    const tableExists = await db.schema.hasTable('login_attempts');
-    if (!tableExists) {
-      return;
-    }
-    
     await db('login_attempts').insert({
       identifier,
       ip_address: ipAddress,
@@ -54,12 +48,6 @@ async function trackFailedAttempt(identifier, ipAddress, userAgent) {
  */
 async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
   try {
-    // Check if table exists first
-    const tableExists = await db.schema.hasTable('login_attempts');
-    if (!tableExists) {
-      return;
-    }
-    
     await db('login_attempts').insert({
       identifier,
       ip_address: ipAddress,
@@ -87,12 +75,6 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
  */
 async function checkAccountLockout(identifier) {
   try {
-    // Check if table exists first
-    const tableExists = await db.schema.hasTable('login_attempts');
-    if (!tableExists) {
-      return { isLocked: false };
-    }
-    
     const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
     
     // Get recent failed attempts
@@ -132,12 +114,6 @@ async function checkAccountLockout(identifier) {
  */
 async function checkSuspiciousActivity(identifier, ipAddress) {
   try {
-    // Check if table exists first
-    const tableExists = await db.schema.hasTable('login_attempts');
-    if (!tableExists) {
-      return false;
-    }
-    
     // Check for rapid attempts from different IPs
     const recentWindow = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes
     
@@ -177,13 +153,6 @@ function getGenericAuthError() {
  */
 async function cleanupOldAttempts() {
   try {
-    // Check if table exists first
-    const tableExists = await db.schema.hasTable('login_attempts');
-    if (!tableExists) {
-      // Table doesn't exist, skip cleanup
-      return;
-    }
-    
     const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 7 days
     
     const deleted = await db('login_attempts')

backend/src/utils/feedbackValidation.js

@@ -1,253 +0,0 @@
-const { body, param, validationResult } = require('express-validator');
-const validator = require('validator');
-
-/**
- * Validation rules for feedback submission
- */
-const feedbackValidationRules = {
-  rating: [
-    body('feedback_type').equals('rating'),
-    body('rating')
-      .isInt({ min: 1, max: 5 })
-      .withMessage('Rating must be between 1 and 5'),
-    body('guest_name')
-      .optional()
-      .trim()
-      .isLength({ max: 100 })
-      .withMessage('Name must be less than 100 characters'),
-    body('guest_email')
-      .optional()
-      .trim()
-      .isEmail()
-      .normalizeEmail()
-      .withMessage('Invalid email address')
-  ],
-  
-  like: [
-    body('feedback_type').equals('like'),
-    body('guest_name')
-      .optional()
-      .trim()
-      .isLength({ max: 100 }),
-    body('guest_email')
-      .optional()
-      .trim()
-      .isEmail()
-      .normalizeEmail()
-  ],
-  
-  favorite: [
-    body('feedback_type').equals('favorite'),
-    body('guest_name')
-      .optional()
-      .trim()
-      .isLength({ max: 100 }),
-    body('guest_email')
-      .optional()
-      .trim()
-      .isEmail()
-      .normalizeEmail()
-  ],
-  
-  comment: [
-    body('feedback_type').equals('comment'),
-    body('comment_text')
-      .trim()
-      .notEmpty()
-      .withMessage('Comment cannot be empty')
-      .isLength({ min: 1, max: 1000 })
-      .withMessage('Comment must be between 1 and 1000 characters')
-      .customSanitizer(value => sanitizeComment(value)),
-    body('guest_name')
-      .optional()
-      .trim()
-      .isLength({ max: 100 })
-      .withMessage('Name must be less than 100 characters'),
-    body('guest_email')
-      .optional()
-      .trim()
-      .isEmail()
-      .normalizeEmail()
-      .withMessage('Invalid email address')
-  ]
-};
-
-/**
- * Sanitize comment text
- */
-function sanitizeComment(text) {
-  if (!text) return '';
-  
-  // Remove excessive whitespace
-  text = text.replace(/\s+/g, ' ').trim();
-  
-  // Remove zero-width characters
-  text = text.replace(/[\u200B-\u200D\uFEFF]/g, '');
-  
-  // Remove control characters
-  text = text.replace(/[\x00-\x1F\x7F]/g, '');
-  
-  // Limit consecutive special characters
-  text = text.replace(/([!?.]){4,}/g, '$1$1$1');
-  
-  // Remove script tags and other dangerous HTML (basic sanitization)
-  text = text.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, '');
-  text = text.replace(/<iframe[^>]*>[\s\S]*?<\/iframe>/gi, '');
-  text = text.replace(/<object[^>]*>[\s\S]*?<\/object>/gi, '');
-  text = text.replace(/<embed[^>]*>/gi, '');
-  
-  return text;
-}
-
-/**
- * Validate feedback type parameter
- */
-const validateFeedbackType = param('feedbackType')
-  .isIn(['rating', 'like', 'comment', 'favorite'])
-  .withMessage('Invalid feedback type');
-
-/**
- * Validate photo ID parameter
- */
-const validatePhotoId = param('photoId')
-  .isInt({ min: 1 })
-  .withMessage('Invalid photo ID');
-
-/**
- * Validate event ID parameter
- */
-const validateEventId = param('eventId')
-  .isInt({ min: 1 })
-  .withMessage('Invalid event ID');
-
-/**
- * Get validation rules based on feedback type
- */
-function getValidationRules(feedbackType) {
-  return feedbackValidationRules[feedbackType] || [];
-}
-
-/**
- * Validation middleware for feedback submission
- */
-const validateFeedbackSubmission = [
-  body('feedback_type')
-    .isIn(['rating', 'like', 'comment', 'favorite'])
-    .withMessage('Invalid feedback type'),
-  
-  // Conditional validation based on feedback type
-  body('rating')
-    .if(body('feedback_type').equals('rating'))
-    .isInt({ min: 1, max: 5 })
-    .withMessage('Rating must be between 1 and 5'),
-  
-  body('comment_text')
-    .if(body('feedback_type').equals('comment'))
-    .trim()
-    .notEmpty()
-    .withMessage('Comment cannot be empty')
-    .isLength({ min: 1, max: 1000 })
-    .withMessage('Comment must be between 1 and 1000 characters')
-    .customSanitizer(value => sanitizeComment(value)),
-  
-  body('guest_name')
-    .optional()
-    .trim()
-    .isLength({ max: 100 })
-    .withMessage('Name must be less than 100 characters')
-    .matches(/^[a-zA-Z0-9\s\-'.]+$/)
-    .withMessage('Name contains invalid characters'),
-  
-  body('guest_email')
-    .optional()
-    .trim()
-    .isEmail()
-    .normalizeEmail()
-    .withMessage('Invalid email address')
-];
-
-/**
- * Validation for feedback settings
- */
-const validateFeedbackSettings = [
-  body('feedback_enabled').optional().isBoolean(),
-  body('allow_ratings').optional().isBoolean(),
-  body('allow_likes').optional().isBoolean(),
-  body('allow_comments').optional().isBoolean(),
-  body('allow_favorites').optional().isBoolean(),
-  body('require_name_email').optional().isBoolean(),
-  body('moderate_comments').optional().isBoolean(),
-  body('show_feedback_to_guests').optional().isBoolean()
-];
-
-/**
- * Validation for word filters
- */
-const validateWordFilter = [
-  body('word')
-    .trim()
-    .notEmpty()
-    .withMessage('Word cannot be empty')
-    .isLength({ min: 2, max: 100 })
-    .withMessage('Word must be between 2 and 100 characters'),
-  body('severity')
-    .optional()
-    .isIn(['mild', 'moderate', 'severe'])
-    .withMessage('Invalid severity level')
-];
-
-/**
- * Check validation results middleware
- */
-const checkValidation = (req, res, next) => {
-  const errors = validationResult(req);
-  if (!errors.isEmpty()) {
-    return res.status(400).json({
-      error: 'Validation failed',
-      errors: errors.array()
-    });
-  }
-  next();
-};
-
-/**
- * Validate guest identity requirements
- */
-async function validateGuestRequirements(settings, guestData) {
-  if (!settings.require_name_email) {
-    return { valid: true };
-  }
-  
-  const errors = [];
-  
-  if (!guestData.guest_name || guestData.guest_name.trim().length === 0) {
-    errors.push('Name is required');
-  }
-  
-  if (!guestData.guest_email || !validator.isEmail(guestData.guest_email)) {
-    errors.push('Valid email is required');
-  }
-  
-  if (errors.length > 0) {
-    return {
-      valid: false,
-      errors
-    };
-  }
-  
-  return { valid: true };
-}
-
-module.exports = {
-  feedbackValidationRules,
-  validateFeedbackType,
-  validatePhotoId,
-  validateEventId,
-  validateFeedbackSubmission,
-  validateFeedbackSettings,
-  validateWordFilter,
-  checkValidation,
-  getValidationRules,
-  sanitizeComment,
-  validateGuestRequirements
-};

backup-implementation-plan.md

@@ -0,0 +1,478 @@
+# Comprehensive Backup & Restore Implementation Plan
+
+## Introduction
+
+This plan extends the existing backup system to include full database backups, S3/MinIO support, intelligent change detection, and complete restore functionality. The system will create versioned, encrypted backups with manifests for easy restoration while minimizing storage usage through incremental backups and smart scheduling.
+
+---
+
+## Phase 1: Enhanced Database Schema & Core Infrastructure
+
+### Task 1.1: Create Enhanced Database Migration
+**File:** `backend/migrations/030_enhance_backup_system.js`  
+**Purpose:** Add tables for database backups, restore operations, and backup manifests
+
+```sql
+-- backup_manifests table
+- id (primary key)
+- backup_run_id (FK to backup_runs)
+- manifest_version (e.g., "1.0.0")
+- created_at
+- database_dump_path
+- database_checksum
+- files_manifest (JSON with all file paths/checksums)
+- metadata (JSON with system info, versions, etc.)
+
+-- restore_operations table
+- id (primary key)
+- started_at
+- completed_at
+- status (pending, running, completed, failed)
+- restore_type (full, partial, database_only, files_only)
+- source_backup_id (FK to backup_runs)
+- restored_by (FK to admin_users)
+- error_message
+- restore_log (detailed log)
+
+-- backup_change_tracking table
+- id (primary key)
+- table_name
+- last_change_timestamp
+- row_count
+- checksum
+- last_backed_up
+```
+
+### Task 1.2: Add S3 Configuration Settings
+**File:** Update migration `029_add_backup_service_tables.js`  
+**Add settings:**
+- `backup_s3_use_ssl` (boolean)
+- `backup_s3_path_style` (for MinIO compatibility)
+- `backup_encryption_enabled` (boolean)
+- `backup_encryption_key` (encrypted storage)
+- `backup_database_included` (boolean)
+- `backup_incremental_enabled` (boolean)
+- `backup_versioning_enabled` (boolean)
+- `backup_versions_to_keep` (number)
+
+---
+
+## Phase 2: S3/MinIO Implementation
+
+### Task 2.1: Install S3 Dependencies
+**File:** `backend/package.json`  
+**Command:** `npm install @aws-sdk/client-s3 @aws-sdk/lib-storage mime-types`  
+**Purpose:** AWS SDK v3 for S3-compatible storage
+
+### Task 2.2: Create S3 Storage Adapter
+**File:** `backend/src/services/storage/s3Storage.js`  
+**Implementation:**
+```javascript
+class S3StorageAdapter {
+  constructor(config)
+  connect() // Test connection
+  uploadFile(localPath, remotePath, metadata)
+  uploadStream(stream, remotePath, metadata)
+  downloadFile(remotePath, localPath)
+  listFiles(prefix)
+  deleteFile(remotePath)
+  getSignedUrl(remotePath, expiresIn)
+  createMultipartUpload(remotePath) // For large files
+  uploadPart(uploadId, partNumber, data)
+  completeMultipartUpload(uploadId, parts)
+}
+```
+
+### Task 2.3: Implement MinIO Compatibility Layer
+**File:** `backend/src/services/storage/minioCompat.js`  
+**Features:**
+- Path-style URL handling
+- Custom endpoint configuration
+- SSL/TLS options
+- Bucket creation if not exists
+
+---
+
+## Phase 3: Database Backup Integration
+
+### Task 3.1: Create Database Dump Service
+**File:** `backend/src/services/databaseBackup.js`  
+**Implementation:**
+```javascript
+class DatabaseBackupService {
+  async createBackup(format = 'sql') // sql or json
+  async dumpSQLite(outputPath)
+  async dumpPostgreSQL(outputPath)
+  async compressBackup(inputPath, outputPath)
+  async encryptBackup(inputPath, outputPath, key)
+  async validateBackup(backupPath)
+  async getTableChecksums() // For change detection
+}
+```
+
+### Task 3.2: Implement Change Detection for Database
+**File:** `backend/src/services/changeDetection.js`  
+**Features:**
+- Track table modifications using triggers
+- Calculate table checksums
+- Compare with last backup state
+- Intelligent backup decision making
+
+---
+
+## Phase 4: Enhanced Backup Service
+
+### Task 4.1: Refactor Backup Service for S3
+**File:** `backend/src/services/backupService.js`  
+**Modifications:**
+- Add `performS3Backup()` implementation
+- Support multipart uploads for large files
+- Add progress tracking callbacks
+- Implement retry logic with exponential backoff
+
+### Task 4.2: Create Backup Manifest Generator
+**File:** `backend/src/services/backupManifest.js`  
+**Structure:**
+```javascript
+{
+  version: "1.0.0",
+  created_at: "2024-01-20T10:00:00Z",
+  system_info: {
+    app_version: "1.0.74",
+    node_version: "18.x",
+    database_type: "sqlite|postgresql"
+  },
+  database: {
+    dump_file: "database/dump.sql.gz",
+    checksum: "sha256:...",
+    tables: { /* table info */ }
+  },
+  files: {
+    count: 1234,
+    total_size: 5678901234,
+    entries: [
+      {
+        path: "events/active/...",
+        checksum: "sha256:...",
+        size: 12345,
+        modified: "2024-01-20T09:00:00Z"
+      }
+    ]
+  },
+  settings: { /* app settings snapshot */ }
+}
+```
+
+### Task 4.3: Implement Incremental Backup Logic
+**File:** `backend/src/services/incrementalBackup.js`  
+**Features:**
+- Track changed files since last full backup
+- Create incremental manifest
+- Link to parent backup
+- Merge incremental backups
+
+---
+
+## Phase 5: Restore Functionality
+
+### Task 5.1: Create Restore Service
+**File:** `backend/src/services/restoreService.js`  
+**Implementation:**
+```javascript
+class RestoreService {
+  async validateBackup(backupId)
+  async prepareRestore(backupId, options)
+  async restoreDatabase(manifestPath)
+  async restoreFiles(manifestPath, options)
+  async performFullRestore(backupId)
+  async performPartialRestore(backupId, selections)
+  async rollbackRestore(restoreId)
+  async verifyRestore(restoreId)
+}
+```
+
+### Task 5.2: Implement Safe Restore Process
+**File:** `backend/src/services/restoreValidation.js`  
+**Safety Features:**
+- Pre-restore backup creation
+- Validation checksums
+- Atomic operations
+- Rollback capability
+- Post-restore verification
+
+### Task 5.3: Create Restore CLI Tool
+**File:** `backend/scripts/restore-backup.js`  
+**Purpose:** Emergency restore without running application  
+**Features:**
+- Interactive mode
+- Dry-run option
+- Progress display
+- Validation reports
+
+---
+
+## Phase 6: Admin API Extensions
+
+### Task 6.1: Add Restore Endpoints
+**File:** `backend/src/routes/adminBackup.js`  
+**New Endpoints:**
+```javascript
+POST   /api/admin/backup/restore/validate
+POST   /api/admin/backup/restore/start
+GET    /api/admin/backup/restore/:id/status
+POST   /api/admin/backup/restore/:id/cancel
+GET    /api/admin/backup/manifests/:backupId
+GET    /api/admin/backup/download/:backupId
+```
+
+### Task 6.2: Add S3 Management Endpoints
+**File:** `backend/src/routes/adminBackup.js`  
+**New Endpoints:**
+```javascript
+GET    /api/admin/backup/s3/buckets
+GET    /api/admin/backup/s3/files
+DELETE /api/admin/backup/s3/cleanup
+POST   /api/admin/backup/s3/test-upload
+```
+
+---
+
+## Phase 7: Frontend Implementation
+
+### Task 7.1: Create Backup Management Page
+**File:** `frontend/src/pages/admin/BackupManagement.jsx`  
+**Components:**
+- Backup configuration form
+- Backup history table
+- Manual backup trigger
+- Restore interface
+- Progress indicators
+
+### Task 7.2: Create Backup Status Dashboard
+**File:** `frontend/src/components/admin/BackupDashboard.jsx`  
+**Features:**
+- Real-time backup status
+- Storage usage charts
+- Backup success rate
+- Next scheduled backup
+- Recent backup/restore operations
+
+### Task 7.3: Implement Restore Wizard
+**File:** `frontend/src/components/admin/RestoreWizard.jsx`  
+**Steps:**
+1. Select backup to restore
+2. Choose restore type (full/partial)
+3. Select components (database/files/settings)
+4. Review and confirm
+5. Monitor progress
+6. Verify results
+
+---
+
+## Phase 8: Background Job Enhancements
+
+### Task 8.1: Implement Smart Scheduling
+**File:** `backend/src/services/smartScheduler.js`  
+**Features:**
+- Skip backup if no changes detected
+- Adaptive scheduling based on activity
+- Priority queuing for critical backups
+- Resource usage monitoring
+
+### Task 8.2: Create Backup Monitor Service
+**File:** `backend/src/services/backupMonitor.js`  
+**Purpose:** Monitor backup health and alert on issues  
+**Features:**
+- Check last successful backup age
+- Verify backup integrity periodically
+- Monitor storage usage
+- Alert on failures or anomalies
+
+---
+
+## Phase 9: Security & Encryption
+
+### Task 9.1: Implement Backup Encryption
+**File:** `backend/src/utils/encryption.js`  
+**Features:**
+- AES-256-GCM encryption
+- Key derivation from master key
+- Encrypted manifest headers
+- Secure key storage
+
+### Task 9.2: Add Access Control
+**File:** `backend/src/middleware/backupAuth.js`  
+**Features:**
+- Separate permissions for backup/restore
+- Audit logging for all operations
+- IP whitelist for restore operations
+- Two-factor authentication for restore
+
+---
+
+## Phase 10: Testing & Validation
+
+### Task 10.1: Create Backup Test Suite
+**File:** `backend/__tests__/services/backup.test.js`  
+**Tests:**
+- Unit tests for each backup method
+- Integration tests with real S3/MinIO
+- Database backup/restore cycles
+- Encryption/decryption validation
+- Manifest generation and parsing
+
+### Task 10.2: Create Restore Test Suite
+**File:** `backend/__tests__/services/restore.test.js`  
+**Tests:**
+- Full restore scenarios
+- Partial restore validation
+- Rollback testing
+- Corruption recovery
+- Cross-version compatibility
+
+### Task 10.3: Create E2E Backup/Restore Tests
+**File:** `backend/__tests__/e2e/backupRestore.test.js`  
+**Scenarios:**
+- Complete backup/restore cycle
+- Disaster recovery simulation
+- Performance benchmarks
+- Storage optimization validation
+
+---
+
+## Phase 11: Documentation & Deployment
+
+### Task 11.1: Create Backup Administrator Guide
+**File:** `docs/backup-admin-guide.md`  
+**Contents:**
+- Configuration guide
+- Best practices
+- Troubleshooting
+- Recovery procedures
+- Performance tuning
+
+### Task 11.2: Update Docker Configuration
+**Files:** `docker-compose.yml`, `Dockerfile`  
+**Changes:**
+- Add S3/MinIO service for development
+- Volume mappings for backups
+- Environment variable templates
+- Health checks for backup service
+
+### Task 11.3: Create Backup Playbook
+**File:** `docs/backup-playbook.md`  
+**Scenarios:**
+- Daily backup verification
+- Disaster recovery steps
+- Migration procedures
+- Troubleshooting flowchart
+
+---
+
+## Implementation Order & Priority
+
+### Critical Path (Must Have):
+1. S3 Storage Adapter (Task 2.2)
+2. Database Backup Service (Task 3.1)
+3. Enhanced Backup Service (Task 4.1)
+4. Basic Restore Service (Task 5.1)
+5. Admin API Extensions (Task 6.1)
+6. Backup Test Suite (Task 10.1)
+
+### High Priority (Should Have):
+1. Backup Manifest Generator (Task 4.2)
+2. Change Detection (Task 3.2)
+3. Frontend Backup Page (Task 7.1)
+4. Encryption Implementation (Task 9.1)
+5. Restore Wizard (Task 7.3)
+
+### Nice to Have:
+1. Incremental Backups (Task 4.3)
+2. Smart Scheduling (Task 8.1)
+3. Advanced Monitoring (Task 8.2)
+4. MinIO Compatibility (Task 2.3)
+
+---
+
+## Configuration Examples
+
+### S3 Configuration:
+```javascript
+{
+  backup_destination_type: "s3",
+  backup_s3_endpoint: "https://s3.amazonaws.com",
+  backup_s3_bucket: "wedding-backups",
+  backup_s3_access_key: "AKIA...",
+  backup_s3_secret_key: "secret",
+  backup_s3_region: "us-east-1",
+  backup_s3_use_ssl: true,
+  backup_s3_path_style: false
+}
+```
+
+### MinIO Configuration:
+```javascript
+{
+  backup_destination_type: "s3",
+  backup_s3_endpoint: "https://minio.example.com:9000",
+  backup_s3_bucket: "picpeak-backups",
+  backup_s3_access_key: "minioadmin",
+  backup_s3_secret_key: "minioadmin",
+  backup_s3_region: "us-east-1",
+  backup_s3_use_ssl: true,
+  backup_s3_path_style: true // Required for MinIO
+}
+```
+
+---
+
+## Best Practices Implementation
+
+1. **Change Detection**: Use database triggers and file checksums to detect changes
+2. **Compression**: Always compress before encryption for better ratios
+3. **Chunking**: Split large backups into manageable chunks
+4. **Versioning**: Keep multiple backup versions with rotation
+5. **Validation**: Verify every backup immediately after creation
+6. **Monitoring**: Alert on backup failures within 5 minutes
+7. **Testing**: Perform monthly restore drills
+8. **Documentation**: Log every backup/restore operation with details
+
+---
+
+## Key Features of This Implementation
+
+### Intelligent Change Detection
+- Only backs up when changes are detected
+- Tracks database modifications via checksums
+- Monitors file system changes
+- Reduces unnecessary backup operations
+
+### Comprehensive Backup Scope
+- Full database dumps (SQLite/PostgreSQL)
+- All event photos and thumbnails
+- Application settings and configuration
+- Email templates and user data
+- Complete system state capture
+
+### Flexible Storage Options
+- Local directory backup
+- Remote server via rsync
+- S3-compatible storage (AWS, MinIO, etc.)
+- Encrypted storage for security
+- Compression for space efficiency
+
+### Robust Restore Capabilities
+- Full system restore
+- Partial restore (specific events/data)
+- Point-in-time recovery
+- Pre-restore validation
+- Rollback on failure
+
+### Enterprise-Grade Features
+- Backup manifests for verification
+- Incremental backup support
+- Version retention policies
+- Automated cleanup of old backups
+- Comprehensive audit logging
+
+This comprehensive plan provides a robust, enterprise-grade backup solution with full disaster recovery capabilities.