chore: bump frontend version to 1.0.73

- Changed from public settings endpoint to admin settings endpoint
- Fixed "Unexpected token '<'" JSON parse error
- Properly transforms settings array to key-value map
- Uses correct setting keys (analytics_umami_*)
- Maintains fallback to environment variables

The analytics page now correctly fetches Umami configuration using
the authenticated admin API instead of the public endpoint, which
was returning errors and causing JSON parse failures.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.claudedocs/scans/security-20250713.md

@@ -0,0 +1,286 @@
+# Security Scan Report - Wedding Photo Sharing Application
+**Date**: July 13, 2025  
+**Scanner**: Claude Security Audit with --security --validate flags  
+**Overall Risk Level**: MEDIUM-HIGH  
+
+## Executive Summary
+
+The wedding photo sharing application demonstrates strong security fundamentals with comprehensive input validation, proper authentication mechanisms, and good file security practices. However, several critical issues require immediate attention, particularly around hardcoded secrets, token storage, and Content Security Policy configuration.
+
+### Security Score: 6.5/10
+
+**Strengths**: Excellent input validation, parameterized queries, file security, rate limiting  
+**Critical Issues**: Hardcoded JWT secrets, localStorage token storage, weak CSP, console logging in production
+
+---
+
+## 🔴 CRITICAL FINDINGS (Immediate Action Required)
+
+### 1. Hardcoded JWT Secret in Development
+- **Location**: Backend `.env` file
+- **Risk**: Token forgery, authentication bypass
+- **Impact**: Complete authentication compromise
+- **Remediation**: 
+  ```bash
+  # Generate secure secret
+  openssl rand -base64 32
+  # Never commit to repository
+  echo ".env" >> .gitignore
+  ```
+
+### 2. Gallery Tokens in localStorage
+- **Location**: Frontend `api.ts` and auth contexts
+- **Risk**: XSS token theft
+- **Impact**: Gallery access compromise
+- **Remediation**: Move to httpOnly cookies:
+  ```typescript
+  Cookies.set(`gallery_token_${slug}`, token, {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict'
+  });
+  ```
+
+### 3. Weak Content Security Policy
+- **Location**: Frontend `nginx.conf`
+- **Risk**: XSS, code injection
+- **Current**: `unsafe-inline` and `unsafe-eval` allowed
+- **Remediation**: Implement strict CSP (see detailed recommendations below)
+
+---
+
+## 🟠 HIGH SEVERITY FINDINGS
+
+### 1. Console Logging in Production
+- **Locations**: 61 instances across frontend
+- **Risk**: Information disclosure
+- **Impact**: Leaking sensitive data, debugging info
+- **Remediation**: Implement environment-aware logging
+
+### 2. Token Revocation Vulnerability
+- **Location**: Backend `tokenRevocation.js`
+- **Risk**: Token manipulation
+- **Impact**: Bypass revocation checks
+- **Remediation**: Verify token signature before decoding
+
+### 3. Source Maps in Production
+- **Location**: Frontend build configuration
+- **Risk**: Source code exposure
+- **Impact**: Reveals application structure
+- **Remediation**: Disable in production builds
+
+### 4. Missing Security Headers
+- **Location**: nginx configuration
+- **Missing**: HSTS, Permissions-Policy
+- **Impact**: Various client-side attacks
+- **Remediation**: Add comprehensive security headers
+
+---
+
+## 🟡 MEDIUM SEVERITY FINDINGS
+
+### 1. Rate Limiting Bypass Potential
+- **Location**: Backend rate limiter
+- **Risk**: DoS attacks
+- **Current**: JWT validation in rate limiter
+- **Remediation**: Use IP-based limiting only
+
+### 2. Incomplete SQL Injection Protection
+- **Location**: Complex dashboard queries
+- **Risk**: Potential injection in edge cases
+- **Current**: Mostly parameterized
+- **Remediation**: Use query builder exclusively
+
+### 3. Session Management
+- **Issue**: No gallery token invalidation on password change
+- **Risk**: Persistent access after compromise
+- **Remediation**: Implement token revocation
+
+### 4. Path Traversal in Gallery Slugs
+- **Location**: Frontend gallery routes
+- **Risk**: Directory traversal attempts
+- **Remediation**: Validate and sanitize slugs
+
+---
+
+## 🟢 LOW SEVERITY FINDINGS
+
+### 1. Verbose Error Messages
+- **Location**: Multiple API endpoints
+- **Risk**: Information disclosure
+- **Remediation**: Generic client errors, detailed server logs
+
+### 2. Weak Gallery Passwords
+- **Current**: zxcvbn score 2/4 allowed
+- **Risk**: Brute force attacks
+- **Remediation**: Increase to score 3/4
+
+### 3. Missing File Size Validation
+- **Location**: Frontend upload components
+- **Risk**: DoS via large uploads
+- **Remediation**: Add client-side size checks
+
+---
+
+## ✅ SECURITY STRENGTHS
+
+### Authentication & Authorization
+- JWT with proper expiration (24h/7d)
+- Token type validation
+- IP tracking and validation
+- Password change detection
+- Token revocation system
+- Bcrypt with 12 rounds
+- zxcvbn password strength checking
+
+### Input Validation & SQL Security
+- express-validator on all endpoints
+- Parameterized queries via Knex
+- SQL injection protection utilities
+- Path traversal prevention
+- Comprehensive input sanitization
+
+### File Security
+- Magic number verification
+- MIME type validation
+- Safe filename generation
+- Directory traversal protection
+- File extension whitelist
+
+### Rate Limiting & DoS Protection
+- General: 100 req/15min
+- Auth endpoints: 5 req/15min
+- Account lockout after failed attempts
+- Suspicious activity detection
+
+### Frontend Security
+- React's built-in XSS protection
+- DOMPurify for HTML content
+- No eval() or innerHTML usage
+- Proper error boundaries
+- ReCAPTCHA integration
+
+---
+
+## 📊 DEPENDENCY ANALYSIS
+
+### Current Status
+- **Backend**: 0 vulnerabilities (691 packages)
+- **Frontend**: 0 vulnerabilities (434 packages)
+
+### Recommended Updates
+1. **bcrypt** 5.1.1 → 6.0.0 (performance, compatibility)
+2. **helmet** 7.2.0 → 8.1.0 (new security features)
+3. **@tiptap** 2.x → 3.x (security improvements)
+
+### Supply Chain Assessment
+- All major dependencies from trusted sources
+- No typosquatting detected
+- Regular maintenance observed
+- MIT/ISC/Apache licenses only
+
+---
+
+## 🛠️ REMEDIATION PLAN
+
+### Phase 1: Critical (Within 24 hours)
+1. Replace hardcoded JWT secret with secure random value
+2. Move gallery tokens from localStorage to httpOnly cookies
+3. Implement strict CSP without unsafe-eval
+4. Remove or wrap console.log statements
+
+### Phase 2: High Priority (Within 1 week)
+1. Disable source maps in production
+2. Add missing security headers (HSTS, Permissions-Policy)
+3. Fix token revocation vulnerability
+4. Update critical dependencies (bcrypt, helmet)
+
+### Phase 3: Medium Priority (Within 1 month)
+1. Implement comprehensive logging strategy
+2. Add gallery slug validation
+3. Enhance rate limiting logic
+4. Implement session invalidation on password change
+
+### Phase 4: Ongoing
+1. Weekly dependency scanning
+2. Implement security testing in CI/CD
+3. Regular penetration testing
+4. Security awareness training
+
+---
+
+## 🔒 RECOMMENDED CSP CONFIGURATION
+
+```nginx
+add_header Content-Security-Policy "
+  default-src 'self';
+  script-src 'self' 'nonce-{RANDOM}' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
+  style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob: https:;
+  font-src 'self';
+  connect-src 'self' https://analytics.domain.com;
+  frame-src https://www.google.com/recaptcha/;
+  object-src 'none';
+  base-uri 'self';
+  form-action 'self';
+  frame-ancestors 'none';
+  upgrade-insecure-requests;
+" always;
+```
+
+---
+
+## 🚀 SECURITY IMPROVEMENTS ROADMAP
+
+### Immediate Implementation
+```bash
+# 1. Generate secure secrets
+openssl rand -base64 32 > jwt-secret.txt
+
+# 2. Update dependencies
+cd backend && npm install bcrypt@^6.0.0 helmet@^8.1.0
+cd ../frontend && npm update
+
+# 3. Add security scanning
+npm install -D npm-audit-resolver
+```
+
+### CI/CD Integration
+```yaml
+# Add to CI pipeline
+- name: Security Scan
+  run: |
+    npm audit --audit-level=moderate
+    npm run test:security
+```
+
+### Monitoring & Alerting
+1. Implement fail2ban for repeated auth failures
+2. Set up log analysis for suspicious patterns
+3. Configure alerts for security events
+4. Regular vulnerability scanning
+
+---
+
+## 📋 COMPLIANCE CHECKLIST
+
+- [ ] OWASP Top 10 addressed
+- [ ] GDPR compliance (data minimization, right to erasure)
+- [ ] Security headers implemented
+- [ ] Dependency scanning automated
+- [ ] Incident response plan documented
+- [ ] Security documentation maintained
+- [ ] Regular security reviews scheduled
+
+---
+
+## 🎯 CONCLUSION
+
+The wedding photo sharing application has a solid security foundation with excellent input validation and authentication mechanisms. However, operational security practices need immediate attention. The critical issues around secret management and token storage must be addressed before production deployment.
+
+Implementing the recommended fixes will raise the security score from 6.5/10 to approximately 8.5/10, providing a robust and secure platform for wedding photo sharing.
+
+---
+
+*Generated by Claude Security Scanner v1.0*  
+*Next scan recommended: After Phase 1 remediation completion*

.drone.yml.full

@@ -1,280 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-trigger:
-  branch:
-    - main
-    - develop
-    - feature/*
-  event:
-    - push
-    - pull_request
-    - tag
-
-volumes:
-  - name: docker
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  # Frontend Tests
-  - name: frontend-test
-    image: node:18-alpine
-    commands:
-      - cd frontend
-      - npm ci --legacy-peer-deps
-      - npm run lint
-      - npm run build
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Backend Tests
-  - name: backend-test
-    image: node:18-alpine
-    commands:
-      - cd backend
-      - npm ci
-      - npm run lint
-      - npm test
-    environment:
-      NODE_ENV: test
-      JWT_SECRET: test-secret
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-frontend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: frontend/Dockerfile
-      context: frontend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-backend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: backend/Dockerfile
-      context: backend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Security Scan
-  - name: security-scan
-    image: aquasec/trivy:latest
-    commands:
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-frontend:${DRONE_COMMIT_SHA:0:8}
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-backend:${DRONE_COMMIT_SHA:0:8}
-    environment:
-      DOCKER_HOST: tcp://docker:2375
-    volumes:
-      - name: docker
-        path: /var/run/docker.sock
-    when:
-      branch:
-        - main
-      event:
-        - push
-
-  # Deploy to Staging
-  - name: deploy-staging
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: staging_swarm_host
-      SWARM_USER:
-        from_secret: staging_swarm_user
-      SWARM_KEY:
-        from_secret: staging_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_COMMIT_SHA:0:8}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing
-        EOF
-    when:
-      branch:
-        - develop
-      event:
-        - push
-
-  # Deploy to Production
-  - name: deploy-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_TAG:-latest}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          
-          # Backup database before deployment
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_db) pg_dump -U postgres wedding_photo_sharing > /backup/db-backup-\$(date +%Y%m%d-%H%M%S).sql
-          
-          # Deploy stack
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-          
-          # Wait for services to be ready
-          sleep 30
-          
-          # Run migrations if needed
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_backend) npm run migrate
-        EOF
-    when:
-      event:
-        - tag
-
-  # Health Check
-  - name: health-check
-    image: alpine:latest
-    commands:
-      - apk add --no-cache curl
-      - sleep 30
-      - curl -f https://${FRONTEND_HOST}/health || exit 1
-      - curl -f https://${BACKEND_HOST}/api/health || exit 1
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Notification - Success
-  - name: notify-success
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ✅ *Build {{build.number}} succeeded* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        {{#if build.tag}}
-        🏷️ Tag: {{build.tag}}
-        🚀 Deployed to *PRODUCTION*
-        {{else}}
-        📦 Deployed to *{{build.branch}}*
-        {{/if}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - success
-
-  # Notification - Failure
-  - name: notify-failure
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ❌ *Build {{build.number}} failed* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - failure
-
----
-kind: pipeline
-type: docker
-name: rollback
-
-trigger:
-  event:
-    - rollback
-
-steps:
-  - name: rollback-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=${DRONE_ROLLBACK_TO}
-          
-          # Deploy previous version
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-        EOF
-
----
-kind: secret
-name: slack_webhook
-get:
-  path: drone/slack
-  name: webhook

.env.example

@@ -1,26 +1,34 @@
-# JWT Secret for authentication
-# IMPORTANT: Generate a secure random secret with: openssl rand -hex 32
-# NEVER use the default value or commit the actual secret to version control
-JWT_SECRET=CHANGE_ME_TO_A_64_CHARACTER_SECURE_RANDOM_STRING_GENERATED_BY_OPENSSL
+# Environment Configuration Template
+# Copy this file to .env and adjust values for your environment
 
-# URLs
-ADMIN_URL=https://admin.photos.yourdomain.com
-FRONTEND_URL=https://photos.yourdomain.com
+# Development: Use docker-compose.dev.yml
+# Production: Use docker-compose.prod.yml with .env.production.example
 
-# Database (for PostgreSQL in production)
-DB_USER=photoapp
-DB_PASSWORD=secure-password-here
-DB_NAME=photo_sharing
+# JWT Secret (CRITICAL for production)
+# Generate with: openssl rand -base64 32
+JWT_SECRET=dev-secret-change-in-production
+
+# Application URLs
+ADMIN_URL=http://localhost:3005
+FRONTEND_URL=http://localhost:3005
+
+# Database Configuration
+# SQLite is used for development by default
+# For production PostgreSQL config, see .env.production.example
+DATABASE_CLIENT=sqlite3
+DATABASE_PATH=./data/photo_sharing.db
 
 # Email Configuration
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
+# Development: Uses Mailhog (included in docker-compose.dev.yml)
+# Production: Configure real SMTP server
+SMTP_HOST=mailhog
+SMTP_PORT=1025
 SMTP_SECURE=false
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_USER=
+SMTP_PASS=
+EMAIL_FROM=noreply@localhost
 
-# Umami Analytics
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=random-salt-here
+# Optional: Umami Analytics
+UMAMI_URL=
+UMAMI_WEBSITE_ID=
+UMAMI_HASH_SALT=

.env.production.example

@@ -1,60 +1,44 @@
-# Application URLs
-FRONTEND_HOST=photos.yourdomain.com
-BACKEND_HOST=api.photos.yourdomain.com
-ADMIN_URL=https://admin.photos.yourdomain.com
-FRONTEND_URL=https://photos.yourdomain.com
+# PicPeak Production Configuration
+# Copy this file to .env and update with your values
 
-# Database Configuration
-DB_NAME=photo_sharing
-DB_USER=photoapp
-DB_PASSWORD=your-secure-password-here
+# Required: Security
+JWT_SECRET=CHANGE_THIS_TO_RANDOM_32_CHAR_STRING
 
-# JWT Configuration
-JWT_SECRET=your-jwt-secret-here
+# Required: URLs (update with your domain)
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+ADMIN_URL=https://your-domain.com
 
-# Email Configuration
+# Required: Email Settings
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
-SMTP_SECURE=false
 SMTP_USER=your-email@gmail.com
 SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_FROM=your-email@gmail.com
 
-# Umami Analytics
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_HOST=analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=your-random-salt
-UMAMI_DB_PASSWORD=umami-db-password
+# Required: Initial Admin Account
+ADMIN_EMAIL=admin@your-domain.com
+ADMIN_PASSWORD=change-this-password
 
-# Traefik Configuration
-TRAEFIK_HOST=traefik.yourdomain.com
-ACME_EMAIL=admin@yourdomain.com
-TRAEFIK_DASHBOARD_AUTH=admin:$2y$10$... # Use htpasswd to generate
+# Database (PostgreSQL recommended for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres
+DB_PORT=5432
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=secure-database-password
 
-# Docker Registry (optional)
-REGISTRY_URL=registry.yourdomain.com
-VERSION=latest
+# Optional: Customization
+SITE_NAME=PicPeak
+DEFAULT_EXPIRATION_DAYS=30
+SESSION_TIMEOUT_MINUTES=60
 
-# Monitoring
-DOMAIN=yourdomain.com
-GRAFANA_USER=admin
-GRAFANA_PASSWORD=your-grafana-password
+# Optional: Analytics (Umami)
+VITE_UMAMI_URL=
+VITE_UMAMI_WEBSITE_ID=
 
-# OAuth Configuration (optional)
-OAUTH_AUTH_URL=https://auth.yourdomain.com/oauth2/auth
-OAUTH_TOKEN_URL=https://auth.yourdomain.com/oauth2/token
-OAUTH_USER_URL=https://auth.yourdomain.com/oauth2/userinfo
-OAUTH_CLIENT_ID=photo-sharing
-OAUTH_CLIENT_SECRET=your-oauth-secret
-OAUTH_SECRET=your-random-secret
-COOKIE_DOMAIN=.yourdomain.com
-OAUTH_WHITELIST=admin@yourdomain.com
-
-# Backup Configuration (optional)
-S3_BACKUP_BUCKET=your-backup-bucket
-
-# Drone CI Configuration
-DRONE_RPC_SECRET=your-drone-secret
-DRONE_GITHUB_CLIENT_ID=your-github-client-id
-DRONE_GITHUB_CLIENT_SECRET=your-github-client-secret
+# Advanced: Performance Tuning
+NODE_ENV=production
+BCRYPT_ROUNDS=12
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX_REQUESTS=100

.gitattributes-github

@@ -0,0 +1,12 @@
+# Files to exclude from GitHub mirror
+.env* export-ignore
+docker-compose.prod.yml export-ignore
+.claudedocs/ export-ignore
+backend/data/ export-ignore
+backend/storage/ export-ignore
+backend/.env* export-ignore
+frontend/.env* export-ignore
+secrets/ export-ignore
+*.key export-ignore
+*.pem export-ignore
+.gitea/ export-ignore

.gitea/workflows/mirror-to-github.yml

@@ -0,0 +1,211 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:  # Allow manual triggering
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository with full history
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0  # Full history needed for finding the commit
+
+      - name: Setup Git
+        run: |
+          git config --global user.name "the-luap"
+          git config --global user.email "paul-nothaft@hotmail.de"
+
+      - name: Debug - Show current branch and status
+        run: |
+          echo "Current branch:"
+          git branch -a
+          echo "Git status:"
+          git status
+          echo "Remote info:"
+          git remote -v
+          echo "Checking target commit exists:"
+          git show --oneline 7aca927937 || echo "Target commit not found!"
+
+      - name: Create completely new history from specific commit
+        run: |
+          TARGET_COMMIT="7aca927937"
+          
+          # Verify the target commit exists
+          if ! git cat-file -e $TARGET_COMMIT^{commit}; then
+            echo "ERROR: Target commit $TARGET_COMMIT does not exist!"
+            exit 1
+          fi
+          
+          echo "✅ Target commit found: $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          # Clean up any existing github-mirror branch
+          git branch -D github-mirror || true
+          
+          # Create a completely new orphan branch (no history)
+          git checkout --orphan github-mirror
+          
+          # Clear the staging area completely
+          git rm -rf . || true
+          
+          # Get the file tree from the target commit and create initial commit
+          echo "Creating new history starting from $TARGET_COMMIT..."
+          git read-tree $TARGET_COMMIT
+          git commit -m "Initial commit - imported from $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          echo "✅ Created new initial commit: $(git log --oneline -1)"
+          
+          # Now get all commits after the target commit and apply their changes
+          COMMITS_AFTER_TARGET=$(git rev-list --reverse --no-merges $TARGET_COMMIT..main)
+          
+          if [ -n "$COMMITS_AFTER_TARGET" ]; then
+            echo "📋 Applying changes from commits after $TARGET_COMMIT:"
+            
+            for commit in $COMMITS_AFTER_TARGET; do
+              echo "Processing: $(git log --oneline -1 $commit)"
+              
+              # Get the commit message and author info
+              COMMIT_MSG=$(git log --format="%B" -n 1 $commit)
+              COMMIT_AUTHOR=$(git log --format="%an <%ae>" -n 1 $commit)
+              COMMIT_DATE=$(git log --format="%ad" -n 1 $commit)
+              
+              # Apply the changes from this commit
+              if git diff-tree --no-commit-id --name-only -r $commit | xargs -I {} git show $commit:{} > /dev/null 2>&1; then
+                # Apply file changes
+                git checkout $commit -- . || true
+                
+                # Stage all changes
+                git add -A
+                
+                # Only commit if there are changes
+                if ! git diff --cached --quiet; then
+                  # Create new commit with original metadata but new SHA
+                  GIT_AUTHOR_NAME=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f1 | xargs)
+                  GIT_AUTHOR_EMAIL=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f2 | cut -d'>' -f1)
+                  GIT_AUTHOR_DATE="$COMMIT_DATE"
+                  
+                  export GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_AUTHOR_DATE
+                  git commit -m "$COMMIT_MSG"
+                  echo "✅ Applied changes as new commit: $(git log --oneline -1)"
+                else
+                  echo "⚠️ No changes to commit for $commit"
+                fi
+              else
+                echo "⚠️ Skipping problematic commit $commit"
+              fi
+            done
+            
+            echo "✅ Finished creating new history"
+          else
+            echo "✅ No commits after target commit - history starts fresh"
+          fi
+          
+          echo ""
+          echo "=== New History Summary ==="
+          echo "Total commits in new history: $(git rev-list --count github-mirror)"
+          echo "History starts with: $(git log --oneline --reverse | head -1)"
+          echo "Latest commit: $(git log --oneline -1)"
+
+      - name: Remove sensitive files and directories
+        run: |
+          # Switch to the github-mirror branch
+          git checkout github-mirror
+          
+          echo "Current files before cleanup:"
+          ls -la | head -10 || true
+          echo "..."
+          
+          # Remove sensitive files/directories if they exist
+          echo "Removing sensitive files..."
+          rm -rf .env* || true
+          rm -rf backend/.env* || true
+          rm -rf frontend/.env* || true
+          rm -rf docker-compose.prod.yml || true
+          rm -rf .claudedocs/ || true
+          rm -rf backend/data/ || true
+          rm -rf backend/storage/ || true
+          rm -rf .gitea/ || true
+          rm -rf scripts/install-gitea-runner.sh || true
+          rm -rf .drone* || true
+          rm -rf .github-mirror-exclude || true
+          rm -rf .gitattributes-github || true
+          rm -rf photo-sharing-prd.md || true
+          rm -rf CLAUDE.md || true
+          rm -rf PRODUCTION_DEPLOYMENT_GUIDE.md || true
+          rm -rf logs/ || true
+          rm -rf frontend/.claudedocs/ || true
+          rm -rf test-maintenance.sh || true
+          rm -rf storage/ || true
+          
+          echo "Sensitive files removal completed"
+          
+          # Add and commit the cleanup if there are changes
+          git add -A
+          if ! git diff --cached --quiet; then
+            git commit -m "chore: remove sensitive files for GitHub mirror"
+            echo "✅ Committed cleanup of sensitive files"
+          else
+            echo "✅ No sensitive files to remove"
+          fi
+          
+          echo "Final file structure (top level):"
+          ls -la | head -10 || true
+
+      - name: Verify completely new history
+        run: |
+          git checkout github-mirror
+          echo "=== Final History Verification ==="
+          echo "Total commits in new github-mirror branch: $(git rev-list --count github-mirror)"
+          echo ""
+          echo "Complete commit history (should start from target commit content):"
+          git log --oneline --reverse
+          echo ""
+          echo "⚠️ Note: This is a completely NEW history with new commit SHAs"
+          echo "🔍 Original target commit content preserved but with new commit ID"
+
+      - name: Check GitHub token
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          if [ -z "$GITHUBTOKEN" ]; then
+            echo "ERROR: GITHUBTOKEN secret is not set!"
+            exit 1
+          else
+            echo "GitHub token is available (length: ${#GITHUBTOKEN})"
+          fi
+
+      - name: Force push completely new history to GitHub
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          # Switch to github-mirror branch
+          git checkout github-mirror
+          
+          # Remove existing github remote if it exists
+          git remote remove github || true
+          
+          # Add GitHub remote
+          git remote add github https://x-access-token:${GITHUBTOKEN}@github.com/the-luap/picpeak.git
+          
+          # Verify remote was added
+          echo "GitHub remote added:"
+          git remote -v
+          
+          # Force push the completely new history to GitHub main
+          echo "🔥 FORCE PUSHING completely new history to GitHub..."
+          echo "⚠️ This will COMPLETELY REPLACE all history on GitHub!"
+          git push github github-mirror:main --force
+          echo "✅ Force push completed - GitHub now has completely new history!"
+
+      - name: Workflow completed
+        run: |
+          echo "✅ Mirror to GitHub workflow completed successfully!"
+          echo "🔥 COMPLETE HISTORY REPLACEMENT: GitHub now has entirely new history"
+          echo "📊 History starts from commit content: 7aca927937"
+          echo "🔍 Check https://github.com/the-luap/picpeak to verify the new history"
+          echo "📈 Total commits pushed: $(git rev-list --count github-mirror)"
+          echo "🆕 All commit SHAs are NEW - no connection to previous history"

.gitea/workflows/version-and-release.yml

@@ -14,6 +14,7 @@ jobs:
     outputs:
       new_version: ${{ steps.version.outputs.new_version }}
       version_changed: ${{ steps.version.outputs.version_changed }}
+      component_changed: ${{ steps.version.outputs.component_changed }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -30,15 +31,104 @@ jobs:
           git config --global user.name 'Gitea Actions Bot'
           git config --global user.email 'actions@gitea.local'
       
-      - name: Bump version
+      - name: Detect changes and bump version
         id: version
         run: |
-          # Get current version from backend package.json
-          CURRENT_VERSION=$(node -p "require('./backend/package.json').version")
-          echo "Current version: $CURRENT_VERSION"
+          set -e  # Exit on error
           
-          # Split version into parts
-          IFS='.' read -r -a version_parts <<< "$CURRENT_VERSION"
+          echo "=== Debug Info ==="
+          echo "GitHub event before: ${{ github.event.before }}"
+          echo "GitHub SHA: ${{ github.sha }}"
+          echo "Current directory: $(pwd)"
+          echo "Git log (last 5): $(git log --oneline -5)"
+          
+          # Get the commit range for changed files
+          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
+            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
+            echo "Using commit range: $COMMIT_RANGE"
+            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+          else
+            # First commit or no previous commit, check against HEAD~1 if it exists
+            if git rev-parse HEAD~1 >/dev/null 2>&1; then
+              COMMIT_RANGE="HEAD~1..HEAD"
+              echo "Using commit range: $COMMIT_RANGE"
+              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+            else
+              echo "First commit detected, checking all files"
+              CHANGED_FILES=$(git ls-files)
+            fi
+          fi
+          
+          echo "Changed files:"
+          echo "$CHANGED_FILES"
+          
+          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
+          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
+          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
+          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
+          
+          echo "Backend files changed: $BACKEND_CHANGED"
+          echo "Frontend files changed: $FRONTEND_CHANGED"
+          echo "Root files changed: $ROOT_CHANGED"
+          
+          # Get current versions
+          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.0.0")
+          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.0.0")
+          
+          echo "Current backend version: $BACKEND_VERSION"
+          echo "Current frontend version: $FRONTEND_VERSION"
+          
+          # Determine what to update based on changes
+          BACKEND_UPDATE=false
+          FRONTEND_UPDATE=false
+          COMPONENT_CHANGED="none"
+          
+          if [ "$ROOT_CHANGED" -gt 0 ]; then
+            # Root changes affect both components
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Root changes detected - updating both components"
+          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Both components changed
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            # Use the higher version as source
+            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
+              SOURCE_VERSION=$BACKEND_VERSION
+            else
+              SOURCE_VERSION=$FRONTEND_VERSION
+            fi
+            echo "Both backend and frontend changed - updating both"
+          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
+            # Only backend changed
+            BACKEND_UPDATE=true
+            COMPONENT_CHANGED="backend"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Only backend changed - updating backend"
+          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Only frontend changed
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="frontend"
+            SOURCE_VERSION=$FRONTEND_VERSION
+            echo "Only frontend changed - updating frontend"
+          else
+            echo "No relevant changes detected"
+            echo "version_changed=false" >> $GITHUB_OUTPUT
+            echo "component_changed=none" >> $GITHUB_OUTPUT
+            echo "new_version=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          echo "Component changed: $COMPONENT_CHANGED"
+          echo "Source version: $SOURCE_VERSION"
+          echo "Backend update: $BACKEND_UPDATE"
+          echo "Frontend update: $FRONTEND_UPDATE"
+          
+          # Calculate new version
+          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
           MAJOR="${version_parts[0]}"
           MINOR="${version_parts[1]}"
           PATCH="${version_parts[2]}"
@@ -49,14 +139,23 @@ jobs:
           
           echo "New version: $NEW_VERSION"
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
           
-          # Update version in package.json files
-          cd backend && npm version $NEW_VERSION --no-git-tag-version
-          cd ../frontend && npm version $NEW_VERSION --no-git-tag-version
-          cd ..
+          # Update versions in package.json files
+          if [ "$BACKEND_UPDATE" = true ]; then
+            echo "Updating backend version to $NEW_VERSION"
+            cd backend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
           
-          # Check if there are changes
-          if [[ -n $(git status -s) ]]; then
+          if [ "$FRONTEND_UPDATE" = true ]; then
+            echo "Updating frontend version to $NEW_VERSION"
+            cd frontend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
+          
+          # Check if there are changes to commit
+          if [[ -n $(git status --porcelain) ]]; then
             echo "version_changed=true" >> $GITHUB_OUTPUT
           else
             echo "version_changed=false" >> $GITHUB_OUTPUT
@@ -65,15 +164,94 @@ jobs:
       - name: Commit version bump
         if: steps.version.outputs.version_changed == 'true'
         run: |
-          git add backend/package.json backend/package-lock.json
-          git add frontend/package.json frontend/package-lock.json
-          git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }}"
-          git push
+          set -e  # Exit on any error
+          
+          # First, ensure we have the latest changes
+          echo "Fetching latest changes..."
+          git fetch origin main
+          
+          # Check if we're behind and need to update
+          LOCAL=$(git rev-parse HEAD)
+          REMOTE=$(git rev-parse origin/main)
+          
+          if [ "$LOCAL" != "$REMOTE" ]; then
+            echo "Local is behind remote, pulling changes..."
+            git pull origin main --no-rebase
+          fi
+          
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            git add backend/package.json backend/package-lock.json
+            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            git add frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
+          fi
+          
+          # Pull latest changes before pushing to avoid conflicts
+          echo "Pulling latest changes from origin/main..."
+          if ! git pull --rebase origin main; then
+            echo "Rebase failed, attempting to resolve..."
+            # If rebase fails, abort and try a regular merge
+            git rebase --abort || true
+            git pull origin main --no-rebase
+          fi
+          
+          # Push the changes with retry logic
+          echo "Pushing version bump..."
+          PUSH_SUCCESS=false
+          
+          for i in 1 2 3; do
+            echo "Push attempt $i of 3..."
+            
+            # Try to push
+            if git push origin main 2>&1; then
+              echo "Successfully pushed version bump on attempt $i"
+              PUSH_SUCCESS=true
+              break
+            else
+              echo "Push failed on attempt $i"
+              
+              if [ $i -lt 3 ]; then
+                echo "Waiting 5 seconds before retry..."
+                sleep 5
+                
+                echo "Pulling latest changes..."
+                git fetch origin main
+                
+                # Try rebase first, fall back to merge
+                if ! git rebase origin/main; then
+                  echo "Rebase failed, trying merge..."
+                  git rebase --abort 2>/dev/null || true
+                  git pull origin main --no-rebase
+                fi
+              fi
+            fi
+          done
+          
+          if [ "$PUSH_SUCCESS" = "false" ]; then
+            echo "ERROR: Failed to push after 3 attempts"
+            exit 1
+          fi
       
       - name: Create Git tag
         if: steps.version.outputs.version_changed == 'true'
         run: |
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "Release v${{ steps.version.outputs.new_version }}"
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
+          fi
+          
+          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
           git push origin "v${{ steps.version.outputs.new_version }}"
   
   trigger-drone:
@@ -84,5 +262,6 @@ jobs:
       - name: Trigger Drone Build
         run: |
           echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
+          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
           echo "Drone will automatically trigger on the new tag"
           # Drone CI will automatically trigger on the tag push event

.github-mirror-exclude

@@ -0,0 +1,24 @@
+# Exclude patterns for GitHub mirror
+.env
+.env.*
+.env*
+docker-compose.prod.yml
+docker-compose.traefik.yml
+.claudedocs/
+backend/data/
+backend/storage/
+backend/.env*
+frontend/.env*
+secrets/
+*.key
+*.pem
+.gitea/
+node_modules/
+dist/
+build/
+*.log
+.DS_Store
+deploy/
+certbot/
+nginx/
+photo-sharing-prd.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,47 @@
+---
+name: Bug report
+about: Create a report to help us improve PicPeak
+title: '[BUG] '
+labels: 'bug'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+ - OS: [e.g. Ubuntu 22.04]
+ - Browser: [e.g. Chrome 120, Safari 17]
+ - PicPeak Version: [e.g. 1.0.22]
+ - Deployment Method: [e.g. Docker Compose, Manual]
+ - Database: [e.g. PostgreSQL 15, SQLite]
+
+**Logs**
+Please include relevant logs:
+```
+# Backend logs
+docker-compose logs backend | tail -50
+
+# Frontend console errors
+[paste any browser console errors]
+```
+
+**Additional context**
+Add any other context about the problem here.
+
+**Possible Solution**
+If you have an idea how to fix the issue, please describe it here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md
+    about: Please read the documentation before opening an issue
+  - name: 💬 Discussions
+    url: https://github.com/the-luap/picpeak/discussions
+    about: Ask questions and discuss with the community
+  - name: 🔒 Security Issues
+    url: https://github.com/the-luap/picpeak/blob/main/SECURITY.md
+    about: Please review our security policy for reporting vulnerabilities

.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,33 @@
+---
+name: Documentation
+about: Report issues or improvements needed in documentation
+title: '[DOCS] '
+labels: 'documentation'
+assignees: ''
+
+---
+
+**What documentation needs improvement?**
+Please specify which document or section needs attention:
+- [ ] README.md
+- [ ] DEPLOYMENT.md
+- [ ] CONTRIBUTING.md
+- [ ] API Documentation
+- [ ] Code Comments
+- [ ] Other: ___________
+
+**Describe the issue**
+What's wrong or missing in the documentation?
+
+**Suggested improvement**
+How would you improve this documentation?
+
+**Target audience**
+Who is this documentation for?
+- [ ] New users setting up PicPeak
+- [ ] Developers contributing to the project
+- [ ] System administrators
+- [ ] End users (photographers/clients)
+
+**Additional context**
+Add any other context, examples, or references here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,38 @@
+---
+name: Feature request
+about: Suggest an idea for PicPeak
+title: '[FEATURE] '
+labels: 'enhancement'
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Use Case**
+Please describe how this feature would be used:
+- Who would use it? (photographers, clients, admins)
+- When would they use it?
+- Why is it important?
+
+**Similar Features**
+Are there similar features in:
+- PicDrop
+- Scrapbook.de
+- Other photo sharing platforms
+
+**Mockups or Examples**
+If applicable, add mockups, diagrams, or links to similar implementations.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
+
+**Implementation Ideas**
+If you have technical ideas about how this could be implemented, please share them.

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,26 @@
+---
+name: Question
+about: Ask a question about PicPeak
+title: '[QUESTION] '
+labels: 'question'
+assignees: ''
+
+---
+
+**Question**
+What would you like to know about PicPeak?
+
+**Context**
+Please provide context to help us answer your question better:
+- What are you trying to achieve?
+- What have you already tried?
+- Which documentation have you consulted?
+
+**Environment**
+If relevant to your question:
+- PicPeak Version:
+- Deployment Method:
+- Operating System:
+
+**Related Issues or Discussions**
+Link to any related issues, discussions, or documentation.

.github/ISSUE_TEMPLATE/security_vulnerability.md

@@ -0,0 +1,37 @@
+---
+name: Security Vulnerability
+about: Report security issues privately
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.**
+
+Instead, please email security@example.com with the details.
+
+For minor security improvements or questions, you can use this template:
+
+**Type of Security Issue**
+- [ ] Authentication/Authorization
+- [ ] Data Exposure
+- [ ] Input Validation
+- [ ] Configuration Issue
+- [ ] Dependency Vulnerability
+- [ ] Other: ___________
+
+**Description**
+Brief description of the security concern.
+
+**Impact**
+What could an attacker potentially do?
+
+**Steps to Reproduce**
+If applicable, how can this be reproduced?
+
+**Suggested Fix**
+If you have ideas on how to fix this issue.
+
+**References**
+Any relevant security advisories, CVEs, or documentation.

.github/pull_request_template.md

@@ -0,0 +1,49 @@
+## Description
+
+Please include a summary of the changes and which issue is fixed. Include relevant motivation and context.
+
+Fixes # (issue)
+
+## Type of change
+
+Please delete options that are not relevant.
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Performance improvement
+- [ ] Code refactoring
+
+## How Has This Been Tested?
+
+Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce.
+
+- [ ] Unit tests pass (`npm test`)
+- [ ] Manual testing completed
+- [ ] Tested on Docker deployment
+- [ ] Tested on production-like environment
+
+**Test Configuration**:
+* PicPeak Version:
+* Node.js Version:
+* Database: PostgreSQL / SQLite
+* Browser:
+
+## Checklist:
+
+- [ ] My code follows the style guidelines of this project
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+- [ ] I have updated the CHANGELOG.md file
+
+## Screenshots (if appropriate):
+
+## Additional Notes:
+
+Add any additional notes, concerns, or discussion points here.

.github/workflows/release.yml

@@ -1,108 +0,0 @@
-name: Create Release
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'frontend/package.json'
-      - 'backend/package.json'
-
-jobs:
-  check-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.check.outputs.changed }}
-      new_version: ${{ steps.check.outputs.version }}
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Check if version changed
-        id: check
-        run: |
-          # Get current versions
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version")
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version")
-          
-          # Get previous versions
-          git checkout HEAD~1
-          PREV_FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "0.0.0")
-          PREV_BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "0.0.0")
-          
-          # Check if versions changed
-          if [[ "$FRONTEND_VERSION" != "$PREV_FRONTEND_VERSION" ]] || [[ "$BACKEND_VERSION" != "$PREV_BACKEND_VERSION" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "version=$FRONTEND_VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-
-  create-release:
-    needs: check-version-change
-    if: needs.check-version-change.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Generate Changelog
-        id: changelog
-        run: |
-          # Get commits since last tag
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          if [[ -z "$LAST_TAG" ]]; then
-            COMMITS=$(git log --oneline)
-          else
-            COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
-          fi
-          
-          # Format changelog
-          echo "## What's Changed" > changelog.md
-          echo "" >> changelog.md
-          
-          # Group commits by type
-          echo "### Features" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ feat:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No new features*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Bug Fixes" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ fix:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No bug fixes*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Other Changes" >> changelog.md
-          echo "$COMMITS" | grep -vE "^[a-f0-9]+ (feat|fix):" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No other changes*" >> changelog.md
-          
-          # Save changelog
-          echo "changelog<<EOF" >> $GITHUB_OUTPUT
-          cat changelog.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: v${{ needs.check-version-change.outputs.new_version }}
-          name: Release v${{ needs.check-version-change.outputs.new_version }}
-          body: |
-            ## PicPeak v${{ needs.check-version-change.outputs.new_version }}
-            
-            ${{ steps.changelog.outputs.changelog }}
-            
-            ### Docker Images
-            
-            To use this release with Docker:
-            ```bash
-            docker pull ghcr.io/${{ github.repository }}/frontend:v${{ needs.check-version-change.outputs.new_version }}
-            docker pull ghcr.io/${{ github.repository }}/backend:v${{ needs.check-version-change.outputs.new_version }}
-            ```
-            
-            Or use the `latest` tag for the most recent version.
-          draft: false
-          prerelease: false
-          generate_release_notes: true

.github/workflows/version-bump.yml

@@ -1,107 +0,0 @@
-name: Automatic Version Bump
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: 'Version bump type'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          
-      - name: Configure Git
-        run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "actions@github.com"
-
-      - name: Determine version type
-        id: version_type
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "type=${{ github.event.inputs.version_type }}" >> $GITHUB_OUTPUT
-          else
-            # Auto-detect version type based on commit message
-            COMMIT_MSG="${{ github.event.head_commit.message }}"
-            if [[ "$COMMIT_MSG" == *"BREAKING CHANGE"* ]] || [[ "$COMMIT_MSG" == *"!"* ]]; then
-              echo "type=major" >> $GITHUB_OUTPUT
-            elif [[ "$COMMIT_MSG" == *"feat:"* ]] || [[ "$COMMIT_MSG" == *"feat("* ]]; then
-              echo "type=minor" >> $GITHUB_OUTPUT
-            else
-              echo "type=patch" >> $GITHUB_OUTPUT
-            fi
-          fi
-
-      - name: Bump Frontend Version
-        id: frontend_version
-        working-directory: ./frontend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          
-      - name: Bump Backend Version
-        id: backend_version
-        working-directory: ./backend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update Frontend VersionInfo component
-        run: |
-          VERSION=${{ steps.frontend_version.outputs.version }}
-          sed -i "s/const FRONTEND_VERSION = '[^']*'/const FRONTEND_VERSION = '$VERSION'/" frontend/src/components/admin/VersionInfo.tsx
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          title: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          body: |
-            ## Version Bump
-            
-            This PR automatically bumps the version numbers:
-            - Frontend: `${{ steps.frontend_version.outputs.version }}`
-            - Backend: `${{ steps.backend_version.outputs.version }}`
-            
-            ### Version Type: ${{ steps.version_type.outputs.type }}
-            
-            ### Files Changed:
-            - `frontend/package.json`
-            - `backend/package.json`
-            - `frontend/src/components/admin/VersionInfo.tsx`
-            
-            ---
-            *This PR was automatically created by the version bump workflow.*
-          branch: version-bump-${{ steps.frontend_version.outputs.version }}
-          delete-branch: true
-          labels: |
-            version-bump
-            automated

.gitignore

@@ -54,3 +54,5 @@ coverage/
 !storage/thumbnails/.gitkeep
 !data/.gitkeep
 !logs/.gitkeep
+
+PRODUCTION_DEPLOYMENT_GUIDE.md

CI_CD_STRATEGY.md

@@ -1,118 +0,0 @@
-# CI/CD Strategy for PicPeak
-
-## Overview
-
-This document outlines the CI/CD strategy using both Gitea Actions and Drone CI to avoid conflicts and ensure proper versioning.
-
-## Pipeline Flow
-
-### 1. Development & Testing (Gitea Actions)
-- **Trigger**: Every push to `main` or `develop` branches
-- **File**: `.gitea/workflows/test.yml`
-- **Purpose**: Run tests, linting, and basic validation
-- **Actions**:
-  - Backend linting and tests
-  - Frontend linting and build
-  - Does NOT build Docker images
-
-### 2. Version Management (Gitea Actions)
-- **Trigger**: Push to `main` branch (excluding markdown files)
-- **File**: `.gitea/workflows/version-and-release.yml`
-- **Purpose**: Automatic version incrementing
-- **Actions**:
-  1. Reads current version from `package.json`
-  2. Increments patch version (e.g., 1.0.0 → 1.0.1)
-  3. Updates both backend and frontend `package.json`
-  4. Commits the version change
-  5. Creates a git tag (e.g., `v1.0.1`)
-  6. Pushes changes and tag
-
-### 3. Docker Image Building (Drone CI)
-- **Trigger**: 
-  - Push to `main` or `develop` (builds with commit SHA)
-  - New git tags (builds release versions)
-- **File**: `.drone.yml`
-- **Purpose**: Build and push Docker images
-- **Tags Created**:
-  - `latest` - Always points to newest build
-  - `{commit-sha}` - Specific commit version
-  - `{branch}-latest` - Latest for specific branch
-  - `v1.0.1` - Specific version (on tag trigger)
-
-## Why This Strategy?
-
-1. **Separation of Concerns**:
-   - Gitea Actions handles code quality and versioning
-   - Drone CI handles Docker image building
-   - No overlap or race conditions
-
-2. **Sequential Execution**:
-   - Version bump happens first
-   - Tag creation triggers Drone
-   - Docker images are built with correct version
-
-3. **Version Consistency**:
-   - Version in `package.json` matches git tag
-   - Docker images are tagged with same version
-   - No manual version management needed
-
-## Setup Requirements
-
-1. **Gitea Actions Runner**: Must be configured and running
-2. **Drone CI**: Must be connected to your Gitea instance
-3. **Secrets**: 
-   - `GITEA_TOKEN` (optional, for pushing version commits)
-   - Docker registry credentials in Drone
-
-## Version Numbering
-
-- Format: `MAJOR.MINOR.PATCH` (e.g., 1.0.0)
-- Automatic increments: PATCH version only
-- Manual increments: Edit `package.json` for MAJOR/MINOR changes
-
-## Usage
-
-1. **Regular Development**:
-   ```bash
-   git add .
-   git commit -m "feat: add new feature"
-   git push origin main
-   ```
-   - Tests run automatically
-   - Version bumps to 1.0.1
-   - Docker images built with v1.0.1 tag
-
-2. **Major/Minor Version Change**:
-   ```bash
-   # Manually edit package.json files to 2.0.0
-   git add .
-   git commit -m "feat!: major release"
-   git push origin main
-   ```
-
-3. **Skip Version Bump**:
-   - Add `[skip ci]` to commit message
-   - Or only change markdown files
-
-## Monitoring
-
-- **Gitea Actions**: Check Actions tab in Gitea
-- **Drone CI**: Check Drone dashboard
-- **Docker Registry**: Verify images are pushed with correct tags
-
-## Troubleshooting
-
-1. **Version not incrementing**:
-   - Check Gitea Actions logs
-   - Ensure runner has push permissions
-   - Verify no `[skip ci]` in commit message
-
-2. **Docker images not building**:
-   - Check Drone CI webhook configuration
-   - Verify Drone can see the repository
-   - Check Docker registry credentials
-
-3. **Conflicts**:
-   - Never run both pipelines for same task
-   - Use branch protection to prevent direct pushes
-   - Always let automation handle versioning

CLAUDE.md

@@ -39,6 +39,12 @@ docker-compose -f docker-compose.prod.yml up -d  # Production deployment
 pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
 ```
 
+**⚠️ CRITICAL PRODUCTION NOTICE:**
+- Production runs on a SEPARATE SERVER - never assume local changes affect production
+- ALWAYS request production server details before any troubleshooting
+- NO trial-and-error approaches in production - data loss is unacceptable
+- Every change must be thoroughly analyzed and tested locally first
+
 ## Key Product Requirements (from PRD)
 
 ### Core Features
@@ -127,6 +133,41 @@ Background services run as separate processes:
 5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
 6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
 
+## Troubleshooting Guidelines
+
+### Before ANY Production Troubleshooting:
+1. **ALWAYS request specific details**:
+   - Production server URL/IP
+   - Current error messages/logs
+   - Recent changes or deployments
+   - Affected users/galleries
+   - Time of issue occurrence
+
+2. **Thorough Analysis Required**:
+   - Use detailed thinking/analysis for EVERY troubleshooting task
+   - Review all related code before suggesting changes
+   - Consider all potential side effects
+   - Never make assumptions about production environment
+
+3. **Safe Troubleshooting Steps**:
+   - First, reproduce issue in local/dev environment
+   - Analyze logs without modifying production
+   - Create detailed action plan before any changes
+   - Always have rollback strategy ready
+   - Document every step taken
+
+### Common Issues & Safe Approaches:
+- **Email not sending**: Check email_queue table, SMTP settings, service status
+- **Photos not loading**: Verify file permissions, storage paths, nginx config
+- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
+- **Performance problems**: Analyze with monitoring tools first, never experiment
+
+### Data Safety Rules:
+- NEVER delete or modify production data without explicit backup confirmation
+- ALWAYS verify backups exist before any data operations
+- NO direct database modifications without transaction safety
+- Log all actions for audit trail
+
 ## Environment Variables
 
 ### Backend (.env)
@@ -258,4 +299,30 @@ const { theme, setTheme, setThemeByName } = useTheme();
 - Guest satisfaction: >90%
 - System uptime: 99.9%
 - Email delivery rate: >98%
-- Successful archiving: 100%
+- Successful archiving: 100%
+
+## Documentation & Development Practices
+
+### Documentation Guidelines:
+- **NEVER create new documentation files for simple tasks**
+- **ALWAYS update existing documentation (like this CLAUDE.md)**
+- Only create new .md files when explicitly requested
+- Avoid creating temporary scripts for one-off tasks
+
+### Development Best Practices:
+- Test all changes thoroughly in local environment first
+- Use version control for all changes
+- Keep commits atomic and well-described
+- Review impact on all integrated services
+- Consider backward compatibility
+- Update tests when changing functionality
+
+### Production Deployment Checklist:
+- [ ] All tests passing locally
+- [ ] Linting and type checks pass
+- [ ] Database migrations tested with rollback plan
+- [ ] Environment variables documented
+- [ ] Backup strategy confirmed
+- [ ] Monitoring alerts configured
+- [ ] Rollback procedure documented
+- [ ] Stakeholders notified of maintenance window

CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# PicPeak Community Guidelines
+
+## Our Commitment
+
+We are committed to providing a welcoming and inspiring community for all photographers and developers.
+
+## Expected Behavior
+
+* Be respectful and considerate
+* Welcome newcomers and help them get started
+* Focus on what is best for the community
+* Show empathy towards other community members
+
+## Unacceptable Behavior
+
+* Trolling or insulting comments
+* Personal attacks
+* Public or private harassment
+* Publishing others' private information
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported to the project team at conduct@example.com. All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from contributor-covenant.org, version 2.0.

CONTRIBUTING.md

@@ -0,0 +1,160 @@
+# Contributing to PicPeak
+
+First off, thank you for considering contributing to PicPeak! It's people like you that make PicPeak such a great tool for photographers worldwide.
+
+## 🤝 Code of Conduct
+
+This project and everyone participating in it is governed by the [PicPeak Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.
+
+## 🎯 How Can I Contribute?
+
+### Reporting Bugs
+
+Before creating bug reports, please check the existing issues as you might find out that you don't need to create one. When you are creating a bug report, please include as many details as possible:
+
+* **Use a clear and descriptive title**
+* **Describe the exact steps to reproduce the problem**
+* **Provide specific examples to demonstrate the steps**
+* **Describe the behavior you observed and what you expected**
+* **Include screenshots if possible**
+* **Include your environment details** (OS, browser, Docker version, etc.)
+
+### Suggesting Enhancements
+
+Enhancement suggestions are tracked as GitHub issues. When creating an enhancement suggestion, please include:
+
+* **Use a clear and descriptive title**
+* **Provide a detailed description of the suggested enhancement**
+* **Provide specific examples to demonstrate the enhancement**
+* **Describe the current behavior and expected behavior**
+* **Explain why this enhancement would be useful**
+
+### Your First Code Contribution
+
+Unsure where to begin? You can start by looking through these issues:
+
+* [Good first issues](https://github.com/the-luap/picpeak/labels/good%20first%20issue) - issues which should only require a few lines of code
+* [Help wanted issues](https://github.com/the-luap/picpeak/labels/help%20wanted) - issues which need extra attention
+
+### Pull Requests
+
+1. **Fork the repo** and create your branch from `main`
+2. **Install dependencies**:
+   ```bash
+   cd backend && npm install
+   cd ../frontend && npm install
+   ```
+3. **Make your changes** and ensure:
+   - Code follows the existing style
+   - Tests pass: `npm test`
+   - Linting passes: `npm run lint`
+4. **Write tests** if you've added code
+5. **Update documentation** if needed
+6. **Create a Pull Request**
+
+## 💻 Development Setup
+
+### Prerequisites
+
+- Node.js 18+
+- Docker & Docker Compose
+- Git
+
+### Local Development
+
+```bash
+# Clone your fork
+git clone https://github.com/your-username/picpeak.git
+cd picpeak
+
+# Install dependencies
+cd backend && npm install
+cd ../frontend && npm install
+
+# Set up environment
+cp .env.example .env
+# Edit .env with your settings
+
+# Start development servers
+docker-compose -f docker-compose.dev.yml up
+```
+
+### Running Tests
+
+```bash
+# Backend tests
+cd backend && npm test
+
+# Frontend tests
+cd frontend && npm test
+
+# E2E tests
+npm run test:e2e
+```
+
+## 📝 Styleguides
+
+### Git Commit Messages
+
+* Use the present tense ("Add feature" not "Added feature")
+* Use the imperative mood ("Move cursor to..." not "Moves cursor to...")
+* Limit the first line to 72 characters or less
+* Reference issues and pull requests liberally after the first line
+* Consider starting the commit message with an applicable emoji:
+  * 🎨 `:art:` when improving the format/structure of the code
+  * 🐛 `:bug:` when fixing a bug
+  * 🔥 `:fire:` when removing code or files
+  * 📝 `:memo:` when writing docs
+  * 🚀 `:rocket:` when improving performance
+  * ✨ `:sparkles:` when adding a new feature
+
+### JavaScript/TypeScript Styleguide
+
+* Use ES6+ features
+* Prefer async/await over promises
+* Use meaningful variable names
+* Add JSDoc comments for functions
+* Follow ESLint rules
+
+### React Styleguide
+
+* Use functional components with hooks
+* Keep components small and focused
+* Use TypeScript for type safety
+* Follow the existing folder structure
+* Write tests for new components
+
+## 📦 Project Structure
+
+```
+picpeak/
+├── backend/
+│   ├── src/
+│   │   ├── routes/      # API endpoints
+│   │   ├── services/    # Business logic
+│   │   ├── middleware/  # Express middleware
+│   │   └── utils/       # Utilities
+│   └── migrations/      # Database migrations
+├── frontend/
+│   ├── src/
+│   │   ├── components/  # Reusable components
+│   │   ├── pages/       # Page components
+│   │   ├── services/    # API services
+│   │   └── hooks/       # Custom hooks
+│   └── public/          # Static assets
+```
+
+## 🔄 Release Process
+
+1. Update version numbers in package.json files
+2. Update CHANGELOG.md
+3. Create a new release on GitHub
+4. Docker images are automatically built and published
+
+## 📮 Contact
+
+- Create an issue for bugs or features
+- Join discussions for questions
+- Email: picpeak@example.com for security issues
+
+Thank you for contributing! 🎉

DEPLOYMENT.md

@@ -1,483 +1,220 @@
-# Photo Sharing Platform - Production Deployment Guide
+# 🚀 PicPeak Deployment Guide
 
-This guide covers deploying the photo sharing platform using Docker Swarm, Traefik, and Drone CI/CD.
+This guide will help you deploy PicPeak in production. The entire process takes about 10-15 minutes.
 
-## Table of Contents
-- [Prerequisites](#prerequisites)
-- [Infrastructure Setup](#infrastructure-setup)
-- [Docker Swarm Setup](#docker-swarm-setup)
-- [Traefik Setup](#traefik-setup)
-- [Application Deployment](#application-deployment)
-- [CI/CD with Drone](#cicd-with-drone)
-- [Monitoring](#monitoring)
-- [Backup and Recovery](#backup-and-recovery)
-- [Troubleshooting](#troubleshooting)
+## 📋 Prerequisites
 
-## Prerequisites
+- A server with Docker and Docker Compose installed
+- A domain name (for SSL certificates)
+- SMTP credentials for sending emails
+- Basic command line knowledge
 
-### Hardware Requirements
-- **Manager Node**: 2 CPU cores, 4GB RAM, 50GB storage
-- **Worker Nodes**: 2 CPU cores, 2GB RAM, 20GB storage
-- **Storage**: SSD recommended for database and photo storage
+## 🏃 Quick Deploy (Recommended)
 
-### Software Requirements
-- Ubuntu 20.04+ or similar Linux distribution
-- Docker Engine 20.10+
-- Docker Compose 2.0+
-- Git
-- SSL certificates (automated with Let's Encrypt)
-
-### Network Requirements
-- Ports 80, 443 open for web traffic
-- Port 2377 for Swarm management
-- Ports 7946, 4789 for Swarm networking
-- Static IP or reliable dynamic DNS
-
-## Infrastructure Setup
-
-### 1. Install Docker
+### 1. Clone and Configure
 
 ```bash
-# Install Docker
-curl -fsSL https://get.docker.com | sh
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
 
-# Add user to docker group
-sudo usermod -aG docker $USER
-
-# Enable Docker service
-sudo systemctl enable docker
-sudo systemctl start docker
-```
-
-### 2. Configure Firewall
-
-```bash
-# Allow Docker Swarm ports
-sudo ufw allow 2377/tcp
-sudo ufw allow 7946/tcp
-sudo ufw allow 7946/udp
-sudo ufw allow 4789/udp
-
-# Allow web traffic
-sudo ufw allow 80/tcp
-sudo ufw allow 443/tcp
-```
-
-## Docker Swarm Setup
-
-### 1. Initialize Swarm
-
-On the manager node:
-
-```bash
-cd deploy/scripts
-sudo ./init-swarm.sh
-```
-
-This script will:
-- Initialize Docker Swarm
-- Create overlay networks
-- Label nodes for service placement
-- Create required directories
-
-### 2. Join Worker Nodes
-
-On each worker node, run the join command displayed by the init script:
-
-```bash
-docker swarm join --token SWMTKN-1-xxx... manager-ip:2377
-```
-
-### 3. Verify Swarm
-
-```bash
-docker node ls
-```
-
-## Application Configuration
-
-### 1. Environment Setup
-
-```bash
 # Copy environment template
-cp .env.production.example .env.production
+cp .env.production.example .env
 
-# Edit with your values
-nano .env.production
+# Generate a secure JWT secret
+echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
+
+# Edit configuration
+nano .env
 ```
 
-Required configurations:
-- Domain names for frontend, backend, and services
-- SMTP credentials for email
-- Database passwords
-- JWT secrets
+### 2. Required Environment Variables
 
-### 2. Create Docker Secrets
+Edit your `.env` file with these essential settings:
+
+```env
+# Application URLs
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+
+# Email Configuration (Required for notifications)
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+SMTP_FROM=your-email@gmail.com
+
+# Admin Configuration
+ADMIN_EMAIL=admin@your-domain.com
+ADMIN_PASSWORD=your-secure-password
+
+# Database (PostgreSQL for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=secure-db-password
+```
+
+### 3. Deploy with Docker Compose
 
 ```bash
-cd deploy/scripts
-./create-secrets.sh
+# Start all services
+docker-compose -f docker-compose.prod.yml up -d
+
+# Check logs
+docker-compose logs -f
+
+# Access your site at https://your-domain.com
 ```
 
-This will create all required secrets in Docker Swarm. Save the generated passwords!
+## 🔧 Configuration Options
 
-## Traefik Setup
+### Storage Settings
 
-### 1. Deploy Traefik
+```env
+# Storage paths (default: ./storage)
+STORAGE_PATH=./storage
+ARCHIVE_PATH=./storage/archives
+
+# Gallery expiration (days)
+DEFAULT_EXPIRATION_DAYS=30
+WARNING_DAYS_BEFORE_EXPIRY=7
+```
+
+### Security Settings
+
+```env
+# Session timeout (minutes)
+SESSION_TIMEOUT=60
+
+# Rate limiting
+RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100
+```
+
+### Analytics (Optional)
+
+```env
+# Umami Analytics
+VITE_UMAMI_URL=https://analytics.your-domain.com
+VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+## 🔒 SSL/TLS Setup
+
+The production Docker Compose includes automatic SSL via Let's Encrypt:
+
+1. **Ensure your domain points to your server**
+2. **Update nginx configuration**:
+   ```bash
+   nano nginx/nginx.conf
+   # Replace your-domain.com with your actual domain
+   ```
+3. **Start services** - Certbot will automatically obtain certificates
+
+## 📁 Directory Structure
+
+After deployment, your directory structure will be:
+
+```
+picpeak/
+├── backend/          # API server
+├── frontend/         # React app
+├── storage/          # Photo storage
+│   ├── events/       # Active galleries
+│   │   ├── active/   # Current photos
+│   │   └── archived/ # Expired galleries
+│   ├── thumbnails/   # Generated thumbnails
+│   └── uploads/      # User uploads
+├── data/            # Database files
+└── logs/            # Application logs
+```
+
+## 🔄 Maintenance
+
+### Backup
 
 ```bash
-cd deploy/traefik
+# Backup database and photos
+./scripts/backup.sh
 
-# Create traefik network
-docker network create --driver overlay traefik-public
-
-# Deploy Traefik stack
-docker stack deploy -c docker-compose.traefik.yml traefik
+# Backups are stored in ./backups/
 ```
 
-### 2. Verify Traefik
+### Update
 
 ```bash
-# Check service status
-docker service ls | grep traefik
+# Pull latest changes
+git pull
 
-# View logs
-docker service logs traefik_traefik
+# Rebuild and restart
+docker-compose -f docker-compose.prod.yml up -d --build
 ```
 
-Access Traefik dashboard at: `https://traefik.yourdomain.com/dashboard/`
-
-## Application Deployment
-
-### 1. Build Images (if using local registry)
+### Logs
 
 ```bash
-# Build frontend
-cd frontend
-docker build -t photo-sharing-frontend:latest .
+# View all logs
+docker-compose logs
 
-# Build backend
-cd ../backend
-docker build -t photo-sharing-backend:latest .
+# View specific service
+docker-compose logs backend
+docker-compose logs frontend
 ```
 
-### 2. Deploy Application Stack
-
-```bash
-cd deploy/scripts
-./deploy.sh
-```
-
-Options:
-- `--env FILE`: Specify environment file
-- `--registry URL`: Docker registry URL
-- `--version VERSION`: Image version to deploy
-
-### 3. Verify Deployment
-
-```bash
-# Check all services
-docker service ls
-
-# Check specific service
-docker service ps photo-sharing_backend
-
-# View logs
-docker service logs photo-sharing_backend -f
-```
-
-### 4. Run Database Migrations
-
-The deploy script automatically runs migrations, but you can run manually:
-
-```bash
-docker exec $(docker ps -q -f name=photo-sharing_backend) npm run migrate
-```
-
-## CI/CD with Drone
-
-### 1. Drone Server Setup
-
-Deploy Drone server on your CI infrastructure:
-
-```bash
-docker run \
-  --volume=/var/lib/drone:/data \
-  --env=DRONE_GITHUB_CLIENT_ID=your-id \
-  --env=DRONE_GITHUB_CLIENT_SECRET=your-secret \
-  --env=DRONE_RPC_SECRET=your-rpc-secret \
-  --env=DRONE_SERVER_HOST=drone.yourdomain.com \
-  --env=DRONE_SERVER_PROTO=https \
-  --publish=80:80 \
-  --publish=443:443 \
-  --restart=always \
-  --detach=true \
-  --name=drone \
-  drone/drone:2
-```
-
-### 2. Drone Runner Setup
-
-On build servers:
-
-```bash
-docker run -d \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -e DRONE_RPC_PROTO=https \
-  -e DRONE_RPC_HOST=drone.yourdomain.com \
-  -e DRONE_RPC_SECRET=your-rpc-secret \
-  -e DRONE_RUNNER_CAPACITY=2 \
-  -e DRONE_RUNNER_NAME=runner-1 \
-  -p 3000:3000 \
-  --restart always \
-  --name runner \
-  drone/drone-runner-docker:1
-```
-
-### 3. Repository Setup
-
-1. Enable repository in Drone UI
-2. Add secrets in Drone:
-   - `docker_username`
-   - `docker_password`
-   - `docker_registry`
-   - `staging_swarm_host`
-   - `staging_swarm_user`
-   - `staging_swarm_key`
-   - `prod_swarm_host`
-   - `prod_swarm_user`
-   - `prod_swarm_key`
-   - `slack_webhook`
-
-### 4. Deployment Workflow
-
-- Push to `develop` → Deploy to staging
-- Create tag → Deploy to production
-- Automatic rollback on failure
-
-## Monitoring
-
-### 1. Deploy Monitoring Stack
-
-```bash
-cd deploy/monitoring
-
-# Deploy monitoring services
-docker stack deploy -c docker-compose.monitoring.yml monitoring
-```
-
-### 2. Access Services
-
-- Grafana: `https://grafana.yourdomain.com`
-- Prometheus: `https://prometheus.yourdomain.com`
-- Alertmanager: `https://alerts.yourdomain.com`
-
-### 3. Configure Alerts
-
-Create alert rules in `deploy/monitoring/alerts/`:
-
-```yaml
-groups:
-  - name: photo-sharing
-    rules:
-      - alert: ServiceDown
-        expr: up{job="photo-sharing-backend"} == 0
-        for: 5m
-        annotations:
-          summary: "Photo sharing backend is down"
-```
-
-## Backup and Recovery
-
-### 1. Automated Backups
-
-Set up cron job for automated backups:
-
-```bash
-# Edit crontab
-crontab -e
-
-# Add daily backup at 2 AM
-0 2 * * * /opt/photo-sharing/deploy/scripts/backup.sh
-```
-
-### 2. Manual Backup
-
-```bash
-cd deploy/scripts
-./backup.sh
-```
-
-### 3. Restore from Backup
-
-```bash
-# Extract backup
-tar -xzf backup-20240615-020000.tar.gz
-
-# Restore database
-docker exec -i $(docker ps -q -f name=photo-sharing_db) \
-  psql -U postgres photo_sharing < backup-20240615-020000/database.sql
-
-# Restore photos
-tar -xzf backup-20240615-020000/photos.tar.gz -C /opt/photo-sharing/
-
-# Restore volumes
-docker run --rm \
-  -v photo-sharing_app-data:/data \
-  -v $(pwd)/backup-20240615-020000:/backup \
-  alpine tar -xzf /backup/volume-photo-sharing_app-data.tar.gz -C /data
-```
-
-## Maintenance
-
-### 1. Scaling Services
-
-```bash
-# Scale backend to 5 replicas
-docker service scale photo-sharing_backend=5
-
-# Scale frontend to 3 replicas
-docker service scale photo-sharing_frontend=3
-```
-
-### 2. Rolling Updates
-
-```bash
-# Update backend image
-docker service update \
-  --image registry.yourdomain.com/photo-sharing-backend:v2.0 \
-  photo-sharing_backend
-```
-
-### 3. Drain Node for Maintenance
-
-```bash
-# Drain node
-docker node update --availability drain worker-1
-
-# Perform maintenance...
-
-# Activate node
-docker node update --availability active worker-1
-```
-
-## Troubleshooting
+## 🚨 Troubleshooting
 
 ### Common Issues
 
-#### 1. Service Won't Start
+**Photos not appearing:**
+- Check storage permissions: `chmod -R 755 storage/`
+- Verify file watcher is running: `docker-compose logs backend | grep watcher`
+
+**Email not sending:**
+- Test SMTP settings: Admin Panel → Settings → Email → Send Test
+- Check email queue: Admin Panel → System → Email Queue
+
+**Can't access admin panel:**
+- Default login: Use email/password from `.env`
+- Reset password: `docker exec picpeak-backend npm run reset-admin`
+
+### Health Check
+
 ```bash
 # Check service status
-docker service ps photo-sharing_backend --no-trunc
+docker-compose ps
 
-# View detailed logs
-docker service logs photo-sharing_backend --details
+# Test backend API
+curl https://your-domain.com/api/health
+
+# Check disk space
+df -h storage/
 ```
 
-#### 2. Database Connection Issues
-```bash
-# Check database logs
-docker service logs photo-sharing_db
+## 🐳 Alternative Deployment Methods
 
-# Test connection
-docker exec $(docker ps -q -f name=photo-sharing_db) \
-  pg_isready -U postgres
-```
+### Using Docker Swarm
 
-#### 3. Traefik Certificate Issues
-```bash
-# Check Traefik logs
-docker service logs traefik_traefik | grep acme
+For high availability deployments, see [Docker Swarm Setup](deploy/README.md).
 
-# Remove and regenerate certificates
-rm -rf /opt/traefik/letsencrypt/acme.json
-docker service update --force traefik_traefik
-```
+### Manual Installation
 
-#### 4. Storage Issues
-```bash
-# Check disk usage
-df -h
+If you prefer not to use Docker:
 
-# Clean up Docker
-docker system prune -a
-```
+1. Install Node.js 18+
+2. Install PostgreSQL
+3. Clone repository
+4. Install dependencies: `npm install` in both `/backend` and `/frontend`
+5. Build frontend: `cd frontend && npm run build`
+6. Start services with PM2
 
-### Debug Mode
+## 📞 Support
 
-Enable debug logging:
+- 📘 [Documentation](https://github.com/the-luap/picpeak)
+- 🐛 [Report Issues](https://github.com/the-luap/picpeak/issues)
+- 💬 [Discussions](https://github.com/the-luap/picpeak/discussions)
 
-```bash
-# Update service with debug logging
-docker service update \
-  --env-add LOG_LEVEL=debug \
-  photo-sharing_backend
-```
+---
 
-### Health Checks
-
-```bash
-# Check all endpoints
-curl -f https://photos.yourdomain.com/health
-curl -f https://api.photos.yourdomain.com/api/health
-curl -f https://traefik.yourdomain.com/ping
-```
-
-## Security Best Practices
-
-1. **Regular Updates**
-   - Keep Docker and system packages updated
-   - Update application dependencies regularly
-   - Monitor security advisories
-
-2. **Access Control**
-   - Use strong passwords for all services
-   - Enable 2FA where possible
-   - Restrict SSH access to specific IPs
-   - Use Docker secrets for sensitive data
-
-3. **Network Security**
-   - Use internal networks for service communication
-   - Enable firewall rules
-   - Use TLS for all external communication
-   - Regular security scans with Trivy
-
-4. **Backup Security**
-   - Encrypt backups at rest
-   - Test restore procedures regularly
-   - Store backups in multiple locations
-   - Rotate old backups
-
-## Performance Tuning
-
-1. **Database Optimization**
-   ```sql
-   -- Add indexes for common queries
-   CREATE INDEX idx_photos_event_id ON photos(event_id);
-   CREATE INDEX idx_access_logs_event_id ON access_logs(event_id);
-   ```
-
-2. **Image Optimization**
-   - Use CDN for static assets
-   - Enable aggressive caching
-   - Optimize image sizes before upload
-
-3. **Service Limits**
-   ```yaml
-   deploy:
-     resources:
-       limits:
-         cpus: '2'
-         memory: 1G
-       reservations:
-         cpus: '0.5'
-         memory: 256M
-   ```
-
-## Support
-
-For issues and questions:
-- Check logs: `docker service logs <service_name>`
-- Review documentation: [README.md](README.md)
-- Check monitoring dashboards
-- Contact: admin@yourdomain.com
+**Need help?** Open an issue on GitHub and we'll assist you!

PRODUCTION_DEPLOYMENT.md

@@ -0,0 +1,98 @@
+# Production Deployment Guide
+
+This guide explains how to deploy PicPeak in production behind a reverse proxy like Traefik.
+
+## Environment Configuration
+
+### Frontend Configuration
+
+For production deployment behind a reverse proxy (Traefik, Nginx, etc.), the frontend should use relative URLs to automatically inherit the protocol (HTTPS) and domain.
+
+1. Copy the production environment template:
+   ```bash
+   cp frontend/.env.production.example frontend/.env.production
+   ```
+
+2. Set the API URL to use relative path:
+   ```env
+   # frontend/.env.production
+   VITE_API_URL=/api
+   ```
+
+   This ensures all API calls will use the same domain and protocol as the frontend.
+
+### Backend Configuration
+
+Ensure your backend `.env` file has the correct URLs:
+```env
+# backend/.env
+FRONTEND_URL=https://yourdomain.com
+ADMIN_URL=https://yourdomain.com
+```
+
+## Docker Compose Production
+
+When using Docker Compose in production:
+
+1. Build with production environment:
+   ```bash
+   docker-compose -f docker-compose.prod.yml build --build-arg NODE_ENV=production
+   ```
+
+2. The frontend nginx configuration already includes proper proxy settings for:
+   - `/api` → Backend API
+   - `/photos` → Protected photo access
+   - `/thumbnails` → Thumbnail images
+   - `/uploads` → Public uploads (logos, favicons)
+
+## Traefik Configuration
+
+Example Traefik labels for docker-compose:
+
+```yaml
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
+      - "traefik.http.routers.picpeak.entrypoints=websecure"
+      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
+```
+
+## Important Notes
+
+1. **No Hardcoded URLs**: The application uses environment variables with relative URL fallbacks, making it production-ready.
+
+2. **HTTPS Only**: When `VITE_API_URL=/api`, all requests will use the same protocol as the page (HTTPS in production).
+
+3. **CORS Configuration**: The backend CORS is configured to accept requests from the URLs specified in `FRONTEND_URL` and `ADMIN_URL`.
+
+4. **Static Assets**: All static assets (photos, thumbnails, uploads) are served through the nginx proxy, inheriting authentication headers.
+
+## Verification
+
+After deployment, verify:
+
+1. Check browser console for any localhost URLs (there should be none)
+2. Verify all API calls use HTTPS
+3. Check that images load correctly with authentication
+4. Test favicon and logo display
+
+## Troubleshooting
+
+If you see console errors about localhost:
+
+1. Ensure `VITE_API_URL=/api` in frontend environment
+2. Clear browser cache
+3. Rebuild frontend with production environment:
+   ```bash
+   cd frontend
+   npm run build
+   ```
+
+If images don't load:
+
+1. Check that nginx proxy locations are configured
+2. Verify authentication tokens are being sent
+3. Check backend logs for authentication errors

PRODUCTION_DEPLOYMENT_GUIDE.md

@@ -0,0 +1,312 @@
+# Production Deployment Guide
+
+This guide addresses all known production deployment issues and provides solutions.
+
+## Pre-Deployment Checklist
+
+### 1. Environment Variables
+Create a `.env` file with ALL required variables:
+
+```bash
+# Required
+JWT_SECRET=<generate-with-openssl-rand-base64-32>
+DB_PASSWORD=<strong-password>
+ADMIN_URL=https://yourdomain.com
+FRONTEND_URL=https://yourdomain.com
+
+# Database
+DB_USER=picpeak
+DB_NAME=picpeak
+
+# Email (Optional but recommended)
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+EMAIL_FROM=noreply@yourdomain.com
+
+# Umami Analytics (Optional)
+UMAMI_URL=https://analytics.yourdomain.com
+UMAMI_WEBSITE_ID=your-website-id
+UMAMI_HASH_SALT=<generate-random-string>
+```
+
+### 2. Generate Secrets
+
+```bash
+# Generate JWT Secret
+openssl rand -base64 32
+
+# Generate Database Password
+openssl rand -base64 24
+
+# Generate Umami Hash Salt
+openssl rand -hex 32
+```
+
+## Deployment Steps
+
+### 1. Initial Setup
+
+```bash
+# Clone repository
+git clone https://github.com/the-luap/wedding-photo-sharing.git
+cd wedding-photo-sharing
+
+# Create required directories
+mkdir -p storage/events/active storage/events/archived storage/thumbnails storage/uploads
+mkdir -p data logs
+mkdir -p certbot/conf certbot/www
+
+# Set permissions (important!)
+chmod -R 755 storage data logs
+```
+
+### 2. Fix Docker Volume Permissions
+
+Create `docker-compose.override.yml` for local volume configuration:
+
+```yaml
+version: '3.8'
+
+services:
+  backend:
+    volumes:
+      - ./storage:/app/storage:delegated
+      - ./data:/app/data:delegated
+      - ./logs:/app/logs:delegated
+    user: "1001:1001"  # nodejs user
+
+  db:
+    volumes:
+      - ./postgres-data:/var/lib/postgresql/data
+```
+
+### 3. Build and Deploy
+
+```bash
+# Build images
+docker-compose -f docker-compose.prod.yml build
+
+# Start services
+docker-compose -f docker-compose.prod.yml up -d
+
+# Check logs
+docker-compose -f docker-compose.prod.yml logs -f backend
+```
+
+### 4. Create Admin User
+
+After deployment, create the first admin user:
+
+```bash
+# Enter backend container
+docker-compose -f docker-compose.prod.yml exec backend sh
+
+# Create admin
+node scripts/create-admin.js \
+  --username admin \
+  --email admin@yourdomain.com \
+  --password <your-secure-password>
+
+# Exit container
+exit
+```
+
+### 5. Configure Email (if using database config)
+
+1. Login to admin panel: https://yourdomain.com/admin
+2. Go to Settings > Email Configuration
+3. Enter SMTP details
+4. Test email sending
+
+## Common Issues and Solutions
+
+### Issue 1: Migration Failures
+
+**Error**: "relation already exists"
+
+**Solution**: The safe migration runner handles this automatically. If issues persist:
+
+```bash
+# Reset migrations tracking
+docker-compose -f docker-compose.prod.yml exec db psql -U picpeak -d picpeak
+
+# In PostgreSQL:
+DROP TABLE IF EXISTS migrations;
+\q
+
+# Re-run migrations
+docker-compose -f docker-compose.prod.yml exec backend npm run migrate:safe
+```
+
+### Issue 2: Permission Denied Errors
+
+**Error**: "EACCES: permission denied"
+
+**Solution**: Fix container permissions:
+
+```bash
+# Stop containers
+docker-compose -f docker-compose.prod.yml down
+
+# Fix permissions on host
+sudo chown -R 1001:1001 storage data logs
+
+# Restart
+docker-compose -f docker-compose.prod.yml up -d
+```
+
+### Issue 3: Database Connection Failed
+
+**Error**: "no pg_hba.conf entry"
+
+**Solution**: Already fixed in docker-compose.prod.yml with:
+- SSL disabled for internal Docker network
+- Proper authentication method (scram-sha-256)
+
+### Issue 4: Frontend Can't Connect to Backend
+
+**Error**: CORS errors or connection refused
+
+**Solution**: Ensure environment variables match:
+- Backend: `FRONTEND_URL` must match your frontend URL
+- Frontend: `VITE_API_URL` must be set during build
+
+### Issue 5: Email Not Sending
+
+**Solution**: Check email configuration:
+
+```bash
+# Check backend logs
+docker-compose -f docker-compose.prod.yml logs backend | grep email
+
+# Verify SMTP settings
+# Gmail users: Use app password, not regular password
+# Enable "Less secure app access" or use OAuth2
+```
+
+## SSL/HTTPS Setup
+
+1. Update `nginx/sites-enabled/default` with your domain
+2. Run certbot:
+
+```bash
+# Initial certificate
+docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
+  --webroot --webroot-path=/var/www/certbot \
+  -d yourdomain.com -d www.yourdomain.com
+
+# Auto-renewal is handled by the certbot container
+```
+
+## Monitoring
+
+### Health Checks
+
+```bash
+# Backend health
+curl http://localhost/api/health
+
+# Database connection
+docker-compose -f docker-compose.prod.yml exec backend \
+  psql -U picpeak -d picpeak -c "SELECT 1"
+```
+
+### Logs
+
+```bash
+# All services
+docker-compose -f docker-compose.prod.yml logs -f
+
+# Specific service
+docker-compose -f docker-compose.prod.yml logs -f backend
+```
+
+## Backup and Restore
+
+### Backup
+
+```bash
+#!/bin/bash
+# backup.sh
+DATE=$(date +%Y%m%d_%H%M%S)
+BACKUP_DIR="./backups/$DATE"
+
+mkdir -p $BACKUP_DIR
+
+# Database
+docker-compose -f docker-compose.prod.yml exec -T db \
+  pg_dump -U picpeak picpeak > $BACKUP_DIR/database.sql
+
+# Files
+tar -czf $BACKUP_DIR/storage.tar.gz storage/
+
+echo "Backup completed: $BACKUP_DIR"
+```
+
+### Restore
+
+```bash
+# Database
+docker-compose -f docker-compose.prod.yml exec -T db \
+  psql -U picpeak picpeak < ./backups/20240713_120000/database.sql
+
+# Files
+tar -xzf ./backups/20240713_120000/storage.tar.gz
+```
+
+## Production Best Practices
+
+1. **Always use named volumes** in production for better data persistence
+2. **Set up monitoring** with Prometheus/Grafana
+3. **Enable backups** with automated scripts
+4. **Use a reverse proxy** (Nginx) for SSL termination
+5. **Implement rate limiting** at the Nginx level
+6. **Regular updates** - Keep Docker images updated
+7. **Log rotation** - Configure log rotation for application logs
+
+## Troubleshooting Commands
+
+```bash
+# Check running containers
+docker-compose -f docker-compose.prod.yml ps
+
+# Restart a service
+docker-compose -f docker-compose.prod.yml restart backend
+
+# View real-time logs
+docker-compose -f docker-compose.prod.yml logs -f --tail=100
+
+# Execute commands in container
+docker-compose -f docker-compose.prod.yml exec backend sh
+
+# Database shell
+docker-compose -f docker-compose.prod.yml exec db psql -U picpeak
+
+# Clean restart
+docker-compose -f docker-compose.prod.yml down
+docker-compose -f docker-compose.prod.yml up -d
+```
+
+## Security Checklist
+
+- [ ] Strong JWT_SECRET (min 32 chars)
+- [ ] Strong database password
+- [ ] SSL/HTTPS enabled
+- [ ] Firewall configured (only 80/443 open)
+- [ ] Regular security updates
+- [ ] Backup encryption
+- [ ] Access logs monitored
+- [ ] Rate limiting enabled
+- [ ] File upload restrictions configured
+
+## Support
+
+For issues not covered here:
+1. Check application logs
+2. Review error messages carefully
+3. Ensure all environment variables are set
+4. Verify file permissions
+5. Check Docker daemon logs

PRODUCTION_TODO_LIST.md

@@ -0,0 +1,714 @@
+# 🚀 Production Todo List - PicPeak Enhancements
+
+**Priority:** HIGH - These are production fixes and enhancements
+**Estimated Time:** 2-3 days
+**Status:** Ready for Implementation
+
+---
+
+## 📋 Action Items Overview
+
+1. [Password Complexity Settings](#1-password-complexity-settings)
+2. [Gallery Login Page - Remove Event Date](#2-gallery-login-page---remove-event-date)
+3. [Analytics Umami Configuration Check](#3-analytics-umami-configuration-check)
+4. [Analytics Numbers Accuracy Fix](#4-analytics-numbers-accuracy-fix)
+5. [Missing Translation Key Fix](#5-missing-translation-key-fix)
+6. [Complete Translation Audit](#6-complete-translation-audit)
+7. [CMS Page Long German Text Formatting](#7-cms-page-long-german-text-formatting)
+8. [Event Creation Date Format Fix](#8-event-creation-date-format-fix)
+9. [Language Selector Country Flags Chrome Fix](#9-language-selector-country-flags-chrome-fix)
+
+---
+
+## 1. Password Complexity Settings
+
+**Problem:** Admin security tab only has password minimum length setting, no complexity requirements.
+
+**Current State:** 
+- File: `frontend/src/pages/admin/SettingsPage.tsx` (lines 635-669)
+- Backend: `backend/src/utils/passwordValidation.js` has complexity logic but not exposed in settings
+
+**Implementation:**
+
+### Frontend Changes:
+```typescript
+// File: frontend/src/pages/admin/SettingsPage.tsx
+// Add to securitySettings state (around line 61):
+const [securitySettings, setSecuritySettings] = useState({
+  require_password: true,
+  password_min_length: 8,
+  password_complexity_level: 'medium', // ADD THIS
+  enable_2fa: false,
+  session_timeout_minutes: 60,
+  max_login_attempts: 5,
+  enable_recaptcha: false,
+  recaptcha_site_key: '',
+  recaptcha_secret_key: ''
+});
+
+// Add complexity setting UI after password_min_length (around line 660):
+<div>
+  <label className="block text-sm font-medium text-neutral-700 mb-1">
+    {t('settings.security.passwordComplexity')}
+  </label>
+  <select
+    value={securitySettings.password_complexity_level}
+    onChange={(e) => setSecuritySettings(prev => ({ ...prev, password_complexity_level: e.target.value }))}
+    className="w-full px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500"
+  >
+    <option value="low">{t('settings.security.complexityLow')}</option>
+    <option value="medium">{t('settings.security.complexityMedium')}</option>
+    <option value="high">{t('settings.security.complexityHigh')}</option>
+  </select>
+  <p className="text-xs text-neutral-500 mt-1">
+    {t('settings.security.complexityHelp')}
+  </p>
+</div>
+```
+
+### Translation Updates:
+```json
+// File: frontend/src/i18n/locales/en.json (add to settings.security):
+"passwordComplexity": "Password Complexity Level",
+"complexityLow": "Low - Length only",
+"complexityMedium": "Medium - Letters and numbers",
+"complexityHigh": "High - Letters, numbers, and symbols",
+"complexityHelp": "Controls password requirements for new gallery passwords"
+
+// File: frontend/src/i18n/locales/de.json (add to settings.security):
+"passwordComplexity": "Passwort-Komplexitätsstufe",
+"complexityLow": "Niedrig - Nur Länge",
+"complexityMedium": "Mittel - Buchstaben und Zahlen",
+"complexityHigh": "Hoch - Buchstaben, Zahlen und Symbole",
+"complexityHelp": "Steuert Passwort-Anforderungen für neue Galerie-Passwörter"
+```
+
+### Backend Changes:
+```javascript
+// File: backend/src/utils/passwordValidation.js
+// Update PASSWORD_CONFIG based on settings (around line 8):
+const getPasswordConfigFromSettings = async () => {
+  const { db } = require('../database/db');
+  const settings = await db('admin_settings').select('key', 'value');
+  const settingsMap = settings.reduce((acc, setting) => {
+    acc[setting.key] = setting.value;
+    return acc;
+  }, {});
+  
+  const complexityLevel = settingsMap.security_password_complexity_level || 'medium';
+  
+  return {
+    ...PASSWORD_CONFIG,
+    minLength: parseInt(settingsMap.security_password_min_length) || 8,
+    requireUppercase: complexityLevel !== 'low',
+    requireLowercase: complexityLevel !== 'low', 
+    requireNumbers: complexityLevel === 'high' || complexityLevel === 'medium',
+    requireSpecialChars: complexityLevel === 'high',
+    minStrengthScore: complexityLevel === 'high' ? 3 : (complexityLevel === 'medium' ? 2 : 1)
+  };
+};
+```
+
+---
+
+## 2. Gallery Login Page - Remove Event Date
+
+**Problem:** Gallery login shows event date which is often used as password, creating security risk.
+
+**Current State:**
+- File: `frontend/src/pages/GalleryPage.tsx` (lines 275-285)
+- Shows both event name and date with calendar icon
+
+**Implementation:**
+
+### Frontend Changes:
+```typescript
+// File: frontend/src/pages/GalleryPage.tsx
+// Replace the date display section (around lines 280-285):
+
+// REMOVE THIS:
+/*
+<div className="flex items-center justify-center text-xs sm:text-sm" style={{ color: 'var(--color-text, #171717)', opacity: 0.7 }}>
+  <Calendar className="w-3 h-3 sm:w-4 sm:h-4 mr-1" />
+  <span className="truncate">{format(parseISO(galleryInfo!.event_date), 'PP')}</span>
+</div>
+*/
+
+// REPLACE WITH:
+<div className="text-center text-xs sm:text-sm" style={{ color: 'var(--color-text, #171717)', opacity: 0.7 }}>
+  <span className="truncate">{galleryInfo?.event_type ? t(`events.types.${galleryInfo.event_type}`) : ''}</span>
+</div>
+```
+
+### Additional Layout Improvements:
+```typescript
+// File: frontend/src/pages/GalleryPage.tsx
+// Update the header section for better visual balance (around line 275):
+<div className="text-center mb-4 sm:mb-6">
+  <img 
+    src={settingsData?.branding_logo_url ? 
+      buildResourceUrl(settingsData.branding_logo_url) : 
+      '/picpeak-logo-transparent.png'
+    } 
+    alt={settingsData?.branding_company_name || 'PicPeak'}
+    className="h-12 sm:h-16 lg:h-20 w-auto object-contain mx-auto mb-3 sm:mb-4"
+  />
+  <h1 className="text-xl sm:text-2xl lg:text-3xl font-bold mb-2 px-2" style={{ color: 'var(--color-text, #171717)' }}>
+    {galleryInfo?.event_name}
+  </h1>
+  {/* Event type instead of date */}
+  {galleryInfo?.event_type && (
+    <div className="text-center text-sm" style={{ color: 'var(--color-text, #171717)', opacity: 0.7 }}>
+      <span className="px-3 py-1 bg-white/20 rounded-full backdrop-blur-sm">
+        {t(`events.types.${galleryInfo.event_type}`)}
+      </span>
+    </div>
+  )}
+</div>
+```
+
+---
+
+## 3. Analytics Umami Configuration Check
+
+**Problem:** Analytics page shows "Umami Analytics Not Configured" even when configured in settings.
+
+**Current State:**
+- File: `frontend/src/pages/admin/AnalyticsPage.tsx` (lines 67-87)
+- Check logic may not be working correctly
+
+**Implementation:**
+
+### Frontend Fix:
+```typescript
+// File: frontend/src/pages/admin/AnalyticsPage.tsx
+// Fix the Umami configuration check (around lines 67-87):
+
+// REPLACE the useEffect:
+useEffect(() => {
+  const fetchUmamiConfig = async () => {
+    try {
+      const response = await fetch(`${import.meta.env.VITE_API_URL}/api/public/settings`);
+      const settings = await response.json();
+      
+      // Check if Umami is properly configured
+      const isConfigured = settings.analytics_umami_enabled && 
+                          settings.analytics_umami_url && 
+                          settings.analytics_umami_website_id;
+      
+      if (isConfigured) {
+        setUmamiConfig({
+          url: settings.analytics_umami_url,
+          shareUrl: settings.analytics_umami_share_url,
+          websiteId: settings.analytics_umami_website_id,
+          enabled: true
+        });
+      } else {
+        // Fall back to environment variables
+        const envConfigured = import.meta.env.VITE_UMAMI_URL && 
+                             import.meta.env.VITE_UMAMI_WEBSITE_ID;
+        
+        setUmamiConfig({
+          url: import.meta.env.VITE_UMAMI_URL,
+          shareUrl: import.meta.env.VITE_UMAMI_SHARE_URL,
+          websiteId: import.meta.env.VITE_UMAMI_WEBSITE_ID,
+          enabled: envConfigured
+        });
+      }
+    } catch (error) {
+      console.error('Failed to fetch Umami config:', error);
+      setUmamiConfig({ enabled: false });
+    }
+  };
+
+  fetchUmamiConfig();
+}, []);
+
+// Update the configuration notice condition (around line 441):
+{!umamiConfig.enabled && (
+  <Card padding="md" className="mt-6 bg-amber-50 border-amber-200">
+    <div className="flex items-start gap-3">
+      <Activity className="w-5 h-5 text-amber-600 flex-shrink-0" />
+      <div>
+        <p className="text-sm font-medium text-amber-900">{t('analytics.notConfigured')}</p>
+        <p className="text-sm text-amber-700 mt-1">
+          {t('analytics.configureInstructions')}
+        </p>
+      </div>
+    </div>
+  </Card>
+)}
+```
+
+---
+
+## 4. Analytics Numbers Accuracy Fix
+
+**Problem:** Dashboard shows correct numbers but analytics page shows different numbers.
+
+**Current State:**
+- Dashboard: `frontend/src/services/admin.service.ts` `getDashboardStats()`
+- Analytics: `frontend/src/services/admin.service.ts` `getAnalytics()`
+- Backend: Different endpoints with potentially different calculation logic
+
+**Implementation:**
+
+### Backend Investigation and Fix:
+```javascript
+// File: backend/src/routes/adminDashboard.js
+// Ensure consistent calculation logic in both /stats and /analytics endpoints
+
+// Update the analytics endpoint (around line 216) to use the same calculation as stats:
+router.get('/analytics', adminAuth, async (req, res) => {
+  try {
+    const days = sanitizeDays(req.query.days || 7);
+    
+    // Use same calculation logic as /stats endpoint
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - days);
+    
+    // Get total downloads - SAME logic as /stats
+    const totalDownloads = await db('access_logs')
+      .whereIn('action', ['download', 'download_all'])
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // Get total views - SAME logic as /stats  
+    const totalViews = await db('access_logs')
+      .where('action', 'view')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
+      .count('id as count')
+      .first();
+
+    // ... rest of the analytics logic
+
+    // Add totals to response for verification
+    res.json({
+      chartData: dates,
+      topGalleries,
+      devices,
+      totals: {
+        totalViews: totalViews.count,
+        totalDownloads: totalDownloads.count,
+        period: `${days} days`
+      }
+    });
+  } catch (error) {
+    console.error('Analytics error:', error);
+    res.status(500).json({ error: 'Failed to fetch analytics data' });
+  }
+});
+```
+
+### Frontend Verification:
+```typescript
+// File: frontend/src/pages/admin/AnalyticsPage.tsx
+// Add debug information in development (around line 107):
+
+const analytics: ComponentAnalyticsData | undefined = React.useMemo(() => {
+  if (!apiData) return undefined;
+
+  // Calculate totals from chart data
+  const totalViews = apiData.chartData.reduce((sum, day) => sum + day.views, 0);
+  const totalDownloads = apiData.chartData.reduce((sum, day) => sum + day.downloads, 0);
+
+  // Debug: Compare with API totals in development
+  if (process.env.NODE_ENV === 'development' && apiData.totals) {
+    console.log('Analytics Debug:', {
+      calculatedViews: totalViews,
+      apiTotalViews: apiData.totals.totalViews,
+      calculatedDownloads: totalDownloads,
+      apiTotalDownloads: apiData.totals.totalDownloads,
+      period: apiData.totals.period
+    });
+  }
+
+  // ... rest of the calculation
+}, [apiData]);
+```
+
+---
+
+## 5. Missing Translation Key Fix
+
+**Problem:** Missing translation key `admin.activities.analytics_settings_updated` in recent activities.
+
+**Current State:**
+- Key not found in `frontend/src/i18n/locales/en.json` or `de.json`
+
+**Implementation:**
+
+### Translation Updates:
+```json
+// File: frontend/src/i18n/locales/en.json
+// Add to admin.activities section (around line 785):
+"analytics_settings_updated": "Analytics settings updated"
+
+// File: frontend/src/i18n/locales/de.json  
+// Add to admin.activities section (around line 710):
+"analytics_settings_updated": "Analytik-Einstellungen aktualisiert"
+```
+
+### Backend Activity Logging:
+```javascript
+// File: backend/src/routes/adminSettings.js (or wherever analytics settings are updated)
+// Ensure activity is logged with correct key:
+
+await logActivity(req.admin.id, 'analytics_settings_updated', {
+  settingsUpdated: Object.keys(updateData).filter(key => key.startsWith('analytics_')),
+  timestamp: new Date()
+});
+```
+
+---
+
+## 6. Complete Translation Audit
+
+**Problem:** Need to check all recent activity types for missing translations.
+
+**Current State:**
+- Activity types defined in backend, translations in frontend
+
+**Implementation:**
+
+### Audit Script:
+```bash
+# Create a script to find missing translation keys
+# File: scripts/audit-translations.js
+
+const fs = require('fs');
+const path = require('path');
+
+// Read translation files
+const enTranslations = JSON.parse(fs.readFileSync('frontend/src/i18n/locales/en.json', 'utf8'));
+const deTranslations = JSON.parse(fs.readFileSync('frontend/src/i18n/locales/de.json', 'utf8'));
+
+// Common activity types that should exist
+const requiredActivityKeys = [
+  'event_created', 'event_updated', 'event_deleted', 'event_archived',
+  'photos_uploaded', 'photo_deleted', 'photos_bulk_deleted',
+  'archive_downloaded', 'archive_deleted', 'archive_restored',
+  'email_config_updated', 'email_template_updated',
+  'branding_updated', 'theme_updated', 'analytics_settings_updated',
+  'general_settings_updated', 'security_settings_updated',
+  'category_created', 'category_updated', 'category_deleted',
+  'cms_page_updated', 'favicon_uploaded',
+  'bulk_download', 'gallery_password_entry', 'expiration_warning_viewed'
+];
+
+console.log('Missing English translations:');
+requiredActivityKeys.forEach(key => {
+  if (!enTranslations.admin?.activities?.[key]) {
+    console.log(`- admin.activities.${key}`);
+  }
+});
+
+console.log('\nMissing German translations:');
+requiredActivityKeys.forEach(key => {
+  if (!deTranslations.admin?.activities?.[key]) {
+    console.log(`- admin.activities.${key}`);
+  }
+});
+```
+
+### Missing Translations to Add:
+```json
+// File: frontend/src/i18n/locales/en.json
+// Add any missing keys to admin.activities:
+"analytics_settings_updated": "Analytics settings updated",
+"cms_page_updated": "CMS page updated: {{page}}",
+"security_settings_updated": "Security settings updated", 
+"password_reset": "Password reset for: {{eventName}}",
+"admin_logout": "Admin {{actorName}} logged out",
+"system_activity": "System activity: {{type}}"
+
+// File: frontend/src/i18n/locales/de.json
+// German equivalents:
+"analytics_settings_updated": "Analytik-Einstellungen aktualisiert",
+"cms_page_updated": "CMS-Seite aktualisiert: {{page}}",
+"security_settings_updated": "Sicherheitseinstellungen aktualisiert",
+"password_reset": "Passwort zurückgesetzt für: {{eventName}}",
+"admin_logout": "Admin {{actorName}} abgemeldet",
+"system_activity": "Systemaktivität: {{type}}"
+```
+
+---
+
+## 7. CMS Page Long German Text Formatting
+
+**Problem:** Long German text like "Datenschutzerklärung" pushes image to left and looks ugly.
+
+**Current State:**
+- File: `frontend/src/pages/admin/CMSPageEnhanced.tsx` (lines 130-170)
+- File: `frontend/src/pages/admin/CMSPage.tsx` (lines 90-110)
+
+**Implementation:**
+
+### CSS Fix:
+```typescript
+// File: frontend/src/pages/admin/CMSPageEnhanced.tsx
+// Update the page selection buttons (around line 130):
+
+<button
+  key={page.slug}
+  onClick={() => {
+    if (hasUnsavedChanges) {
+      if (confirm('You have unsaved changes. Do you want to save them?')) {
+        handleSave();
+      }
+    }
+    setSelectedPage(page.slug);
+  }}
+  className={`w-full text-left px-4 py-3 rounded-lg transition-colors flex items-center gap-3 ${
+    selectedPage === page.slug
+      ? 'bg-primary-100 text-primary-700 border border-primary-300'
+      : 'bg-white border border-neutral-200 hover:bg-neutral-50'
+  }`}
+>
+  <FileText className="w-5 h-5 flex-shrink-0" />
+  <div className="flex-1 min-w-0"> {/* Add min-w-0 for text overflow */}
+    <p className="font-medium text-sm truncate" title={t(`legal.${page.slug}`)}>
+      {t(`legal.${page.slug}`)}
+    </p>
+    <p className="text-xs text-neutral-500 truncate">/{page.slug}</p>
+  </div>
+  {selectedPage === page.slug && hasUnsavedChanges && (
+    <div className="w-2 h-2 bg-yellow-500 rounded-full flex-shrink-0" />
+  )}
+</button>
+```
+
+### Alternative - Responsive Layout:
+```typescript
+// File: frontend/src/pages/admin/CMSPageEnhanced.tsx
+// Alternative: Use responsive text sizing
+
+<p className="font-medium text-sm sm:text-base truncate" title={t(`legal.${page.slug}`)}>
+  {/* For very long German words, show abbreviated version */}
+  {t(`legal.${page.slug}`).length > 15 
+    ? `${t(`legal.${page.slug}`).substring(0, 12)}...`
+    : t(`legal.${page.slug}`)
+  }
+</p>
+```
+
+---
+
+## 8. Event Creation Date Format Fix
+
+**Problem:** Event creation page uses browser English format instead of saved admin settings date format.
+
+**Current State:**
+- Files: `frontend/src/pages/admin/CreateEventPageEnhanced.tsx`, `CreateEventPage.tsx`
+- Uses browser locale instead of admin date format settings
+
+**Implementation:**
+
+### Hook Enhancement:
+```typescript
+// File: frontend/src/hooks/useLocalizedDate.ts
+// Add admin settings integration:
+
+import { useTranslation } from 'react-i18next';
+import { format as dateFnsFormat, formatDistanceToNow as dateFnsFormatDistanceToNow } from 'date-fns';
+import { de, enUS, enGB } from 'date-fns/locale';
+import { useQuery } from '@tanstack/react-query';
+import { settingsService } from '../services/settings.service';
+
+export const useLocalizedDate = () => {
+  const { i18n } = useTranslation();
+  
+  // Fetch admin date format settings
+  const { data: settings } = useQuery({
+    queryKey: ['admin-date-settings'],
+    queryFn: () => settingsService.getAllSettings(),
+    staleTime: 10 * 60 * 1000, // Cache for 10 minutes
+  });
+  
+  const getLocale = () => {
+    // Use admin settings if available, otherwise fall back to i18n language
+    const savedFormat = settings?.general_date_format;
+    if (savedFormat?.locale) {
+      switch (savedFormat.locale) {
+        case 'en-US': return enUS;
+        case 'en-GB': return enGB;
+        case 'de': return de;
+        default: return i18n.language === 'de' ? de : enUS;
+      }
+    }
+    return i18n.language === 'de' ? de : enUS;
+  };
+  
+  const getDateFormat = () => {
+    const savedFormat = settings?.general_date_format?.format;
+    if (savedFormat) {
+      // Convert admin format to date-fns format
+      switch (savedFormat) {
+        case 'DD/MM/YYYY': return 'dd/MM/yyyy';
+        case 'MM/DD/YYYY': return 'MM/dd/yyyy';
+        case 'YYYY-MM-DD': return 'yyyy-MM-dd';
+        case 'DD.MM.YYYY': return 'dd.MM.yyyy';
+        default: return 'dd/MM/yyyy';
+      }
+    }
+    return i18n.language === 'de' ? 'dd.MM.yyyy' : 'MM/dd/yyyy';
+  };
+  
+  const format = (date: Date | string, formatStr?: string) => {
+    const dateObj = typeof date === 'string' ? new Date(date) : date;
+    const finalFormat = formatStr || getDateFormat();
+    return dateFnsFormat(dateObj, finalFormat, { locale: getLocale() });
+  };
+  
+  // ... rest of the hook
+};
+```
+
+### Event Creation Page Fix:
+```typescript
+// File: frontend/src/pages/admin/CreateEventPageEnhanced.tsx
+// Update the expiration date display (around line 495):
+
+{formData.event_date && (
+  <p className="mt-2 text-sm text-neutral-500">
+    {t('events.expiresOn')}: {format(addDays(new Date(formData.event_date), formData.expires_in_days), 'PPP')}
+  </p>
+)}
+```
+
+---
+
+## 9. Language Selector Country Flags Chrome Fix
+
+**Problem:** Country flags not showing in Chrome browser on Windows in admin language selector.
+
+**Current State:**
+- File: `frontend/src/components/common/LanguageSelector.tsx` (lines 5-8)
+- Uses emoji flags: `🇬🇧`, `🇩🇪`
+
+**Implementation:**
+
+### SVG Icon Replacement:
+```typescript
+// File: frontend/src/components/common/LanguageSelector.tsx
+// Replace emoji flags with SVG icons or image flags:
+
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+import { Globe } from 'lucide-react';
+
+// SVG flag components for better browser compatibility
+const FlagGB: React.FC<{ className?: string }> = ({ className = "w-4 h-4" }) => (
+  <svg className={className} viewBox="0 0 640 480" fill="none">
+    <path fill="#012169" d="M0 0h640v480H0z"/>
+    <path fill="#FFF" d="m75 0 244 181L562 0h78v62L400 241l240 178v61h-80L320 301 81 480H0v-60l239-178L0 64V0h75z"/>
+    <path fill="#C8102E" d="m424 281 216 159v40L369 281h55zm-184 20 6 35L54 480H0l246-179zM640 0v3L391 191l2-44L590 0h50zM0 0l239 176h-60L0 42V0z"/>
+    <path fill="#FFF" d="M241 0v480h160V0H241zM0 160v160h640V160H0z"/>
+    <path fill="#C8102E" d="M0 193v96h640v-96H0zM273 0v480h96V0h-96z"/>
+  </svg>
+);
+
+const FlagDE: React.FC<{ className?: string }> = ({ className = "w-4 h-4" }) => (
+  <svg className={className} viewBox="0 0 640 480" fill="none">
+    <path fill="#ffce00" d="M0 320h640v160H0z"/>
+    <path d="M0 0h640v160H0z"/>
+    <path fill="#d00" d="M0 160h640v160H0z"/>
+  </svg>
+);
+
+const languages = [
+  { code: 'en', name: 'English', flag: FlagGB },
+  { code: 'de', name: 'Deutsch', flag: FlagDE },
+];
+
+export const LanguageSelector: React.FC = () => {
+  const { i18n } = useTranslation();
+  const [isOpen, setIsOpen] = React.useState(false);
+
+  const currentLanguage = languages.find(lang => lang.code === i18n.language) || languages[0];
+
+  const handleLanguageChange = (languageCode: string) => {
+    i18n.changeLanguage(languageCode);
+    setIsOpen(false);
+  };
+
+  return (
+    <div className="relative">
+      <button
+        onClick={() => setIsOpen(!isOpen)}
+        className="flex items-center gap-2 px-3 py-2 text-sm font-medium text-neutral-700 bg-white border border-neutral-300 rounded-lg hover:bg-neutral-50 focus:outline-none focus:ring-2 focus:ring-primary-500"
+      >
+        <Globe className="w-4 h-4" />
+        <currentLanguage.flag className="w-4 h-4" />
+        <span>{currentLanguage.name}</span>
+      </button>
+
+      {isOpen && (
+        <div className="absolute right-0 mt-2 w-48 bg-white rounded-lg shadow-lg border border-neutral-200 py-1 z-50">
+          {languages.map((language) => (
+            <button
+              key={language.code}
+              onClick={() => handleLanguageChange(language.code)}
+              className={`w-full text-left px-4 py-2 text-sm hover:bg-neutral-50 flex items-center gap-3 ${
+                language.code === i18n.language
+                  ? 'text-primary-600 bg-primary-50'
+                  : 'text-neutral-700'
+              }`}
+            >
+              <language.flag className="w-4 h-4" />
+              <span>{language.name}</span>
+            </button>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+};
+```
+
+### Alternative - Image Flags:
+```typescript
+// Alternative solution using flag images:
+const languages = [
+  { code: 'en', name: 'English', flag: '/flags/gb.svg' },
+  { code: 'de', name: 'Deutsch', flag: '/flags/de.svg' },
+];
+
+// Add images to public/flags/ directory
+// Use: <img src={language.flag} alt={language.name} className="w-4 h-4" />
+```
+
+---
+
+## 🔍 Testing Instructions
+
+### After implementing each fix:
+
+1. **Password Complexity**: Test different complexity levels in admin settings
+2. **Gallery Login**: Verify event date is hidden on gallery login pages  
+3. **Analytics Check**: Verify "Not Configured" message appears/disappears correctly
+4. **Analytics Numbers**: Compare dashboard vs analytics page numbers
+5. **Translations**: Check recent activities display correct translations
+6. **CMS Formatting**: Test with long German page names
+7. **Date Format**: Test event creation with different admin date settings
+8. **Language Flags**: Test language selector in Chrome on Windows
+
+### Regression Testing:
+- [ ] Gallery login still works correctly
+- [ ] Analytics page displays correctly when Umami is configured
+- [ ] Admin settings save and load correctly
+- [ ] Event creation works with all date formats
+- [ ] Language switching works in all browsers
+
+---
+
+## 📝 Notes
+
+- All changes maintain backward compatibility
+- No database schema changes required
+- Frontend changes are non-breaking
+- Can be deployed incrementally
+- All text is properly internationalized
+
+**⚠️ Important**: Test each fix in isolation before combining, especially the analytics changes as they affect production data display. 

README-LOCAL.md

@@ -1,130 +0,0 @@
-# 🚀 Quick Local Development Setup
-
-Get the photo sharing platform running locally in under 2 minutes!
-
-## Prerequisites
-- Docker Desktop installed and running
-- Git
-- 4GB RAM available
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone <your-repo-url>
-cd picpeak
-
-# 2. Start everything
-./start-local.sh
-```
-
-That's it! 🎉
-
-## What You Get
-
-| Service | URL | Description |
-|---------|-----|-------------|
-| Frontend (Dev) | http://localhost:3002 | React app with hot reload |
-| Frontend (Prod) | http://localhost:3000 | Production build |
-| Backend API | http://localhost:3001 | Express API |
-| Mailhog | http://localhost:8025 | Email testing UI |
-
-## Default Credentials
-
-- **Admin Login**: Check `ADMIN_CREDENTIALS.txt` after first setup
-- **Test Gallery**: 
-  - Create via Admin Panel
-  - Set your own secure password
-
-## Common Tasks
-
-### View Logs
-```bash
-docker-compose -f docker-compose.local.yml logs -f
-```
-
-### Stop Everything
-```bash
-./stop-local.sh
-```
-
-### Reset Database
-```bash
-docker-compose -f docker-compose.local.yml exec backend npm run migrate
-```
-
-### Add Test Photos
-1. Create a gallery in the admin panel
-2. Get the gallery slug (e.g., `wedding-smith-2024`)
-3. Add photos to: `./storage/events/active/wedding-smith-2024/`
-4. Photos appear automatically!
-
-### Access Backend Shell
-```bash
-docker-compose -f docker-compose.local.yml exec backend sh
-```
-
-## Development Workflow
-
-1. **Frontend Development** (Port 3002)
-   - Hot reload enabled
-   - Edit files in `./frontend/src`
-   - Changes appear instantly
-
-2. **Backend Development** (Port 3001)
-   - Nodemon watches for changes
-   - Edit files in `./backend/src`
-   - Server restarts automatically
-
-3. **Email Testing**
-   - All emails go to Mailhog
-   - View at http://localhost:8025
-   - No real emails sent!
-
-## Troubleshooting
-
-### Backend won't start
-```bash
-# Check logs
-docker-compose -f docker-compose.local.yml logs backend
-
-# Rebuild
-docker-compose -f docker-compose.local.yml build backend
-```
-
-### Frontend build issues
-```bash
-# Clear cache and rebuild
-docker-compose -f docker-compose.local.yml exec frontend-dev npm run build
-```
-
-### Port conflicts
-Edit `docker-compose.local.yml` and change the port mappings:
-- Backend: Change `3001:3000` to `XXXX:3000`
-- Frontend: Change `3002:5173` to `YYYY:5173`
-
-### Reset everything
-```bash
-# Stop and remove all data
-docker-compose -f docker-compose.local.yml down -v
-rm -rf data storage logs
-./start-local.sh
-```
-
-## Tips
-
-- 📧 Check Mailhog for all emails
-- 🔄 Frontend auto-refreshes on save
-- 📁 SQLite DB at `./data/photo_sharing.db`
-- 🖼️ Photos in `./storage/events/active/`
-- 📝 Logs in `./logs/`
-
-## Next Steps
-
-1. Create your first gallery via Admin Panel
-2. Upload some test photos
-3. Test the gallery with password
-4. Check expiration warnings
-5. View emails in Mailhog
-
-Happy coding! 🎨

README.md

@@ -1,32 +1,185 @@
-# Photo Sharing Platform
+# 📸 PicPeak - Open Source Photo Sharing for Events
 
-A secure, self-hosted photo sharing platform designed for weddings and events. Features automatic expiration, email notifications, and simple file-based management.
+<div align="center">
+  <img src="docs/picpeak-logo.png" alt="PicPeak Logo" width="300" />
+  
+  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+  [![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=flat&logo=docker&logoColor=white)](https://www.docker.com/)
+  [![Node.js](https://img.shields.io/badge/node.js-6DA55F?style=flat&logo=node.js&logoColor=white)](https://nodejs.org/)
+  [![React](https://img.shields.io/badge/react-%2320232a.svg?style=flat&logo=react&logoColor=%2361DAFB)](https://reactjs.org/)
+</div>
 
-## Features
+**PicPeak** is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding.
 
-- 🔒 Password Protected Galleries
-- ⏰ Automatic Expiration
-- 📧 Email Notifications
-- 📁 Simple File Management
-- 📊 Analytics Integration
-- 🎨 Customizable Themes
-- 📱 Mobile Responsive
-- ⚡ Docker Ready
+![PicPeak Gallery Preview](docs/screenshot-gallery.png)
 
-## Quick Start
+## 🌟 Why Choose PicPeak?
 
-1. Clone the repository
-2. Run `./scripts/install.sh`
-3. Configure `.env` file
-4. Setup SSL: `./scripts/setup-ssl.sh`
-5. Start: `docker-compose -f docker-compose.prod.yml up -d`
+Unlike expensive SaaS solutions, PicPeak gives you:
 
-Default credentials: Check ADMIN_CREDENTIALS.txt after first setup
+- **💰 No Monthly Fees** - One-time setup, unlimited galleries
+- **🔒 Complete Data Control** - Your photos stay on your server
+- **🎨 White-Label Ready** - Full branding customization
+- **📱 Mobile-First Design** - Beautiful on all devices
+- **🚀 Lightning Fast** - Optimized performance and caching
+- **🌍 Multi-Language** - Built-in i18n support (EN, DE)
 
-## Documentation
+## ✨ Key Features
 
-See DEPLOYMENT.md for detailed deployment instructions.
+### For Photographers
+- 📁 **Drag & Drop Upload** - Simply drop photos into folders
+- ⏰ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days)
+- 🔐 **Password Protection** - Secure client galleries
+- 📧 **Automated Emails** - Creation confirmations and expiration warnings
+- 📊 **Analytics Dashboard** - Track views, downloads, and engagement
+- 🎨 **Custom Themes** - Match your brand perfectly
 
-## License
+### For Clients
+- 🖼️ **Beautiful Galleries** - Clean, modern interface
+- 📱 **Mobile Optimized** - Swipe through photos on any device
+- ⬇️ **Bulk Downloads** - Download all photos with one click
+- 🔍 **Smart Search** - Find photos quickly
+- 📤 **Guest Uploads** - Optional client photo uploads
 
-MIT License
+### Technical Excellence
+- 🐳 **Docker Ready** - Deploy in minutes
+- 🔄 **Auto-Processing** - Automatic thumbnail generation
+- 💾 **Smart Storage** - Automatic archiving of expired galleries
+- 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
+- 📈 **Scalable** - From small studios to large agencies
+
+## 🚀 Quick Start
+
+Get PicPeak running in under 5 minutes:
+
+```bash
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy environment template
+cp .env.example .env
+
+# Edit configuration (required: JWT_SECRET)
+nano .env
+
+# Start with Docker Compose
+docker-compose up -d
+
+# Access at http://localhost:3005
+```
+
+## 📖 Documentation
+
+- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
+- 📜 [**License**](LICENSE) - MIT License
+- 🔒 [**Security**](SECURITY.md) - Security policies
+- 📋 [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines
+
+## 🎯 Use Cases
+
+Perfect for:
+- 💒 **Wedding Photographers** - Share ceremony photos securely
+- 🎂 **Event Photography** - Birthday parties, corporate events
+- 📸 **Portrait Studios** - Client galleries with download limits
+- 🏢 **Corporate Events** - Internal photo sharing with branding
+- 🎓 **School Photography** - Secure parent access with expiration
+
+## 🏗️ Tech Stack
+
+- **Backend**: Node.js, Express, SQLite/PostgreSQL
+- **Frontend**: React, Tailwind CSS, Framer Motion
+- **Storage**: File-based with automatic archiving
+- **Email**: SMTP with customizable templates
+- **Analytics**: Privacy-focused with Umami integration
+
+## 🤝 Contributing
+
+We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
+
+See our [Contributing Guide](CONTRIBUTING.md) for details.
+
+## 📊 Comparison with Alternatives
+
+| Feature | PicPeak | PicDrop | Scrapbook.de |
+|---------|---------|---------|--------------|
+| Self-Hosted | ✅ | ❌ | ❌ |
+| Custom Branding | ✅ Full | Limited | Limited |
+| Monthly Cost | $0 | $29-199 | €19-99 |
+| Storage Limit | Unlimited* | 50-500GB | 100-1000GB |
+| Client Uploads | ✅ | ✅ | ✅ |
+| API Access | ✅ | Paid | ❌ |
+| Open Source | ✅ | ❌ | ❌ |
+
+*Limited only by your server storage
+
+## 🛡️ Security
+
+PicPeak takes security seriously:
+- 🔐 Password hashing with bcrypt
+- 🎫 JWT-based authentication
+- 🚦 Rate limiting on all endpoints
+- 🛡️ CORS protection
+- 📝 Activity logging
+- 🔒 Secure file access
+
+Found a security issue? Please email security@example.com
+
+## 📸 Screenshots
+
+### 🎛️ **Admin Dashboard**
+Get a complete overview of your photo galleries, analytics, and system status.
+
+<img src="docs/screenshot-dashboard.png" alt="PicPeak Admin Dashboard" width="800" />
+
+### 📊 **Analytics & Insights**
+Track gallery performance, view statistics, and monitor user engagement.
+
+<img src="docs/screenshot-analytics.png" alt="PicPeak Analytics Dashboard" width="800" />
+
+### 📁 **Event Management**
+Organize and manage your photo galleries with intuitive event management tools.
+
+<img src="docs/screenshots-events.png" alt="PicPeak Events Management" width="800" />
+
+### ✨ **Key Interface Highlights**
+
+<details>
+<summary>👆 Click to see more interface details</summary>
+
+#### What makes PicPeak's interface special:
+
+- **🎨 Clean Design**: Modern, photographer-friendly interface
+- **📱 Responsive**: Perfect on desktop, tablet, and mobile
+- **⚡ Fast Loading**: Optimized for quick photo browsing
+- **🔒 Secure Access**: Password-protected galleries with expiration
+- **📤 Easy Uploads**: Drag & drop functionality for effortless photo management
+- **🎯 Client-Focused**: Intuitive gallery experience for your clients
+
+</details>
+
+## 🙏 Acknowledgments
+
+PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
+
+## 📄 License
+
+PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
+
+## 🚀 Ready to Get Started?
+
+1. ⭐ **Star this repository** to show your support
+2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+3. 🐛 Report issues or request features
+4. 🤝 Join our community and contribute!
+
+---
+
+<p align="center">
+  Made with ❤️ by photographers, for photographers
+  <br>
+  <a href="https://github.com/the-luap/picpeak">GitHub</a> •
+  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="https://github.com/the-luap/picpeak/issues">Support</a>
+</p>

SECURITY.md

@@ -0,0 +1,85 @@
+# Security Policy
+
+## Supported Versions
+
+We release patches for security vulnerabilities. Currently supported versions:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x.x   | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of PicPeak seriously. If you have discovered a security vulnerability, please follow these steps:
+
+### 1. **Do NOT create a public GitHub issue**
+
+### 2. Email us at security@example.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### 3. You can expect:
+- Acknowledgment within 48 hours
+- Regular updates on our progress
+- Credit in the fix announcement (unless you prefer to remain anonymous)
+
+## Security Measures
+
+PicPeak implements several security measures:
+
+### Authentication & Authorization
+- JWT-based authentication with secure token storage
+- bcrypt password hashing with configurable rounds
+- Role-based access control for admin functions
+- Session timeout management
+
+### Input Validation
+- All user inputs are validated and sanitized
+- SQL injection prevention through parameterized queries
+- XSS protection via Content Security Policy
+- File upload restrictions and validation
+
+### Rate Limiting
+- API rate limiting to prevent abuse
+- Brute force protection on authentication endpoints
+- Configurable limits per endpoint
+
+### Data Protection
+- HTTPS enforcement in production
+- Secure cookie settings
+- CORS configuration
+- Sensitive data encryption
+
+### Infrastructure
+- Regular dependency updates
+- Security headers (HSTS, X-Frame-Options, etc.)
+- Activity logging for audit trails
+- Automated backups
+
+## Best Practices for Deployment
+
+1. **Always use HTTPS** in production
+2. **Change default passwords** immediately
+3. **Keep dependencies updated** regularly
+4. **Configure firewall rules** appropriately
+5. **Monitor logs** for suspicious activity
+6. **Backup regularly** and test restoration
+
+## Vulnerability Disclosure
+
+We believe in responsible disclosure. Once a vulnerability is fixed:
+
+1. We'll publish a security advisory
+2. Credit researchers (with permission)
+3. Detail the impact and mitigation steps
+4. Release patches for all supported versions
+
+## Contact
+
+- Security issues: security@example.com
+- General support: https://github.com/the-luap/picpeak/issues
+
+Thank you for helping keep PicPeak and its users safe!

SETUP_GUIDE.md

@@ -1,252 +0,0 @@
-# PicPeak - Complete Setup Guide
-
-## Repository Created Successfully! 🎉
-
-Your PicPeak repository has been created at:
-**https://gitea.nothaft.cloud/paul/picpeak**
-
-## What's Been Created
-
-I've uploaded the core files needed to run the application:
-
-### ✅ Created Files:
-- `.gitignore` - Git ignore rules
-- `.dockerignore` - Docker ignore rules
-- `.env.example` - Environment configuration template
-- `docker-compose.yml` - Development Docker setup
-- `docker-compose.prod.yml` - Production Docker setup
-- `backend/` - Core backend files including:
-  - `package.json` - Dependencies
-  - `server.js` - Main server file
-  - `Dockerfile` - Backend container config
-  - Core routes and services
-- `setup-remaining-files.sh` - Script to create remaining files
-
-## Next Steps to Complete Setup
-
-### 1. Clone the Repository
-```bash
-git clone https://gitea.local.nothaft.cloud/paul/picpeak.git
-cd picpeak
-```
-
-### 2. Run the Setup Script
-```bash
-chmod +x setup-remaining-files.sh
-./setup-remaining-files.sh
-```
-
-This will create all remaining directories and files needed.
-
-### 3. Create Critical Service Files
-
-Due to the large number of files, I've created the most important ones. You'll need to add these remaining backend services:
-
-#### backend/src/services/expirationChecker.js
-```javascript
-const cron = require('node-cron');
-const { db } = require('../database/db');
-const { archiveEvent } = require('./archiveService');
-const logger = require('../utils/logger');
-
-function startExpirationChecker() {
-  // Check every hour for expired events
-  cron.schedule('0 * * * *', async () => {
-    await checkExpirations();
-  });
-  
-  logger.info('Expiration checker started');
-}
-
-async function checkExpirations() {
-  try {
-    const now = new Date();
-    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-    
-    // Check for events needing warning emails
-    const eventsNeedingWarning = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', warningDate)
-      .where('expires_at', '>', now);
-    
-    for (const event of eventsNeedingWarning) {
-      const existingWarning = await db('email_queue')
-        .where('event_id', event.id)
-        .where('email_type', 'warning')
-        .first();
-      
-      if (!existingWarning) {
-        await queueExpirationWarning(event);
-      }
-    }
-    
-    // Check for expired events
-    const expiredEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', now);
-    
-    for (const event of expiredEvents) {
-      await handleExpiredEvent(event);
-    }
-    
-  } catch (error) {
-    logger.error('Error checking expirations:', error);
-  }
-}
-
-async function queueExpirationWarning(event) {
-  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
-  
-  await db('email_queue').insert({
-    event_id: event.id,
-    recipient_email: event.host_email,
-    email_type: 'warning',
-    email_data: JSON.stringify({
-      event_name: event.event_name,
-      days_remaining: daysRemaining,
-      share_link: event.share_link
-    })
-  });
-  
-  logger.info(`Queued expiration warning for event ${event.slug}`);
-}
-
-async function handleExpiredEvent(event) {
-  try {
-    await db('events').where('id', event.id).update({ is_active: false });
-    
-    await db('email_queue').insert([
-      {
-        event_id: event.id,
-        recipient_email: event.host_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name
-        })
-      },
-      {
-        event_id: event.id,
-        recipient_email: event.admin_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name,
-          event_slug: event.slug
-        })
-      }
-    ]);
-    
-    await archiveEvent(event);
-    
-    logger.info(`Handled expiration for event ${event.slug}`);
-  } catch (error) {
-    logger.error(`Error handling expired event ${event.slug}:`, error);
-  }
-}
-
-module.exports = { startExpirationChecker };
-```
-
-### 4. Create Frontend Files
-
-The frontend needs these key files in `frontend/src/`:
-
-#### App.js
-```javascript
-import React from 'react';
-import { Routes, Route, Navigate } from 'react-router-dom';
-import { AuthProvider } from './contexts/AuthContext';
-import ProtectedRoute from './components/ProtectedRoute';
-
-// Pages
-import Login from './pages/Login';
-import Gallery from './pages/Gallery';
-import AdminLogin from './pages/admin/Login';
-import AdminDashboard from './pages/admin/Dashboard';
-
-function App() {
-  return (
-    <AuthProvider>
-      <Routes>
-        <Route path="/" element={<Navigate to="/gallery" />} />
-        <Route path="/gallery/:slug/:token?" element={<Gallery />} />
-        <Route path="/login/:slug" element={<Login />} />
-        <Route path="/admin/login" element={<AdminLogin />} />
-        <Route path="/admin" element={
-          <ProtectedRoute>
-            <AdminDashboard />
-          </ProtectedRoute>
-        } />
-      </Routes>
-    </AuthProvider>
-  );
-}
-
-export default App;
-```
-
-### 5. Install Dependencies
-
-```bash
-# Backend
-cd backend
-npm install
-
-# Frontend
-cd ../frontend
-npm install
-```
-
-### 6. Configure Environment
-
-Copy `.env.example` to `.env` and update with your settings:
-```bash
-cp .env.example .env
-nano .env
-```
-
-### 7. Start Development Environment
-
-```bash
-# From root directory
-docker-compose up
-```
-
-- Backend: http://localhost:3000
-- Frontend: http://localhost:3001
-- MailHog: http://localhost:8025
-
-## Key Features Implemented
-
-- ✅ Password-protected galleries
-- ✅ Automatic expiration with email warnings
-- ✅ File-based photo management
-- ✅ ZIP archiving on expiration
-- ✅ Separate admin and public interfaces
-- ✅ Email notifications at all stages
-- ✅ Mobile-responsive design
-- ✅ Docker deployment ready
-
-## Production Deployment
-
-1. Update `.env` with production values
-2. Run `./scripts/install.sh` on your server
-3. Configure SSL with `./scripts/setup-ssl.sh`
-4. Start with `docker-compose -f docker-compose.prod.yml up -d`
-
-## Need Help?
-
-The complete implementation includes:
-- Backend API with all routes
-- React frontend with admin panel
-- Email service with templates
-- Automatic file watching
-- Expiration checking
-- Archive service
-- Docker configuration
-- Deployment scripts
-
-All core functionality from your PRD has been implemented. You may need to create some additional UI components based on your specific design preferences.
-
-Default admin credentials: **admin / admin123** (change immediately!)

TODO.md

@@ -1,47 +0,0 @@
-# TODO - Open Items Before Release
-
-## Priority Items
-
-- [ ] **Gallery Mobile View** 
-  - Logout button should only show logo icon (no text)
-  - If photo upload is enabled, move upload button inside menu (not on top bar)
-  - Top bar should show: logo (left), gallery title (center), event date + expiration date
-
-- [ ] **Gallery Preview** 
-  - Preview should correctly reflect the selected grid layout style
-  - Add grid style selector above current top bar
-  - Selector should match the style of event template settings grid selector
-
-- [ ] **Hero Grid Layout** 
-  - Top bar: only menu and logout buttons
-  - Title + logo displayed centered on hero photo
-  - Event date and expiration date also on hero photo
-  - No logo/title in top bar
-
-- [ ] **Logo Testing** - Test new PicPeak logos across all grid styles
-
-- [ ] **Welcome Message** 
-  - Add welcome message to email template when creating new event
-  - Use as personal message in the email
-
-- [ ] **Gallery Upload Function**
-  - Fix scrolling in upload popup when multiple images selected
-  - Save/Cancel buttons unreachable due to incorrect scroll formatting
-
-- [ ] **Watermarks** - Test watermark functionality, styling, and image application
-
-- [ ] **Dashboard Activities** - Remove "show all" link from latest activities widget
-
-- [ ] **Security Audit** - Perform security review and code audit
-
-- [ ] **Drone CI/CD** - Update drone.yaml configuration
-
-- [ ] **Version Management** - Implement automatic version updates on commits/builds
-
-## Completed Items
-
-_(Move completed items here with date)_
-
----
-
-Last updated: 2025-07-10

backend/.env.example

@@ -1,33 +1,41 @@
-NODE_ENV=development
+# Backend Environment Variables Example
+# Copy this file to .env and update with your values
+
+# Application
+NODE_ENV=production
 PORT=3000
 
-# URLs
-ADMIN_URL=http://localhost:3000
-FRONTEND_URL=http://localhost:3001
-
 # Security
-JWT_SECRET=dev-secret-key
+JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long
+
+# URLs
+ADMIN_URL=https://yourdomain.com
+FRONTEND_URL=https://yourdomain.com
+
+# Database Configuration
+DATABASE_CLIENT=pg
+DB_HOST=db
+DB_PORT=5432
+DB_USER=picpeak
+DB_PASSWORD=your-secure-database-password
+DB_NAME=picpeak
 
 # Email Configuration
-SMTP_HOST=mailhog
-SMTP_PORT=1025
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-EMAIL_FROM=noreply@localhost
+SMTP_USER=your-smtp-username
+SMTP_PASS=your-smtp-password
+EMAIL_FROM=noreply@yourdomain.com
 
-# Storage Paths (relative to project root)
-STORAGE_PATH=./storage
-EVENTS_PATH=./storage/events
-ARCHIVE_PATH=./storage/events/archived
+# Storage Paths (Docker)
+STORAGE_PATH=/app/storage
+EVENTS_PATH=/app/storage/events
+ARCHIVE_PATH=/app/storage/events/archived
+
+# Analytics (Optional)
+UMAMI_URL=https://analytics.yourdomain.com
+UMAMI_WEBSITE_ID=your-website-id
 
 # Logging
-LOG_LEVEL=info
-
-# Database (for production, consider PostgreSQL)
-DATABASE_CLIENT=sqlite3
-DATABASE_PATH=./data/photo_sharing.db
-
-# Umami Analytics (optional)
-UMAMI_URL=
-UMAMI_WEBSITE_ID=
+LOG_LEVEL=info

backend/ACTIVATE_AUTH_V2.md

@@ -1,137 +0,0 @@
-# Quick Guide: Activate Authentication V2 Fixes
-
-## Step 1: Install Dependency
-```bash
-cd backend
-npm install zxcvbn@4.4.2
-```
-
-## Step 2: Add to Docker & Run Migration
-```bash
-# Rebuild Docker with new dependency
-docker-compose down
-docker-compose up -d --build
-
-# Run migration for token revocation
-docker exec wedding-photo-sharing-backend-1 node /app/scripts/add-token-revocation-tables.js
-```
-
-## Step 3: Update server.js
-
-### 3.1 Fix Rate Limiting (Line ~10)
-```javascript
-// Add after other requires
-const { createSecureSkipFunction, logRateLimitHit } = require('./src/utils/rateLimitSecurity');
-```
-
-### 3.2 Update Rate Limiter (Line ~59)
-```javascript
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: process.env.NODE_ENV === 'development' ? 1000 : 100,
-  skip: createSecureSkipFunction(), // CHANGE THIS LINE
-  handler: (req, res) => {
-    logRateLimitHit(req, res); // ADD THIS
-    res.status(429).json({
-      error: 'Too many requests from this IP, please try again later.'
-    });
-  }
-});
-```
-
-### 3.3 Update Auth Limiter (Line ~81)
-```javascript
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5,
-  skipSuccessfulRequests: true, // ADD THIS
-  handler: (req, res) => {
-    logRateLimitHit(req, res); // ADD THIS
-    res.status(429).json({
-      error: 'Too many login attempts, please try again later.',
-      retryAfter: res.getHeader('Retry-After')
-    });
-  }
-});
-```
-
-### 3.4 Change Auth Routes (Line ~22)
-```javascript
-// Change from:
-const authRoutes = require('./src/routes/auth-enhanced');
-// To:
-const authRoutes = require('./src/routes/auth-enhanced-v2');
-```
-
-### 3.5 Add Token Revocation (After line ~147)
-```javascript
-// After initializeCleanupJob();
-const { initializeRevocationCleanup } = require('./src/utils/tokenRevocation');
-initializeRevocationCleanup();
-```
-
-## Step 4: Update Middleware Imports
-
-In files that import adminAuth:
-```javascript
-// Change from:
-const { adminAuth } = require('../middleware/auth-enhanced');
-// To:
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-```
-
-## Step 5: Update adminEvents.js
-
-Add password validation to event creation:
-```javascript
-// At top of file
-const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-
-// In POST route, after extracting password, add:
-const passwordValidation = validatePasswordInContext(password, 'gallery', {
-  eventName: event_name
-});
-
-if (!passwordValidation.valid) {
-  return res.status(400).json({ 
-    error: 'Password does not meet security requirements',
-    details: passwordValidation.errors,
-    score: passwordValidation.score,
-    feedback: passwordValidation.feedback
-  });
-}
-
-// Change password hashing to:
-const password_hash = await bcrypt.hash(password, getBcryptRounds());
-```
-
-## Step 6: Add Environment Variable
-```bash
-# In .env file
-BCRYPT_ROUNDS=12
-```
-
-## Step 7: Restart & Test
-```bash
-docker-compose restart backend
-
-# Test rate limiting
-curl -H "Authorization: Bearer invalid" http://localhost:3001/api/admin/events
-
-# Test password validation  
-node scripts/test-auth-v2-fixes.js
-```
-
-## Verification Checklist
-- [ ] zxcvbn installed
-- [ ] Token revocation tables created
-- [ ] Rate limiting can't be bypassed
-- [ ] Weak passwords rejected
-- [ ] Password change works
-- [ ] No errors in logs
-
-## Rollback
-If issues occur:
-1. Revert server.js changes
-2. Restart backend
-3. All new features are additive, so existing functionality remains

backend/AUTH_FLAWS_ANALYSIS.md

@@ -1,64 +0,0 @@
-# Authentication & Authorization Flaws Analysis
-
-## Already Fixed ✅
-
-1. **Missing Token Type Validation** ✅
-   - Fixed in `auth-enhanced.js` line 31
-   - Checks `decoded.type !== 'admin'`
-   - Prevents gallery tokens from accessing admin endpoints
-
-2. **No Audit Logging** ✅
-   - Added `login_attempts` table
-   - Tracks all login attempts with IP, user agent, timestamp
-   - Automatic cleanup of old records
-
-3. **Account Lockout Protection** ✅
-   - Lockout after 5 failed attempts
-   - 30-minute lockout duration
-   - Prevents brute force attacks
-
-4. **Basic Session Management** ✅
-   - Added session timeout middleware
-   - Tracks active sessions
-   - Can invalidate sessions
-
-## Still Needs Fixing ❌
-
-### 1. Weak Password Requirements 🔴
-- **Current**: No minimum length validation
-- **Required**: Minimum 12 characters + complexity
-- **Risk**: Vulnerable to brute force
-
-### 2. Rate Limiting Bypass 🔴
-- **Current**: Invalid JWT bypasses rate limiting
-- **Location**: `server.js:64-71`
-- **Risk**: Attackers can spam with invalid tokens
-
-### 3. No Password Complexity 🟡
-- **Current**: Any 6+ character password accepted
-- **Required**: Upper, lower, number, special char
-- **Risk**: Weak passwords
-
-### 4. No Token Revocation 🟡
-- **Current**: Tokens valid until expiration
-- **Required**: Blacklist/revocation mechanism
-- **Risk**: Can't invalidate compromised tokens
-
-### 5. Fixed Bcrypt Rounds 🟡
-- **Current**: Hardcoded to 10 rounds
-- **Required**: Configurable (12-14 recommended)
-- **Risk**: May become insufficient over time
-
-### 6. In-Memory Session Storage 🟡
-- **Current**: Sessions stored in memory
-- **Required**: Redis or database storage
-- **Risk**: Lost on restart, not scalable
-
-## Priority Fixes
-
-1. **Rate Limiting Bypass** (Critical)
-2. **Password Requirements** (High)
-3. **Password Complexity** (High)
-4. **Token Revocation** (Medium)
-5. **Bcrypt Rounds** (Medium)
-6. **Session Storage** (Low - for scalability)

backend/AUTH_SECURITY_INTEGRATION.md

@@ -1,216 +0,0 @@
-# Authentication Security Integration Guide
-
-## How The Enhanced Security Works
-
-### 1. Login Flow with Protection
-
-```
-User Login Attempt
-    ↓
-Rate Limiter (5 attempts/15 min)
-    ↓
-Account Lockout Check
-    ↓
-reCAPTCHA Verification
-    ↓
-Credentials Validation
-    ↓
-Track Login Attempt
-    ↓
-Generate Enhanced JWT
-```
-
-### 2. Token Structure
-
-**Before** (Basic JWT):
-```json
-{
-  "id": 1,
-  "type": "admin",
-  "exp": 1234567890
-}
-```
-
-**After** (Enhanced JWT):
-```json
-{
-  "id": 1,
-  "username": "admin",
-  "type": "admin",
-  "ip": "192.168.1.100",
-  "loginTime": 1234567890,
-  "exp": 1234567890,
-  "iss": "picpeak-auth"
-}
-```
-
-### 3. Security Layers
-
-1. **Network Level**:
-   - Rate limiting (express-rate-limit)
-   - CORS restrictions
-   - Helmet security headers
-
-2. **Application Level**:
-   - Account lockout (5 attempts)
-   - reCAPTCHA validation
-   - Login attempt tracking
-
-3. **Session Level**:
-   - JWT with expiration
-   - Session timeout tracking
-   - IP validation
-   - Password change detection
-
-4. **Database Level**:
-   - Bcrypt password hashing
-   - Audit trail (login_attempts)
-   - Secure token storage
-
-## Integration Points
-
-### Server.js Changes
-
-```javascript
-// Add after database initialization
-const { initializeCleanupJob } = require('./src/utils/authSecurity');
-initializeCleanupJob();
-
-// Update route import (when ready)
-const authRoutes = require('./src/routes/auth-enhanced');
-```
-
-### Middleware Updates
-
-For routes requiring enhanced security:
-```javascript
-// Change from:
-router.get('/sensitive', adminAuth, handler);
-
-// To:
-const { adminAuth } = require('../middleware/auth-enhanced');
-router.get('/sensitive', adminAuth, handler);
-```
-
-### Frontend Integration
-
-1. **Handle New Error Codes**:
-```javascript
-// Lockout error
-if (error.response?.status === 423) {
-  const retryAfter = error.response.data.retryAfter;
-  showError(`Account locked. Try again in ${retryAfter} seconds`);
-}
-
-// Session expired
-if (error.response?.data?.code === 'SESSION_TIMEOUT') {
-  redirectToLogin();
-}
-```
-
-2. **Implement Logout**:
-```javascript
-async function logout() {
-  await api.post('/auth/logout');
-  clearToken();
-  redirectToLogin();
-}
-```
-
-3. **Check Session Status**:
-```javascript
-async function checkSession() {
-  const response = await api.get('/auth/session');
-  if (!response.data.valid) {
-    redirectToLogin();
-  }
-}
-```
-
-## Configuration
-
-### Environment Variables
-No new environment variables required. Uses existing:
-- `JWT_SECRET` - For token signing
-- `NODE_ENV` - For environment detection
-
-### Security Settings
-In `authSecurity.js`:
-```javascript
-const MAX_LOGIN_ATTEMPTS = 5;       // Attempts before lockout
-const LOCKOUT_DURATION = 30 * 60 * 1000;  // 30 minutes
-const ATTEMPT_WINDOW = 15 * 60 * 1000;    // 15 minute window
-```
-
-## Monitoring & Maintenance
-
-### Daily Monitoring
-```sql
--- Check for brute force attempts
-SELECT identifier, COUNT(*) as attempts,
-       MAX(attempt_time) as last_attempt
-FROM login_attempts
-WHERE success = 0
-AND attempt_time > datetime('now', '-24 hours')
-GROUP BY identifier
-HAVING COUNT(*) > 10
-ORDER BY attempts DESC;
-```
-
-### Weekly Review
-```sql
--- Suspicious activity patterns
-SELECT DATE(attempt_time) as date,
-       COUNT(DISTINCT identifier) as unique_users,
-       COUNT(DISTINCT ip_address) as unique_ips,
-       COUNT(*) as total_attempts,
-       SUM(CASE WHEN success = 0 THEN 1 ELSE 0 END) as failed_attempts
-FROM login_attempts
-WHERE attempt_time > datetime('now', '-7 days')
-GROUP BY DATE(attempt_time)
-ORDER BY date DESC;
-```
-
-### Automated Cleanup
-The system automatically cleans up login attempts older than 7 days to prevent database bloat.
-
-## Troubleshooting
-
-### User Locked Out
-```sql
--- Check lockout status
-SELECT * FROM login_attempts 
-WHERE identifier = 'user@example.com'
-AND attempt_time > datetime('now', '-30 minutes')
-ORDER BY attempt_time DESC;
-
--- Clear lockout
-DELETE FROM login_attempts 
-WHERE identifier = 'user@example.com'
-AND success = 0;
-```
-
-### Token Issues
-```javascript
-// Debug token in browser console
-const token = localStorage.getItem('token');
-const decoded = JSON.parse(atob(token.split('.')[1]));
-console.log('Token expires:', new Date(decoded.exp * 1000));
-console.log('Token IP:', decoded.ip);
-```
-
-## Security Best Practices
-
-1. **Monitor Failed Attempts**: Set up alerts for excessive failures
-2. **Review IP Patterns**: Look for geographic anomalies
-3. **Rotate JWT Secret**: Periodically update in production
-4. **Update Dependencies**: Keep auth libraries current
-5. **Test Lockouts**: Regularly verify protection works
-
-## Future Enhancements
-
-1. **Two-Factor Authentication**: Database columns already added
-2. **IP Whitelist**: For admin accounts
-3. **Device Fingerprinting**: Enhanced session security
-4. **OAuth Integration**: Social login options
-5. **WebAuthn/Passkeys**: Passwordless authentication

backend/AUTH_SECURITY_MIGRATION.md

@@ -1,221 +0,0 @@
-# Authentication Security Enhancement Migration Guide
-
-## Overview
-This guide provides a safe migration path to enhance authentication security without disrupting the production system.
-
-## Security Enhancements Implemented
-
-### 1. Account Lockout Protection
-- Locks accounts after 5 failed login attempts within 15 minutes
-- 30-minute lockout duration
-- Prevents brute force attacks
-
-### 2. Login Attempt Tracking
-- Records all login attempts (success/failure)
-- Tracks IP addresses and user agents
-- Enables security monitoring and alerting
-
-### 3. Enhanced Token Security
-- Added issuer validation
-- IP address tracking in tokens
-- Login time tracking
-- Password change detection
-
-### 4. Generic Error Messages
-- Prevents user enumeration attacks
-- Returns "Invalid credentials" for all auth failures
-
-### 5. Logout Endpoint
-- Properly invalidates sessions
-- Clears server-side session tracking
-
-## Migration Steps
-
-### Step 1: Database Migrations (Low Risk)
-
-First, run the new migrations to add required tables/columns:
-
-```bash
-cd backend
-
-# Run new migrations
-npx knex migrate:latest
-
-# Verify migrations
-npx knex migrate:status
-```
-
-This adds:
-- `login_attempts` table
-- `password_changed_at` column to `admin_users`
-- `last_login_ip` column to `admin_users`
-
-### Step 2: Deploy Enhanced Auth Utilities (Low Risk)
-
-The new files don't affect existing functionality:
-- `src/utils/authSecurity.js` - New security utilities
-- `src/middleware/auth-enhanced.js` - Enhanced auth middleware
-- `src/routes/auth-enhanced.js` - Enhanced auth routes
-
-### Step 3: Gradual Rollout Plan
-
-#### Phase 1: Testing (Day 1)
-1. Deploy code but keep using existing auth routes
-2. Test enhanced routes in parallel:
-   ```bash
-   # Test existing endpoint
-   curl -X POST http://localhost:3001/api/auth/admin/login
-   
-   # Test enhanced endpoint (if added to routes)
-   curl -X POST http://localhost:3001/api/auth-enhanced/admin/login
-   ```
-
-#### Phase 2: Monitoring (Days 2-3)
-1. Add the auth security initialization to server.js:
-   ```javascript
-   // In server.js, after database initialization
-   const { initializeCleanupJob } = require('./src/utils/authSecurity');
-   initializeCleanupJob();
-   ```
-
-2. Monitor logs for any issues
-3. Check login_attempts table is populating
-
-#### Phase 3: Switch Routes (Day 4)
-1. Update route imports in server.js:
-   ```javascript
-   // Change from:
-   const authRoutes = require('./src/routes/auth');
-   
-   // To:
-   const authRoutes = require('./src/routes/auth-enhanced');
-   ```
-
-2. Update middleware imports where needed:
-   ```javascript
-   // Change from:
-   const { adminAuth } = require('./src/middleware/auth');
-   
-   // To:
-   const { adminAuth } = require('./src/middleware/auth-enhanced');
-   ```
-
-### Step 4: Rollback Plan
-
-If issues occur at any phase:
-
-```bash
-# Quick rollback - revert route imports
-# In server.js, change back to:
-const authRoutes = require('./src/routes/auth');
-const { adminAuth } = require('./src/middleware/auth');
-
-# Restart application
-docker-compose restart backend
-# or
-pm2 restart picpeak-backend
-```
-
-## Testing Checklist
-
-### Before Production Deployment:
-
-1. **Test Normal Login Flow**:
-   ```bash
-   # Should work normally
-   curl -X POST http://localhost:3001/api/auth/admin/login \
-     -H "Content-Type: application/json" \
-     -d '{"username":"admin","password":"correct-password"}'
-   ```
-
-2. **Test Account Lockout**:
-   ```bash
-   # Make 5 failed attempts
-   for i in {1..5}; do
-     curl -X POST http://localhost:3001/api/auth/admin/login \
-       -H "Content-Type: application/json" \
-       -d '{"username":"admin","password":"wrong-password"}'
-   done
-   
-   # 6th attempt should return lockout error
-   ```
-
-3. **Test Logout**:
-   ```bash
-   curl -X POST http://localhost:3001/api/auth/logout \
-     -H "Authorization: Bearer YOUR_TOKEN"
-   ```
-
-4. **Test Session Info**:
-   ```bash
-   curl http://localhost:3001/api/auth/session \
-     -H "Authorization: Bearer YOUR_TOKEN"
-   ```
-
-## Configuration Options
-
-### Adjusting Security Settings
-
-In `src/utils/authSecurity.js`, you can adjust:
-```javascript
-const MAX_LOGIN_ATTEMPTS = 5;  // Number of attempts before lockout
-const LOCKOUT_DURATION = 30 * 60 * 1000;  // Lockout time in ms
-const ATTEMPT_WINDOW = 15 * 60 * 1000;  // Time window for counting attempts
-```
-
-## Monitoring
-
-### Check Login Attempts:
-```sql
--- Recent failed attempts
-SELECT * FROM login_attempts 
-WHERE success = false 
-ORDER BY attempt_time DESC 
-LIMIT 20;
-
--- Accounts with multiple failures
-SELECT identifier, COUNT(*) as failed_attempts
-FROM login_attempts
-WHERE success = false
-AND attempt_time > datetime('now', '-1 hour')
-GROUP BY identifier
-HAVING COUNT(*) > 3;
-```
-
-### Monitor Locked Accounts:
-```sql
--- Check currently locked accounts
-SELECT identifier, COUNT(*) as attempts,
-       MAX(attempt_time) as last_attempt
-FROM login_attempts
-WHERE success = false
-AND attempt_time > datetime('now', '-15 minutes')
-GROUP BY identifier
-HAVING COUNT(*) >= 5;
-```
-
-## Security Benefits
-
-1. **Prevents Brute Force**: Account lockout after failed attempts
-2. **Audit Trail**: Complete login history for security analysis
-3. **Session Security**: Tokens invalidated on password change
-4. **IP Monitoring**: Detect suspicious login patterns
-5. **User Privacy**: Generic errors prevent user enumeration
-
-## Notes
-
-- Old tokens remain valid until expiration
-- No immediate user impact
-- Gradual rollout minimizes risk
-- Full rollback possible at any stage
-
-## Support
-
-Monitor logs after deployment:
-```bash
-# Docker
-docker-compose logs -f backend | grep -E "(auth|login|security)"
-
-# PM2
-pm2 logs picpeak-backend | grep -E "(auth|login|security)"
-```

backend/AUTH_SECURITY_ROLLBACK.md

@@ -1,187 +0,0 @@
-# Authentication Security Enhancement Rollback Plan
-
-## Quick Rollback Steps
-
-### Immediate Rollback (< 2 minutes)
-
-If auth issues occur after deployment, follow these steps:
-
-```bash
-# 1. SSH into production server
-ssh your-server
-
-# 2. Navigate to backend directory
-cd /path/to/picpeak/backend
-
-# 3. Revert route changes in server.js
-# Change from:
-# const authRoutes = require('./src/routes/auth-enhanced');
-# Back to:
-# const authRoutes = require('./src/routes/auth');
-
-# 4. Revert middleware if changed
-# Change from:
-# const { adminAuth } = require('./src/middleware/auth-enhanced');
-# Back to:
-# const { adminAuth } = require('./src/middleware/auth');
-
-# 5. Restart application
-docker-compose restart backend
-# OR
-pm2 restart picpeak-backend
-```
-
-## Rollback Scenarios
-
-### Scenario 1: Users Can't Login
-
-**Symptoms**:
-- All login attempts fail
-- Generic "Invalid credentials" error
-- Admin panel inaccessible
-
-**Quick Fix**:
-```bash
-# Revert to original auth routes
-cd backend
-git checkout HEAD -- server.js
-docker-compose restart backend
-```
-
-### Scenario 2: Account Lockout Issues
-
-**Symptoms**:
-- Legitimate users locked out
-- "Account temporarily locked" errors
-
-**Quick Fix**:
-```sql
--- Clear all lockouts
-DELETE FROM login_attempts WHERE success = false;
-
--- Or clear specific user
-DELETE FROM login_attempts 
-WHERE identifier = 'username_or_email' 
-AND success = false;
-```
-
-### Scenario 3: Token Validation Errors
-
-**Symptoms**:
-- "Invalid token" errors
-- Existing sessions broken
-- API calls failing
-
-**Quick Fix**:
-```javascript
-// In auth middleware, temporarily disable strict validation
-// Comment out issuer validation:
-// issuer: 'picpeak-auth'
-
-// Just use basic verification:
-const decoded = jwt.verify(token, process.env.JWT_SECRET);
-```
-
-### Scenario 4: Database Migration Issues
-
-**Symptoms**:
-- Application won't start
-- Database errors in logs
-
-**Rollback Migration**:
-```bash
-# Rollback last 2 migrations
-npx knex migrate:rollback --all
-npx knex migrate:up 014_add_default_welcome_message.js
-
-# Or manually fix:
-sqlite3 database.db
-DROP TABLE IF EXISTS login_attempts;
-ALTER TABLE admin_users DROP COLUMN password_changed_at;
-ALTER TABLE admin_users DROP COLUMN last_login_ip;
-```
-
-## Verification After Rollback
-
-1. **Test Admin Login**:
-   ```bash
-   curl -X POST http://your-domain/api/auth/admin/login \
-     -H "Content-Type: application/json" \
-     -d '{"username":"admin","password":"your-password"}'
-   ```
-
-2. **Test Gallery Access**:
-   ```bash
-   curl -X POST http://your-domain/api/auth/gallery/verify \
-     -H "Content-Type: application/json" \
-     -d '{"slug":"test-gallery","password":"gallery-password"}'
-   ```
-
-3. **Check Logs**:
-   ```bash
-   # No auth errors should appear
-   docker-compose logs backend | tail -100 | grep -i error
-   ```
-
-## File Restoration
-
-If files were modified, restore from backup:
-
-```bash
-# List of files that can be safely reverted
-git checkout HEAD -- src/middleware/auth.js
-git checkout HEAD -- src/routes/auth.js
-git checkout HEAD -- server.js
-
-# Remove new files (safe to delete)
-rm -f src/utils/authSecurity.js
-rm -f src/middleware/auth-enhanced.js
-rm -f src/routes/auth-enhanced.js
-rm -f migrations/015_add_login_attempts_table.js
-rm -f migrations/016_add_auth_security_columns.js
-```
-
-## Emergency SQL Fixes
-
-```sql
--- Clear all security restrictions
-DELETE FROM login_attempts;
-
--- Reset admin password if locked out
-UPDATE admin_users 
-SET password_hash = '$2b$10$YourKnownGoodHashHere'
-WHERE username = 'admin';
-
--- Remove security columns if causing issues
--- (SQLite doesn't support DROP COLUMN easily, so ignore)
-```
-
-## Monitoring After Rollback
-
-```bash
-# Watch for stability
-watch -n 5 'docker-compose logs backend | tail -20'
-
-# Check active connections
-netstat -an | grep :3001 | wc -l
-
-# Monitor CPU/Memory
-docker stats wedding-photo-sharing-backend-1
-```
-
-## Prevention for Next Attempt
-
-Before re-attempting the security enhancement:
-
-1. **Test in staging environment first**
-2. **Implement gradual rollout with feature flags**
-3. **Add backwards compatibility for tokens**
-4. **Create admin bypass for lockouts**
-5. **Set up monitoring alerts**
-
-## Contact
-
-If rollback fails:
-1. Check `backend/logs/error.log`
-2. Restore from last known good backup
-3. Use original auth implementation as reference

backend/AUTH_SECURITY_SUMMARY.md

@@ -1,119 +0,0 @@
-# Authentication Security Enhancement Summary
-
-## Security Issues Fixed
-
-### 1. ✅ Account Lockout Protection
-- **Issue**: No protection against brute force attacks
-- **Fix**: Lock account after 5 failed attempts in 15 minutes
-- **Files**: `authSecurity.js`, `login_attempts` table
-
-### 2. ✅ Login Attempt Tracking
-- **Issue**: No audit trail for security monitoring
-- **Fix**: Track all login attempts with IP, user agent, timestamp
-- **Database**: New `login_attempts` table
-
-### 3. ✅ Generic Error Messages
-- **Issue**: Different errors could reveal if username exists
-- **Fix**: Always return "Invalid credentials"
-- **Impact**: Prevents user enumeration attacks
-
-### 4. ✅ Session Management
-- **Issue**: No way to invalidate tokens/logout
-- **Fix**: Added `/api/auth/logout` endpoint
-- **Fix**: Session tracking with timeout
-
-### 5. ✅ Enhanced Token Security
-- **Issue**: Basic JWT with minimal claims
-- **Fix**: Added issuer, IP, loginTime claims
-- **Fix**: Token invalidation on password change
-
-## Implementation Details
-
-### New Files Created
-```
-backend/
-├── src/
-│   ├── utils/
-│   │   └── authSecurity.js (122 lines)
-│   ├── middleware/
-│   │   └── auth-enhanced.js (169 lines)
-│   └── routes/
-│       └── auth-enhanced.js (244 lines)
-├── migrations/
-│   ├── 015_add_login_attempts_table.js
-│   └── 016_add_auth_security_columns.js
-└── scripts/
-    └── test-auth-security.js
-```
-
-### Database Changes
-1. **login_attempts** table:
-   - Tracks all authentication attempts
-   - Enables lockout and monitoring
-
-2. **admin_users** additions:
-   - `password_changed_at` - Invalidate old tokens
-   - `last_login_ip` - Security monitoring
-   - `two_factor_enabled` - Future 2FA support
-
-## Security Improvements
-
-### Before
-- ❌ Unlimited login attempts
-- ❌ No audit trail
-- ❌ User enumeration possible
-- ❌ No session invalidation
-- ❌ Basic JWT validation
-
-### After
-- ✅ Brute force protection
-- ✅ Complete audit trail
-- ✅ Generic error messages
-- ✅ Logout functionality
-- ✅ Enhanced token validation
-- ✅ IP tracking
-- ✅ Password change detection
-
-## Deployment Safety
-
-### Gradual Rollout
-1. **Phase 1**: Deploy code (no impact)
-2. **Phase 2**: Run migrations (adds tables only)
-3. **Phase 3**: Initialize tracking (monitoring only)
-4. **Phase 4**: Switch routes (activates protection)
-
-### Risk Mitigation
-- ✅ Backward compatible
-- ✅ No breaking changes
-- ✅ Existing tokens remain valid
-- ✅ Quick rollback possible
-- ✅ Comprehensive testing
-
-## Testing Results
-```
-✅ All 10 security tests passed
-✅ Generic errors working
-✅ Lockout logic verified
-✅ Token enhancements tested
-```
-
-## Next Steps
-
-1. **Deploy database migrations** (safe)
-2. **Deploy new files** (no impact)
-3. **Test in staging** if available
-4. **Gradual production rollout**
-5. **Monitor login_attempts table**
-
-## Monitoring Commands
-
-```bash
-# Check failed login attempts
-sqlite3 database.db "SELECT identifier, COUNT(*) as attempts FROM login_attempts WHERE success = 0 AND attempt_time > datetime('now', '-1 hour') GROUP BY identifier"
-
-# View recent login activity
-sqlite3 database.db "SELECT * FROM login_attempts ORDER BY attempt_time DESC LIMIT 10"
-
-# Check locked accounts
-sqlite3 database.db "SELECT identifier FROM login_attempts WHERE success = 0 GROUP BY identifier HAVING COUNT(*) >= 5"
-```

backend/AUTH_V2_DEPLOYMENT_PLAN.md

@@ -1,232 +0,0 @@
-# Authentication Security V2 Deployment Plan
-
-## Overview
-This deployment adds remaining authentication security fixes identified in the security scan.
-
-## New Security Features
-
-### 1. Rate Limiting Bypass Fix ✅
-- **File**: `src/utils/rateLimitSecurity.js`
-- **Fix**: Properly validates JWT before skipping rate limit
-- **Impact**: Prevents attackers from bypassing with invalid tokens
-
-### 2. Password Complexity Requirements ✅
-- **File**: `src/utils/passwordValidation.js`
-- **Features**:
-  - Minimum 12 characters (up from 6)
-  - Must contain: uppercase, lowercase, numbers, special chars
-  - Password strength scoring (zxcvbn)
-  - Context-aware validation (admin vs gallery)
-  - Configurable bcrypt rounds
-
-### 3. Token Revocation System ✅
-- **Files**: `src/utils/tokenRevocation.js`, migration
-- **Features**:
-  - Revoke individual tokens
-  - Revoke all user tokens
-  - Automatic cleanup of expired revocations
-  - Check on every auth request
-
-### 4. Enhanced Auth Routes ✅
-- **File**: `src/routes/auth-enhanced-v2.js`
-- **Features**:
-  - Password change endpoint with validation
-  - Real-time password strength checking
-  - Better error responses with feedback
-
-## Dependencies to Install
-
-```bash
-npm install zxcvbn@4.4.2
-```
-
-## Database Migrations
-
-```sql
--- Token revocation tables
-CREATE TABLE revoked_tokens (
-  id INTEGER PRIMARY KEY,
-  token_id TEXT UNIQUE NOT NULL,
-  user_id INTEGER,
-  token_type TEXT,
-  revoked_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-  expires_at TIMESTAMP NOT NULL,
-  reason TEXT,
-  metadata TEXT
-);
-
-CREATE TABLE user_token_revocations (
-  user_id INTEGER PRIMARY KEY,
-  revoked_at TIMESTAMP NOT NULL,
-  reason TEXT
-);
-```
-
-## Deployment Steps
-
-### Phase 1: Preparation (Day 1)
-
-1. **Install Dependencies**
-   ```bash
-   cd backend
-   npm install zxcvbn@4.4.2
-   ```
-
-2. **Run Migrations**
-   ```bash
-   docker exec wedding-photo-sharing-backend-1 node scripts/add-token-revocation-tables.js
-   ```
-
-3. **Deploy New Files** (No impact yet)
-   - `rateLimitSecurity.js`
-   - `passwordValidation.js`
-   - `tokenRevocation.js`
-   - `auth-enhanced-v2.js`
-
-### Phase 2: Testing (Day 2)
-
-1. **Test Rate Limiting Fix**
-   ```bash
-   # Try with invalid token
-   curl -H "Authorization: Bearer invalid-token" \
-     http://localhost:3001/api/admin/events
-   # Should apply rate limiting
-   ```
-
-2. **Test Password Validation**
-   ```bash
-   node -e "
-     const {validatePassword} = require('./src/utils/passwordValidation');
-     console.log(validatePassword('weak'));
-     console.log(validatePassword('StrongP@ssw0rd123'));
-   "
-   ```
-
-### Phase 3: Gradual Activation (Day 3)
-
-#### Step 1: Update Server.js for Rate Limiting
-```javascript
-// Replace in server.js
-const { createSecureSkipFunction, logRateLimitHit } = require('./src/utils/rateLimitSecurity');
-
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: process.env.NODE_ENV === 'development' ? 1000 : 100,
-  skip: createSecureSkipFunction(), // NEW: Secure skip function
-  handler: (req, res) => {
-    logRateLimitHit(req, res); // NEW: Logging
-    res.status(429).json({
-      error: 'Too many requests from this IP, please try again later.'
-    });
-  }
-});
-```
-
-#### Step 2: Update Auth Routes
-```javascript
-// In server.js, change to v2
-const authRoutes = require('./src/routes/auth-enhanced-v2');
-```
-
-#### Step 3: Update Middleware
-```javascript
-// Update imports to use v2
-const { adminAuth } = require('./src/middleware/auth-enhanced-v2');
-```
-
-#### Step 4: Update Event Creation
-```javascript
-// In adminEvents.js, add password validation
-const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-
-// In the POST route, add validation before hashing
-```
-
-#### Step 5: Initialize Token Revocation
-```javascript
-// In server.js, after initializeCleanupJob()
-const { initializeRevocationCleanup } = require('./src/utils/tokenRevocation');
-initializeRevocationCleanup();
-```
-
-## Environment Variables
-
-Add to `.env`:
-```bash
-# Bcrypt rounds (12-14 recommended)
-BCRYPT_ROUNDS=12
-```
-
-## Testing Checklist
-
-- [ ] Invalid tokens can't bypass rate limiting
-- [ ] Weak passwords are rejected
-- [ ] Password change requires strong password
-- [ ] Tokens can be revoked
-- [ ] Revoked tokens are rejected
-- [ ] Admin passwords require higher strength
-- [ ] Gallery passwords check for event name
-
-## Rollback Plan
-
-### Quick Rollback
-```bash
-# Revert server.js changes
-git checkout HEAD -- server.js
-
-# Restart
-docker-compose restart backend
-```
-
-### Rollback Specific Features
-
-1. **Rate Limiting**: Revert to old skip function
-2. **Password Validation**: Remove validation calls
-3. **Token Revocation**: Skip revocation checks
-
-## Monitoring
-
-### Check Password Validation Failures
-```bash
-docker-compose logs backend | grep "Password validation failed"
-```
-
-### Check Rate Limiting
-```bash
-docker-compose logs backend | grep "Rate limit"
-```
-
-### Check Token Revocations
-```bash
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('revoked_tokens').count().first()
-    .then(r => console.log('Revoked tokens:', r['count(*)'] || 0))
-    .then(() => db.destroy());
-"
-```
-
-## Security Improvements
-
-| Feature | Before | After |
-|---------|---------|--------|
-| Rate Limiting | Can bypass with invalid token | Properly validated |
-| Password Length | 6 chars | 12 chars minimum |
-| Password Complexity | None | Upper+lower+number+special |
-| Password Strength | Not checked | zxcvbn scoring |
-| Token Revocation | Not possible | Full revocation system |
-| Bcrypt Rounds | Fixed (10) | Configurable (12) |
-
-## Performance Considerations
-
-1. **Password Validation**: ~50ms per check (zxcvbn)
-2. **Token Revocation**: Adds 1 DB query per request
-3. **Bcrypt Rounds**: 12 rounds = ~250ms (vs 100ms for 10)
-
-## Success Criteria
-
-- ✅ No invalid tokens bypass rate limiting
-- ✅ All new passwords meet complexity requirements  
-- ✅ Password change works with validation
-- ✅ Tokens can be revoked on logout
-- ✅ No performance degradation > 100ms

backend/AUTH_V2_FIXES_SUMMARY.md

@@ -1,114 +0,0 @@
-# Authentication V2 Security Fixes Summary
-
-## What We Fixed
-
-### 1. ✅ Rate Limiting Bypass (CRITICAL)
-**Issue**: Invalid JWT tokens could bypass rate limiting  
-**Fix**: Created `rateLimitSecurity.js` that properly validates tokens  
-**Impact**: Attackers can no longer spam requests with invalid tokens
-
-### 2. ✅ Weak Password Requirements (HIGH)
-**Issue**: Only 6 character minimum, no complexity  
-**Fix**: Created `passwordValidation.js` with:
-- 12 character minimum
-- Must have: uppercase, lowercase, numbers, special chars
-- Password strength scoring (zxcvbn)
-- Context-aware validation (prevents username/event name in password)
-- Configurable bcrypt rounds (default 12)
-**Impact**: Much stronger passwords, resistant to brute force
-
-### 3. ✅ Token Revocation (MEDIUM)
-**Issue**: No way to invalidate tokens before expiration  
-**Fix**: Created `tokenRevocation.js` with full revocation system
-- Individual token revocation
-- User-level revocation (all tokens)
-- Automatic cleanup
-- Database tables for tracking
-**Impact**: Can now invalidate compromised tokens
-
-### 4. ✅ Enhanced Authentication Routes
-**Fix**: Created `auth-enhanced-v2.js` with:
-- Password change endpoint with validation
-- Real-time password strength API
-- Better error messages with feedback
-**Impact**: Users get helpful password feedback
-
-## Files Created
-
-```
-backend/
-├── src/
-│   ├── utils/
-│   │   ├── rateLimitSecurity.js (118 lines)
-│   │   ├── passwordValidation.js (267 lines)
-│   │   └── tokenRevocation.js (127 lines)
-│   ├── routes/
-│   │   ├── auth-enhanced-v2.js (332 lines)
-│   │   └── adminEvents-enhanced.js (partial)
-│   └── middleware/
-│       └── auth-enhanced-v2.js (updated)
-├── migrations/
-│   └── 017_add_token_revocation_tables.js
-├── scripts/
-│   ├── add-token-revocation-tables.js
-│   └── test-auth-v2-fixes.js
-└── server-enhanced.js (partial)
-```
-
-## Deployment Status
-
-### Ready to Deploy ✅
-- All code written and tested
-- Migration scripts ready
-- Test scripts available
-- Rollback plan documented
-
-### Required Actions
-1. Install `zxcvbn` dependency
-2. Run token revocation migration
-3. Update server.js with new imports
-4. Update auth routes to v2
-5. Test thoroughly before production
-
-## Security Improvements Summary
-
-| Vulnerability | Severity | Status | Fix |
-|--------------|----------|---------|-----|
-| Rate Limiting Bypass | 🔴 Critical | ✅ Fixed | Proper token validation |
-| Weak Passwords | 🔴 High | ✅ Fixed | 12 chars + complexity |
-| No Token Revocation | 🟡 Medium | ✅ Fixed | Full revocation system |
-| Fixed Bcrypt Rounds | 🟡 Medium | ✅ Fixed | Configurable (env var) |
-| No Password Feedback | 🟡 Low | ✅ Fixed | Strength API endpoint |
-
-## What's Still Pending
-
-From the original auth flaws, these remain lower priority:
-1. **In-memory session storage** - Works fine for single instance
-2. **No refresh tokens** - 24h tokens are reasonable for this use case
-3. **Fixed token expiration** - Could make configurable later
-
-## Testing Commands
-
-```bash
-# Test rate limiting fix
-node scripts/test-auth-v2-fixes.js
-
-# Test password validation
-node -e "
-  const {validatePassword} = require('./src/utils/passwordValidation');
-  console.log(validatePassword('Test123!Pass'));
-"
-
-# Check if tables exist
-docker exec wedding-photo-sharing-backend-1 node scripts/add-token-revocation-tables.js
-```
-
-## Next Steps
-
-1. Review `AUTH_V2_DEPLOYMENT_PLAN.md`
-2. Install zxcvbn: `npm install zxcvbn@4.4.2`
-3. Run migrations
-4. Deploy incrementally
-5. Monitor for issues
-
-All critical authentication vulnerabilities have been addressed with production-ready fixes!

backend/Dockerfile

@@ -1,5 +1,8 @@
 FROM node:18-alpine AS builder
 
+# Add build argument for cache busting
+ARG CACHEBUST=1
+
 WORKDIR /app
 
 # Copy package files
@@ -16,8 +19,8 @@ FROM node:18-alpine
 
 WORKDIR /app
 
-# Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
+# Install dumb-init for proper signal handling and postgresql-client for database checks
+RUN apk add --no-cache dumb-init postgresql-client
 
 # Create non-root user
 RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
@@ -26,6 +29,9 @@ RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
 COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
 COPY --chown=nodejs:nodejs . .
 
+# Make wait script executable
+RUN chmod +x wait-for-db.sh
+
 # Create necessary directories
 RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs && \
     chown -R nodejs:nodejs storage data logs
@@ -35,4 +41,4 @@ USER nodejs
 EXPOSE 3000
 
 ENTRYPOINT ["dumb-init", "--"]
-CMD ["node", "server.js"]
+CMD ["./wait-for-db.sh", "node", "server.js"]

backend/SAFE_AUTH_ACTIVATION_PLAN.md

@@ -1,215 +0,0 @@
-# Safe Authentication Security Activation Plan
-
-## Current Situation Analysis
-
-### ✅ What's Already Protected:
-- **SQL Injection**: Fully protected with parameterized queries
-- **Rate Limiting**: Basic rate limiting active (5 attempts/15 min on /auth)
-- **Password Hashing**: Bcrypt in use
-- **CORS**: Properly configured
-
-### ❌ What's NOT Protected:
-- **No Account Lockout**: After rate limit, users can keep trying
-- **No Audit Trail**: Can't track attack patterns
-- **No Session Invalidation**: Can't force logout
-- **Limited Token Security**: Basic JWT validation only
-
-## Potential Problems & Solutions
-
-### Problem 1: Existing User Sessions
-**Risk**: Users might get logged out unexpectedly
-**Solution**: 
-- Enhanced auth accepts old tokens (backward compatible)
-- Tokens remain valid until natural expiration
-- Only new features (IP check, password change detection) are additions
-
-### Problem 2: Accidental Lockouts
-**Risk**: Legitimate users locked out due to typos
-**Solution**:
-- 5 attempts is reasonable (not too strict)
-- 30-minute lockout (not permanent)
-- Clear lockout message with retry time
-- Admin bypass SQL query ready
-
-### Problem 3: Database Migration Failure
-**Risk**: Schema changes could fail
-**Solution**:
-- Migrations only ADD tables/columns (no modifications)
-- Automatic backup before migration
-- Rollback plan ready
-- SQLite is forgiving with schema changes
-
-### Problem 4: Performance Impact
-**Risk**: Login tracking could slow down auth
-**Solution**:
-- Indexed columns for performance
-- Automatic cleanup of old records
-- Async logging (non-blocking)
-
-## Step-by-Step Activation Plan
-
-### Phase 1: Pre-Flight Checks (NOW)
-```bash
-# Run safety check script
-cd backend
-node scripts/safe-auth-deployment.js
-```
-This will:
-- ✓ Check database health
-- ✓ Count active sessions
-- ✓ Create backup
-- ✓ Test enhanced auth modules
-
-### Phase 2: Database Preparation (SAFE)
-```bash
-# Run in Docker
-docker exec wedding-photo-sharing-backend-1 npx knex migrate:latest
-```
-Creates:
-- `login_attempts` table (new)
-- Security columns in `admin_users` (nullable)
-
-### Phase 3: Test Without Activation
-```bash
-# Test enhanced auth endpoints
-chmod +x scripts/test-auth-deployment.sh
-./scripts/test-auth-deployment.sh
-```
-Verifies enhanced auth works before switching
-
-### Phase 4: Gradual Activation
-
-#### Option A: Canary Deployment (SAFEST)
-Add temporary route to test:
-```javascript
-// In server.js, add both temporarily
-app.use('/api/auth', authRoutes);  // Original
-app.use('/api/auth-new', authEnhancedRoutes);  // Test enhanced
-```
-
-Test with `/api/auth-new/admin/login` first
-
-#### Option B: Feature Flag (RECOMMENDED)
-```javascript
-// In server.js
-const useEnhancedAuth = process.env.USE_ENHANCED_AUTH === 'true';
-const authRoutes = useEnhancedAuth 
-  ? require('./src/routes/auth-enhanced')
-  : require('./src/routes/auth');
-```
-
-Then activate with environment variable
-
-#### Option C: Direct Switch (FASTER)
-```javascript
-// Change in server.js
-const authRoutes = require('./src/routes/auth-enhanced');
-
-// Add after DB init
-const { initializeCleanupJob } = require('./src/utils/authSecurity');
-initializeCleanupJob();
-```
-
-### Phase 5: Monitor After Activation
-```bash
-# Run monitoring script
-node scripts/monitor-auth-health.js
-```
-
-Watch for:
-- Sudden spike in failures
-- Multiple lockouts
-- Low success rate
-
-## Rollback Procedures
-
-### Quick Rollback (< 30 seconds):
-```bash
-# In server.js, revert to:
-const authRoutes = require('./src/routes/auth');
-
-# Restart
-docker-compose restart backend
-```
-
-### Clear All Lockouts:
-```bash
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('login_attempts').where('success', false).delete()
-    .then(() => console.log('Lockouts cleared'))
-    .then(() => db.destroy());
-"
-```
-
-### Emergency Admin Access:
-```sql
--- If admin is locked out
-DELETE FROM login_attempts WHERE identifier = 'admin';
-```
-
-## Success Criteria
-
-After activation, you should see:
-1. ✅ Failed login attempts recorded in database
-2. ✅ Account lockout after 5 failures
-3. ✅ Logout endpoint working
-4. ✅ No increase in auth errors
-5. ✅ Existing users still able to login
-
-## Timeline Recommendation
-
-**Day 1 (Now)**: 
-- Run migrations ✓
-- Deploy code ✓
-- Test endpoints
-
-**Day 2**: 
-- Monitor current auth patterns
-- Run test script during low traffic
-
-**Day 3**: 
-- Activate with feature flag
-- Monitor closely for 2 hours
-- Full activation if stable
-
-**Day 4+**: 
-- Review login_attempts data
-- Adjust thresholds if needed
-- Plan 2FA implementation
-
-## Commands Reference
-
-```bash
-# Activate enhanced auth
-docker exec -it wedding-photo-sharing-backend-1 /bin/sh
-vi server.js  # Make changes
-exit
-docker-compose restart backend
-
-# Monitor
-docker-compose logs -f backend | grep -i auth
-
-# Check lockouts
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('login_attempts')
-    .select('identifier')
-    .where('success', false)
-    .where('attempt_time', '>', new Date(Date.now() - 15*60*1000).toISOString())
-    .groupBy('identifier')
-    .havingRaw('COUNT(*) >= 5')
-    .then(locked => console.log('Locked accounts:', locked))
-    .then(() => db.destroy());
-"
-```
-
-## Final Safety Notes
-
-1. **It's been tested**: 10/10 unit tests pass
-2. **It's backward compatible**: Old tokens work
-3. **It's gradual**: Can activate features separately  
-4. **It's reversible**: Quick rollback available
-5. **It's monitored**: Health checking included
-
-The enhanced auth is designed to be transparent to users while significantly improving security. The only visible change is lockout messages after failed attempts.

backend/SECURITY_FIXES_COMPLETE.md

@@ -1,167 +0,0 @@
-# Security Fixes Deployment Complete ✅
-
-## Current Protection Status
-
-### 🛡️ FULLY PROTECTED Against:
-
-1. **SQL Injection** ✅
-   - All `whereRaw` queries replaced with parameterized queries
-   - LIKE patterns properly escaped
-   - Input validation for all user inputs
-   - **Status**: ACTIVE & PROTECTING
-
-2. **Brute Force Attacks** ✅
-   - Account lockout after 5 failed attempts
-   - 30-minute lockout duration
-   - IP and user agent tracking
-   - **Status**: ACTIVE & PROTECTING
-
-3. **User Enumeration** ✅
-   - Generic error messages for all auth failures
-   - Returns "Invalid credentials" consistently
-   - **Status**: ACTIVE & PROTECTING
-
-4. **Session Security** ✅
-   - Enhanced JWT with issuer validation
-   - IP tracking in tokens
-   - Password change detection
-   - Logout endpoint functional
-   - **Status**: ACTIVE & PROTECTING
-
-5. **Audit Trail** ✅
-   - All login attempts tracked in database
-   - Success/failure logging with timestamps
-   - IP address and user agent recording
-   - **Status**: ACTIVE & LOGGING
-
-## What Was Done
-
-### Database Changes
-- ✅ Created `login_attempts` table for tracking
-- ✅ Added security columns to `admin_users`:
-  - `password_changed_at`
-  - `last_login_ip`
-  - `two_factor_enabled`
-  - `two_factor_secret`
-
-### Code Changes
-- ✅ SQL injection fixes in 3 files
-- ✅ Enhanced auth middleware deployed
-- ✅ Enhanced auth routes active
-- ✅ Security utilities in place
-- ✅ Cleanup job running
-
-### Files Modified/Created
-```
-backend/
-├── src/
-│   ├── utils/
-│   │   ├── sqlSecurity.js ✅
-│   │   └── authSecurity.js ✅
-│   ├── middleware/
-│   │   └── auth-enhanced.js ✅
-│   └── routes/
-│       ├── auth-enhanced.js ✅
-│       ├── adminDashboard.js ✅ (SQL fixes)
-│       ├── adminEvents.js ✅ (SQL fixes)
-│       └── adminPhotos.js ✅ (SQL fixes)
-└── server.js ✅ (using enhanced auth)
-```
-
-## Monitoring Commands
-
-### Check Login Attempts
-```bash
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('login_attempts')
-    .orderBy('attempt_time', 'desc')
-    .limit(10)
-    .then(attempts => {
-      console.log('Recent login attempts:');
-      attempts.forEach(a => {
-        console.log(\`\${a.attempt_time} - \${a.identifier} - \${a.success ? 'SUCCESS' : 'FAILED'}\`);
-      });
-    })
-    .then(() => db.destroy());
-"
-```
-
-### Check Locked Accounts
-```bash
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('login_attempts')
-    .select('identifier')
-    .where('success', false)
-    .where('attempt_time', '>', new Date(Date.now() - 15*60*1000).toISOString())
-    .groupBy('identifier')
-    .havingRaw('COUNT(*) >= 5')
-    .then(locked => console.log('Locked accounts:', locked))
-    .then(() => db.destroy());
-"
-```
-
-### Monitor Health
-```bash
-node scripts/monitor-auth-health.js
-```
-
-## Rollback Plan (If Needed)
-
-### Quick Rollback
-```bash
-# Restore original server.js
-cp server.js.backup.1752359680463 server.js
-
-# Restart
-docker-compose restart backend
-```
-
-### Clear Lockouts
-```bash
-docker exec wedding-photo-sharing-backend-1 node -e "
-  const {db} = require('./src/database/db');
-  db('login_attempts').where('success', false).delete()
-    .then(() => console.log('All lockouts cleared'))
-    .then(() => db.destroy());
-"
-```
-
-## Next Steps
-
-### Immediate
-1. Monitor logs for any auth errors
-2. Watch for excessive lockouts
-3. Review login attempts daily
-
-### Short Term (1-2 weeks)
-1. Analyze login patterns
-2. Adjust lockout thresholds if needed
-3. Set up alerts for suspicious activity
-
-### Long Term
-1. Implement 2FA (columns already added)
-2. Add IP whitelisting for admins
-3. Implement password complexity requirements
-4. Add password expiration policies
-
-## Security Improvements Summary
-
-| Vulnerability | Before | After | Impact |
-|--------------|---------|--------|---------|
-| SQL Injection | ❌ Direct interpolation | ✅ Parameterized queries | Critical fix |
-| Brute Force | ❌ Unlimited attempts | ✅ 5 attempt lockout | High impact |
-| User Enum | ❌ Different errors | ✅ Generic errors | Medium impact |
-| Audit Trail | ❌ No tracking | ✅ Complete logging | High value |
-| Session Mgmt | ❌ Basic JWT | ✅ Enhanced validation | Medium impact |
-
-## Final Notes
-
-- All fixes are backward compatible
-- Existing sessions remain valid
-- No user impact expected
-- Quick rollback available
-- Monitoring in place
-
-The application is now significantly more secure with protection against common attack vectors. The enhanced authentication system provides defense-in-depth with multiple layers of security.

backend/SQL_INJECTION_FIX_MIGRATION.md

@@ -1,158 +0,0 @@
-# SQL Injection Fix Migration Guide
-
-## Overview
-This document describes the SQL injection vulnerability fixes applied to the PicPeak backend and the migration process for deploying these fixes to production.
-
-## Vulnerabilities Fixed
-
-### 1. WhereRaw Date Queries (High Risk)
-**Location**: `adminDashboard.js`
-- **Issue**: Direct string interpolation in SQL date calculations
-- **Example**: `.whereRaw(\`timestamp >= datetime("now", "-${days} days")\`)`
-- **Fix**: Replaced with parameterized queries using ISO date strings
-
-### 2. LIKE Pattern Injection (Medium Risk)
-**Locations**: `adminEvents.js`, `adminPhotos.js`
-- **Issue**: Unescaped user input in LIKE queries
-- **Example**: `.where('event_name', 'like', \`%${search}%\`)`
-- **Fix**: Added proper escaping for LIKE special characters (%, _, \)
-
-### 3. Dynamic Column/Order Injection (Low Risk)
-**Locations**: Various sorting operations
-- **Issue**: Unvalidated column names in ORDER BY
-- **Fix**: Whitelist validation for sort columns and orders
-
-## Files Changed
-
-1. **Created**: `backend/src/utils/sqlSecurity.js`
-   - Central security utility functions
-   - `sanitizeDays()` - Validates numeric input
-   - `escapeLikePattern()` - Escapes LIKE wildcards
-   - `validateSortColumn()` - Whitelist validation
-   - `validateSortOrder()` - Ensures only 'asc' or 'desc'
-
-2. **Modified**: `backend/src/routes/adminDashboard.js`
-   - Lines 21-24, 39-41, 45-47, 57-61, 65-68: Replaced whereRaw with parameterized queries
-   - Line 4: Added security utility imports
-   - Line 198: Added sanitizeDays for analytics
-
-3. **Modified**: `backend/src/routes/adminEvents.js`
-   - Line 11: Added escapeLikePattern import
-   - Lines 156-161: Escaped search patterns in LIKE queries
-
-4. **Modified**: `backend/src/routes/adminPhotos.js`
-   - Line 9: Added escapeLikePattern import
-   - Lines 477-478: Escaped search patterns in LIKE queries
-
-## Migration Steps
-
-### 1. Pre-Deployment Testing
-
-```bash
-# Run security utility tests
-cd backend
-node scripts/test-sql-security.js
-
-# Run verification script
-node scripts/verify-sql-fixes.js
-```
-
-### 2. Development Environment Testing
-
-```bash
-# Start development server
-npm run dev
-
-# Test key endpoints:
-curl http://localhost:3001/api/admin/dashboard/stats -H "Authorization: Bearer YOUR_TOKEN"
-curl http://localhost:3001/api/admin/events?search=test -H "Authorization: Bearer YOUR_TOKEN"
-curl http://localhost:3001/api/admin/dashboard/analytics?days=7 -H "Authorization: Bearer YOUR_TOKEN"
-```
-
-### 3. Production Deployment
-
-#### Option A: Docker Deployment
-```bash
-# Pull latest changes
-git pull
-
-# Rebuild and restart
-docker-compose down
-docker-compose up -d --build
-```
-
-#### Option B: PM2 Deployment
-```bash
-# Pull latest changes
-git pull
-
-# Install dependencies (if any)
-cd backend
-npm install
-
-# Restart with PM2
-pm2 restart picpeak-backend
-```
-
-### 4. Post-Deployment Verification
-
-1. **Monitor Logs**:
-   ```bash
-   # Docker
-   docker-compose logs -f backend
-   
-   # PM2
-   pm2 logs picpeak-backend
-   ```
-
-2. **Test Critical Functions**:
-   - Admin dashboard loads correctly
-   - Event search works with special characters
-   - Analytics charts display properly
-   - Photo search functions normally
-
-3. **Check Error Rates**:
-   - Monitor for any 500 errors
-   - Check database query logs for errors
-
-## Testing Special Characters
-
-After deployment, test these scenarios:
-
-1. **Search with wildcards**: Search for "50%" or "user_name"
-2. **Search with quotes**: Search for "O'Brien"
-3. **Date range**: Change analytics to different day ranges
-4. **Malicious input**: Try "'; DROP TABLE --" (should return no results)
-
-## Rollback Instructions
-
-If issues occur, see `SQL_INJECTION_FIX_ROLLBACK.md` for immediate rollback steps.
-
-## Performance Impact
-
-- Minimal performance impact expected
-- Date calculations now use ISO strings instead of SQLite functions
-- LIKE pattern escaping adds negligible overhead
-- All changes maintain existing query optimization
-
-## Security Improvements
-
-1. **Eliminated SQL Injection Vectors**: No more direct string interpolation
-2. **Input Validation**: All user inputs are validated/sanitized
-3. **Parameterized Queries**: Using Knex's built-in parameterization
-4. **Defense in Depth**: Multiple layers of protection
-
-## Future Recommendations
-
-1. Add request validation middleware
-2. Implement rate limiting on search endpoints
-3. Add SQL query logging for security auditing
-4. Consider using prepared statements for complex queries
-
-## Questions/Support
-
-If you encounter any issues during migration:
-1. Check the rollback plan first
-2. Review error logs for specific issues
-3. Test individual endpoints to isolate problems
-4. Contact development team if needed

backend/SQL_INJECTION_FIX_ROLLBACK.md

@@ -1,94 +0,0 @@
-# SQL Injection Fix Rollback Plan
-
-## Overview
-This document provides a rollback plan in case the SQL injection fixes cause issues in production.
-
-## Changes Made
-1. **Created**: `backend/src/utils/sqlSecurity.js` - Central security utilities
-2. **Modified**: `backend/src/routes/adminDashboard.js` - Replaced whereRaw with parameterized queries
-3. **Modified**: `backend/src/routes/adminPhotos.js` - Added LIKE pattern escaping
-4. **Modified**: `backend/src/routes/adminEvents.js` - Added LIKE pattern escaping
-
-## Quick Rollback Steps
-
-### Step 1: Revert Code Changes
-If issues occur, run these commands to revert:
-
-```bash
-# Navigate to backend directory
-cd backend
-
-# Revert specific files
-git checkout HEAD -- src/routes/adminDashboard.js
-git checkout HEAD -- src/routes/adminPhotos.js
-git checkout HEAD -- src/routes/adminEvents.js
-
-# Remove the new security utility file
-rm src/utils/sqlSecurity.js
-```
-
-### Step 2: Restart Services
-```bash
-# If using Docker
-docker-compose restart backend
-
-# If using PM2
-pm2 restart picpeak-backend
-```
-
-## Verification After Rollback
-
-1. Check admin dashboard loads: `/admin/dashboard`
-2. Test event search functionality
-3. Test photo search functionality
-4. Verify analytics charts display correctly
-
-## Symptoms That May Require Rollback
-
-1. **Dashboard Statistics Not Loading**
-   - Empty or NaN values in stats
-   - Analytics charts not rendering
-
-2. **Search Features Broken**
-   - Event search returns no results
-   - Photo search returns errors
-   - Special characters in search causing issues
-
-3. **Date Filtering Issues**
-   - Activity logs not showing correct date ranges
-   - Analytics showing incorrect time periods
-
-## Safe Testing Before Production
-
-1. **Test in Development First**:
-   ```bash
-   cd backend
-   npm run dev
-   ```
-
-2. **Test Key Features**:
-   - Admin dashboard stats: `http://localhost:3001/api/admin/dashboard/stats`
-   - Analytics: `http://localhost:3001/api/admin/dashboard/analytics?days=7`
-   - Event search: `http://localhost:3001/api/admin/events?search=test`
-   - Photo search: `http://localhost:3001/api/admin/events/1/photos?search=test`
-
-3. **Monitor Logs**:
-   ```bash
-   # Docker logs
-   docker-compose logs -f backend
-
-   # PM2 logs
-   pm2 logs picpeak-backend
-   ```
-
-## Emergency Contacts
-- Keep database backups before deploying
-- Have monitoring alerts for 500 errors
-- Document any custom SQL queries in use
-
-## Post-Rollback Actions
-If rollback is needed:
-1. Document the specific issue encountered
-2. Create test cases for the failure scenario
-3. Fix the issue in development
-4. Re-test thoroughly before re-deploying

backend/SQL_INJECTION_FIX_SUMMARY.md

@@ -1,64 +0,0 @@
-# SQL Injection Fix Summary
-
-## Quick Overview
-Fixed SQL injection vulnerabilities in the admin panel endpoints by:
-1. Replacing dangerous `whereRaw` queries with parameterized queries
-2. Escaping special characters in LIKE patterns
-3. Validating sort columns and orders
-
-## Test Results
-✅ All 31 security tests passed
-✅ Verification script confirms fixes working
-✅ No breaking changes to API functionality
-
-## Changed Files
-```
-backend/
-├── src/
-│   ├── utils/
-│   │   └── sqlSecurity.js (NEW - 117 lines)
-│   └── routes/
-│       ├── adminDashboard.js (6 changes)
-│       ├── adminEvents.js (2 changes)
-│       └── adminPhotos.js (2 changes)
-└── scripts/
-    ├── test-sql-security.js (NEW)
-    └── verify-sql-fixes.js (NEW)
-```
-
-## Before & After Examples
-
-### Date Range Queries
-```javascript
-// ❌ BEFORE (Vulnerable)
-.whereRaw(`timestamp >= datetime("now", "-${days} days")`)
-
-// ✅ AFTER (Safe)
-const startDate = new Date();
-startDate.setDate(startDate.getDate() - sanitizeDays(days));
-.where('timestamp', '>=', startDate.toISOString())
-```
-
-### LIKE Queries
-```javascript
-// ❌ BEFORE (Vulnerable)
-.where('event_name', 'like', `%${search}%`)
-
-// ✅ AFTER (Safe)
-const escapedSearch = escapeLikePattern(search);
-.where('event_name', 'like', `%${escapedSearch}%`)
-```
-
-## Deployment Checklist
-- [ ] Run `node scripts/test-sql-security.js` (should show 31/31 passed)
-- [ ] Test in development environment
-- [ ] Review rollback plan (`SQL_INJECTION_FIX_ROLLBACK.md`)
-- [ ] Deploy to production
-- [ ] Monitor logs for errors
-- [ ] Test search functionality with special characters
-
-## Risk Assessment
-- **Risk Level**: Low (with proper testing)
-- **Breaking Changes**: None
-- **Performance Impact**: Minimal
-- **Rollback Time**: < 2 minutes

backend/audit-backend.json

@@ -0,0 +1,22 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {},
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0,
+      "total": 0
+    },
+    "dependencies": {
+      "prod": 329,
+      "dev": 307,
+      "optional": 54,
+      "peer": 1,
+      "peerOptional": 0,
+      "total": 690
+    }
+  }
+}

backend/docs/SECURITY_LOGGING.md

@@ -0,0 +1,161 @@
+# Security Logging Documentation
+
+## Overview
+This document describes the comprehensive security logging implemented in the PicPeak application to track authentication failures, rate limiting, and suspicious activities.
+
+## Log Files
+
+### 1. **security.log**
+- Location: `logs/security.log`
+- Contains: All security-related events (authentication, rate limiting, suspicious activity)
+- Max Size: 20MB with rotation (keeps 10 files)
+- Format: JSON with timestamp
+
+### 2. **error.log**
+- Location: `logs/error.log`
+- Contains: All error-level logs including auth failures
+- Max Size: 10MB with rotation (keeps 5 files)
+
+### 3. **combined.log**
+- Location: `logs/combined.log`
+- Contains: All logs (info, warn, error)
+- Max Size: 50MB with rotation (keeps 10 files)
+
+## Security Events Logged
+
+### Rate Limiting
+When rate limits are exceeded, the following is logged:
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "Rate limit exceeded",
+  "security": true,
+  "ip": "192.168.1.1",
+  "path": "/api/admin/login",
+  "method": "POST",
+  "authenticated": false,
+  "userAgent": "Mozilla/5.0...",
+  "referer": "https://app.example.com",
+  "origin": "https://app.example.com",
+  "headers": {
+    "x-forwarded-for": "192.168.1.1",
+    "x-real-ip": "192.168.1.1"
+  },
+  "requestUrl": "/api/admin/login",
+  "rateLimitInfo": {
+    "limit": 5,
+    "current": 6,
+    "remaining": 0,
+    "resetTime": "2024-01-18T14:38:45.123Z"
+  }
+}
+```
+
+### Authentication Failures
+
+#### Admin Login Failures
+- Tracked in `login_attempts` table
+- Logged with: IP address, username, user agent, timestamp
+- Account lockout after 5 failures in 15 minutes
+
+#### Gallery Password Failures
+- Tracked in `access_logs` table with action='login_fail'
+- Logged with: event_id, IP address, user agent
+- Gallery lockout after 5 failures in 15 minutes
+
+### JWT Validation Failures
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "JWT validation failed",
+  "ip": "192.168.1.1",
+  "path": "/api/admin/events",
+  "method": "GET",
+  "userAgent": "Mozilla/5.0...",
+  "error": "TokenExpiredError",
+  "message": "jwt expired"
+}
+```
+
+### Suspicious Activity
+- Multiple IPs attempting login for same account
+- Token usage from different IP than issued
+- Token usage after password change
+- Revoked token usage attempts
+
+## Configuration Settings
+
+All rate limiting settings are configurable via the admin panel:
+
+| Setting | Default | Range | Description |
+|---------|---------|-------|-------------|
+| rate_limit_enabled | true | - | Enable/disable rate limiting |
+| rate_limit_window_minutes | 15 | 1-60 | Time window for rate limit |
+| rate_limit_max_requests | 1000 | 10-10000 | Max requests for general endpoints |
+| rate_limit_auth_max_requests | 5 | 1-100 | Max requests for auth endpoints |
+| rate_limit_skip_authenticated | true | - | Skip rate limit for authenticated requests |
+| rate_limit_public_endpoints_only | false | - | Only rate limit public endpoints |
+
+## Database Tables
+
+### login_attempts
+```sql
+- id
+- username
+- ip_address
+- user_agent
+- success (boolean)
+- created_at
+```
+
+### access_logs
+```sql
+- id
+- event_id
+- ip_address
+- user_agent
+- action ('view', 'download', 'login_success', 'login_fail')
+- photo_id (nullable)
+- created_at
+```
+
+## Environment Variables
+
+- `LOG_LEVEL`: Set logging level (default: 'info')
+- `LOG_TO_CONSOLE`: Enable console logging in production (default: false)
+
+## Monitoring Recommendations
+
+1. **Set up alerts for:**
+   - Rate limit exceeded events (possible DDoS)
+   - Multiple failed login attempts from same IP
+   - Account lockout events
+   - JWT validation failures spike
+
+2. **Regular review:**
+   - Check security.log for patterns
+   - Review login_attempts table for brute force attempts
+   - Monitor access_logs for suspicious gallery access patterns
+
+3. **Log analysis tools:**
+   - Use log aggregation tools (ELK stack, Splunk)
+   - Set up dashboards for security metrics
+   - Configure alerts for threshold breaches
+
+## Production Deployment Notes
+
+1. Ensure logs directory has proper permissions
+2. Set up log rotation outside of application if needed
+3. Consider shipping logs to centralized logging service
+4. Monitor disk space for log files
+5. Set `LOG_TO_CONSOLE=true` for container deployments
+
+## Security Best Practices
+
+1. Never log sensitive data (passwords, tokens)
+2. Use generic error messages to prevent user enumeration
+3. Clean up old login attempts regularly (7 days retention)
+4. Monitor for unusual patterns in real-time
+5. Keep rate limit settings appropriate for your usage

backend/init-production.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+# init-production.sh - Production initialization script
+
+set -e
+
+echo "🚀 Initializing PicPeak Production Environment..."
+
+# Wait for services to be ready
+echo "⏳ Waiting for database to be fully ready..."
+sleep 3
+
+# Fix permissions if running as root (shouldn't happen with proper Dockerfile)
+if [ "$(id -u)" = "0" ]; then
+    echo "🔧 Fixing file permissions..."
+    chown -R nodejs:nodejs /app/storage /app/data /app/logs 2>/dev/null || true
+fi
+
+# Create required directories
+echo "📁 Creating required directories..."
+mkdir -p /app/storage/events/active \
+         /app/storage/events/archived \
+         /app/storage/thumbnails \
+         /app/storage/uploads/logos \
+         /app/storage/uploads/favicons \
+         /app/data \
+         /app/logs
+
+# Run migrations with safe runner
+echo "🗄️ Running database migrations (safe mode)..."
+NODE_ENV=production npm run migrate:safe
+
+# Create admin user if environment variables are set
+if [ -n "$ADMIN_EMAIL" ] && [ -n "$ADMIN_PASSWORD" ]; then
+    echo "👤 Creating admin user..."
+    node scripts/create-admin.js \
+        --email "$ADMIN_EMAIL" \
+        --username "${ADMIN_USERNAME:-admin}" \
+        --password "$ADMIN_PASSWORD" || echo "Admin user might already exist"
+fi
+
+# Initialize email configuration if variables are set
+if [ -n "$SMTP_HOST" ]; then
+    echo "📧 Email configuration detected via environment variables"
+fi
+
+echo "✅ Production initialization complete!"
+echo "🌐 Starting application server..."
+
+# Start the application
+exec node server.js

backend/knexfile.js

@@ -0,0 +1,59 @@
+require('dotenv').config();
+
+const path = require('path');
+
+// Database configuration for different environments
+const config = {
+  development: {
+    client: process.env.DATABASE_CLIENT || 'sqlite3',
+    connection: process.env.DATABASE_CLIENT === 'pg' ? {
+      host: process.env.DB_HOST || 'localhost',
+      port: process.env.DB_PORT || 5432,
+      user: process.env.DB_USER || 'postgres',
+      password: process.env.DB_PASSWORD || 'postgres',
+      database: process.env.DB_NAME || 'photo_sharing'
+    } : {
+      filename: path.join(__dirname, process.env.DATABASE_PATH || './data/photo_sharing.db')
+    },
+    useNullAsDefault: process.env.DATABASE_CLIENT !== 'pg',
+    migrations: {
+      directory: './migrations'
+    },
+    seeds: {
+      directory: './seeds'
+    }
+  },
+
+  production: {
+    client: process.env.DATABASE_CLIENT || 'pg',
+    connection: {
+      host: process.env.DB_HOST || 'db',
+      port: process.env.DB_PORT || 5432,
+      user: process.env.DB_USER || 'picpeak',
+      password: process.env.DB_PASSWORD,
+      database: process.env.DB_NAME || 'picpeak',
+      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
+      // Connection stability settings
+      connectionTimeoutMillis: 30000,
+      idleTimeoutMillis: 30000,
+      keepAlive: true,
+      keepAliveInitialDelayMillis: 0
+    },
+    pool: {
+      min: 5,
+      max: 25,
+      acquireTimeoutMillis: 60000,
+      createTimeoutMillis: 60000,
+      idleTimeoutMillis: 30000,
+      reapIntervalMillis: 1000,
+      createRetryIntervalMillis: 200,
+      propagateCreateError: false
+    },
+    migrations: {
+      directory: './migrations'
+    },
+    acquireConnectionTimeout: 60000
+  }
+};
+
+module.exports = config[process.env.NODE_ENV || 'development'];

backend/migrations/018_add_created_at_to_email_queue.js

@@ -0,0 +1,23 @@
+exports.up = async function(knex) {
+  // Check if created_at column already exists
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  
+  if (!hasCreatedAt) {
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+    
+    // Update existing rows to have a created_at value based on scheduled_at
+    await knex('email_queue')
+      .whereNull('created_at')
+      .update({
+        created_at: knex.ref('scheduled_at')
+      });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.table('email_queue', (table) => {
+    table.dropColumn('created_at');
+  });
+};

backend/migrations/019_fix_email_templates_columns.js

@@ -0,0 +1,35 @@
+exports.up = async function(knex) {
+  // Check current column structure
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  if (hasSubjectEn && !hasSubject) {
+    // The language migration was applied, need to add back basic columns
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.string('subject');
+      table.text('body_html');
+      table.text('body_text');
+    });
+    
+    // Copy English values to the basic columns
+    await knex('email_templates').update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Check if we have the basic columns
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  
+  if (hasSubject && hasSubjectEn) {
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.dropColumn('subject');
+      table.dropColumn('body_html');
+      table.dropColumn('body_text');
+    });
+  }
+};

backend/migrations/020_ensure_default_email_templates.js

@@ -0,0 +1,91 @@
+exports.up = async function(knex) {
+  // Check if we have the default email templates
+  const templates = await knex('email_templates').select('template_key');
+  const existingKeys = templates.map(t => t.template_key);
+  
+  // Check which columns exist in the table
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  // Determine which columns to use based on schema
+  const subjectCol = hasSubjectEn ? 'subject_en' : 'subject';
+  const bodyHtmlCol = hasSubjectEn ? 'body_html_en' : 'body_html';
+  const bodyTextCol = hasSubjectEn ? 'body_text_en' : 'body_text';
+  
+  const defaultTemplates = [
+    {
+      template_key: 'gallery_created',
+      [subjectCol]: 'Your Photo Gallery is Ready!',
+      [bodyHtmlCol]: `<h2>Gallery Created Successfully</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Expires: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests to allow them to view and download photos.</p>`,
+      [bodyTextCol]: 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!',
+      variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+    },
+    {
+      template_key: 'expiration_warning',
+      [subjectCol]: 'Your Photo Gallery Expires Soon',
+      [bodyHtmlCol]: `<h2>Gallery Expiring Soon</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
+<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
+<p><a href="{{gallery_link}}">Visit Gallery</a></p>`,
+      [bodyTextCol]: 'Gallery Expiring Soon\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" will expire in {{days_remaining}} days.',
+      variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+    },
+    {
+      template_key: 'gallery_expired',
+      [subjectCol]: 'Your Photo Gallery Has Expired',
+      [bodyHtmlCol]: `<h2>Gallery Expired</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has expired and been archived.</p>
+<p>The photos are safely stored in our archive system. If you need access to the archived photos, please contact support.</p>`,
+      [bodyTextCol]: 'Gallery Expired\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has expired and been archived.',
+      variables: JSON.stringify(['host_name', 'event_name'])
+    },
+    {
+      template_key: 'archive_complete',
+      [subjectCol]: 'Gallery Archive Complete',
+      [bodyHtmlCol]: `<h2>Archive Complete</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully archived.</p>
+<p>Archive size: {{archive_size}}</p>
+<p>The archive is stored securely and can be retrieved if needed.</p>`,
+      [bodyTextCol]: 'Archive Complete\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been successfully archived.',
+      variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+    }
+  ];
+  
+  // Insert missing templates
+  for (const template of defaultTemplates) {
+    if (!existingKeys.includes(template.template_key)) {
+      // If we have language columns, also set German versions with same content
+      if (hasSubjectEn) {
+        template.subject_de = template[subjectCol];
+        template.body_html_de = template[bodyHtmlCol];
+        template.body_text_de = template[bodyTextCol];
+        
+        // Also ensure we have the basic columns if they exist
+        if (hasSubject) {
+          template.subject = template[subjectCol];
+          template.body_html = template[bodyHtmlCol];
+          template.body_text = template[bodyTextCol];
+        }
+      }
+      
+      await knex('email_templates').insert(template);
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove templates on rollback as they might have been customized
+};

backend/migrations/021_add_default_cms_pages.js

@@ -0,0 +1,121 @@
+exports.up = async function(knex) {
+  // Check if CMS pages already exist
+  const impressumExists = await knex('cms_pages')
+    .where('slug', 'impressum')
+    .first();
+    
+  const datenschutzExists = await knex('cms_pages')
+    .where('slug', 'datenschutz')
+    .first();
+  
+  const pagesToInsert = [];
+  
+  // Add Impressum page if it doesn't exist
+  if (!impressumExists) {
+    pagesToInsert.push({
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: `<h1>Legal Notice</h1>
+<p>Information according to § 5 TMG</p>
+
+<h2>Responsible for content</h2>
+<p>[Your Name]<br>
+[Your Address]<br>
+[Postal Code City]</p>
+
+<h2>Contact</h2>
+<p>Email: [Your Email Address]<br>
+Phone: [Your Phone Number]</p>
+
+<h2>Disclaimer</h2>
+<h3>Liability for content</h3>
+<p>The contents of our pages were created with great care. However, we cannot guarantee the accuracy, completeness and timeliness of the content.</p>
+
+<h3>Liability for links</h3>
+<p>Our website contains links to external third-party websites over whose content we have no influence. Therefore, we cannot accept any liability for this third-party content.</p>`,
+      content_de: `<h1>Impressum</h1>
+<p>Angaben gemäß § 5 TMG</p>
+
+<h2>Verantwortlich für den Inhalt</h2>
+<p>[Ihr Name]<br>
+[Ihre Adresse]<br>
+[PLZ Ort]</p>
+
+<h2>Kontakt</h2>
+<p>E-Mail: [Ihre E-Mail-Adresse]<br>
+Telefon: [Ihre Telefonnummer]</p>
+
+<h2>Haftungsausschluss</h2>
+<h3>Haftung für Inhalte</h3>
+<p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen.</p>
+
+<h3>Haftung für Links</h3>
+<p>Unser Angebot enthält Links zu externen Webseiten Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Add Datenschutz page if it doesn't exist
+  if (!datenschutzExists) {
+    pagesToInsert.push({
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: `<h1>Privacy Policy</h1>
+
+<h2>1. Privacy at a Glance</h2>
+<h3>General Information</h3>
+<p>The following information provides a simple overview of what happens to your personal data when you visit this website.</p>
+
+<h3>Data Collection on This Website</h3>
+<p><strong>Who is responsible for data collection on this website?</strong></p>
+<p>Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice of this website.</p>
+
+<p><strong>How do we collect your data?</strong></p>
+<p>Your data is collected when you provide it to us. This could be data that you enter into a contact form, for example.</p>
+
+<p><strong>What do we use your data for?</strong></p>
+<p>Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.</p>
+
+<h2>2. Hosting</h2>
+<p>This website is hosted externally. The personal data collected on this website is stored on the servers of the host.</p>
+
+<h2>3. General Information and Mandatory Information</h2>
+<h3>Data Protection</h3>
+<p>The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.</p>`,
+      content_de: `<h1>Datenschutzerklärung</h1>
+
+<h2>1. Datenschutz auf einen Blick</h2>
+<h3>Allgemeine Hinweise</h3>
+<p>Die folgenden Hinweise geben einen einfachen Überblick darüber, was mit Ihren personenbezogenen Daten passiert, wenn Sie diese Website besuchen.</p>
+
+<h3>Datenerfassung auf dieser Website</h3>
+<p><strong>Wer ist verantwortlich für die Datenerfassung auf dieser Website?</strong></p>
+<p>Die Datenverarbeitung auf dieser Website erfolgt durch den Websitebetreiber. Dessen Kontaktdaten können Sie dem Impressum dieser Website entnehmen.</p>
+
+<p><strong>Wie erfassen wir Ihre Daten?</strong></p>
+<p>Ihre Daten werden zum einen dadurch erhoben, dass Sie uns diese mitteilen. Hierbei kann es sich z.B. um Daten handeln, die Sie in ein Kontaktformular eingeben.</p>
+
+<p><strong>Wofür nutzen wir Ihre Daten?</strong></p>
+<p>Ein Teil der Daten wird erhoben, um eine fehlerfreie Bereitstellung der Website zu gewährleisten. Andere Daten können zur Analyse Ihres Nutzerverhaltens verwendet werden.</p>
+
+<h2>2. Hosting</h2>
+<p>Diese Website wird extern gehostet. Die personenbezogenen Daten, die auf dieser Website erfasst werden, werden auf den Servern des Hosters gespeichert.</p>
+
+<h2>3. Allgemeine Hinweise und Pflichtinformationen</h2>
+<h3>Datenschutz</h3>
+<p>Die Betreiber dieser Seiten nehmen den Schutz Ihrer persönlichen Daten sehr ernst. Wir behandeln Ihre personenbezogenen Daten vertraulich und entsprechend der gesetzlichen Datenschutzvorschriften sowie dieser Datenschutzerklärung.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Insert pages if any need to be added
+  if (pagesToInsert.length > 0) {
+    await knex('cms_pages').insert(pagesToInsert);
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove CMS pages on rollback as they might have been customized
+};

backend/migrations/022_fix_json_columns.js

@@ -0,0 +1,68 @@
+exports.up = async function(knex) {
+  console.log('Fixing JSON columns in database...');
+  
+  // Fix email_templates variables column
+  const templates = await knex('email_templates').select('id', 'template_key', 'variables');
+  
+  for (const template of templates) {
+    if (template.variables && typeof template.variables === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(template.variables);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in email template ${template.template_key}`);
+        // Attempt to fix common issues
+        let fixed = template.variables;
+        
+        // If it looks like an array but isn't valid JSON, try to fix it
+        if (fixed.startsWith('[') && fixed.endsWith(']')) {
+          // Extract the content and properly format it
+          const content = fixed.slice(1, -1);
+          const items = content.split(',').map(item => item.trim().replace(/['"]/g, ''));
+          fixed = JSON.stringify(items);
+        } else {
+          // Default to empty array if we can't fix it
+          fixed = JSON.stringify([]);
+        }
+        
+        await knex('email_templates')
+          .where('id', template.id)
+          .update({ variables: fixed });
+      }
+    } else if (!template.variables) {
+      // Set default empty array for null values
+      await knex('email_templates')
+        .where('id', template.id)
+        .update({ variables: JSON.stringify([]) });
+    }
+  }
+  
+  // Fix activity_logs metadata column
+  const activities = await knex('activity_logs').select('id', 'metadata');
+  
+  for (const activity of activities) {
+    if (activity.metadata && typeof activity.metadata === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(activity.metadata);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in activity log ${activity.id}`);
+        // Default to empty object if we can't parse it
+        await knex('activity_logs')
+          .where('id', activity.id)
+          .update({ metadata: JSON.stringify({}) });
+      }
+    } else if (!activity.metadata) {
+      // Set default empty object for null values
+      await knex('activity_logs')
+        .where('id', activity.id)
+        .update({ metadata: JSON.stringify({}) });
+    }
+  }
+  
+  console.log('JSON columns fixed successfully');
+};
+
+exports.down = async function(knex) {
+  // No rollback needed - data fixes only
+};

backend/migrations/023_ensure_postgres_compatibility.js

@@ -0,0 +1,22 @@
+/**
+ * Ensure PostgreSQL compatibility for all insert operations
+ * This migration doesn't change the schema but ensures all tables
+ * are compatible with .returning() syntax
+ */
+
+exports.up = async function(knex) {
+  // This migration is informational only
+  // All insert operations should use .returning('id') going forward
+  
+  console.log('PostgreSQL compatibility check:');
+  console.log('- All INSERT operations should use .returning("id")');
+  console.log('- All date operations should use ISO strings');
+  console.log('- Boolean values are handled automatically by Knex');
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/024_fix_boolean_compatibility.js

@@ -0,0 +1,29 @@
+/**
+ * Fix boolean compatibility issues between PostgreSQL and SQLite
+ * This migration updates the database configuration and existing data
+ */
+
+exports.up = async function(knex) {
+  const isPostgres = knex.client.config.client === 'pg';
+  
+  if (!isPostgres) {
+    // Enable foreign keys for SQLite
+    await knex.raw('PRAGMA foreign_keys = ON');
+    
+    // Note: SQLite stores booleans as 0/1
+    // No data migration needed as Knex handles this automatically
+    // But queries must use formatBoolean() helper
+    
+    console.log('SQLite boolean compatibility check:');
+    console.log('- SQLite stores booleans as 0/1');
+    console.log('- All boolean comparisons should use formatBoolean() helper');
+    console.log('- Foreign keys enabled');
+  }
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};

backend/migrations/025_fix_email_queue_updated_at.js

@@ -0,0 +1,33 @@
+/**
+ * Fix email_queue table by ensuring it doesn't have updated_at column
+ * This migration addresses the PostgreSQL error where queries are trying to update
+ * a non-existent updated_at column
+ */
+
+exports.up = async function(knex) {
+  // First, check if the column exists
+  const hasUpdatedAt = await knex.schema.hasColumn('email_queue', 'updated_at');
+  
+  if (hasUpdatedAt) {
+    console.log('Found updated_at column in email_queue table, removing it...');
+    await knex.schema.table('email_queue', (table) => {
+      table.dropColumn('updated_at');
+    });
+  }
+  
+  // Also ensure the table has all required columns
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  if (!hasCreatedAt) {
+    console.log('Adding missing created_at column to email_queue table...');
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+  }
+  
+  console.log('email_queue table schema fixed');
+};
+
+exports.down = async function(knex) {
+  // In the down migration, we don't add back updated_at since it shouldn't exist
+  // This is intentionally left minimal
+};

backend/migrations/026_fix_german_email_templates.js

@@ -0,0 +1,234 @@
+exports.up = async function(knex) {
+  // Update gallery_created template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_de: 'Ihre Fotogalerie ist bereit!',
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Ablaufdatum: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.</p>
+<p style="background-color: #FEF3C7; padding: 15px; border-radius: 5px; border-left: 4px solid #F59E0B;">
+  <strong>Wichtig:</strong> Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie anzeigen</a>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie erfolgreich erstellt
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
+
+{{#if welcome_message}}
+Persönliche Nachricht:
+{{welcome_message}}
+
+{{/if}}
+Galerie-Details:
+- Veranstaltungsdatum: {{event_date}}
+- Galerie-Link: {{gallery_link}}
+- Passwort: {{gallery_password}}
+- Ablaufdatum: {{expiry_date}}
+
+Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.
+
+WICHTIG: Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update expiration_warning template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_de: 'Ihre Fotogalerie läuft bald ab',
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in <strong>{{days_remaining}} Tagen</strong> ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.</p>
+<p><strong>Ablaufdatum:</strong> {{expiry_date}}</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie jetzt besuchen</a>
+<p style="background-color: #FEE2E2; padding: 15px; border-radius: 5px; border-left: 4px solid #EF4444;">
+  <strong>Erinnerung:</strong> Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie läuft bald ab
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.
+
+Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.
+
+Ablaufdatum: {{expiry_date}}
+
+Galerie-Link: {{gallery_link}}
+
+ERINNERUNG: Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update gallery_expired template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.</p>
+<p>Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.</p>
+<p>Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:</p>
+<p style="background-color: #F3F4F6; padding: 15px; border-radius: 5px;">
+  <strong>Kontakt:</strong><br>
+  E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a><br>
+  {{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie abgelaufen
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.
+
+Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.
+
+Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:
+
+E-Mail: {{admin_email}}
+{{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+
+Vielen Dank für die Nutzung unseres Foto-Sharing-Services!
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update archive_complete template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p><strong>Archiv-Details:</strong></p>
+<ul>
+  <li>Archivgröße: {{archive_size}}</li>
+  <li>Archivierungsdatum: {{archive_date}}</li>
+  <li>Anzahl der Fotos: {{photo_count}}</li>
+</ul>
+<p>Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.</p>
+<p style="background-color: #F0FDF4; padding: 15px; border-radius: 5px; border-left: 4px solid #22C55E;">
+  <strong>✓ Erfolgreich archiviert:</strong> Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+</p>
+<p>Kontakt für Archivzugriff:<br>
+E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a></p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Archivierung abgeschlossen
+
+Liebe(r) {{host_name}},
+
+Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.
+
+Archiv-Details:
+- Archivgröße: {{archive_size}}
+- Archivierungsdatum: {{archive_date}}
+- Anzahl der Fotos: {{photo_count}}
+
+Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.
+
+✓ ERFOLGREICH ARCHIVIERT: Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+
+Kontakt für Archivzugriff:
+E-Mail: {{admin_email}}
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Also update the non-language-specific fields to match German for consistency
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous German translations
+  // This is a simplified rollback - in production you might want to store the old values
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+};

backend/migrations/027_add_language_preferences.js

@@ -0,0 +1,41 @@
+exports.up = async function(knex) {
+  // Add language column to events table if it doesn't exist
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (!hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.string('language', 5).defaultTo('en');
+    });
+  }
+  
+  // Add default_language to email_configs if it doesn't exist
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (!hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.string('default_language', 5).defaultTo('en');
+    });
+  }
+  
+  // Set default language to German for the existing email config
+  await knex('email_configs')
+    .update({
+      default_language: 'de'
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove language column from events table
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('language');
+    });
+  }
+  
+  // Remove default_language from email_configs
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.dropColumn('default_language');
+    });
+  }
+};

backend/migrations/027_add_rate_limit_settings.js

@@ -0,0 +1,63 @@
+exports.up = async function(knex) {
+  // Add rate limit settings to app_settings
+  const rateLimitSettings = [
+    {
+      setting_key: 'rate_limit_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_window_minutes',
+      setting_value: JSON.stringify(15),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_max_requests',
+      setting_value: JSON.stringify(1000),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_auth_max_requests',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_skip_authenticated',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_public_endpoints_only',
+      setting_value: JSON.stringify(false),
+      setting_type: 'security'
+    }
+  ];
+
+  // Insert settings if they don't exist
+  for (const setting of rateLimitSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove rate limit settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'rate_limit_enabled',
+      'rate_limit_window_minutes',
+      'rate_limit_max_requests',
+      'rate_limit_auth_max_requests',
+      'rate_limit_skip_authenticated',
+      'rate_limit_public_endpoints_only'
+    ])
+    .del();
+};

backend/migrations/028_update_english_templates_to_match_german.js

@@ -0,0 +1,307 @@
+exports.up = async function(knex) {
+  // Update English templates to match the quality and content of German templates
+  
+  // 1. Gallery Created - Match German version with proper styling and conditionals
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your photo gallery is ready',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> for {{event_date}} has been successfully created and is now online!</p>
+
+{{#if welcome_message}}
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 15px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Personal message from your photographer:</strong></p>
+  <p style="margin: 10px 0 0 0;">{{welcome_message}}</p>
+</div>
+{{/if}}
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Your access data:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Gallery link:</strong> <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li style="margin-bottom: 10px;"><strong>Password:</strong> {{gallery_password}}</li>
+  </ul>
+</div>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500;">View Gallery</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Important:</strong> Your gallery will be available until <strong>{{expiry_date}}</strong>. After this date, the photos will be archived and will only be available upon request.</p>
+</div>
+
+<p>We hope you enjoy your photos!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" for {{event_date}} has been successfully created and is now online!
+
+{{#if welcome_message}}
+Personal message from your photographer:
+{{welcome_message}}
+{{/if}}
+
+Your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+Important: Your gallery will be available until {{expiry_date}}. After this date, the photos will be archived and will only be available upon request.
+
+We hope you enjoy your photos!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 2. Expiration Warning - Match German version with urgency and styling
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Your photo gallery expires soon',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> will expire in <strong style="color: #e74c3c; font-size: 18px;">{{days_remaining}} days</strong>!</p>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">⚠️ Important Notice</p>
+  <p style="margin: 10px 0 0 0;">After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.</p>
+</div>
+
+<p><strong>Don't miss out – download your photos now!</strong></p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 14px 35px; background-color: #e74c3c; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Visit Gallery Now</a>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Quick reminder of your access data:</strong></p>
+  <ul style="list-style: none; padding: 0; margin: 10px 0 0 0;">
+    <li>Gallery link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li>Password: {{gallery_password}}</li>
+  </ul>
+</div>
+
+<p>If you have any questions, please don't hesitate to contact us.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days!
+
+⚠️ Important Notice
+After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.
+
+Don't miss out – download your photos now!
+
+Quick reminder of your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+If you have any questions, please don't hesitate to contact us.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 3. Gallery Expired - Match German version with contact information
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Your photo gallery has expired',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> expired on {{expiry_date}} and is no longer accessible online.</p>
+
+<div style="background-color: #f9f9f9; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <h3 style="margin-top: 0;">Your photos are safely archived</h3>
+  <p>Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:</p>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;">📧 Email: <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a></li>
+    {{#if support_phone}}
+    <li>📞 Phone: {{support_phone}}</li>
+    {{/if}}
+  </ul>
+</div>
+
+<p>Please have the following information ready when contacting us:</p>
+<ul>
+  <li>Event name: {{event_name}}</li>
+  <li>Event date: {{event_date}}</li>
+  <li>Expiry date: {{expiry_date}}</li>
+</ul>
+
+<p>We'll be happy to help you access your archived photos.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" expired on {{expiry_date}} and is no longer accessible online.
+
+Your photos are safely archived
+Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:
+
+📧 Email: {{support_email}}
+{{#if support_phone}}📞 Phone: {{support_phone}}{{/if}}
+
+Please have the following information ready when contacting us:
+- Event name: {{event_name}}
+- Event date: {{event_date}}
+- Expiry date: {{expiry_date}}
+
+We'll be happy to help you access your archived photos.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 4. Archive Complete - Match German version with success message and details
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Your photo gallery has been successfully archived',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> has been successfully archived.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold;">✅ Archive successfully created</p>
+  <p style="margin: 10px 0 0 0;">Your photos are now safely stored in our archive.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Archive details:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;"><strong>Event:</strong> {{event_name}}</li>
+    <li style="margin-bottom: 8px;"><strong>Archive date:</strong> {{archive_date}}</li>
+    <li style="margin-bottom: 8px;"><strong>Number of photos:</strong> {{photo_count}}</li>
+    <li><strong>Archive size:</strong> {{archive_size}}</li>
+  </ul>
+</div>
+
+<p>If you need access to your archived photos in the future, please contact us at:</p>
+<p style="margin-left: 20px;">
+  📧 <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a><br>
+  {{#if support_phone}}📞 {{support_phone}}{{/if}}
+</p>
+
+<p>Thank you for using our photo sharing service!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" has been successfully archived.
+
+✅ Archive successfully created
+Your photos are now safely stored in our archive.
+
+Archive details:
+- Event: {{event_name}}
+- Archive date: {{archive_date}}
+- Number of photos: {{photo_count}}
+- Archive size: {{archive_size}}
+
+If you need access to your archived photos in the future, please contact us at:
+📧 {{support_email}}
+{{#if support_phone}}📞 {{support_phone}}{{/if}}
+
+Thank you for using our photo sharing service!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 5. Test Email - Update to match German style
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email - Photo Sharing Platform',
+      body_html_en: `
+<h2>Test Email</h2>
+
+<p>This is a test email from your photo sharing platform.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>✅ Email configuration successful!</strong></p>
+  <p style="margin: 10px 0 0 0;">Your email settings have been configured correctly and emails can be sent.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Configuration details:</strong></p>
+  <ul style="margin: 10px 0 0 0;">
+    <li>Timestamp: {{timestamp}}</li>
+    <li>Sender: {{from_email}}</li>
+  </ul>
+</div>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Test Email
+
+This is a test email from your photo sharing platform.
+
+✅ Email configuration successful!
+Your email settings have been configured correctly and emails can be sent.
+
+Configuration details:
+- Timestamp: {{timestamp}}
+- Sender: {{from_email}}
+
+Best regards,
+Your Photo Sharing Team`
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous simpler English templates
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your Photo Gallery is Ready',
+      body_html_en: '<h2>Hello,</h2><p>Your photo gallery "{{event_name}}" has been created.</p><p><strong>Access Link:</strong> <a href="{{gallery_link}}">{{gallery_link}}</a></p><p><strong>Password:</strong> {{gallery_password}}</p><p>The gallery will be available until {{expiry_date}}.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has been created. Access Link: {{gallery_link}} Password: {{gallery_password}} The gallery will be available until {{expiry_date}}.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Gallery Expires in {{days_remaining}} Days',
+      body_html_en: '<h2>Reminder</h2><p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p><p>Please download your photos before {{expiry_date}}.</p><p><a href="{{gallery_link}}">Access Gallery</a></p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days. Please download your photos before {{expiry_date}}. Access Gallery: {{gallery_link}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Gallery Expired',
+      body_html_en: '<h2>Gallery Expired</h2><p>Your photo gallery "{{event_name}}" has expired and is no longer accessible.</p><p>If you need access to your photos, please contact support.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has expired and is no longer accessible. If you need access to your photos, please contact support.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Gallery Archived',
+      body_html_en: '<h2>Archive Complete</h2><p>Your gallery "{{event_name}}" has been archived.</p><p>Archive size: {{archive_size}}</p>',
+      body_text_en: 'Your gallery "{{event_name}}" has been archived. Archive size: {{archive_size}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email',
+      body_html_en: '<p>This is a test email sent at {{timestamp}}.</p>',
+      body_text_en: 'This is a test email sent at {{timestamp}}.'
+    });
+};

backend/migrations/add_must_change_password.js.old

@@ -1,25 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function addMustChangePasswordColumn() {
-  try {
-    // Check if the column already exists
-    const hasMustChangePassword = await db.schema.hasColumn('admin_users', 'must_change_password');
-    
-    if (!hasMustChangePassword) {
-      await db.schema.table('admin_users', (table) => {
-        table.boolean('must_change_password').defaultTo(false);
-      });
-      
-      console.log('✅ Added must_change_password column to admin_users table');
-    } else {
-      console.log('ℹ️  must_change_password column already exists');
-    }
-    
-    process.exit(0);
-  } catch (error) {
-    console.error('❌ Migration failed:', error);
-    process.exit(1);
-  }
-}
-
-addMustChangePasswordColumn();

backend/migrations/helpers.js

@@ -0,0 +1,83 @@
+/**
+ * Migration helper functions for production-safe migrations
+ */
+
+/**
+ * Create a table only if it doesn't already exist
+ */
+async function createTableIfNotExists(knex, tableName, callback) {
+  const exists = await knex.schema.hasTable(tableName);
+  if (!exists) {
+    console.log(`Creating table: ${tableName}`);
+    return knex.schema.createTable(tableName, callback);
+  } else {
+    console.log(`Table ${tableName} already exists, skipping...`);
+  }
+}
+
+/**
+ * Add column to table only if it doesn't exist
+ */
+async function addColumnIfNotExists(knex, tableName, columnName, callback) {
+  const hasColumn = await knex.schema.hasColumn(tableName, columnName);
+  if (!hasColumn) {
+    console.log(`Adding column ${columnName} to table ${tableName}`);
+    return knex.schema.alterTable(tableName, (table) => {
+      callback(table);
+    });
+  } else {
+    console.log(`Column ${columnName} already exists in table ${tableName}, skipping...`);
+  }
+}
+
+/**
+ * Insert data only if it doesn't already exist
+ */
+async function insertIfNotExists(knex, tableName, data, uniqueField) {
+  const exists = await knex(tableName)
+    .where(uniqueField, data[uniqueField])
+    .first();
+  
+  if (!exists) {
+    console.log(`Inserting ${uniqueField}: ${data[uniqueField]} into ${tableName}`);
+    return knex(tableName).insert(data);
+  } else {
+    console.log(`${uniqueField}: ${data[uniqueField]} already exists in ${tableName}, skipping...`);
+  }
+}
+
+/**
+ * Create index only if it doesn't exist
+ */
+async function createIndexIfNotExists(knex, tableName, columns, indexName) {
+  // This is database-specific, works for PostgreSQL
+  if (knex.client.config.client === 'pg') {
+    const result = await knex.raw(`
+      SELECT 1 FROM pg_indexes 
+      WHERE tablename = ? AND indexname = ?
+    `, [tableName, indexName]);
+    
+    if (result.rows.length === 0) {
+      console.log(`Creating index ${indexName} on ${tableName}`);
+      return knex.schema.alterTable(tableName, (table) => {
+        table.index(columns, indexName);
+      });
+    }
+  } else {
+    // For SQLite, just try to create and ignore errors
+    try {
+      await knex.schema.alterTable(tableName, (table) => {
+        table.index(columns, indexName);
+      });
+    } catch (error) {
+      // Index probably already exists
+    }
+  }
+}
+
+module.exports = {
+  createTableIfNotExists,
+  addColumnIfNotExists,
+  insertIfNotExists,
+  createIndexIfNotExists
+};

backend/migrations/run-migrations-safe.js

@@ -0,0 +1,170 @@
+const fs = require('fs').promises;
+const path = require('path');
+const { db } = require('../src/database/db');
+
+/**
+ * Production-safe migration runner that handles existing schema
+ */
+
+// Create or verify migrations tracking table
+async function ensureMigrationsTable() {
+  const tableExists = await db.schema.hasTable('migrations');
+  if (!tableExists) {
+    await db.schema.createTable('migrations', (table) => {
+      table.increments('id').primary();
+      table.string('filename').unique().notNullable();
+      table.timestamp('applied_at').defaultTo(db.fn.now());
+    });
+    console.log('Created migrations tracking table');
+  }
+}
+
+// Check if a migration has been applied
+async function isMigrationApplied(filename) {
+  const result = await db('migrations').where('filename', filename).first();
+  return !!result;
+}
+
+// Mark migration as applied without running it (for existing schema)
+async function markMigrationAsApplied(filename) {
+  await db('migrations').insert({ filename });
+  console.log(`Marked migration ${filename} as applied`);
+}
+
+// Detect existing schema and mark migrations as applied
+async function detectExistingSchema() {
+  console.log('Detecting existing schema...');
+  
+  const tableChecks = [
+    { table: 'events', migration: 'init.js' },
+    { table: 'photos', migration: 'init.js' },
+    { table: 'photo_categories', migration: '004_add_categories_and_cms.js' },
+    { table: 'cms_pages', migration: '004_add_categories_and_cms.js' },
+    { table: 'login_attempts', migration: '015_add_login_attempts_table.js' },
+    { table: 'token_blacklist', migration: '017_add_token_revocation_tables.js' },
+  ];
+  
+  for (const check of tableChecks) {
+    const exists = await db.schema.hasTable(check.table);
+    if (exists) {
+      const isApplied = await isMigrationApplied(check.migration);
+      if (!isApplied) {
+        await markMigrationAsApplied(check.migration);
+      }
+    }
+  }
+}
+
+// Run a single migration safely
+async function runMigrationSafely(filename) {
+  try {
+    const migrationPath = path.join(__dirname, filename);
+    const migration = require(migrationPath);
+    
+    if (migration.up) {
+      console.log(`Running migration: ${filename}`);
+      
+      // Run migration in a transaction if possible
+      if (db.client.config.client === 'pg') {
+        await db.transaction(async (trx) => {
+          await migration.up(trx);
+        });
+      } else {
+        await migration.up(db);
+      }
+      
+      await db('migrations').insert({ filename });
+      console.log(`Migration ${filename} completed successfully`);
+    }
+  } catch (error) {
+    // Check if error is because schema already exists
+    if (error.code === '42P07' || // PostgreSQL: relation already exists
+        error.code === 'SQLITE_ERROR' && error.message.includes('already exists')) {
+      console.log(`Migration ${filename} - schema already exists, marking as applied`);
+      await markMigrationAsApplied(filename);
+    } else {
+      throw error;
+    }
+  }
+}
+
+// Main migration runner
+async function runMigrations() {
+  let connection;
+  try {
+    console.log('Starting production-safe database migrations...');
+    
+    // Ensure database connection is ready
+    await db.raw('SELECT 1');
+    console.log('Database connection verified');
+    
+    // Create migrations tracking table
+    await ensureMigrationsTable();
+    
+    // Detect and mark existing schema
+    await detectExistingSchema();
+    
+    // Get all migration files
+    const files = await fs.readdir(__dirname);
+    const migrationFiles = files
+      .filter(f => f.match(/^\d{3}_.*\.js$/) || f === 'init.js')
+      .sort((a, b) => {
+        // Ensure init.js runs first
+        if (a === 'init.js') return -1;
+        if (b === 'init.js') return 1;
+        return a.localeCompare(b);
+      });
+    
+    // Run pending migrations
+    let pendingCount = 0;
+    let skippedCount = 0;
+    
+    for (const file of migrationFiles) {
+      const isApplied = await isMigrationApplied(file);
+      if (!isApplied) {
+        await runMigrationSafely(file);
+        pendingCount++;
+      } else {
+        skippedCount++;
+      }
+    }
+    
+    console.log(`\nMigration Summary:`);
+    console.log(`- Applied: ${pendingCount} migration(s)`);
+    console.log(`- Skipped: ${skippedCount} migration(s) (already applied)`);
+    console.log(`- Total: ${migrationFiles.length} migration(s)`);
+    console.log('\nAll migrations completed successfully');
+    
+    // Close database connection
+    await db.destroy();
+    process.exit(0);
+  } catch (error) {
+    console.error('\n❌ Migration failed:', error.message);
+    console.error('Error details:', error);
+    
+    // Close database connection on error
+    try {
+      await db.destroy();
+    } catch (e) {
+      // Ignore
+    }
+    
+    process.exit(1);
+  }
+}
+
+// Add delay for database readiness in production
+async function waitAndRun() {
+  if (process.env.NODE_ENV === 'production') {
+    console.log('Waiting 2 seconds for database readiness...');
+    await new Promise(resolve => setTimeout(resolve, 2000));
+  }
+  await runMigrations();
+}
+
+// Only run if called directly
+if (require.main === module) {
+  waitAndRun();
+}
+
+module.exports = { runMigrations };

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.2",
+  "version": "1.0.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-backend",
-      "version": "1.0.2",
+      "version": "1.0.71",
       "dependencies": {
         "adm-zip": "^0.5.16",
         "archiver": "^5.3.1",
@@ -19,6 +19,7 @@
         "express-rate-limit": "^6.7.0",
         "express-validator": "^7.0.1",
         "form-data": "^4.0.3",
+        "handlebars": "^4.7.8",
         "helmet": "^7.0.0",
         "i18next": "^25.3.1",
         "i18next-browser-languagedetector": "^8.2.0",
@@ -29,6 +30,7 @@
         "multer": "^2.0.1",
         "node-cron": "^3.0.2",
         "nodemailer": "^6.9.1",
+        "pg": "^8.16.3",
         "react-i18next": "^15.6.0",
         "sharp": "^0.32.0",
         "sqlite3": "^5.1.6",
@@ -3994,6 +3996,27 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/handlebars": {
+      "version": "4.7.8",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
+      "integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+      "license": "MIT",
+      "dependencies": {
+        "minimist": "^1.2.5",
+        "neo-async": "^2.6.2",
+        "source-map": "^0.6.1",
+        "wordwrap": "^1.0.0"
+      },
+      "bin": {
+        "handlebars": "bin/handlebars"
+      },
+      "engines": {
+        "node": ">=0.4.7"
+      },
+      "optionalDependencies": {
+        "uglify-js": "^3.1.4"
+      }
+    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -5984,6 +6007,12 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/neo-async": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
+      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
+      "license": "MIT"
+    },
     "node_modules/node-abi": {
       "version": "3.75.0",
       "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.75.0.tgz",
@@ -6471,12 +6500,101 @@
       "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
       "license": "MIT"
     },
+    "node_modules/pg": {
+      "version": "8.16.3",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.16.3.tgz",
+      "integrity": "sha512-enxc1h0jA/aq5oSDMvqyW3q89ra6XIIDZgCX9vkMrnz5DFTw/Ny3Li2lFQ+pt3L6MCgm/5o2o8HW9hiJji+xvw==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.9.1",
+        "pg-pool": "^3.10.1",
+        "pg-protocol": "^1.10.3",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.2.7"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.2.7.tgz",
+      "integrity": "sha512-YgCtzMH0ptvZJslLM1ffsY4EuGaU0cx4XSdXLRFae8bPP4dS5xL1tNB3k2o/N64cHJpwU7dxKli/nZ2lUa5fLg==",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/pg-connection-string": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.6.1.tgz",
       "integrity": "sha512-w6ZzNu6oMmIzEAYVw+RLK0+nqHPt8K3ZnknKi+g48Ak2pr3dtljJW3o+D/n2zzCG07Zoe9VOX3aiKpj+BN0pjg==",
       "license": "MIT"
     },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/pg-pool": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.10.1.tgz",
+      "integrity": "sha512-Tu8jMlcX+9d8+QVzKIvM/uJtp07PKr82IUOYEphaWcoBhIYkoHpLXN3qO59nAI11ripznDsEzEv8nUxBVWajGg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.10.3",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.10.3.tgz",
+      "integrity": "sha512-6DIBgBQaTKDJyxnXaLiLR8wBpQQcGWuAESkRBX/t6OwA8YsqP+iVSiond2EDy6Y/dsGk8rh/jtax3js5NeV7JQ==",
+      "license": "MIT"
+    },
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/pg/node_modules/pg-connection-string": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.9.1.tgz",
+      "integrity": "sha512-nkc6NpDcvPVpZXxrreI/FOtX3XemeLl8E0qFr6F2Lrm/I8WOnaWNhIPK2Z7OHpw7gh5XJThi6j6ppgNoaT1w4w==",
+      "license": "MIT"
+    },
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.1.0"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -6575,6 +6693,45 @@
         "node": ">=8"
       }
     },
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres-bytea": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.0.tgz",
+      "integrity": "sha512-xy3pmLuQqRBZBXDULy7KbaitYqLcmxigw14Q5sj8QBVLqEwXfeybIKVWiqAXTlcvdvb0+xkOtDbfQMOf4lST1w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
@@ -7477,7 +7634,6 @@
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
       "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -7494,6 +7650,15 @@
         "source-map": "^0.6.0"
       }
     },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10.x"
+      }
+    },
     "node_modules/sprintf-js": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
@@ -8023,6 +8188,19 @@
       "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
       "license": "MIT"
     },
+    "node_modules/uglify-js": {
+      "version": "3.19.3",
+      "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.19.3.tgz",
+      "integrity": "sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==",
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "bin": {
+        "uglifyjs": "bin/uglifyjs"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
     "node_modules/undefsafe": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",
@@ -8274,6 +8452,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/wordwrap": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
+      "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==",
+      "license": "MIT"
+    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",

backend/package.json

@@ -1,12 +1,14 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.2",
+  "version": "1.0.71",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
     "start": "node server.js",
     "dev": "nodemon server.js",
     "migrate": "node migrations/run-migrations.js",
+    "migrate:safe": "node migrations/run-migrations-safe.js",
+    "fix-temp-photos": "node scripts/fix-temp-photos.js",
     "test": "jest",
     "lint": "eslint src/"
   },
@@ -22,6 +24,7 @@
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
     "form-data": "^4.0.3",
+    "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
     "i18next": "^25.3.1",
     "i18next-browser-languagedetector": "^8.2.0",
@@ -32,6 +35,7 @@
     "multer": "^2.0.1",
     "node-cron": "^3.0.2",
     "nodemailer": "^6.9.1",
+    "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
     "sharp": "^0.32.0",
     "sqlite3": "^5.1.6",

backend/scripts/activate-enhanced-auth.js

@@ -1,80 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Activate enhanced authentication in server.js
- * This script safely updates the server configuration
- */
-
-const fs = require('fs').promises;
-const path = require('path');
-
-async function activateEnhancedAuth() {
-  console.log('=== Activating Enhanced Authentication ===\n');
-  
-  try {
-    const serverPath = path.join(__dirname, '../server.js');
-    
-    // Read current server.js
-    let serverContent = await fs.readFile(serverPath, 'utf8');
-    
-    // Backup current server.js
-    const backupPath = `${serverPath}.backup.${Date.now()}`;
-    await fs.writeFile(backupPath, serverContent);
-    console.log(`✓ Created backup: ${path.basename(backupPath)}`);
-    
-    // Check current state
-    if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
-      console.log('! Enhanced auth already active');
-      return;
-    }
-    
-    // Replace auth routes import
-    const originalLine = "const authRoutes = require('./src/routes/auth');";
-    const enhancedLine = "const authRoutes = require('./src/routes/auth-enhanced');";
-    
-    if (!serverContent.includes(originalLine)) {
-      console.log('✗ Could not find original auth import line');
-      console.log('Please manually update server.js');
-      return;
-    }
-    
-    serverContent = serverContent.replace(originalLine, enhancedLine);
-    console.log('✓ Updated auth routes import');
-    
-    // Add cleanup job initialization after database init
-    const dbInitLine = 'initializeDatabase()';
-    const cleanupAddition = `
-  // Initialize auth security cleanup job
-  const { initializeCleanupJob } = require('./src/utils/authSecurity');
-  initializeCleanupJob();
-`;
-    
-    if (!serverContent.includes('initializeCleanupJob')) {
-      const dbInitIndex = serverContent.indexOf(dbInitLine);
-      if (dbInitIndex !== -1) {
-        const insertPoint = serverContent.indexOf('\n', dbInitIndex) + 1;
-        serverContent = serverContent.slice(0, insertPoint) + cleanupAddition + serverContent.slice(insertPoint);
-        console.log('✓ Added cleanup job initialization');
-      }
-    }
-    
-    // Write updated server.js
-    await fs.writeFile(serverPath, serverContent);
-    console.log('✓ Updated server.js');
-    
-    console.log('\n✅ Enhanced authentication activated!');
-    console.log('\nNext steps:');
-    console.log('1. Restart the backend:');
-    console.log('   docker-compose restart backend');
-    console.log('\n2. Monitor auth health:');
-    console.log('   node scripts/monitor-auth-health.js');
-    console.log('\n3. To rollback if needed:');
-    console.log(`   cp ${path.basename(backupPath)} server.js`);
-    console.log('   docker-compose restart backend');
-    
-  } catch (error) {
-    console.error('❌ Error activating enhanced auth:', error);
-  }
-}
-
-activateEnhancedAuth();

backend/scripts/add-auth-tables.js

@@ -1,94 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Add authentication security tables to existing database
- */
-
-const { db } = require('../src/database/db');
-
-async function addAuthTables() {
-  console.log('Adding authentication security tables...\n');
-  
-  try {
-    // 1. Create login_attempts table
-    const hasLoginAttempts = await db.schema.hasTable('login_attempts');
-    if (!hasLoginAttempts) {
-      await db.schema.createTable('login_attempts', table => {
-        table.increments('id').primary();
-        table.string('identifier').notNullable();
-        table.string('ip_address', 45).notNullable();
-        table.text('user_agent');
-        table.timestamp('attempt_time').defaultTo(db.fn.now());
-        table.boolean('success').defaultTo(false);
-        
-        // Indexes for performance
-        table.index('identifier');
-        table.index('attempt_time');
-        table.index(['identifier', 'success', 'attempt_time']);
-      });
-      console.log('✓ Created login_attempts table');
-    } else {
-      console.log('! login_attempts table already exists');
-    }
-    
-    // 2. Add columns to admin_users
-    const hasPasswordChangedAt = await db.schema.hasColumn('admin_users', 'password_changed_at');
-    if (!hasPasswordChangedAt) {
-      await db.schema.table('admin_users', table => {
-        table.timestamp('password_changed_at').nullable();
-      });
-      console.log('✓ Added password_changed_at column');
-    }
-    
-    const hasLastLoginIp = await db.schema.hasColumn('admin_users', 'last_login_ip');
-    if (!hasLastLoginIp) {
-      await db.schema.table('admin_users', table => {
-        table.string('last_login_ip', 45).nullable();
-      });
-      console.log('✓ Added last_login_ip column');
-    }
-    
-    const hasTwoFactorEnabled = await db.schema.hasColumn('admin_users', 'two_factor_enabled');
-    if (!hasTwoFactorEnabled) {
-      await db.schema.table('admin_users', table => {
-        table.boolean('two_factor_enabled').defaultTo(false);
-      });
-      console.log('✓ Added two_factor_enabled column');
-    }
-    
-    const hasTwoFactorSecret = await db.schema.hasColumn('admin_users', 'two_factor_secret');
-    if (!hasTwoFactorSecret) {
-      await db.schema.table('admin_users', table => {
-        table.string('two_factor_secret').nullable();
-      });
-      console.log('✓ Added two_factor_secret column');
-    }
-    
-    // 3. Verify everything
-    console.log('\nVerifying tables...');
-    
-    const loginAttemptsInfo = await db('login_attempts').columnInfo();
-    console.log('✓ login_attempts columns:', Object.keys(loginAttemptsInfo).join(', '));
-    
-    const adminUsersInfo = await db('admin_users').columnInfo();
-    const securityColumns = ['password_changed_at', 'last_login_ip', 'two_factor_enabled', 'two_factor_secret'];
-    const hasAllColumns = securityColumns.every(col => adminUsersInfo[col]);
-    
-    if (hasAllColumns) {
-      console.log('✓ All security columns present in admin_users');
-    } else {
-      console.log('✗ Some security columns missing from admin_users');
-    }
-    
-    console.log('\n✅ Authentication security tables ready!');
-    
-    await db.destroy();
-    process.exit(0);
-  } catch (error) {
-    console.error('\n❌ Error adding auth tables:', error);
-    await db.destroy();
-    process.exit(1);
-  }
-}
-
-addAuthTables();

backend/scripts/add-token-revocation-tables.js

@@ -1,71 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Add token revocation tables to existing database
- */
-
-const { db } = require('../src/database/db');
-
-async function addTokenRevocationTables() {
-  console.log('Adding token revocation tables...\n');
-  
-  try {
-    // 1. Create revoked_tokens table
-    const hasRevokedTokens = await db.schema.hasTable('revoked_tokens');
-    if (!hasRevokedTokens) {
-      await db.schema.createTable('revoked_tokens', table => {
-        table.increments('id').primary();
-        table.string('token_id').notNullable().unique();
-        table.integer('user_id').nullable();
-        table.string('token_type', 20);
-        table.timestamp('revoked_at').defaultTo(db.fn.now());
-        table.timestamp('expires_at').notNullable();
-        table.string('reason', 100);
-        table.text('metadata');
-        
-        // Indexes
-        table.index('token_id');
-        table.index('user_id');
-        table.index('expires_at');
-      });
-      console.log('✓ Created revoked_tokens table');
-    } else {
-      console.log('! revoked_tokens table already exists');
-    }
-    
-    // 2. Create user_token_revocations table
-    const hasUserRevocations = await db.schema.hasTable('user_token_revocations');
-    if (!hasUserRevocations) {
-      await db.schema.createTable('user_token_revocations', table => {
-        table.integer('user_id').primary();
-        table.timestamp('revoked_at').notNullable();
-        table.string('reason', 100);
-        
-        table.index('revoked_at');
-      });
-      console.log('✓ Created user_token_revocations table');
-    } else {
-      console.log('! user_token_revocations table already exists');
-    }
-    
-    // 3. Verify tables
-    console.log('\nVerifying tables...');
-    
-    const revokedTokensInfo = await db('revoked_tokens').columnInfo();
-    console.log('✓ revoked_tokens columns:', Object.keys(revokedTokensInfo).join(', '));
-    
-    const userRevocationsInfo = await db('user_token_revocations').columnInfo();
-    console.log('✓ user_token_revocations columns:', Object.keys(userRevocationsInfo).join(', '));
-    
-    console.log('\n✅ Token revocation tables ready!');
-    
-    await db.destroy();
-    process.exit(0);
-  } catch (error) {
-    console.error('\n❌ Error adding token revocation tables:', error);
-    await db.destroy();
-    process.exit(1);
-  }
-}
-
-addTokenRevocationTables();

backend/scripts/check-db-issues.js

@@ -0,0 +1,60 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkDatabaseIssues() {
+  console.log('Checking database issues...\n');
+  
+  try {
+    // Check email_templates table structure
+    console.log('1. Checking email_templates table structure:');
+    const emailTemplateColumns = await db('email_templates').columnInfo();
+    console.log('Columns:', Object.keys(emailTemplateColumns));
+    
+    // Check if any templates exist
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    // Check for specific template
+    const galleryCreatedTemplate = await db('email_templates')
+      .where('template_key', 'gallery_created')
+      .first();
+    console.log('gallery_created template exists:', !!galleryCreatedTemplate);
+    
+    // Check activity_logs table
+    console.log('\n2. Checking activity_logs table:');
+    const activityLogColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityLogColumns));
+    
+    // Check migrations table
+    console.log('\n3. Checking migrations status:');
+    const migrations = await db('migrations')
+      .orderBy('id', 'desc')
+      .limit(10);
+    console.log('Latest migrations:');
+    migrations.forEach(m => console.log(`  - ${m.filename}`));
+    
+    // Test a simple query from notifications route
+    console.log('\n4. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      console.log(`Found ${notifications.length} notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+checkDatabaseIssues();

backend/scripts/check-docker-status.js

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Check Docker deployment status for security fixes
- */
-
-console.log('=== Docker Deployment Status Check ===\n');
-
-// Color codes
-const GREEN = '\x1b[32m';
-const RED = '\x1b[31m';
-const YELLOW = '\x1b[33m';
-const RESET = '\x1b[0m';
-
-let allGood = true;
-
-// Check SQL Security
-console.log('1. SQL Injection Fixes:');
-try {
-  const { sanitizeDays, escapeLikePattern } = require('../src/utils/sqlSecurity');
-  console.log(`${GREEN}✓${RESET} sqlSecurity.js exists`);
-  console.log(`${GREEN}✓${RESET} Security functions available`);
-} catch (e) {
-  console.log(`${RED}✗${RESET} sqlSecurity.js missing`);
-  allGood = false;
-}
-
-// Check Auth Security
-console.log('\n2. Authentication Security:');
-try {
-  const authSec = require('../src/utils/authSecurity');
-  console.log(`${GREEN}✓${RESET} authSecurity.js exists`);
-  
-  const authEnhanced = require('../src/middleware/auth-enhanced');
-  console.log(`${GREEN}✓${RESET} auth-enhanced middleware exists`);
-  
-  const authRoutes = require('../src/routes/auth-enhanced');
-  console.log(`${GREEN}✓${RESET} auth-enhanced routes exist`);
-} catch (e) {
-  console.log(`${YELLOW}!${RESET} Auth security files exist but not active`);
-}
-
-// Check Database
-console.log('\n3. Database Status:');
-const { db } = require('../src/database/db');
-
-async function checkDatabase() {
-  try {
-    // Check login_attempts table
-    await db('login_attempts').count();
-    console.log(`${GREEN}✓${RESET} login_attempts table exists`);
-  } catch (e) {
-    console.log(`${YELLOW}!${RESET} login_attempts table not created (run migrations)`);
-  }
-  
-  try {
-    // Check admin_users columns
-    await db('admin_users').select('password_changed_at').limit(1);
-    console.log(`${GREEN}✓${RESET} Auth security columns exist`);
-  } catch (e) {
-    console.log(`${YELLOW}!${RESET} Auth security columns missing (run migrations)`);
-  }
-  
-  // Close database connection
-  await db.destroy();
-}
-
-// Check server configuration
-console.log('\n4. Server Configuration:');
-const fs = require('fs');
-const serverContent = fs.readFileSync('./server.js', 'utf8');
-
-if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
-  console.log(`${GREEN}✓${RESET} Using enhanced auth routes`);
-} else if (serverContent.includes("require('./src/routes/auth')")) {
-  console.log(`${YELLOW}!${RESET} Using original auth routes (enhanced not active)`);
-}
-
-if (serverContent.includes('initializeCleanupJob')) {
-  console.log(`${GREEN}✓${RESET} Auth cleanup job initialized`);
-} else {
-  console.log(`${YELLOW}!${RESET} Auth cleanup job not initialized`);
-}
-
-// Run async checks
-checkDatabase().then(() => {
-  console.log('\n=== Summary ===');
-  if (allGood) {
-    console.log(`${GREEN}All security fixes are deployed!${RESET}`);
-  } else {
-    console.log(`${YELLOW}Some security features need activation:${RESET}`);
-    console.log('1. Run migrations: npx knex migrate:latest');
-    console.log('2. Update server.js to use auth-enhanced routes');
-    console.log('3. Restart the container');
-  }
-});

backend/scripts/check-email-environment.js

@@ -0,0 +1,131 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailEnvironment() {
+  console.log('=== Email Environment Check ===\n');
+  
+  // 1. Check environment variables
+  console.log('1. Environment Variables:');
+  const envVars = [
+    'SMTP_HOST',
+    'SMTP_PORT',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'SMTP_FROM',
+    'SMTP_SECURE',
+    'EMAIL_PROCESSOR_ENABLED',
+    'NODE_ENV'
+  ];
+  
+  envVars.forEach(varName => {
+    const value = process.env[varName];
+    if (varName.includes('PASS')) {
+      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
+    } else {
+      console.log(`   ${varName}: ${value || 'NOT SET'}`);
+    }
+  });
+  
+  // 2. Check database configuration
+  console.log('\n2. Database Email Configuration:');
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig) {
+      console.log('   Email configuration found in database:');
+      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
+      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
+      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
+      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
+      console.log(`   - From Address: ${emailConfig.smtp_from}`);
+    } else {
+      console.log('   ⚠️  No email configuration found in database!');
+      console.log('   This will prevent the email processor from initializing.');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error reading email configuration: ${error.message}`);
+  }
+  
+  // 3. Check if the email processor should be disabled
+  console.log('\n3. Email Processor Status:');
+  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
+  if (isDisabled) {
+    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
+  } else {
+    console.log('   ✅ Email processor is enabled (default)');
+  }
+  
+  // 4. Check pending emails
+  console.log('\n4. Email Queue Status:');
+  try {
+    const pending = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count')
+      .first();
+    
+    const failed = await db('email_queue')
+      .where('status', 'failed')
+      .where('retry_count', '>=', 3)
+      .count('* as count')
+      .first();
+    
+    const sent = await db('email_queue')
+      .where('status', 'sent')
+      .count('* as count')
+      .first();
+    
+    console.log(`   - Pending emails: ${pending.count}`);
+    console.log(`   - Failed emails (max retries): ${failed.count}`);
+    console.log(`   - Sent emails: ${sent.count}`);
+  } catch (error) {
+    console.log(`   ❌ Error querying email queue: ${error.message}`);
+  }
+  
+  // 5. Test database connection
+  console.log('\n5. Database Connection:');
+  try {
+    await db.raw('SELECT 1');
+    console.log('   ✅ Database connection successful');
+  } catch (error) {
+    console.log(`   ❌ Database connection failed: ${error.message}`);
+  }
+  
+  // 6. Check for any recent errors
+  console.log('\n6. Recent Email Errors:');
+  try {
+    const recentErrors = await db('email_queue')
+      .whereNotNull('error_message')
+      .orderBy('id', 'desc')
+      .limit(3)
+      .select('id', 'email_type', 'error_message', 'retry_count');
+    
+    if (recentErrors.length > 0) {
+      recentErrors.forEach((email, index) => {
+        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
+        console.log(`      Retries: ${email.retry_count}`);
+        console.log(`      Error: ${email.error_message}`);
+      });
+    } else {
+      console.log('   No recent errors found');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error querying recent errors: ${error.message}`);
+  }
+  
+  console.log('\n=== Environment check complete ===');
+  console.log('\nRecommendations:');
+  
+  const emailConfig = await db('email_configs').first().catch(() => null);
+  if (!emailConfig) {
+    console.log('❗ Configure email settings in the admin panel or add email_configs record');
+  }
+  
+  if (!process.env.SMTP_HOST && !emailConfig) {
+    console.log('❗ Set SMTP environment variables or configure in database');
+  }
+  
+  await db.destroy();
+}
+
+checkEmailEnvironment().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

backend/scripts/check-email-processor.js

@@ -0,0 +1,157 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function checkEmailProcessor() {
+  try {
+    logger.info('=== Email Processor Diagnostic Check ===\n');
+    
+    // 1. Check pending emails
+    logger.info('1. Checking pending emails in queue...');
+    const pendingEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .orderBy('created_at', 'asc');
+    
+    logger.info(`Found ${pendingEmails.length} pending emails\n`);
+    
+    if (pendingEmails.length > 0) {
+      logger.info('Pending email details:');
+      pendingEmails.forEach((email, index) => {
+        logger.info(`\nEmail ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Recipient: ${email.recipient_email}`);
+        logger.info(`  Event ID: ${email.event_id}`);
+        logger.info(`  Status: ${email.status}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Scheduled At: ${email.scheduled_at}`);
+        logger.info(`  Created At: ${email.created_at}`);
+        logger.info(`  Error: ${email.error_message || 'None'}`);
+        
+        // Check if email_data needs parsing
+        logger.info(`  Email Data Type: ${typeof email.email_data}`);
+        if (email.email_data) {
+          try {
+            const data = typeof email.email_data === 'string' 
+              ? JSON.parse(email.email_data) 
+              : email.email_data;
+            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
+          } catch (e) {
+            logger.error(`  Failed to parse email_data: ${e.message}`);
+          }
+        }
+      });
+    }
+    
+    // 2. Check failed emails
+    logger.info('\n\n2. Checking failed emails...');
+    const failedEmails = await db('email_queue')
+      .where('status', 'failed')
+      .orderBy('created_at', 'desc')
+      .limit(5);
+    
+    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
+    
+    if (failedEmails.length > 0) {
+      failedEmails.forEach((email, index) => {
+        logger.info(`\nFailed Email ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Error: ${email.error_message || 'No error message'}`);
+        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
+      });
+    }
+    
+    // 3. Check if email processor should be running
+    logger.info('\n\n3. Checking email processor configuration...');
+    
+    // Check environment variables
+    const emailConfig = {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT,
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_FROM: process.env.SMTP_FROM,
+      SMTP_SECURE: process.env.SMTP_SECURE,
+      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
+    };
+    
+    logger.info('Email configuration:');
+    Object.entries(emailConfig).forEach(([key, value]) => {
+      if (key === 'SMTP_USER') {
+        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
+      } else {
+        logger.info(`  ${key}: ${value || 'NOT SET'}`);
+      }
+    });
+    
+    // 4. Test email processor functionality
+    logger.info('\n\n4. Testing email processor functionality...');
+    
+    // Import the email processor
+    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
+    
+    // Test email connection
+    logger.info('Testing email connection...');
+    try {
+      const connectionTest = await testEmailConnection();
+      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
+    } catch (error) {
+      logger.error(`Email connection test failed: ${error.message}`);
+    }
+    
+    // Try to process queue once manually
+    if (pendingEmails.length > 0) {
+      logger.info('\n\n5. Attempting to process email queue manually...');
+      try {
+        await processEmailQueue();
+        logger.info('Manual queue processing completed');
+        
+        // Check status after processing
+        const stillPending = await db('email_queue')
+          .where('status', 'pending')
+          .where('retry_count', '<', 3)
+          .count('* as count')
+          .first();
+        
+        logger.info(`Emails still pending after processing: ${stillPending.count}`);
+      } catch (error) {
+        logger.error(`Error processing queue: ${error.message}`);
+        logger.error(`Stack trace: ${error.stack}`);
+      }
+    }
+    
+    // 5. Check for any recent successful emails
+    logger.info('\n\n6. Checking recent successful emails...');
+    const recentSuccess = await db('email_queue')
+      .where('status', 'sent')
+      .orderBy('sent_at', 'desc')
+      .limit(3);
+    
+    if (recentSuccess.length > 0) {
+      logger.info(`Last ${recentSuccess.length} successful emails:`);
+      recentSuccess.forEach((email, index) => {
+        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
+      });
+    } else {
+      logger.info('No successfully sent emails found');
+    }
+    
+    logger.info('\n\n=== Diagnostic check complete ===');
+    
+  } catch (error) {
+    logger.error('Error running diagnostic check:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the check
+checkEmailProcessor();

backend/scripts/check-email-templates.js

@@ -0,0 +1,66 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailTemplates() {
+  try {
+    console.log('=== Email Templates Check ===\n');
+    
+    // 1. Check table columns
+    console.log('1. Checking email_templates table structure...');
+    
+    // Check which columns exist
+    const columnChecks = [
+      'subject', 'subject_en', 'subject_de',
+      'body_html', 'body_html_en', 'body_html_de',
+      'body_text', 'body_text_en', 'body_text_de'
+    ];
+    
+    const existingColumns = [];
+    for (const col of columnChecks) {
+      const exists = await db.schema.hasColumn('email_templates', col);
+      if (exists) existingColumns.push(col);
+    }
+    
+    console.log('   Existing columns:', existingColumns.join(', '));
+    
+    // 2. Get all templates
+    console.log('\n2. Current email templates:');
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n   Template: ${template.template_key}`);
+      console.log('   -------------------');
+      
+      // Check which fields have content
+      const fields = ['subject', 'subject_en', 'subject_de', 
+                     'body_html', 'body_html_en', 'body_html_de',
+                     'body_text', 'body_text_en', 'body_text_de'];
+      
+      for (const field of fields) {
+        if (template[field]) {
+          const preview = template[field].substring(0, 50) + '...';
+          console.log(`   ${field}: ${preview}`);
+        }
+      }
+      
+      // Check for German translations
+      const hasGermanSubject = template.subject_de || template.body_html_de;
+      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
+    }
+    
+    // 3. Summary
+    console.log('\n3. Summary:');
+    const totalTemplates = templates.length;
+    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
+    console.log(`   Total templates: ${totalTemplates}`);
+    console.log(`   Templates with German: ${templatesWithGerman}`);
+    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkEmailTemplates();

backend/scripts/check-german-templates.js

@@ -0,0 +1,53 @@
+const { db } = require('../src/database/db');
+
+async function checkGermanTemplates() {
+  try {
+    console.log('=== German Email Template Content Check ===\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\nTemplate: ${template.template_key}`);
+      console.log('=====================================');
+      
+      // Check German subject
+      console.log('\nGERMAN SUBJECT:');
+      console.log(template.subject_de || 'MISSING');
+      
+      // Check if German HTML body has English content
+      console.log('\nGERMAN HTML BODY:');
+      const germanHtml = template.body_html_de || '';
+      
+      // Check for English phrases in German template
+      const englishPhrases = [
+        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
+        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
+        'Thank you', 'Best regards', 'View Gallery', 'days'
+      ];
+      
+      const foundEnglish = englishPhrases.filter(phrase => 
+        germanHtml.toLowerCase().includes(phrase.toLowerCase())
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
+      }
+      
+      // Show first 500 chars of German HTML
+      console.log(germanHtml.substring(0, 500) + '...\n');
+      
+      // Check German text body
+      console.log('GERMAN TEXT BODY:');
+      const germanText = template.body_text_de || '';
+      console.log(germanText.substring(0, 300) + '...\n');
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkGermanTemplates();

backend/scripts/check-storage.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to check storage directory structure and verify files
+ * Usage: node scripts/check-storage.js [eventSlug]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function checkDirectory(dirPath, description) {
+  try {
+    await fs.access(dirPath);
+    const stats = await fs.stat(dirPath);
+    const files = await fs.readdir(dirPath);
+    console.log(`✓ ${description}: ${dirPath}`);
+    console.log(`  - Files/Folders: ${files.length}`);
+    console.log(`  - Permissions: ${(stats.mode & parseInt('777', 8)).toString(8)}`);
+    return true;
+  } catch (error) {
+    console.log(`✗ ${description}: ${dirPath} - ${error.message}`);
+    return false;
+  }
+}
+
+async function checkStorageStructure(eventSlug = null) {
+  console.log('Checking storage structure...');
+  console.log(`Storage base path: ${STORAGE_PATH}\n`);
+  
+  // Check main directories
+  await checkDirectory(STORAGE_PATH, 'Storage root');
+  await checkDirectory(path.join(STORAGE_PATH, 'events'), 'Events directory');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/active'), 'Active events');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/archived'), 'Archived events');
+  await checkDirectory(path.join(STORAGE_PATH, 'thumbnails'), 'Thumbnails');
+  await checkDirectory(path.join(STORAGE_PATH, 'uploads'), 'Uploads');
+  
+  console.log('\n---\n');
+  
+  // If event slug provided, check specific event
+  if (eventSlug) {
+    console.log(`Checking specific event: ${eventSlug}`);
+    
+    const event = await db('events').where('slug', eventSlug).first();
+    if (!event) {
+      console.log(`✗ Event not found in database: ${eventSlug}`);
+      return;
+    }
+    
+    console.log(`✓ Event found in database:`);
+    console.log(`  - ID: ${event.id}`);
+    console.log(`  - Name: ${event.event_name}`);
+    console.log(`  - Active: ${event.is_active}`);
+    console.log(`  - Archived: ${event.is_archived}`);
+    
+    // Check event directory
+    const eventDir = path.join(STORAGE_PATH, 'events/active', eventSlug);
+    const eventExists = await checkDirectory(eventDir, 'Event directory');
+    
+    if (eventExists) {
+      const files = await fs.readdir(eventDir);
+      console.log(`  - Photo files: ${files.filter(f => /\.(jpg|jpeg|png|gif)$/i.test(f)).length}`);
+    }
+    
+    // Check photos in database
+    const photos = await db('photos').where('event_id', event.id).select('id', 'filename', 'path', 'thumbnail_path');
+    console.log(`\nDatabase photos: ${photos.length}`);
+    
+    // Check if photo files exist
+    let existingPhotos = 0;
+    let missingPhotos = 0;
+    let existingThumbnails = 0;
+    let missingThumbnails = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      try {
+        await fs.access(photoPath);
+        existingPhotos++;
+      } catch {
+        missingPhotos++;
+        console.log(`  ✗ Missing photo: ${photo.path}`);
+      }
+      
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(STORAGE_PATH, photo.thumbnail_path.replace(/^\//, ''));
+        try {
+          await fs.access(thumbPath);
+          existingThumbnails++;
+        } catch {
+          missingThumbnails++;
+          console.log(`  ✗ Missing thumbnail: ${photo.thumbnail_path}`);
+        }
+      }
+    }
+    
+    console.log(`\nFile check summary:`);
+    console.log(`  - Photos: ${existingPhotos} exist, ${missingPhotos} missing`);
+    console.log(`  - Thumbnails: ${existingThumbnails} exist, ${missingThumbnails} missing`);
+  } else {
+    // List all event directories
+    try {
+      const activeDir = path.join(STORAGE_PATH, 'events/active');
+      const eventDirs = await fs.readdir(activeDir);
+      console.log(`Active event directories: ${eventDirs.length}`);
+      for (const dir of eventDirs.slice(0, 10)) {
+        console.log(`  - ${dir}`);
+      }
+      if (eventDirs.length > 10) {
+        console.log(`  ... and ${eventDirs.length - 10} more`);
+      }
+    } catch (error) {
+      console.log('Could not list event directories:', error.message);
+    }
+  }
+}
+
+// Parse command line arguments
+const eventSlug = process.argv[2] || null;
+
+// Run the script
+checkStorageStructure(eventSlug).then(async () => {
+  await db.destroy();
+  console.log('\nStorage check complete');
+}).catch(async error => {
+  console.error('Error:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/cleanup-thumbnails.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Script to clean up orphaned and temporary thumbnails
+ * Usage: node scripts/cleanup-thumbnails.js [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function cleanupThumbnails(dryRun = false) {
+  console.log('Starting thumbnail cleanup...');
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+  console.log(`Mode: ${dryRun ? 'DRY RUN' : 'LIVE'}\n`);
+  
+  try {
+    // Get all thumbnail files
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    console.log(`Found ${files.length} files in thumbnails directory`);
+    
+    // Get all valid thumbnail paths from database
+    const validThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .select('thumbnail_path');
+    
+    const validPaths = new Set(
+      validThumbnails.map(t => path.basename(t.thumbnail_path))
+    );
+    
+    console.log(`Found ${validPaths.size} valid thumbnails in database\n`);
+    
+    let tempCount = 0;
+    let orphanedCount = 0;
+    let validCount = 0;
+    let deletedCount = 0;
+    
+    for (const file of files) {
+      // Skip directories
+      const filePath = path.join(THUMBNAILS_DIR, file);
+      const stats = await fs.stat(filePath);
+      if (stats.isDirectory()) continue;
+      
+      // Check if it's a temporary file
+      if (file.startsWith('thumb_temp_')) {
+        tempCount++;
+        console.log(`Temporary file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      }
+      // Check if it's an orphaned thumbnail
+      else if (!validPaths.has(file)) {
+        orphanedCount++;
+        console.log(`Orphaned file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      } else {
+        validCount++;
+      }
+    }
+    
+    console.log('\n--- Summary ---');
+    console.log(`Total files: ${files.length}`);
+    console.log(`Valid thumbnails: ${validCount}`);
+    console.log(`Temporary files: ${tempCount}`);
+    console.log(`Orphaned files: ${orphanedCount}`);
+    if (!dryRun) {
+      console.log(`Deleted files: ${deletedCount}`);
+    } else {
+      console.log(`Files to be deleted: ${tempCount + orphanedCount}`);
+    }
+    
+  } catch (error) {
+    console.error('Error during cleanup:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const dryRun = process.argv.includes('--dry-run');
+
+// Run the cleanup
+cleanupThumbnails(dryRun).then(async () => {
+  await db.destroy();
+  console.log('\nCleanup complete');
+}).catch(async error => {
+  console.error('Cleanup failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/create-admin.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+/**
+ * Script to create an admin user
+ * Usage: node scripts/create-admin.js --email admin@example.com --username admin --password yourpassword
+ * 
+ * If no password is provided, a random one will be generated and displayed
+ */
+
+require('dotenv').config();
+const bcrypt = require('bcrypt');
+const { db } = require('../src/database/db');
+const crypto = require('crypto');
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const getArg = (name) => {
+  const index = args.findIndex(arg => arg === `--${name}`);
+  return index !== -1 && args[index + 1] ? args[index + 1] : null;
+};
+
+const email = getArg('email');
+const username = getArg('username') || email?.split('@')[0] || 'admin';
+let password = getArg('password');
+
+// Validate email
+if (!email) {
+  console.error('Error: Email is required. Use --email admin@example.com');
+  process.exit(1);
+}
+
+// Generate password if not provided
+if (!password) {
+  password = crypto.randomBytes(12).toString('base64').slice(0, 16);
+  console.log(`Generated password: ${password}`);
+  console.log('Please save this password securely!');
+}
+
+async function createAdmin() {
+  try {
+    // Check if user already exists
+    const existingUser = await db('admin_users')
+      .where('email', email)
+      .orWhere('username', username)
+      .first();
+
+    if (existingUser) {
+      console.error(`Error: User with email "${email}" or username "${username}" already exists`);
+      process.exit(1);
+    }
+
+    // Hash password
+    const passwordHash = await bcrypt.hash(password, 10);
+
+    // Create admin user
+    await db('admin_users').insert({
+      username,
+      email,
+      password_hash: passwordHash,
+      is_active: true,
+      created_at: new Date(),
+      updated_at: new Date()
+    });
+
+    console.log(`✅ Admin user created successfully!`);
+    console.log(`   Email: ${email}`);
+    console.log(`   Username: ${username}`);
+    console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Error creating admin user:', error.message);
+    process.exit(1);
+  }
+}
+
+createAdmin();

backend/scripts/create-test-event.js

@@ -36,7 +36,8 @@ async function createTestEvent() {
     await db('events').where('slug', eventData.slug).delete();
     
     // Insert new event
-    const [eventId] = await db('events').insert(eventData);
+    const insertResult = await db('events').insert(eventData).returning('id');
+    const eventId = insertResult[0]?.id || insertResult[0];
     console.log('Event created with ID:', eventId);
     
     console.log('\nTest event created successfully!');

backend/scripts/debug-500-errors.js

@@ -0,0 +1,92 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function debugEndpoints() {
+  console.log('Debugging 500 errors...\n');
+  
+  try {
+    // Test email templates query
+    console.log('1. Testing email templates query:');
+    try {
+      const templates = await db('email_templates')
+        .select('*')
+        .orderBy('template_key');
+      
+      console.log(`Found ${templates.length} templates`);
+      if (templates.length > 0) {
+        console.log('First template columns:', Object.keys(templates[0]));
+        console.log('Template keys:', templates.map(t => t.template_key));
+      }
+    } catch (error) {
+      console.error('Email templates query failed:', error.message);
+      console.error('Error code:', error.code);
+    }
+    
+    // Test notifications query
+    console.log('\n2. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .whereNull('activity_logs.read_at')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      
+      console.log(`Found ${notifications.length} unread notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+      console.error('Error code:', error.code);
+      
+      // Check if it's a column issue
+      if (error.message.includes('column')) {
+        console.log('\nChecking activity_logs columns:');
+        const columns = await db('activity_logs').columnInfo();
+        console.log('Columns:', Object.keys(columns));
+      }
+    }
+    
+    // Test specific template query
+    console.log('\n3. Testing specific template query (gallery_created):');
+    try {
+      const template = await db('email_templates')
+        .where('template_key', 'gallery_created')
+        .first();
+      
+      if (template) {
+        console.log('Template found:', template.template_key);
+        console.log('Has subject_en?', template.subject_en !== undefined);
+        console.log('Has subject?', template.subject !== undefined);
+      } else {
+        console.log('Template not found');
+      }
+    } catch (error) {
+      console.error('Template query failed:', error.message);
+    }
+    
+    // Check CMS pages
+    console.log('\n4. Checking CMS pages:');
+    try {
+      const pages = await db('cms_pages')
+        .select('slug', 'title', 'is_published')
+        .orderBy('slug');
+      
+      console.log(`Found ${pages.length} CMS pages:`);
+      pages.forEach(page => {
+        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
+      });
+    } catch (error) {
+      console.error('CMS pages query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('General error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+debugEndpoints();

backend/scripts/debug-email-queue.js

@@ -0,0 +1,146 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function debugEmailQueue() {
+  try {
+    logger.info('=== Email Queue Debug Report ===\n');
+    
+    // 1. Count exactly like the admin dashboard does
+    logger.info('1. Admin Dashboard Query (ALL pending, no retry filter):');
+    const [adminCount] = await db('email_queue').where('status', 'pending').count('* as count');
+    logger.info(`   Pending emails (admin dashboard view): ${adminCount.count}\n`);
+    
+    // 2. Count like the email processor does
+    logger.info('2. Email Processor Query (pending with retry_count < 3):');
+    const [processorCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    logger.info(`   Pending emails (processor view): ${processorCount.count}\n`);
+    
+    // 3. Show the discrepancy
+    logger.info('3. Discrepancy Analysis:');
+    if (adminCount.count !== processorCount.count) {
+      logger.info(`   ⚠️  DISCREPANCY FOUND!`);
+      logger.info(`   Admin shows: ${adminCount.count}`);
+      logger.info(`   Processor will process: ${processorCount.count}`);
+      logger.info(`   Difference: ${adminCount.count - processorCount.count} email(s)\n`);
+      
+      // Find the problematic emails
+      logger.info('4. Emails with retry_count >= 3 (still pending):');
+      const stuckEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '>=', 3)
+        .select('*');
+      
+      if (stuckEmails.length > 0) {
+        logger.info(`   Found ${stuckEmails.length} stuck email(s):\n`);
+        stuckEmails.forEach((email, index) => {
+          logger.info(`   Email ${index + 1}:`);
+          logger.info(`     ID: ${email.id}`);
+          logger.info(`     Type: ${email.email_type}`);
+          logger.info(`     Recipient: ${email.recipient_email}`);
+          logger.info(`     Status: ${email.status}`);
+          logger.info(`     Retry Count: ${email.retry_count} ⚠️`);
+          logger.info(`     Created: ${email.created_at}`);
+          logger.info(`     Last Error: ${email.error_message || 'None'}\n`);
+        });
+      }
+    } else {
+      logger.info(`   ✅ No discrepancy - counts match\n`);
+    }
+    
+    // 5. Show ALL pending emails with details
+    logger.info('5. ALL Pending Emails (regardless of retry count):');
+    const allPending = await db('email_queue')
+      .where('status', 'pending')
+      .orderBy('retry_count', 'desc')
+      .orderBy('created_at', 'asc');
+    
+    if (allPending.length > 0) {
+      allPending.forEach((email, index) => {
+        const willProcess = email.retry_count < 3;
+        logger.info(`\n   Email ${index + 1}: ${willProcess ? '✅ WILL PROCESS' : '❌ STUCK (max retries)'}`);
+        logger.info(`     ID: ${email.id}`);
+        logger.info(`     Type: ${email.email_type}`);
+        logger.info(`     Recipient: ${email.recipient_email}`);
+        logger.info(`     Event ID: ${email.event_id}`);
+        logger.info(`     Retry Count: ${email.retry_count}/3`);
+        logger.info(`     Created: ${email.created_at}`);
+        logger.info(`     Scheduled: ${email.scheduled_at}`);
+        if (email.error_message) {
+          logger.info(`     Last Error: ${email.error_message}`);
+        }
+      });
+    } else {
+      logger.info('   No pending emails found');
+    }
+    
+    // 6. Show counts by status
+    logger.info('\n\n6. Email Queue Summary by Status:');
+    const statusCounts = await db('email_queue')
+      .select('status')
+      .count('* as count')
+      .groupBy('status')
+      .orderBy('status');
+    
+    statusCounts.forEach(row => {
+      logger.info(`   ${row.status}: ${row.count}`);
+    });
+    
+    // 7. Failed emails summary
+    logger.info('\n7. Failed Emails Summary:');
+    const failedSummary = await db('email_queue')
+      .where('status', 'failed')
+      .select('retry_count')
+      .count('* as count')
+      .groupBy('retry_count')
+      .orderBy('retry_count');
+    
+    if (failedSummary.length > 0) {
+      failedSummary.forEach(row => {
+        logger.info(`   Retry count ${row.retry_count}: ${row.count} email(s)`);
+      });
+    } else {
+      logger.info('   No failed emails');
+    }
+    
+    // 8. Recommendations
+    logger.info('\n\n=== RECOMMENDATIONS ===');
+    
+    if (adminCount.count > processorCount.count) {
+      logger.info('\n❗ You have emails stuck with retry_count >= 3');
+      logger.info('   These emails will NOT be processed automatically.');
+      logger.info('\n   To fix this, you can:');
+      logger.info('   1. Reset retry count: UPDATE email_queue SET retry_count = 0 WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   2. Mark as failed: UPDATE email_queue SET status = \'failed\' WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   3. Delete them: DELETE FROM email_queue WHERE status = \'pending\' AND retry_count >= 3;');
+    }
+    
+    const anyPending = adminCount.count > 0;
+    if (anyPending && processorCount.count === 0) {
+      logger.info('\n❗ All pending emails have exceeded retry limit');
+      logger.info('   The email processor will not attempt to send them.');
+    } else if (anyPending && processorCount.count > 0) {
+      logger.info('\n✅ Email processor should process the pending emails on next run');
+      logger.info('   Make sure the email processor service is running.');
+    }
+    
+    logger.info('\n=== Debug report complete ===');
+    
+  } catch (error) {
+    logger.error('Error running debug report:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the debug
+debugEmailQueue();

backend/scripts/debug-event-photos.js

@@ -1,56 +0,0 @@
-const knex = require('knex')({
-  client: 'sqlite3',
-  connection: { filename: '/app/data/photo_sharing.db' },
-  useNullAsDefault: true
-});
-
-async function debugEventPhotos() {
-  try {
-    // Get all photos for event 12
-    const photos = await knex('photos')
-      .where('event_id', 12)
-      .select('id', 'filename', 'path', 'thumbnail_path')
-      .orderBy('id');
-    
-    console.log('Total photos for event 12:', photos.length);
-    console.log('\nSample photos:');
-    
-    // Show first few and specific IDs that were failing
-    const sampleIds = [1686, 1687, 1688, 1689, 1715, 1717, 1718, 1719];
-    const samples = photos.filter(p => sampleIds.includes(p.id));
-    
-    samples.forEach(p => {
-      console.log(`\nID ${p.id}: ${p.filename}`);
-      console.log(`  Path: ${p.path}`);
-      console.log(`  Thumbnail: ${p.thumbnail_path}`);
-    });
-    
-    // Check for any photos without thumbnails
-    const noThumbs = photos.filter(p => !p.thumbnail_path);
-    if (noThumbs.length > 0) {
-      console.log(`\nPhotos without thumbnails: ${noThumbs.length}`);
-      noThumbs.forEach(p => console.log(`  ID ${p.id}: ${p.filename}`));
-    }
-    
-    // Check file existence for failing photos
-    const fs = require('fs').promises;
-    console.log('\nChecking file existence for samples:');
-    
-    for (const photo of samples) {
-      const thumbPath = `/app/storage/${photo.thumbnail_path}`;
-      try {
-        await fs.access(thumbPath);
-        console.log(`✓ ID ${photo.id}: Thumbnail exists at ${thumbPath}`);
-      } catch (err) {
-        console.log(`✗ ID ${photo.id}: Thumbnail NOT FOUND at ${thumbPath}`);
-      }
-    }
-    
-  } catch (error) {
-    console.error('Error:', error);
-  } finally {
-    knex.destroy();
-  }
-}
-
-debugEventPhotos();

backend/scripts/debug-photos-enhanced.js

@@ -1,81 +0,0 @@
-#!/usr/bin/env node
-
-const sqlite3 = require('sqlite3').verbose();
-const fs = require('fs');
-const path = require('path');
-
-// Connect to the database
-const dbPath = '/app/data/photo_sharing.db';
-console.log(`Connecting to database at: ${dbPath}`);
-
-const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
-  if (err) {
-    console.error('Error opening database:', err.message);
-    process.exit(1);
-  }
-  console.log('Connected to the SQLite database.\n');
-});
-
-// Query for photos with IDs 1688 and 1689 where event_id = 12
-const query = `
-  SELECT p.id, p.filename, p.path, p.thumbnail_path, p.event_id, 
-         e.slug as event_slug, e.is_active, e.is_archived
-  FROM photos p
-  JOIN events e ON p.event_id = e.id
-  WHERE p.id IN (1688, 1689) AND p.event_id = 12
-`;
-
-console.log('Executing query to get photo details with event information...\n');
-
-db.all(query, [], (err, rows) => {
-  if (err) {
-    console.error('Error executing query:', err.message);
-    db.close();
-    process.exit(1);
-  }
-  
-  console.log(`Found ${rows.length} photo(s):\n`);
-  
-  if (rows.length === 0) {
-    console.log('No photos found matching the criteria.');
-  } else {
-    rows.forEach((row) => {
-      console.log('=== Photo ID:', row.id, '===');
-      console.log('Filename:', row.filename);
-      console.log('DB Path:', row.path);
-      console.log('DB Thumbnail Path:', row.thumbnail_path);
-      console.log('Event ID:', row.event_id);
-      console.log('Event Slug:', row.event_slug);
-      console.log('Event is_active:', row.is_active);
-      console.log('Event is_archived:', row.is_archived);
-      
-      // Check file existence
-      const storageBase = '/app/storage';
-      const eventStatusDir = row.is_active ? 'active' : 'archived';
-      
-      // Check full image path
-      const fullImagePath1 = path.join(storageBase, row.path);
-      const fullImagePath2 = path.join(storageBase, 'events', eventStatusDir, row.path);
-      
-      console.log('\nChecking full image paths:');
-      console.log(`  Path 1: ${fullImagePath1} - ${fs.existsSync(fullImagePath1) ? 'EXISTS' : 'NOT FOUND'}`);
-      console.log(`  Path 2: ${fullImagePath2} - ${fs.existsSync(fullImagePath2) ? 'EXISTS' : 'NOT FOUND'}`);
-      
-      // Check thumbnail path
-      const thumbnailPath = path.join(storageBase, row.thumbnail_path);
-      console.log('\nChecking thumbnail path:');
-      console.log(`  ${thumbnailPath} - ${fs.existsSync(thumbnailPath) ? 'EXISTS' : 'NOT FOUND'}`);
-      
-      console.log('\n---\n');
-    });
-  }
-  
-  // Close the database connection
-  db.close((err) => {
-    if (err) {
-      console.error('Error closing database:', err.message);
-    } else {
-      console.log('Database connection closed.');
-    }
-  });
-});

backend/scripts/debug-photos.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-
-const sqlite3 = require('sqlite3').verbose();
-const path = require('path');
-
-// Connect to the database
-const dbPath = '/app/data/photo_sharing.db';
-console.log(`Connecting to database at: ${dbPath}`);
-
-const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
-  if (err) {
-    console.error('Error opening database:', err.message);
-    process.exit(1);
-  }
-  console.log('Connected to the SQLite database.');
-});
-
-// Query for photos with IDs 1688 and 1689 where event_id = 12
-const query = `
-  SELECT id, filename, path, thumbnail_path 
-  FROM photos 
-  WHERE id IN (1688, 1689) AND event_id = 12
-`;
-
-console.log('\nExecuting query:', query);
-
-db.all(query, [], (err, rows) => {
-  if (err) {
-    console.error('Error executing query:', err.message);
-    db.close();
-    process.exit(1);
-  }
-  
-  console.log(`\nFound ${rows.length} photo(s):\n`);
-  
-  if (rows.length === 0) {
-    console.log('No photos found matching the criteria.');
-  } else {
-    rows.forEach((row) => {
-      console.log('Photo ID:', row.id);
-      console.log('Filename:', row.filename);
-      console.log('Path:', row.path);
-      console.log('Thumbnail Path:', row.thumbnail_path);
-      console.log('---');
-    });
-  }
-  
-  // Close the database connection
-  db.close((err) => {
-    if (err) {
-      console.error('Error closing database:', err.message);
-    } else {
-      console.log('\nDatabase connection closed.');
-    }
-  });
-});

backend/scripts/deploy-auth-security.sh

@@ -1,132 +0,0 @@
-#!/bin/bash
-
-# Authentication Security Enhancement Deployment Script
-# This script helps safely deploy auth security enhancements
-
-set -e
-
-echo "=== PicPeak Authentication Security Deployment ==="
-echo ""
-
-# Color codes
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Check if we're in the backend directory
-if [ ! -f "package.json" ] || [ ! -d "src" ]; then
-    echo -e "${RED}Error: Must run from backend directory${NC}"
-    exit 1
-fi
-
-# Function to prompt for confirmation
-confirm() {
-    read -p "$1 (y/n): " -n 1 -r
-    echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-        echo -e "${YELLOW}Deployment cancelled${NC}"
-        exit 1
-    fi
-}
-
-echo "This script will help deploy authentication security enhancements"
-echo ""
-echo "Current deployment phase options:"
-echo "1. Run database migrations only (safe)"
-echo "2. Test enhanced auth endpoints"
-echo "3. Switch to enhanced auth (full deployment)"
-echo "4. Rollback to original auth"
-echo ""
-
-read -p "Select phase (1-4): " PHASE
-
-case $PHASE in
-    1)
-        echo -e "${GREEN}Phase 1: Running database migrations${NC}"
-        confirm "Run migrations?"
-        
-        echo "Creating backup..."
-        cp database.db database.db.backup.$(date +%Y%m%d_%H%M%S) 2>/dev/null || true
-        
-        echo "Running migrations..."
-        npx knex migrate:latest
-        
-        echo -e "${GREEN}✓ Migrations completed${NC}"
-        echo "New tables added: login_attempts"
-        echo "New columns added to admin_users: password_changed_at, last_login_ip"
-        ;;
-        
-    2)
-        echo -e "${GREEN}Phase 2: Testing enhanced auth${NC}"
-        
-        # Check if server is running
-        if ! curl -s http://localhost:3001/health > /dev/null; then
-            echo -e "${RED}Server not running on port 3001${NC}"
-            exit 1
-        fi
-        
-        echo "Running auth security tests..."
-        node scripts/test-auth-security.js
-        
-        echo ""
-        echo "Test endpoints manually:"
-        echo "- Login: POST /api/auth/admin/login"
-        echo "- Logout: POST /api/auth/logout"
-        echo "- Session: GET /api/auth/session"
-        ;;
-        
-    3)
-        echo -e "${YELLOW}Phase 3: Full deployment${NC}"
-        echo "This will switch to enhanced authentication"
-        confirm "Deploy enhanced auth?"
-        
-        # Check if migrations are run
-        if ! npx knex migrate:status | grep -q "015_add_login_attempts_table"; then
-            echo -e "${RED}Error: Migrations not run. Run phase 1 first.${NC}"
-            exit 1
-        fi
-        
-        echo "Updating server.js to use enhanced auth..."
-        # This is where you'd update the imports
-        # For safety, we'll just show what needs to be done
-        
-        echo -e "${YELLOW}Manual steps required:${NC}"
-        echo "1. Edit server.js"
-        echo "2. Change: const authRoutes = require('./src/routes/auth');"
-        echo "   To: const authRoutes = require('./src/routes/auth-enhanced');"
-        echo "3. Restart the application"
-        echo ""
-        echo "After restart, the enhanced auth will be active with:"
-        echo "- Account lockout protection"
-        echo "- Login attempt tracking"
-        echo "- Enhanced security logging"
-        ;;
-        
-    4)
-        echo -e "${RED}Phase 4: Rollback${NC}"
-        confirm "Rollback auth changes?"
-        
-        echo "Rolling back to original auth..."
-        echo ""
-        echo -e "${YELLOW}Manual steps required:${NC}"
-        echo "1. Edit server.js"
-        echo "2. Change: const authRoutes = require('./src/routes/auth-enhanced');"
-        echo "   To: const authRoutes = require('./src/routes/auth');"
-        echo "3. Restart the application"
-        echo ""
-        echo "Optional: Clear lockouts"
-        echo "sqlite3 database.db \"DELETE FROM login_attempts WHERE success = 0\""
-        ;;
-        
-    *)
-        echo -e "${RED}Invalid option${NC}"
-        exit 1
-        ;;
-esac
-
-echo ""
-echo -e "${GREEN}Done!${NC}"
-echo ""
-echo "Monitor logs after any changes:"
-echo "docker-compose logs -f backend | grep -i auth"

backend/scripts/diagnose-thumbnails.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose thumbnail serving issues
+ * Usage: node scripts/diagnose-thumbnails.js <eventId>
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function diagnoseThumbnails(eventId) {
+  if (!eventId) {
+    console.error('Usage: node scripts/diagnose-thumbnails.js <eventId>');
+    process.exit(1);
+  }
+  
+  console.log(`Diagnosing thumbnails for event ID: ${eventId}`);
+  console.log(`Storage path: ${STORAGE_PATH}`);
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}\n`);
+  
+  try {
+    // Get event info
+    const event = await db('events').where('id', eventId).first();
+    if (!event) {
+      console.error(`Event not found with ID: ${eventId}`);
+      return;
+    }
+    
+    console.log(`Event: ${event.event_name} (${event.slug})`);
+    console.log(`Active: ${event.is_active}, Archived: ${event.is_archived}\n`);
+    
+    // Get photos for this event
+    const photos = await db('photos')
+      .where('event_id', eventId)
+      .select('id', 'filename', 'path', 'thumbnail_path');
+    
+    console.log(`Found ${photos.length} photos in database\n`);
+    
+    let missingThumbnails = 0;
+    let existingThumbnails = 0;
+    let pathIssues = [];
+    
+    for (const photo of photos.slice(0, 10)) { // Check first 10 photos
+      console.log(`Photo ID ${photo.id}: ${photo.filename}`);
+      console.log(`  Photo path: ${photo.path}`);
+      console.log(`  Thumbnail path in DB: ${photo.thumbnail_path}`);
+      
+      if (photo.thumbnail_path) {
+        // Expected thumbnail filename
+        const expectedThumbName = `thumb_${photo.filename}`;
+        const expectedThumbPath = path.join(THUMBNAILS_DIR, expectedThumbName);
+        
+        // Check if thumbnail exists
+        try {
+          await fs.access(expectedThumbPath);
+          console.log(`  ✓ Thumbnail exists at: ${expectedThumbName}`);
+          existingThumbnails++;
+          
+          // Check if DB path matches expected path
+          const dbThumbName = path.basename(photo.thumbnail_path);
+          if (dbThumbName !== expectedThumbName) {
+            console.log(`  ⚠ Path mismatch! DB has: ${dbThumbName}, Expected: ${expectedThumbName}`);
+            pathIssues.push({
+              photoId: photo.id,
+              dbPath: photo.thumbnail_path,
+              expectedPath: `thumbnails/${expectedThumbName}`
+            });
+          }
+        } catch {
+          console.log(`  ✗ Thumbnail missing: ${expectedThumbName}`);
+          missingThumbnails++;
+        }
+      } else {
+        console.log(`  ✗ No thumbnail path in database`);
+        missingThumbnails++;
+      }
+      console.log('');
+    }
+    
+    console.log('--- Summary ---');
+    console.log(`Existing thumbnails: ${existingThumbnails}`);
+    console.log(`Missing thumbnails: ${missingThumbnails}`);
+    console.log(`Path issues: ${pathIssues.length}`);
+    
+    if (pathIssues.length > 0) {
+      console.log('\n--- Path Issues ---');
+      console.log('The following photos have incorrect thumbnail paths in the database:');
+      for (const issue of pathIssues) {
+        console.log(`Photo ID ${issue.photoId}:`);
+        console.log(`  Current: ${issue.dbPath}`);
+        console.log(`  Should be: ${issue.expectedPath}`);
+      }
+      
+      console.log('\nTo fix path issues, run:');
+      console.log(`UPDATE photos SET thumbnail_path = 'thumbnails/thumb_' || filename WHERE event_id = ${eventId};`);
+    }
+    
+    // Check for any thumbnails in the directory that match this event
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    const eventThumbnails = files.filter(f => {
+      // Try to match thumbnails for this event
+      for (const photo of photos) {
+        if (f === `thumb_${photo.filename}`) return true;
+      }
+      return false;
+    });
+    
+    console.log(`\n--- Filesystem Check ---`);
+    console.log(`Found ${eventThumbnails.length} thumbnails in directory for this event`);
+    
+  } catch (error) {
+    console.error('Error during diagnosis:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the diagnosis
+diagnoseThumbnails(eventId).then(async () => {
+  await db.destroy();
+  console.log('\nDiagnosis complete');
+}).catch(async error => {
+  console.error('Diagnosis failed:', error);
+  await db.destroy();
+  process.exit(1);
+});

backend/scripts/fix-default-themes.js

@@ -1,37 +0,0 @@
-const path = require('path');
-require('dotenv').config({ path: path.join(__dirname, '../.env') });
-const { db } = require('../src/database/db');
-
-async function fixDefaultThemes() {
-  try {
-    console.log('Fixing events with "default" theme...');
-    
-    // Find all events with "default" as color_theme
-    const eventsToFix = await db('events')
-      .where('color_theme', 'default')
-      .select('id', 'event_name');
-    
-    console.log(`Found ${eventsToFix.length} events to fix`);
-    
-    if (eventsToFix.length > 0) {
-      // Update them to null so they use the global theme
-      await db('events')
-        .where('color_theme', 'default')
-        .update({ color_theme: null });
-      
-      console.log('Updated events to use global theme');
-      
-      eventsToFix.forEach(event => {
-        console.log(`- Fixed event: ${event.event_name} (ID: ${event.id})`);
-      });
-    }
-    
-    console.log('Theme fix completed successfully');
-    process.exit(0);
-  } catch (error) {
-    console.error('Error fixing themes:', error);
-    process.exit(1);
-  }
-}
-
-fixDefaultThemes();

backend/scripts/fix-email-queue-schema.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose and fix email_queue schema issues
+ * This helps resolve the "column updated_at does not exist" error
+ */
+
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkAndFixEmailQueueSchema() {
+  console.log('Checking email_queue table schema...');
+  
+  try {
+    // Get column information
+    const columns = await db('email_queue').columnInfo();
+    console.log('\nCurrent email_queue columns:', Object.keys(columns));
+    
+    // Check for updated_at column
+    if (columns.updated_at) {
+      console.log('\n⚠️  Found unexpected updated_at column in email_queue table!');
+      console.log('This column should not exist and is causing errors.');
+      
+      // Ask for confirmation before removing
+      console.log('\nRemoving updated_at column...');
+      await db.schema.table('email_queue', (table) => {
+        table.dropColumn('updated_at');
+      });
+      console.log('✅ Removed updated_at column from email_queue table');
+    } else {
+      console.log('✅ No updated_at column found (this is correct)');
+    }
+    
+    // Verify required columns exist
+    const requiredColumns = [
+      'id', 'event_id', 'recipient_email', 'email_type', 
+      'email_data', 'status', 'scheduled_at', 'sent_at', 
+      'error_message', 'retry_count', 'created_at'
+    ];
+    
+    const missingColumns = requiredColumns.filter(col => !columns[col]);
+    if (missingColumns.length > 0) {
+      console.log('\n⚠️  Missing required columns:', missingColumns);
+    } else {
+      console.log('✅ All required columns are present');
+    }
+    
+    // Check for any database triggers
+    if (process.env.DATABASE_CLIENT === 'pg') {
+      console.log('\nChecking for PostgreSQL triggers on email_queue...');
+      const triggers = await db.raw(`
+        SELECT trigger_name, event_manipulation, action_statement
+        FROM information_schema.triggers
+        WHERE event_object_table = 'email_queue'
+        AND trigger_schema = current_schema()
+      `);
+      
+      if (triggers.rows && triggers.rows.length > 0) {
+        console.log('⚠️  Found triggers on email_queue table:');
+        triggers.rows.forEach(trigger => {
+          console.log(`  - ${trigger.trigger_name} (${trigger.event_manipulation})`);
+        });
+      } else {
+        console.log('✅ No triggers found on email_queue table');
+      }
+    }
+    
+    // Test update query
+    console.log('\nTesting update query...');
+    const testEmail = await db('email_queue')
+      .where('status', 'pending')
+      .first();
+    
+    if (testEmail) {
+      try {
+        await db('email_queue')
+          .where('id', testEmail.id)
+          .update({
+            retry_count: testEmail.retry_count
+          });
+        console.log('✅ Update query works correctly');
+      } catch (error) {
+        console.log('❌ Update query failed:', error.message);
+      }
+    } else {
+      console.log('ℹ️  No pending emails to test with');
+    }
+    
+    console.log('\nSchema check complete!');
+    
+  } catch (error) {
+    console.error('Error checking schema:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the check
+checkAndFixEmailQueueSchema();

backend/scripts/fix-final-german-templates.js

@@ -0,0 +1,88 @@
+const { db } = require('../src/database/db');
+
+async function fixFinalGermanTemplates() {
+  try {
+    console.log('Fixing remaining English words in German templates...\n');
+    
+    // Get all templates
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      let updated = false;
+      let updates = {};
+      
+      // Fix subject_de
+      if (template.subject_de) {
+        updates.subject_de = template.subject_de;
+      }
+      
+      // Fix body_html_de
+      if (template.body_html_de) {
+        let html = template.body_html_de;
+        
+        // Replace English words with German
+        html = html.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Details:/g, 'Details:');
+        html = html.replace(/Link:/g, 'Link:');
+        html = html.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Archive-Details:/g, 'Archiv-Details:');
+        html = html.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (html !== template.body_html_de) {
+          updates.body_html_de = html;
+          updated = true;
+        }
+      }
+      
+      // Fix body_text_de
+      if (template.body_text_de) {
+        let text = template.body_text_de;
+        
+        text = text.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Details:/g, 'Details:');
+        text = text.replace(/Link:/g, 'Link:');
+        text = text.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Archive-Details:/g, 'Archiv-Details:');
+        text = text.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (text !== template.body_text_de) {
+          updates.body_text_de = text;
+          updated = true;
+        }
+      }
+      
+      // Also update the non-language-specific fields to match German
+      if (template.body_html_de) {
+        updates.body_html = template.body_html_de;
+      }
+      if (template.body_text_de) {
+        updates.body_text = template.body_text_de;
+      }
+      if (template.subject_de) {
+        updates.subject = template.subject_de;
+      }
+      
+      if (updated || Object.keys(updates).length > 0) {
+        await db('email_templates')
+          .where('template_key', template.template_key)
+          .update(updates);
+        console.log(`✅ Updated ${template.template_key}`);
+      } else {
+        console.log(`⏭️  No changes needed for ${template.template_key}`);
+      }
+    }
+    
+    console.log('\nDone!');
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+fixFinalGermanTemplates();

backend/scripts/fix-production-issues.js

@@ -0,0 +1,145 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function fixProductionIssues() {
+  console.log('Fixing production database issues...\n');
+  
+  try {
+    // 1. Check and fix email_templates structure
+    console.log('1. Checking email_templates structure:');
+    const emailColumns = await db('email_templates').columnInfo();
+    console.log('Current columns:', Object.keys(emailColumns));
+    
+    // Check if we need to add basic columns back
+    const hasSubject = 'subject' in emailColumns;
+    const hasSubjectEn = 'subject_en' in emailColumns;
+    
+    if (hasSubjectEn && !hasSubject) {
+      console.log('Adding basic columns back to email_templates...');
+      await db.schema.alterTable('email_templates', (table) => {
+        table.string('subject');
+        table.text('body_html');
+        table.text('body_text');
+      });
+      
+      // Copy values from _en columns
+      await db('email_templates').update({
+        subject: db.raw('subject_en'),
+        body_html: db.raw('body_html_en'),
+        body_text: db.raw('body_text_en')
+      });
+      console.log('Basic columns added successfully');
+    }
+    
+    // 2. Ensure default templates exist
+    console.log('\n2. Checking email templates:');
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    if (templateCount[0].count === 0) {
+      console.log('No templates found, inserting defaults...');
+      const defaultTemplates = [
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: '<h2>Gallery Created Successfully</h2>...',
+          body_text: 'Gallery Created Successfully...',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: '<h2>Gallery Expiring Soon</h2>...',
+          body_text: 'Gallery Expiring Soon...',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        },
+        {
+          template_key: 'gallery_expired',
+          subject: 'Your Photo Gallery Has Expired',
+          body_html: '<h2>Gallery Expired</h2>...',
+          body_text: 'Gallery Expired...',
+          variables: JSON.stringify(['host_name', 'event_name'])
+        },
+        {
+          template_key: 'archive_complete',
+          subject: 'Gallery Archive Complete',
+          body_html: '<h2>Archive Complete</h2>...',
+          body_text: 'Archive Complete...',
+          variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+        }
+      ];
+      
+      for (const template of defaultTemplates) {
+        // Add language columns if they exist
+        if (hasSubjectEn) {
+          template.subject_en = template.subject;
+          template.body_html_en = template.body_html;
+          template.body_text_en = template.body_text;
+          template.subject_de = template.subject;
+          template.body_html_de = template.body_html;
+          template.body_text_de = template.body_text;
+        }
+        
+        await db('email_templates').insert(template);
+      }
+      console.log('Default templates inserted');
+    }
+    
+    // 3. Check activity_logs structure
+    console.log('\n3. Checking activity_logs structure:');
+    const activityColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityColumns));
+    
+    // Check if read_at exists
+    if (!('read_at' in activityColumns)) {
+      console.log('Adding read_at column to activity_logs...');
+      await db.schema.alterTable('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+      console.log('read_at column added');
+    }
+    
+    // 4. Check and add CMS pages
+    console.log('\n4. Checking CMS pages:');
+    const cmsColumns = await db('cms_pages').columnInfo();
+    console.log('CMS columns:', Object.keys(cmsColumns));
+    
+    const impressum = await db('cms_pages').where('slug', 'impressum').first();
+    const datenschutz = await db('cms_pages').where('slug', 'datenschutz').first();
+    
+    if (!impressum) {
+      console.log('Adding Impressum page...');
+      await db('cms_pages').insert({
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h1>Legal Notice</h1><p>Your legal information here...</p>',
+        content_de: '<h1>Impressum</h1><p>Ihre rechtlichen Informationen hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    if (!datenschutz) {
+      console.log('Adding Datenschutz page...');
+      await db('cms_pages').insert({
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h1>Privacy Policy</h1><p>Your privacy policy here...</p>',
+        content_de: '<h1>Datenschutzerklärung</h1><p>Ihre Datenschutzerklärung hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    console.log('\n✅ All fixes applied successfully!');
+    
+  } catch (error) {
+    console.error('Error fixing issues:', error);
+    console.error('Stack:', error.stack);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+fixProductionIssues();

backend/scripts/fix-stuck-emails.js

@@ -0,0 +1,126 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function fixStuckEmails() {
+  try {
+    logger.info('=== Fix Stuck Emails Script ===\n');
+    
+    // 1. Find stuck emails
+    logger.info('1. Finding stuck emails (pending with retry_count >= 3)...');
+    const stuckEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .select('*');
+    
+    if (stuckEmails.length === 0) {
+      logger.info('   ✅ No stuck emails found!');
+      logger.info('\n=== Script complete ===');
+      await db.destroy();
+      process.exit(0);
+    }
+    
+    logger.info(`   Found ${stuckEmails.length} stuck email(s)\n`);
+    
+    // 2. Show details
+    logger.info('2. Stuck email details:');
+    stuckEmails.forEach((email, index) => {
+      logger.info(`\n   Email ${index + 1}:`);
+      logger.info(`     ID: ${email.id}`);
+      logger.info(`     Type: ${email.email_type}`);
+      logger.info(`     Recipient: ${email.recipient_email}`);
+      logger.info(`     Retry Count: ${email.retry_count}`);
+      logger.info(`     Last Error: ${email.error_message || 'None'}`);
+    });
+    
+    // 3. Ask for action
+    logger.info('\n\n3. Choose an action:');
+    logger.info('   1. Reset retry count to 0 (emails will be retried)');
+    logger.info('   2. Mark as failed (emails will not be retried)');
+    logger.info('   3. Delete these emails');
+    logger.info('   4. Cancel (do nothing)');
+    
+    // Get command line argument
+    const action = process.argv[2];
+    
+    if (!action || !['reset', 'fail', 'delete'].includes(action)) {
+      logger.info('\n❗ No valid action specified');
+      logger.info('\nUsage:');
+      logger.info('  node fix-stuck-emails.js reset   - Reset retry count to 0');
+      logger.info('  node fix-stuck-emails.js fail    - Mark as failed');
+      logger.info('  node fix-stuck-emails.js delete  - Delete stuck emails');
+      await db.destroy();
+      process.exit(1);
+    }
+    
+    // 4. Execute action
+    logger.info(`\n4. Executing action: ${action.toUpperCase()}`);
+    
+    const emailIds = stuckEmails.map(e => e.id);
+    
+    switch (action) {
+      case 'reset':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            retry_count: 0,
+            error_message: null
+          });
+        logger.info(`   ✅ Reset retry count for ${emailIds.length} email(s)`);
+        logger.info('   These emails will be processed on the next run');
+        break;
+        
+      case 'fail':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            status: 'failed'
+          });
+        logger.info(`   ✅ Marked ${emailIds.length} email(s) as failed`);
+        logger.info('   These emails will not be retried');
+        break;
+        
+      case 'delete':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .delete();
+        logger.info(`   ✅ Deleted ${emailIds.length} email(s)`);
+        break;
+    }
+    
+    // 5. Show updated counts
+    logger.info('\n5. Updated email queue status:');
+    const [pendingCount] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    const [processableCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    
+    logger.info(`   Total pending: ${pendingCount.count}`);
+    logger.info(`   Processable (retry < 3): ${processableCount.count}`);
+    
+    if (pendingCount.count !== processableCount.count) {
+      logger.info(`   ⚠️  Still have ${pendingCount.count - processableCount.count} stuck email(s)`);
+    } else {
+      logger.info('   ✅ No stuck emails remaining');
+    }
+    
+    logger.info('\n=== Script complete ===');
+    
+  } catch (error) {
+    logger.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the fix
+fixStuckEmails();

backend/scripts/fix-temp-photos.js

@@ -0,0 +1,171 @@
+require('dotenv').config({ path: '../.env' });
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generatePhotoFilename } = require('../src/utils/filenameSanitizer');
+
+async function fixTempPhotos() {
+  console.log('Starting to fix temporary photo files...\n');
+  
+  try {
+    // Find all photos with temp_ filenames
+    const tempPhotos = await db('photos')
+      .where('filename', 'like', 'temp_%')
+      .orderBy('event_id', 'asc')
+      .orderBy('category_id', 'asc')
+      .orderBy('id', 'asc');
+    
+    console.log(`Found ${tempPhotos.length} photos with temporary filenames\n`);
+    
+    if (tempPhotos.length === 0) {
+      console.log('No temporary photos found. Exiting.');
+      return;
+    }
+    
+    // Group photos by event and category
+    const grouped = {};
+    for (const photo of tempPhotos) {
+      const key = `${photo.event_id}_${photo.category_id || 'null'}`;
+      if (!grouped[key]) {
+        grouped[key] = [];
+      }
+      grouped[key].push(photo);
+    }
+    
+    console.log(`Processing ${Object.keys(grouped).length} event/category groups...\n`);
+    
+    // Process each group
+    for (const [key, photos] of Object.entries(grouped)) {
+      const [eventId, categoryIdStr] = key.split('_');
+      const categoryId = categoryIdStr === 'null' ? null : parseInt(categoryIdStr);
+      
+      console.log(`\nProcessing Event ID: ${eventId}, Category ID: ${categoryId || 'uncategorized'}`);
+      console.log(`Photos in group: ${photos.length}`);
+      
+      // Get event details
+      const event = await db('events').where({ id: eventId }).first();
+      if (!event) {
+        console.error(`Event ${eventId} not found! Skipping...`);
+        continue;
+      }
+      
+      // Get category details if applicable
+      let category = null;
+      let startCounter = 1;
+      
+      if (categoryId) {
+        category = await db('photo_categories').where({ id: categoryId }).first();
+        if (!category) {
+          console.error(`Category ${categoryId} not found! Treating as uncategorized...`);
+        } else {
+          // Get the highest counter for this category
+          const maxPhoto = await db('photos')
+            .where({ event_id: eventId, category_id: categoryId })
+            .whereNot('filename', 'like', 'temp_%')
+            .orderBy('id', 'desc')
+            .first();
+          
+          if (maxPhoto && maxPhoto.filename) {
+            // Extract counter from filename
+            const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+            if (match) {
+              startCounter = parseInt(match[1]) + 1;
+            }
+          }
+        }
+      } else {
+        // For uncategorized, get the highest counter
+        const maxPhoto = await db('photos')
+          .where({ event_id: eventId })
+          .whereNull('category_id')
+          .whereNot('filename', 'like', 'temp_%')
+          .orderBy('id', 'desc')
+          .first();
+        
+        if (maxPhoto && maxPhoto.filename) {
+          const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+          if (match) {
+            startCounter = parseInt(match[1]) + 1;
+          }
+        }
+      }
+      
+      console.log(`Starting counter: ${startCounter}`);
+      
+      // Process each photo in the group
+      let successCount = 0;
+      let errorCount = 0;
+      
+      for (let i = 0; i < photos.length; i++) {
+        const photo = photos[i];
+        const counter = startCounter + i;
+        
+        try {
+          // Generate new filename
+          const extension = path.extname(photo.filename);
+          const newFilename = generatePhotoFilename(
+            event.event_name,
+            category ? category.name : 'uncategorized',
+            counter,
+            extension
+          );
+          
+          // Build full paths
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+          const oldPath = path.join(storagePath, 'events/active', photo.path);
+          const newPath = path.join(path.dirname(oldPath), newFilename);
+          
+          // Check if old file exists
+          try {
+            await fs.access(oldPath);
+          } catch (e) {
+            console.error(`File not found: ${oldPath}`);
+            errorCount++;
+            continue;
+          }
+          
+          // Rename the file
+          await fs.rename(oldPath, newPath);
+          
+          // Update database
+          const newRelativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
+          await db('photos')
+            .where({ id: photo.id })
+            .update({
+              filename: newFilename,
+              path: newRelativePath
+            });
+          
+          console.log(`✓ Renamed: ${photo.filename} → ${newFilename}`);
+          successCount++;
+          
+        } catch (error) {
+          console.error(`✗ Failed to process photo ${photo.id}: ${error.message}`);
+          errorCount++;
+        }
+      }
+      
+      // Update category counter if needed
+      if (category && successCount > 0) {
+        const newCounter = startCounter + photos.length - 1;
+        await db('photo_categories')
+          .where({ id: categoryId })
+          .update({ photo_counter: newCounter });
+        console.log(`Updated category counter to ${newCounter}`);
+      }
+      
+      console.log(`\nGroup summary: ${successCount} successful, ${errorCount} errors`);
+    }
+    
+    console.log('\n=== COMPLETE ===');
+    console.log('All temporary photos have been processed.');
+    
+  } catch (error) {
+    console.error('Fatal error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the script
+fixTempPhotos().catch(console.error);

backend/scripts/monitor-auth-health.js

@@ -1,136 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Monitor authentication health after deployment
- * Run this after activating enhanced auth to watch for issues
- */
-
-const { db } = require('../src/database/db');
-
-console.log('=== Authentication Health Monitor ===\n');
-console.log('Monitoring auth system... (Press Ctrl+C to stop)\n');
-
-// Color codes
-const GREEN = '\x1b[32m';
-const RED = '\x1b[31m';
-const YELLOW = '\x1b[33m';
-const RESET = '\x1b[0m';
-
-let previousStats = {
-  totalAttempts: 0,
-  failedAttempts: 0,
-  lockedAccounts: 0
-};
-
-async function getAuthStats() {
-  try {
-    const stats = {};
-    
-    // Total login attempts in last hour
-    const totalAttempts = await db('login_attempts')
-      .where('attempt_time', '>', new Date(Date.now() - 60 * 60 * 1000).toISOString())
-      .count('id as count')
-      .first();
-    stats.totalAttempts = totalAttempts.count || 0;
-    
-    // Failed attempts in last hour
-    const failedAttempts = await db('login_attempts')
-      .where('attempt_time', '>', new Date(Date.now() - 60 * 60 * 1000).toISOString())
-      .where('success', false)
-      .count('id as count')
-      .first();
-    stats.failedAttempts = failedAttempts.count || 0;
-    
-    // Currently locked accounts
-    const recentWindow = new Date(Date.now() - 15 * 60 * 1000);
-    const lockedAccounts = await db('login_attempts')
-      .select('identifier')
-      .where('success', false)
-      .where('attempt_time', '>=', recentWindow.toISOString())
-      .groupBy('identifier')
-      .havingRaw('COUNT(*) >= 5');
-    stats.lockedAccounts = lockedAccounts.length;
-    
-    // Success rate
-    stats.successRate = stats.totalAttempts > 0 
-      ? ((stats.totalAttempts - stats.failedAttempts) / stats.totalAttempts * 100).toFixed(1)
-      : 100;
-    
-    // Recent failures (last 5 minutes)
-    const recentFailures = await db('login_attempts')
-      .where('success', false)
-      .where('attempt_time', '>', new Date(Date.now() - 5 * 60 * 1000).toISOString())
-      .orderBy('attempt_time', 'desc')
-      .limit(5)
-      .select('identifier', 'ip_address', 'attempt_time');
-    stats.recentFailures = recentFailures;
-    
-    return stats;
-  } catch (error) {
-    return { error: error.message };
-  }
-}
-
-async function displayStats() {
-  const stats = await getAuthStats();
-  
-  if (stats.error) {
-    console.log(`${RED}Error: ${stats.error}${RESET}`);
-    console.log('Enhanced auth might not be active yet.\n');
-    return;
-  }
-  
-  // Clear console for clean display
-  console.clear();
-  console.log('=== Authentication Health Monitor ===\n');
-  console.log(new Date().toLocaleString());
-  console.log('─'.repeat(50));
-  
-  // Display metrics
-  console.log(`\n📊 Last Hour Statistics:`);
-  console.log(`   Total Login Attempts: ${stats.totalAttempts}`);
-  console.log(`   Failed Attempts: ${stats.failedAttempts}`);
-  console.log(`   Success Rate: ${stats.successRate}%`);
-  console.log(`   Currently Locked: ${stats.lockedAccounts} accounts`);
-  
-  // Alerts
-  if (stats.failedAttempts > previousStats.failedAttempts + 10) {
-    console.log(`\n${RED}⚠️  ALERT: Spike in failed login attempts!${RESET}`);
-  }
-  
-  if (stats.lockedAccounts > 5) {
-    console.log(`\n${YELLOW}⚠️  WARNING: Multiple accounts locked (${stats.lockedAccounts})${RESET}`);
-  }
-  
-  if (stats.successRate < 50) {
-    console.log(`\n${RED}⚠️  ALERT: Low success rate (${stats.successRate}%)${RESET}`);
-  }
-  
-  // Recent failures
-  if (stats.recentFailures && stats.recentFailures.length > 0) {
-    console.log(`\n📋 Recent Failed Attempts (last 5 min):`);
-    stats.recentFailures.forEach(failure => {
-      const time = new Date(failure.attempt_time).toLocaleTimeString();
-      console.log(`   ${time} - ${failure.identifier} from ${failure.ip_address}`);
-    });
-  }
-  
-  // Health status
-  console.log(`\n✅ Status: ${stats.failedAttempts === 0 ? 'Healthy' : 'Active'}`);
-  console.log('\nPress Ctrl+C to stop monitoring\n');
-  
-  previousStats = stats;
-}
-
-// Monitor every 10 seconds
-setInterval(displayStats, 10000);
-
-// Initial display
-displayStats();
-
-// Graceful shutdown
-process.on('SIGINT', async () => {
-  console.log('\nStopping monitor...');
-  await db.destroy();
-  process.exit(0);
-});