screenshots: security-scan-batch-1 Settings > General help text

.dockerignore

@@ -1,20 +0,0 @@
-.git
-.gitignore
-*.md
-.env
-.env.*
-docker-compose*.yml
-.DS_Store
-node_modules
-npm-debug.log
-coverage
-.nyc_output
-.vscode
-.idea
-*.swp
-*.swo
-storage/events/active/*
-storage/events/archived/*
-storage/thumbnails/*
-data/*.db
-logs/*

.drone.yml

@@ -1,77 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-steps:
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-      
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags: 
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_BRANCH}-latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-      build_args:
-        - VERSION=${DRONE_TAG:-dev}
-        - VITE_API_URL=${VITE_API_URL:-/api}
-
-trigger:
-  branch:
-    - main
-    - develop
-  event:
-    - push
-    - pull_request
-
----
-kind: pipeline
-type: docker
-name: release
-
-steps:
-  # Build Backend Release
-  - name: build-backend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-backend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: backend/Dockerfile
-      context: backend/
-      registry: registry.local.nothaft.cloud
-      
-  # Build Frontend Release
-  - name: build-frontend-release
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/picpeak-frontend
-      tags:
-        - ${DRONE_TAG}
-        - latest
-      dockerfile: frontend/Dockerfile
-      context: frontend/
-      registry: registry.local.nothaft.cloud
-
-trigger:
-  event:
-    - tag

.drone.yml.full

@@ -1,280 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-trigger:
-  branch:
-    - main
-    - develop
-    - feature/*
-  event:
-    - push
-    - pull_request
-    - tag
-
-volumes:
-  - name: docker
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  # Frontend Tests
-  - name: frontend-test
-    image: node:18-alpine
-    commands:
-      - cd frontend
-      - npm ci --legacy-peer-deps
-      - npm run lint
-      - npm run build
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Backend Tests
-  - name: backend-test
-    image: node:18-alpine
-    commands:
-      - cd backend
-      - npm ci
-      - npm run lint
-      - npm test
-    environment:
-      NODE_ENV: test
-      JWT_SECRET: test-secret
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-frontend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: frontend/Dockerfile
-      context: frontend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-backend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: backend/Dockerfile
-      context: backend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Security Scan
-  - name: security-scan
-    image: aquasec/trivy:latest
-    commands:
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-frontend:${DRONE_COMMIT_SHA:0:8}
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-backend:${DRONE_COMMIT_SHA:0:8}
-    environment:
-      DOCKER_HOST: tcp://docker:2375
-    volumes:
-      - name: docker
-        path: /var/run/docker.sock
-    when:
-      branch:
-        - main
-      event:
-        - push
-
-  # Deploy to Staging
-  - name: deploy-staging
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: staging_swarm_host
-      SWARM_USER:
-        from_secret: staging_swarm_user
-      SWARM_KEY:
-        from_secret: staging_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_COMMIT_SHA:0:8}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing
-        EOF
-    when:
-      branch:
-        - develop
-      event:
-        - push
-
-  # Deploy to Production
-  - name: deploy-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_TAG:-latest}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          
-          # Backup database before deployment
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_db) pg_dump -U postgres wedding_photo_sharing > /backup/db-backup-\$(date +%Y%m%d-%H%M%S).sql
-          
-          # Deploy stack
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-          
-          # Wait for services to be ready
-          sleep 30
-          
-          # Run migrations if needed
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_backend) npm run migrate
-        EOF
-    when:
-      event:
-        - tag
-
-  # Health Check
-  - name: health-check
-    image: alpine:latest
-    commands:
-      - apk add --no-cache curl
-      - sleep 30
-      - curl -f https://${FRONTEND_HOST}/health || exit 1
-      - curl -f https://${BACKEND_HOST}/api/health || exit 1
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Notification - Success
-  - name: notify-success
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ✅ *Build {{build.number}} succeeded* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        {{#if build.tag}}
-        🏷️ Tag: {{build.tag}}
-        🚀 Deployed to *PRODUCTION*
-        {{else}}
-        📦 Deployed to *{{build.branch}}*
-        {{/if}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - success
-
-  # Notification - Failure
-  - name: notify-failure
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ❌ *Build {{build.number}} failed* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - failure
-
----
-kind: pipeline
-type: docker
-name: rollback
-
-trigger:
-  event:
-    - rollback
-
-steps:
-  - name: rollback-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=${DRONE_ROLLBACK_TO}
-          
-          # Deploy previous version
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-        EOF
-
----
-kind: secret
-name: slack_webhook
-get:
-  path: drone/slack
-  name: webhook

.env.example

@@ -1,34 +0,0 @@
-# Environment Configuration Template
-# Copy this file to .env and adjust values for your environment
-
-# Development: Use docker-compose.dev.yml
-# Production: Use docker-compose.prod.yml with .env.production.example
-
-# JWT Secret (CRITICAL for production)
-# Generate with: openssl rand -base64 32
-JWT_SECRET=dev-secret-change-in-production
-
-# Application URLs
-ADMIN_URL=http://localhost:3005
-FRONTEND_URL=http://localhost:3005
-
-# Database Configuration
-# SQLite is used for development by default
-# For production PostgreSQL config, see .env.production.example
-DATABASE_CLIENT=sqlite3
-DATABASE_PATH=./data/photo_sharing.db
-
-# Email Configuration
-# Development: Uses Mailhog (included in docker-compose.dev.yml)
-# Production: Configure real SMTP server
-SMTP_HOST=mailhog
-SMTP_PORT=1025
-SMTP_SECURE=false
-SMTP_USER=
-SMTP_PASS=
-EMAIL_FROM=noreply@localhost
-
-# Optional: Umami Analytics
-UMAMI_URL=
-UMAMI_WEBSITE_ID=
-UMAMI_HASH_SALT=

.env.production.example

@@ -1,32 +0,0 @@
-# Production Environment Configuration Template
-# Copy this file to .env and fill in your values
-
-# Application URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
-
-# Security - CRITICAL: Generate a secure random JWT secret
-# You can generate one with: openssl rand -base64 32
-JWT_SECRET=your-secure-random-jwt-secret-here
-
-# Database Configuration (PostgreSQL)
-DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
-DB_NAME=picpeak
-
-# Email Configuration
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
-
-# Umami Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=your-random-hash-salt
-
-# First Admin User (for initial setup)
-# Run: docker-compose exec backend node scripts/create-admin.js --email admin@yourdomain.com
-ADMIN_EMAIL=admin@yourdomain.com

.gitea/workflows/test.yml

@@ -1,52 +0,0 @@
-name: Test and Lint
-
-on:
-  push:
-    branches: [ main, develop ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  backend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install backend dependencies
-        working-directory: ./backend
-        run: npm ci
-      
-      - name: Run backend linting
-        working-directory: ./backend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Run backend tests
-        working-directory: ./backend
-        run: npm test || true  # Continue on test failures for now
-  
-  frontend-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci --legacy-peer-deps
-      
-      - name: Run frontend linting
-        working-directory: ./frontend
-        run: npm run lint || true  # Continue on lint errors for now
-      
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build

.gitea/workflows/version-and-release.yml

@@ -1,88 +0,0 @@
-name: Version and Release
-
-on:
-  push:
-    branches: [ main ]
-    paths-ignore:
-      - '**.md'
-      - '.gitea/**'
-      - '.drone.yml'
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    outputs:
-      new_version: ${{ steps.version.outputs.new_version }}
-      version_changed: ${{ steps.version.outputs.version_changed }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITEA_TOKEN || github.token }}
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-      
-      - name: Configure Git
-        run: |
-          git config --global user.name 'Gitea Actions Bot'
-          git config --global user.email 'actions@gitea.local'
-      
-      - name: Bump version
-        id: version
-        run: |
-          # Get current version from backend package.json
-          CURRENT_VERSION=$(node -p "require('./backend/package.json').version")
-          echo "Current version: $CURRENT_VERSION"
-          
-          # Split version into parts
-          IFS='.' read -r -a version_parts <<< "$CURRENT_VERSION"
-          MAJOR="${version_parts[0]}"
-          MINOR="${version_parts[1]}"
-          PATCH="${version_parts[2]}"
-          
-          # Increment patch version
-          NEW_PATCH=$((PATCH + 1))
-          NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
-          
-          echo "New version: $NEW_VERSION"
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          
-          # Update version in package.json files
-          cd backend && npm version $NEW_VERSION --no-git-tag-version
-          cd ../frontend && npm version $NEW_VERSION --no-git-tag-version
-          cd ..
-          
-          # Check if there are changes
-          if [[ -n $(git status -s) ]]; then
-            echo "version_changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "version_changed=false" >> $GITHUB_OUTPUT
-          fi
-      
-      - name: Commit version bump
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          git add backend/package.json backend/package-lock.json
-          git add frontend/package.json frontend/package-lock.json
-          git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }}"
-          git push
-      
-      - name: Create Git tag
-        if: steps.version.outputs.version_changed == 'true'
-        run: |
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "Release v${{ steps.version.outputs.new_version }}"
-          git push origin "v${{ steps.version.outputs.new_version }}"
-  
-  trigger-drone:
-    needs: version-bump
-    if: needs.version-bump.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Drone Build
-        run: |
-          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
-          echo "Drone will automatically trigger on the new tag"
-          # Drone CI will automatically trigger on the tag push event

.github/workflows/release.yml

@@ -1,108 +0,0 @@
-name: Create Release
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'frontend/package.json'
-      - 'backend/package.json'
-
-jobs:
-  check-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.check.outputs.changed }}
-      new_version: ${{ steps.check.outputs.version }}
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Check if version changed
-        id: check
-        run: |
-          # Get current versions
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version")
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version")
-          
-          # Get previous versions
-          git checkout HEAD~1
-          PREV_FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "0.0.0")
-          PREV_BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "0.0.0")
-          
-          # Check if versions changed
-          if [[ "$FRONTEND_VERSION" != "$PREV_FRONTEND_VERSION" ]] || [[ "$BACKEND_VERSION" != "$PREV_BACKEND_VERSION" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "version=$FRONTEND_VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-
-  create-release:
-    needs: check-version-change
-    if: needs.check-version-change.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Generate Changelog
-        id: changelog
-        run: |
-          # Get commits since last tag
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          if [[ -z "$LAST_TAG" ]]; then
-            COMMITS=$(git log --oneline)
-          else
-            COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
-          fi
-          
-          # Format changelog
-          echo "## What's Changed" > changelog.md
-          echo "" >> changelog.md
-          
-          # Group commits by type
-          echo "### Features" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ feat:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No new features*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Bug Fixes" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ fix:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No bug fixes*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Other Changes" >> changelog.md
-          echo "$COMMITS" | grep -vE "^[a-f0-9]+ (feat|fix):" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No other changes*" >> changelog.md
-          
-          # Save changelog
-          echo "changelog<<EOF" >> $GITHUB_OUTPUT
-          cat changelog.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: v${{ needs.check-version-change.outputs.new_version }}
-          name: Release v${{ needs.check-version-change.outputs.new_version }}
-          body: |
-            ## PicPeak v${{ needs.check-version-change.outputs.new_version }}
-            
-            ${{ steps.changelog.outputs.changelog }}
-            
-            ### Docker Images
-            
-            To use this release with Docker:
-            ```bash
-            docker pull ghcr.io/${{ github.repository }}/frontend:v${{ needs.check-version-change.outputs.new_version }}
-            docker pull ghcr.io/${{ github.repository }}/backend:v${{ needs.check-version-change.outputs.new_version }}
-            ```
-            
-            Or use the `latest` tag for the most recent version.
-          draft: false
-          prerelease: false
-          generate_release_notes: true

.github/workflows/version-bump.yml

@@ -1,107 +0,0 @@
-name: Automatic Version Bump
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: 'Version bump type'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          
-      - name: Configure Git
-        run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "actions@github.com"
-
-      - name: Determine version type
-        id: version_type
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "type=${{ github.event.inputs.version_type }}" >> $GITHUB_OUTPUT
-          else
-            # Auto-detect version type based on commit message
-            COMMIT_MSG="${{ github.event.head_commit.message }}"
-            if [[ "$COMMIT_MSG" == *"BREAKING CHANGE"* ]] || [[ "$COMMIT_MSG" == *"!"* ]]; then
-              echo "type=major" >> $GITHUB_OUTPUT
-            elif [[ "$COMMIT_MSG" == *"feat:"* ]] || [[ "$COMMIT_MSG" == *"feat("* ]]; then
-              echo "type=minor" >> $GITHUB_OUTPUT
-            else
-              echo "type=patch" >> $GITHUB_OUTPUT
-            fi
-          fi
-
-      - name: Bump Frontend Version
-        id: frontend_version
-        working-directory: ./frontend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          
-      - name: Bump Backend Version
-        id: backend_version
-        working-directory: ./backend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update Frontend VersionInfo component
-        run: |
-          VERSION=${{ steps.frontend_version.outputs.version }}
-          sed -i "s/const FRONTEND_VERSION = '[^']*'/const FRONTEND_VERSION = '$VERSION'/" frontend/src/components/admin/VersionInfo.tsx
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          title: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          body: |
-            ## Version Bump
-            
-            This PR automatically bumps the version numbers:
-            - Frontend: `${{ steps.frontend_version.outputs.version }}`
-            - Backend: `${{ steps.backend_version.outputs.version }}`
-            
-            ### Version Type: ${{ steps.version_type.outputs.type }}
-            
-            ### Files Changed:
-            - `frontend/package.json`
-            - `backend/package.json`
-            - `frontend/src/components/admin/VersionInfo.tsx`
-            
-            ---
-            *This PR was automatically created by the version bump workflow.*
-          branch: version-bump-${{ steps.frontend_version.outputs.version }}
-          delete-branch: true
-          labels: |
-            version-bump
-            automated

.gitignore

@@ -1,56 +0,0 @@
-# Dependencies
-node_modules/
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Environment files
-.env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
-# Security - Never commit credentials
-ADMIN_CREDENTIALS.txt
-ADMIN_PASSWORD_RESET.txt
-*_CREDENTIALS.txt
-*_PASSWORD_RESET.txt
-
-# Storage and data
-storage/events/active/*
-storage/events/archived/*
-storage/thumbnails/*
-data/*.db
-data/*.db-journal
-logs/*
-
-# Build outputs
-build/
-dist/
-*.log
-
-# OS files
-.DS_Store
-Thumbs.db
-
-# IDE files
-.vscode/
-.idea/
-*.swp
-*.swo
-
-# Test coverage
-coverage/
-.nyc_output/
-
-# Temporary files
-*.tmp
-*.temp
-
-# Keep directory structure
-!storage/events/active/.gitkeep
-!storage/events/archived/.gitkeep
-!storage/thumbnails/.gitkeep
-!data/.gitkeep
-!logs/.gitkeep

CI_CD_STRATEGY.md

@@ -1,118 +0,0 @@
-# CI/CD Strategy for PicPeak
-
-## Overview
-
-This document outlines the CI/CD strategy using both Gitea Actions and Drone CI to avoid conflicts and ensure proper versioning.
-
-## Pipeline Flow
-
-### 1. Development & Testing (Gitea Actions)
-- **Trigger**: Every push to `main` or `develop` branches
-- **File**: `.gitea/workflows/test.yml`
-- **Purpose**: Run tests, linting, and basic validation
-- **Actions**:
-  - Backend linting and tests
-  - Frontend linting and build
-  - Does NOT build Docker images
-
-### 2. Version Management (Gitea Actions)
-- **Trigger**: Push to `main` branch (excluding markdown files)
-- **File**: `.gitea/workflows/version-and-release.yml`
-- **Purpose**: Automatic version incrementing
-- **Actions**:
-  1. Reads current version from `package.json`
-  2. Increments patch version (e.g., 1.0.0 → 1.0.1)
-  3. Updates both backend and frontend `package.json`
-  4. Commits the version change
-  5. Creates a git tag (e.g., `v1.0.1`)
-  6. Pushes changes and tag
-
-### 3. Docker Image Building (Drone CI)
-- **Trigger**: 
-  - Push to `main` or `develop` (builds with commit SHA)
-  - New git tags (builds release versions)
-- **File**: `.drone.yml`
-- **Purpose**: Build and push Docker images
-- **Tags Created**:
-  - `latest` - Always points to newest build
-  - `{commit-sha}` - Specific commit version
-  - `{branch}-latest` - Latest for specific branch
-  - `v1.0.1` - Specific version (on tag trigger)
-
-## Why This Strategy?
-
-1. **Separation of Concerns**:
-   - Gitea Actions handles code quality and versioning
-   - Drone CI handles Docker image building
-   - No overlap or race conditions
-
-2. **Sequential Execution**:
-   - Version bump happens first
-   - Tag creation triggers Drone
-   - Docker images are built with correct version
-
-3. **Version Consistency**:
-   - Version in `package.json` matches git tag
-   - Docker images are tagged with same version
-   - No manual version management needed
-
-## Setup Requirements
-
-1. **Gitea Actions Runner**: Must be configured and running
-2. **Drone CI**: Must be connected to your Gitea instance
-3. **Secrets**: 
-   - `GITEA_TOKEN` (optional, for pushing version commits)
-   - Docker registry credentials in Drone
-
-## Version Numbering
-
-- Format: `MAJOR.MINOR.PATCH` (e.g., 1.0.0)
-- Automatic increments: PATCH version only
-- Manual increments: Edit `package.json` for MAJOR/MINOR changes
-
-## Usage
-
-1. **Regular Development**:
-   ```bash
-   git add .
-   git commit -m "feat: add new feature"
-   git push origin main
-   ```
-   - Tests run automatically
-   - Version bumps to 1.0.1
-   - Docker images built with v1.0.1 tag
-
-2. **Major/Minor Version Change**:
-   ```bash
-   # Manually edit package.json files to 2.0.0
-   git add .
-   git commit -m "feat!: major release"
-   git push origin main
-   ```
-
-3. **Skip Version Bump**:
-   - Add `[skip ci]` to commit message
-   - Or only change markdown files
-
-## Monitoring
-
-- **Gitea Actions**: Check Actions tab in Gitea
-- **Drone CI**: Check Drone dashboard
-- **Docker Registry**: Verify images are pushed with correct tags
-
-## Troubleshooting
-
-1. **Version not incrementing**:
-   - Check Gitea Actions logs
-   - Ensure runner has push permissions
-   - Verify no `[skip ci]` in commit message
-
-2. **Docker images not building**:
-   - Check Drone CI webhook configuration
-   - Verify Drone can see the repository
-   - Check Docker registry credentials
-
-3. **Conflicts**:
-   - Never run both pipelines for same task
-   - Use branch protection to prevent direct pushes
-   - Always let automation handle versioning

CLAUDE.md

@@ -1,261 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Product Overview
-
-A secure photo sharing platform designed for weddings and events, enabling photographers to share time-limited, password-protected galleries. The platform features automatic expiration, archiving, and a scrappbook.de-inspired modern, minimalist UI.
-
-## Architecture Overview
-
-- **Backend**: Node.js/Express API with SQLite/PostgreSQL, file-based photo storage
-- **Frontend**: React SPA with scrappbook.de-style design (requires implementation)
-- **Storage**: File-based with active/archived separation
-- **Services**: Background workers for email, archiving, file watching, and expiration monitoring
-- **Analytics**: Umami integration for engagement tracking
-
-## Essential Commands
-
-### Backend Development
-```bash
-cd backend
-npm install               # Install dependencies
-npm run migrate          # Initialize database schema
-npm run dev              # Start with hot-reload (port 3001)
-npm test                 # Run Jest tests
-npm run lint             # ESLint checks
-```
-
-### Running a Single Test
-```bash
-cd backend
-npm test -- path/to/test.test.js
-npm test -- --testNamePattern="test name"
-```
-
-### Production
-```bash
-docker-compose -f docker-compose.prod.yml up -d  # Production deployment
-pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
-```
-
-## Key Product Requirements (from PRD)
-
-### Core Features
-1. **File-Based System**: Drop photos in folders → automatic gallery creation
-2. **Automatic Expiration**: Default 30 days, with 7-day warning emails
-3. **Password Protection**: Secure access with customizable passwords
-4. **Automatic Archiving**: ZIP compression and storage after expiration
-5. **Email Notifications**: Creation, warning, and expiration notifications
-6. **Analytics**: Umami tracking for views, downloads, and engagement
-
-### Folder Structure
-```
-/events/
-  ├── active/
-  │   ├── wedding-smith-jones-2024-06-15/
-  │   │   ├── collages/
-  │   │   └── individual/
-  │   └── birthday-emma-2024-07-20/
-  └── archived/
-      └── wedding-smith-jones-2024-06-15.zip
-```
-
-## Frontend Implementation Requirements
-
-### Design Style (scrappbook.de-inspired)
-- **Color Palette**: Primary green (#5C8762), neutral backgrounds
-- **Typography**: Clean, modern sans-serif (Noto Sans or similar)
-- **Layout**: Minimalist, modular sections with grid-based photo displays
-- **Aesthetic**: Professional yet approachable, photographer-focused
-
-### Key Frontend Components to Build
-1. **Landing Page**: Password entry with event preview
-2. **Gallery View**: 
-   - Responsive photo grid with lazy loading
-   - Toggle between collages/individual photos
-   - Prominent expiration banner
-   - Download urgency indicators
-3. **Photo Lightbox**: Full-screen viewing with zoom
-4. **Mobile-First**: Responsive design with touch gestures
-5. **Personalization**: Dynamic theming per event type
-
-### User Experience Priorities
-- Clear expiration warnings (sticky banner)
-- One-click "Download All" for urgent galleries
-- Smooth image loading with skeleton screens
-- Intuitive navigation between photo categories
-- Professional presentation matching photographer branding
-
-## Key Architecture Patterns
-
-### Authentication Flow
-- JWT-based with separate tokens for admin and gallery access
-- Gallery tokens include event-specific claims
-- Auth middleware: `backend/src/middleware/auth.js`
-  - `adminAuth` - Admin panel protection
-  - `photoAuth` - Protected photo access  
-  - `verifyGalleryAccess` - Gallery-specific validation
-
-### Database Schema (Knex/SQLite)
-Main tables:
-- `events` - Gallery metadata with expiration, custom messages, themes
-- `photos` - Photo records linked to events
-- `access_logs` - IP-based usage tracking
-- `email_queue` - Async email processing
-- `admin_users` - Admin authentication
-
-### Service Architecture
-Background services run as separate processes:
-- **emailService**: Processes email queue with retry logic
-- **archiveService**: Creates ZIP archives of expired events
-- **expirationChecker**: Cron job for expiration warnings
-- **fileWatcher**: Monitors for new photo uploads
-
-### API Structure
-- `/api/admin/*` - Admin panel endpoints (requires adminAuth)
-- `/api/gallery/*` - Public gallery endpoints  
-- `/api/auth/*` - Authentication endpoints
-- Rate limiting: 100 req/15min (general), 5 req/15min (auth)
-
-## Critical Implementation Notes
-
-1. **Security**: All gallery access requires valid JWT with event-specific claims
-2. **Expiration**: Events auto-expire based on `expires_at`, with 7-day email warnings
-3. **Email Queue**: Async processing with retry logic, check `email_queue` table
-4. **File Processing**: Sharp library for thumbnail generation (300x300)
-5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
-6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
-
-## Environment Variables
-
-### Backend (.env)
-- `JWT_SECRET` - Token signing
-- `ADMIN_URL`, `FRONTEND_URL` - CORS origins
-- `SMTP_*` - Email configuration
-- `DB_*` - PostgreSQL credentials (production)
-- `UMAMI_URL` - Umami instance URL (for server-side tracking)
-- `UMAMI_WEBSITE_ID` - Website ID from Umami
-
-### Frontend (.env)
-- `VITE_API_URL` - Backend API URL
-- `VITE_UMAMI_URL` - Umami analytics URL
-- `VITE_UMAMI_WEBSITE_ID` - Website ID from Umami
-- `VITE_UMAMI_SHARE_URL` - (Optional) Public share URL for embedded dashboard
-
-## Testing Approach
-- Jest with Supertest for API testing
-- Test files in `__tests__` directories
-- Database migrations run before tests
-- Mock email sending in tests
-
-## Umami Analytics Integration
-
-The frontend includes comprehensive Umami analytics integration for tracking user behavior and gallery performance.
-
-### Tracked Events:
-- **Gallery Events**:
-  - `gallery_password_entry` - Password attempts (success/failure)
-  - `gallery_photo_view` - Individual photo views
-  - `gallery_photo_download` - Single photo downloads
-  - `gallery_bulk_download` - Bulk/all photo downloads
-  - `gallery_expired` - Expired gallery access attempts
-- **Admin Events**:
-  - `admin_login` - Admin authentication
-  - `admin_event_created` - New event creation
-  - `admin_event_archived` - Event archiving
-  - `admin_event_deleted` - Event deletion
-  - `admin_settings_updated` - Settings changes
-- **User Behavior**:
-  - Search queries (with debouncing)
-  - Expiration warning views
-  - Page views with automatic tracking
-
-### Setup:
-1. Install Umami (self-hosted or cloud)
-2. Create a website in Umami dashboard
-3. Set environment variables:
-   ```
-   VITE_UMAMI_URL=https://your-umami-instance.com
-   VITE_UMAMI_WEBSITE_ID=your-website-id
-   VITE_UMAMI_SHARE_URL=https://your-umami-instance.com/share/...
-   ```
-
-### Analytics Dashboard:
-- Admin panel includes analytics page at `/admin/analytics`
-- Summary view with key metrics
-- Option to embed full Umami dashboard
-- Real-time event tracking
-
-## Accessibility & Performance Features
-
-### Accessibility (WCAG 2.1 AA Compliance)
-- **Error Boundaries**: Graceful error handling with recovery options
-- **Skip Links**: Skip to main content for keyboard navigation
-- **ARIA Labels**: Proper labeling for screen readers
-- **Focus Management**: Focus trap in modals, visible focus indicators
-- **Keyboard Navigation**: Full keyboard support in gallery lightbox (arrows, escape, +/-, d for download)
-- **Loading States**: Skeleton screens instead of spinners for better UX
-- **Offline Support**: Visual indicator when offline
-- **Form Validation**: Accessible error messages with aria-describedby
-
-### Performance Optimizations
-- **Lazy Loading**: Images load on scroll with Intersection Observer
-- **Skeleton Screens**: Instant visual feedback during loading
-- **Error Recovery**: Component-level error boundaries prevent full page crashes
-- **Optimistic Updates**: Immediate UI updates with background sync
-- **Debounced Search**: Prevents excessive API calls
-- **Analytics**: Non-blocking Umami integration
-
-### Component Library Enhancements
-- `<ErrorBoundary>` - Catches and displays errors gracefully
-- `<PageErrorBoundary>` - Full-page error recovery
-- `<Skeleton>` - Flexible skeleton loader with variants
-- `<OfflineIndicator>` - Network status monitoring
-- `<SkipLink>` - Accessibility navigation
-- `useFocusTrap` - Modal focus management hook
-- `useOnlineStatus` - Network status hook
-
-## Theme System & Branding
-
-### Theme Features
-- **Dynamic Theming**: CSS variables for runtime theme switching
-- **Preset Themes**: Default, Wedding, Birthday, Corporate, Minimal
-- **Customization Options**:
-  - Primary/Accent/Background/Text colors
-  - Font family selection
-  - Border radius (none, sm, md, lg)
-  - Custom logo upload
-  - Custom CSS injection
-- **Event-Specific Themes**: Override global theme per gallery
-- **Live Preview**: Real-time theme changes in admin panel
-
-### Theme Context API
-```typescript
-const { theme, setTheme, setThemeByName } = useTheme();
-```
-
-### Branding Settings
-- Company name, tagline, and support email
-- Custom footer text
-- Optional watermarking on downloads
-- Logo upload for gallery header
-
-### CSS Variables
-```css
---color-primary: #5C8762;
---color-primary-light: #7aa583;
---color-primary-dark: #4a6f4f;
---color-accent: #22c55e;
---color-background: #fafafa;
---color-text: #171717;
---font-family: 'Inter', sans-serif;
---border-radius: 0.5rem;
-```
-
-## Success Metrics (from PRD)
-- Time to generate gallery: <2 minutes
-- Guest satisfaction: >90%
-- System uptime: 99.9%
-- Email delivery rate: >98%
-- Successful archiving: 100%

DEPLOYMENT.md

@@ -1,346 +0,0 @@
-# PicPeak Deployment Guide
-
-This guide covers deploying PicPeak for development and production environments.
-
-## Table of Contents
-- [Quick Start (Development)](#quick-start-development)
-- [Production Deployment](#production-deployment)
-- [Admin User Setup](#admin-user-setup)
-- [Configuration Reference](#configuration-reference)
-- [Troubleshooting](#troubleshooting)
-
-## Quick Start (Development)
-
-### 1. Clone and Setup
-
-```bash
-git clone https://github.com/yourusername/picpeak.git
-cd picpeak
-
-# Copy environment template
-cp .env.example .env
-
-# Start development environment
-docker-compose -f docker-compose.dev.yml up -d
-```
-
-### 2. Access Services
-
-- Frontend: http://localhost:3005
-- Backend API: http://localhost:3001
-- MailHog (email testing): http://localhost:8025
-
-### 3. Create Admin User
-
-```bash
-docker-compose -f docker-compose.dev.yml exec backend node scripts/create-admin.js \
-  --email admin@localhost \
-  --username admin \
-  --password admin123
-```
-
-## Production Deployment
-
-### Prerequisites
-
-- Docker and Docker Compose installed
-- Domain with DNS configured
-- SSL/TLS handled by reverse proxy (Traefik, Nginx, etc.)
-
-### 1. Environment Setup
-
-```bash
-# Copy production template
-cp .env.production.example .env
-
-# Generate secure secrets
-echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
-echo "DB_PASSWORD=$(openssl rand -base64 24)" >> .env
-```
-
-Edit `.env` with your configuration:
-
-```env
-# Your domain
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
-
-# Database (PostgreSQL)
-DB_USER=picpeak
-DB_NAME=picpeak
-# DB_PASSWORD already generated above
-
-# Email
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
-```
-
-### 2. Frontend Configuration
-
-```bash
-# Configure frontend for production
-echo "VITE_API_URL=/api" > frontend/.env.production
-```
-
-### 3. Deploy with Docker Compose
-
-```bash
-# Build and start services
-docker-compose -f docker-compose.prod.yml up -d
-
-# Check status
-docker-compose -f docker-compose.prod.yml ps
-
-# View logs
-docker-compose -f docker-compose.prod.yml logs -f
-```
-
-### 4. Deploy with Traefik
-
-If using Traefik, create `docker-compose.override.yml`:
-
-```yaml
-version: '3.8'
-
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-    networks:
-      - traefik
-      - picpeak
-
-networks:
-  traefik:
-    external: true
-```
-
-## Admin User Setup
-
-### Create First Admin
-
-After deployment, create your admin user:
-
-```bash
-# Production
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com \
-  --username admin \
-  --password yourSecurePassword
-
-# Auto-generate password
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com
-```
-
-The script will display:
-- ✅ Admin user created successfully!
-- Email: admin@yourdomain.com
-- Username: admin
-- Login URL: https://yourdomain.com/admin/login
-- Password: (save this if auto-generated!)
-
-### Managing Admin Users
-
-```bash
-# List admin users
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "SELECT id, username, email, is_active, last_login FROM admin_users;"
-
-# Deactivate user
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "UPDATE admin_users SET is_active = false WHERE email = 'user@example.com';"
-```
-
-## Configuration Reference
-
-### Database Configuration
-
-PicPeak automatically detects the environment and uses:
-- **Development**: SQLite (`./data/photo_sharing.db`)
-- **Production**: PostgreSQL (configured via environment variables)
-
-### Environment Variables
-
-#### Required for Production
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `JWT_SECRET` | JWT signing key | `openssl rand -base64 32` |
-| `DB_PASSWORD` | PostgreSQL password | `openssl rand -base64 24` |
-| `ADMIN_URL` | Admin panel URL | `https://yourdomain.com` |
-| `FRONTEND_URL` | Frontend URL | `https://yourdomain.com` |
-| `EMAIL_FROM` | Sender email | `noreply@yourdomain.com` |
-
-#### Email Configuration
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `SMTP_HOST` | SMTP server | `smtp.gmail.com` |
-| `SMTP_PORT` | SMTP port | `587` |
-| `SMTP_SECURE` | Use TLS | `true` |
-| `SMTP_USER` | SMTP username | `your-email@gmail.com` |
-| `SMTP_PASS` | SMTP password | App-specific password |
-
-### Storage Paths
-
-- Photos: `./storage/events/active/`
-- Archives: `./storage/events/archived/`
-- Thumbnails: `./storage/thumbnails/`
-- Uploads: `./storage/uploads/`
-
-## Backup and Restore
-
-### Backup Database
-
-```bash
-# PostgreSQL backup
-docker-compose -f docker-compose.prod.yml exec db \
-  pg_dump -U picpeak picpeak > backup-$(date +%Y%m%d).sql
-
-# Backup storage
-tar -czf storage-backup-$(date +%Y%m%d).tar.gz ./storage
-```
-
-### Restore Database
-
-```bash
-# PostgreSQL restore
-docker-compose -f docker-compose.prod.yml exec -T db \
-  psql -U picpeak picpeak < backup-20240115.sql
-
-# Restore storage
-tar -xzf storage-backup-20240115.tar.gz
-```
-
-## Monitoring
-
-### Health Checks
-
-```bash
-# Backend health
-curl https://yourdomain.com/api/health
-
-# Frontend health
-curl https://yourdomain.com/health
-```
-
-### Logs
-
-```bash
-# All services
-docker-compose -f docker-compose.prod.yml logs -f
-
-# Specific service
-docker-compose -f docker-compose.prod.yml logs -f backend
-
-# Last 100 lines
-docker-compose -f docker-compose.prod.yml logs --tail=100 backend
-```
-
-## Troubleshooting
-
-### Backend Won't Start
-
-1. Check database connection:
-   ```bash
-   docker-compose -f docker-compose.prod.yml logs db
-   ```
-
-2. Verify environment variables:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep DB_
-   ```
-
-### Can't Login as Admin
-
-1. Verify admin user exists:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM admin_users;"
-   ```
-
-2. Reset admin password:
-   ```bash
-   # Create new admin with different email
-   docker-compose -f docker-compose.prod.yml exec backend \
-     node scripts/create-admin.js --email newadmin@yourdomain.com
-   ```
-
-### Photos Not Loading
-
-1. Check file permissions:
-   ```bash
-   ls -la ./storage/events/active/
-   ```
-
-2. Verify nginx proxy configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec frontend \
-     cat /etc/nginx/conf.d/default.conf
-   ```
-
-### Email Not Sending
-
-1. Check email configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep SMTP_
-   ```
-
-2. View email queue:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM email_queue WHERE status = 'failed';"
-   ```
-
-## Maintenance
-
-### Update Application
-
-```bash
-# Pull latest changes
-git pull
-
-# Rebuild images
-docker-compose -f docker-compose.prod.yml build
-
-# Restart services
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-### Clean Up
-
-```bash
-# Remove unused images
-docker image prune -a
-
-# Clean up logs
-docker-compose -f docker-compose.prod.yml logs --tail=0 -f
-
-# Remove old archives
-find ./storage/events/archived -name "*.zip" -mtime +90 -delete
-```
-
-## Security Checklist
-
-- [ ] Generated secure `JWT_SECRET`
-- [ ] Generated secure `DB_PASSWORD`
-- [ ] HTTPS enabled via reverse proxy
-- [ ] Changed default admin credentials
-- [ ] Configured real SMTP server
-- [ ] Set file permissions: `chmod 600 .env`
-- [ ] Firewall configured
-- [ ] Regular backups scheduled
-- [ ] Monitoring enabled

LICENSE

@@ -1,9 +0,0 @@
-MIT License
-
-Copyright (c) 2025 paul
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

PRODUCTION_DEPLOYMENT.md

@@ -1,98 +0,0 @@
-# Production Deployment Guide
-
-This guide explains how to deploy PicPeak in production behind a reverse proxy like Traefik.
-
-## Environment Configuration
-
-### Frontend Configuration
-
-For production deployment behind a reverse proxy (Traefik, Nginx, etc.), the frontend should use relative URLs to automatically inherit the protocol (HTTPS) and domain.
-
-1. Copy the production environment template:
-   ```bash
-   cp frontend/.env.production.example frontend/.env.production
-   ```
-
-2. Set the API URL to use relative path:
-   ```env
-   # frontend/.env.production
-   VITE_API_URL=/api
-   ```
-
-   This ensures all API calls will use the same domain and protocol as the frontend.
-
-### Backend Configuration
-
-Ensure your backend `.env` file has the correct URLs:
-```env
-# backend/.env
-FRONTEND_URL=https://yourdomain.com
-ADMIN_URL=https://yourdomain.com
-```
-
-## Docker Compose Production
-
-When using Docker Compose in production:
-
-1. Build with production environment:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build --build-arg NODE_ENV=production
-   ```
-
-2. The frontend nginx configuration already includes proper proxy settings for:
-   - `/api` → Backend API
-   - `/photos` → Protected photo access
-   - `/thumbnails` → Thumbnail images
-   - `/uploads` → Public uploads (logos, favicons)
-
-## Traefik Configuration
-
-Example Traefik labels for docker-compose:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-```
-
-## Important Notes
-
-1. **No Hardcoded URLs**: The application uses environment variables with relative URL fallbacks, making it production-ready.
-
-2. **HTTPS Only**: When `VITE_API_URL=/api`, all requests will use the same protocol as the page (HTTPS in production).
-
-3. **CORS Configuration**: The backend CORS is configured to accept requests from the URLs specified in `FRONTEND_URL` and `ADMIN_URL`.
-
-4. **Static Assets**: All static assets (photos, thumbnails, uploads) are served through the nginx proxy, inheriting authentication headers.
-
-## Verification
-
-After deployment, verify:
-
-1. Check browser console for any localhost URLs (there should be none)
-2. Verify all API calls use HTTPS
-3. Check that images load correctly with authentication
-4. Test favicon and logo display
-
-## Troubleshooting
-
-If you see console errors about localhost:
-
-1. Ensure `VITE_API_URL=/api` in frontend environment
-2. Clear browser cache
-3. Rebuild frontend with production environment:
-   ```bash
-   cd frontend
-   npm run build
-   ```
-
-If images don't load:
-
-1. Check that nginx proxy locations are configured
-2. Verify authentication tokens are being sent
-3. Check backend logs for authentication errors

PRODUCTION_DEPLOYMENT_FIXES.md

@@ -1,84 +0,0 @@
-# Production Deployment Fixes
-
-This document describes the fixes applied to resolve production deployment issues in Docker.
-
-## Issues Fixed
-
-### 1. Database Connection Error: "getaddrinfo ENOTFOUND postgres"
-**Problem**: The backend was trying to connect to hostname "postgres" but the database service is named "db" in docker-compose.
-**Solution**: 
-- Updated `knexfile.js` to use correct default host "db" instead of "postgres"
-- Added `depends_on: db` to backend service in docker-compose.prod.yml
-
-### 2. Backend Starting Before Database Ready
-**Problem**: Backend service started before PostgreSQL was ready, causing connection failures.
-**Solution**:
-- Created `wait-for-db.sh` script that waits for PostgreSQL to be ready
-- Updated Dockerfile to install postgresql-client and use the wait script
-- Script also runs migrations automatically on startup
-
-### 3. Email Processor Initialization Failure
-**Problem**: Email processor tried to initialize on module load before database was available.
-**Solution**:
-- Modified `emailProcessor.js` to export initialization functions
-- Updated `server.js` to call initialization after database is ready
-- Added proper error handling for email service initialization
-
-### 4. Missing Environment Variables
-**Problem**: Critical storage path environment variables were missing.
-**Solution**:
-- Added STORAGE_PATH, EVENTS_PATH, and ARCHIVE_PATH to docker-compose.prod.yml
-- Created `.env.example` documenting all required environment variables
-
-### 5. Enhanced Health Check
-**Problem**: Basic health check didn't verify database connectivity.
-**Solution**:
-- Updated `/api/health` endpoint to check database connection
-- Returns proper HTTP 503 status when unhealthy
-
-## Files Modified
-
-1. **backend/knexfile.js** - Fixed production database defaults
-2. **backend/wait-for-db.sh** - Created database wait script
-3. **backend/Dockerfile** - Added postgresql-client and wait script
-4. **docker-compose.prod.yml** - Added dependencies and environment variables
-5. **backend/src/services/emailProcessor.js** - Disabled auto-initialization
-6. **backend/server.js** - Added email initialization and improved health check
-7. **backend/.env.example** - Created environment variable documentation
-
-## Deployment Steps
-
-1. Ensure all environment variables are set according to `.env.example`
-2. Build and deploy with docker-compose:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build
-   docker-compose -f docker-compose.prod.yml up -d
-   ```
-3. The backend will now:
-   - Wait for PostgreSQL to be ready
-   - Run migrations automatically
-   - Initialize all services in proper order
-   - Provide health status at `/api/health`
-
-## Verification
-
-Check deployment health:
-```bash
-curl http://localhost/api/health
-```
-
-Expected response:
-```json
-{
-  "status": "ok",
-  "database": "connected",
-  "timestamp": "2025-07-13T20:30:00.000Z"
-}
-```
-
-## Email Configuration
-
-Email service requires configuration in the database. If email is not configured:
-- The service will log a warning but continue running
-- Emails will be queued but not sent
-- Configure email settings in the admin panel after deployment

README-LOCAL.md

@@ -1,130 +0,0 @@
-# 🚀 Quick Local Development Setup
-
-Get the photo sharing platform running locally in under 2 minutes!
-
-## Prerequisites
-- Docker Desktop installed and running
-- Git
-- 4GB RAM available
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone <your-repo-url>
-cd picpeak
-
-# 2. Start everything
-./start-local.sh
-```
-
-That's it! 🎉
-
-## What You Get
-
-| Service | URL | Description |
-|---------|-----|-------------|
-| Frontend (Dev) | http://localhost:3002 | React app with hot reload |
-| Frontend (Prod) | http://localhost:3000 | Production build |
-| Backend API | http://localhost:3001 | Express API |
-| Mailhog | http://localhost:8025 | Email testing UI |
-
-## Default Credentials
-
-- **Admin Login**: Check `ADMIN_CREDENTIALS.txt` after first setup
-- **Test Gallery**: 
-  - Create via Admin Panel
-  - Set your own secure password
-
-## Common Tasks
-
-### View Logs
-```bash
-docker-compose -f docker-compose.local.yml logs -f
-```
-
-### Stop Everything
-```bash
-./stop-local.sh
-```
-
-### Reset Database
-```bash
-docker-compose -f docker-compose.local.yml exec backend npm run migrate
-```
-
-### Add Test Photos
-1. Create a gallery in the admin panel
-2. Get the gallery slug (e.g., `wedding-smith-2024`)
-3. Add photos to: `./storage/events/active/wedding-smith-2024/`
-4. Photos appear automatically!
-
-### Access Backend Shell
-```bash
-docker-compose -f docker-compose.local.yml exec backend sh
-```
-
-## Development Workflow
-
-1. **Frontend Development** (Port 3002)
-   - Hot reload enabled
-   - Edit files in `./frontend/src`
-   - Changes appear instantly
-
-2. **Backend Development** (Port 3001)
-   - Nodemon watches for changes
-   - Edit files in `./backend/src`
-   - Server restarts automatically
-
-3. **Email Testing**
-   - All emails go to Mailhog
-   - View at http://localhost:8025
-   - No real emails sent!
-
-## Troubleshooting
-
-### Backend won't start
-```bash
-# Check logs
-docker-compose -f docker-compose.local.yml logs backend
-
-# Rebuild
-docker-compose -f docker-compose.local.yml build backend
-```
-
-### Frontend build issues
-```bash
-# Clear cache and rebuild
-docker-compose -f docker-compose.local.yml exec frontend-dev npm run build
-```
-
-### Port conflicts
-Edit `docker-compose.local.yml` and change the port mappings:
-- Backend: Change `3001:3000` to `XXXX:3000`
-- Frontend: Change `3002:5173` to `YYYY:5173`
-
-### Reset everything
-```bash
-# Stop and remove all data
-docker-compose -f docker-compose.local.yml down -v
-rm -rf data storage logs
-./start-local.sh
-```
-
-## Tips
-
-- 📧 Check Mailhog for all emails
-- 🔄 Frontend auto-refreshes on save
-- 📁 SQLite DB at `./data/photo_sharing.db`
-- 🖼️ Photos in `./storage/events/active/`
-- 📝 Logs in `./logs/`
-
-## Next Steps
-
-1. Create your first gallery via Admin Panel
-2. Upload some test photos
-3. Test the gallery with password
-4. Check expiration warnings
-5. View emails in Mailhog
-
-Happy coding! 🎨

README.md

@@ -1,32 +0,0 @@
-# Photo Sharing Platform
-
-A secure, self-hosted photo sharing platform designed for weddings and events. Features automatic expiration, email notifications, and simple file-based management.
-
-## Features
-
-- 🔒 Password Protected Galleries
-- ⏰ Automatic Expiration
-- 📧 Email Notifications
-- 📁 Simple File Management
-- 📊 Analytics Integration
-- 🎨 Customizable Themes
-- 📱 Mobile Responsive
-- ⚡ Docker Ready
-
-## Quick Start
-
-1. Clone the repository
-2. Run `./scripts/install.sh`
-3. Configure `.env` file
-4. Setup SSL: `./scripts/setup-ssl.sh`
-5. Start: `docker-compose -f docker-compose.prod.yml up -d`
-
-Default credentials: Check ADMIN_CREDENTIALS.txt after first setup
-
-## Documentation
-
-See DEPLOYMENT.md for detailed deployment instructions.
-
-## License
-
-MIT License

SETUP_GUIDE.md

@@ -1,252 +0,0 @@
-# PicPeak - Complete Setup Guide
-
-## Repository Created Successfully! 🎉
-
-Your PicPeak repository has been created at:
-**https://gitea.nothaft.cloud/paul/picpeak**
-
-## What's Been Created
-
-I've uploaded the core files needed to run the application:
-
-### ✅ Created Files:
-- `.gitignore` - Git ignore rules
-- `.dockerignore` - Docker ignore rules
-- `.env.example` - Environment configuration template
-- `docker-compose.yml` - Development Docker setup
-- `docker-compose.prod.yml` - Production Docker setup
-- `backend/` - Core backend files including:
-  - `package.json` - Dependencies
-  - `server.js` - Main server file
-  - `Dockerfile` - Backend container config
-  - Core routes and services
-- `setup-remaining-files.sh` - Script to create remaining files
-
-## Next Steps to Complete Setup
-
-### 1. Clone the Repository
-```bash
-git clone https://gitea.local.nothaft.cloud/paul/picpeak.git
-cd picpeak
-```
-
-### 2. Run the Setup Script
-```bash
-chmod +x setup-remaining-files.sh
-./setup-remaining-files.sh
-```
-
-This will create all remaining directories and files needed.
-
-### 3. Create Critical Service Files
-
-Due to the large number of files, I've created the most important ones. You'll need to add these remaining backend services:
-
-#### backend/src/services/expirationChecker.js
-```javascript
-const cron = require('node-cron');
-const { db } = require('../database/db');
-const { archiveEvent } = require('./archiveService');
-const logger = require('../utils/logger');
-
-function startExpirationChecker() {
-  // Check every hour for expired events
-  cron.schedule('0 * * * *', async () => {
-    await checkExpirations();
-  });
-  
-  logger.info('Expiration checker started');
-}
-
-async function checkExpirations() {
-  try {
-    const now = new Date();
-    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-    
-    // Check for events needing warning emails
-    const eventsNeedingWarning = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', warningDate)
-      .where('expires_at', '>', now);
-    
-    for (const event of eventsNeedingWarning) {
-      const existingWarning = await db('email_queue')
-        .where('event_id', event.id)
-        .where('email_type', 'warning')
-        .first();
-      
-      if (!existingWarning) {
-        await queueExpirationWarning(event);
-      }
-    }
-    
-    // Check for expired events
-    const expiredEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', now);
-    
-    for (const event of expiredEvents) {
-      await handleExpiredEvent(event);
-    }
-    
-  } catch (error) {
-    logger.error('Error checking expirations:', error);
-  }
-}
-
-async function queueExpirationWarning(event) {
-  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
-  
-  await db('email_queue').insert({
-    event_id: event.id,
-    recipient_email: event.host_email,
-    email_type: 'warning',
-    email_data: JSON.stringify({
-      event_name: event.event_name,
-      days_remaining: daysRemaining,
-      share_link: event.share_link
-    })
-  });
-  
-  logger.info(`Queued expiration warning for event ${event.slug}`);
-}
-
-async function handleExpiredEvent(event) {
-  try {
-    await db('events').where('id', event.id).update({ is_active: false });
-    
-    await db('email_queue').insert([
-      {
-        event_id: event.id,
-        recipient_email: event.host_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name
-        })
-      },
-      {
-        event_id: event.id,
-        recipient_email: event.admin_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name,
-          event_slug: event.slug
-        })
-      }
-    ]);
-    
-    await archiveEvent(event);
-    
-    logger.info(`Handled expiration for event ${event.slug}`);
-  } catch (error) {
-    logger.error(`Error handling expired event ${event.slug}:`, error);
-  }
-}
-
-module.exports = { startExpirationChecker };
-```
-
-### 4. Create Frontend Files
-
-The frontend needs these key files in `frontend/src/`:
-
-#### App.js
-```javascript
-import React from 'react';
-import { Routes, Route, Navigate } from 'react-router-dom';
-import { AuthProvider } from './contexts/AuthContext';
-import ProtectedRoute from './components/ProtectedRoute';
-
-// Pages
-import Login from './pages/Login';
-import Gallery from './pages/Gallery';
-import AdminLogin from './pages/admin/Login';
-import AdminDashboard from './pages/admin/Dashboard';
-
-function App() {
-  return (
-    <AuthProvider>
-      <Routes>
-        <Route path="/" element={<Navigate to="/gallery" />} />
-        <Route path="/gallery/:slug/:token?" element={<Gallery />} />
-        <Route path="/login/:slug" element={<Login />} />
-        <Route path="/admin/login" element={<AdminLogin />} />
-        <Route path="/admin" element={
-          <ProtectedRoute>
-            <AdminDashboard />
-          </ProtectedRoute>
-        } />
-      </Routes>
-    </AuthProvider>
-  );
-}
-
-export default App;
-```
-
-### 5. Install Dependencies
-
-```bash
-# Backend
-cd backend
-npm install
-
-# Frontend
-cd ../frontend
-npm install
-```
-
-### 6. Configure Environment
-
-Copy `.env.example` to `.env` and update with your settings:
-```bash
-cp .env.example .env
-nano .env
-```
-
-### 7. Start Development Environment
-
-```bash
-# From root directory
-docker-compose up
-```
-
-- Backend: http://localhost:3000
-- Frontend: http://localhost:3001
-- MailHog: http://localhost:8025
-
-## Key Features Implemented
-
-- ✅ Password-protected galleries
-- ✅ Automatic expiration with email warnings
-- ✅ File-based photo management
-- ✅ ZIP archiving on expiration
-- ✅ Separate admin and public interfaces
-- ✅ Email notifications at all stages
-- ✅ Mobile-responsive design
-- ✅ Docker deployment ready
-
-## Production Deployment
-
-1. Update `.env` with production values
-2. Run `./scripts/install.sh` on your server
-3. Configure SSL with `./scripts/setup-ssl.sh`
-4. Start with `docker-compose -f docker-compose.prod.yml up -d`
-
-## Need Help?
-
-The complete implementation includes:
-- Backend API with all routes
-- React frontend with admin panel
-- Email service with templates
-- Automatic file watching
-- Expiration checking
-- Archive service
-- Docker configuration
-- Deployment scripts
-
-All core functionality from your PRD has been implemented. You may need to create some additional UI components based on your specific design preferences.
-
-Default admin credentials: **admin / admin123** (change immediately!)

TODO.md

@@ -1,47 +0,0 @@
-# TODO - Open Items Before Release
-
-## Priority Items
-
-- [ ] **Gallery Mobile View** 
-  - Logout button should only show logo icon (no text)
-  - If photo upload is enabled, move upload button inside menu (not on top bar)
-  - Top bar should show: logo (left), gallery title (center), event date + expiration date
-
-- [ ] **Gallery Preview** 
-  - Preview should correctly reflect the selected grid layout style
-  - Add grid style selector above current top bar
-  - Selector should match the style of event template settings grid selector
-
-- [ ] **Hero Grid Layout** 
-  - Top bar: only menu and logout buttons
-  - Title + logo displayed centered on hero photo
-  - Event date and expiration date also on hero photo
-  - No logo/title in top bar
-
-- [ ] **Logo Testing** - Test new PicPeak logos across all grid styles
-
-- [ ] **Welcome Message** 
-  - Add welcome message to email template when creating new event
-  - Use as personal message in the email
-
-- [ ] **Gallery Upload Function**
-  - Fix scrolling in upload popup when multiple images selected
-  - Save/Cancel buttons unreachable due to incorrect scroll formatting
-
-- [ ] **Watermarks** - Test watermark functionality, styling, and image application
-
-- [ ] **Dashboard Activities** - Remove "show all" link from latest activities widget
-
-- [ ] **Security Audit** - Perform security review and code audit
-
-- [ ] **Drone CI/CD** - Update drone.yaml configuration
-
-- [ ] **Version Management** - Implement automatic version updates on commits/builds
-
-## Completed Items
-
-_(Move completed items here with date)_
-
----
-
-Last updated: 2025-07-10

backend/.dockerignore

@@ -1,14 +0,0 @@
-node_modules
-npm-debug.log
-.env
-storage/events/active/*
-storage/events/archived/*
-storage/thumbnails/*
-data/*.db
-logs/*
-coverage
-.git
-.gitignore
-README.md
-.eslintrc.js
-jest.config.js

backend/.env.example

@@ -1,41 +0,0 @@
-# Backend Environment Variables Example
-# Copy this file to .env and update with your values
-
-# Application
-NODE_ENV=production
-PORT=3000
-
-# Security
-JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long
-
-# URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
-
-# Database Configuration
-DATABASE_CLIENT=pg
-DB_HOST=db
-DB_PORT=5432
-DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
-DB_NAME=picpeak
-
-# Email Configuration
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=your-smtp-username
-SMTP_PASS=your-smtp-password
-EMAIL_FROM=noreply@yourdomain.com
-
-# Storage Paths (Docker)
-STORAGE_PATH=/app/storage
-EVENTS_PATH=/app/storage/events
-ARCHIVE_PATH=/app/storage/events/archived
-
-# Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-
-# Logging
-LOG_LEVEL=info

backend/.eslintrc.js

@@ -1,23 +0,0 @@
-module.exports = {
-  env: {
-    browser: false,
-    es2021: true,
-    node: true,
-    jest: true
-  },
-  extends: [
-    'eslint:recommended'
-  ],
-  parserOptions: {
-    ecmaVersion: 'latest',
-    sourceType: 'module'
-  },
-  rules: {
-    'indent': ['error', 2],
-    'linebreak-style': ['error', 'unix'],
-    'quotes': ['error', 'single'],
-    'semi': ['error', 'always'],
-    'no-unused-vars': ['error', { 'argsIgnorePattern': '^_' }],
-    'no-console': ['warn', { allow: ['warn', 'error'] }]
-  }
-};

backend/Dockerfile

@@ -1,41 +0,0 @@
-FROM node:18-alpine AS builder
-
-WORKDIR /app
-
-# Copy package files
-COPY package*.json ./
-
-# Install dependencies
-RUN npm ci --only=production
-
-# Copy application files
-COPY . .
-
-# Production stage
-FROM node:18-alpine
-
-WORKDIR /app
-
-# Install dumb-init for proper signal handling and postgresql-client for database checks
-RUN apk add --no-cache dumb-init postgresql-client
-
-# Create non-root user
-RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
-
-# Copy from builder
-COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
-COPY --chown=nodejs:nodejs . .
-
-# Make wait script executable
-RUN chmod +x wait-for-db.sh
-
-# Create necessary directories
-RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs && \
-    chown -R nodejs:nodejs storage data logs
-
-USER nodejs
-
-EXPOSE 3000
-
-ENTRYPOINT ["dumb-init", "--"]
-CMD ["./wait-for-db.sh", "node", "server.js"]

backend/Dockerfile.dev

@@ -1,29 +0,0 @@
-FROM node:18-alpine
-
-WORKDIR /app
-
-# Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
-
-# Copy package files
-COPY package*.json ./
-
-# Install all dependencies (including dev)
-RUN npm install
-
-# Copy application files
-COPY . .
-
-# Create necessary directories
-RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs
-
-# Create non-root user
-RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
-RUN chown -R nodejs:nodejs /app
-
-USER nodejs
-
-EXPOSE 3000
-
-ENTRYPOINT ["dumb-init", "--"]
-CMD ["npm", "run", "dev"]

backend/ecosystem.config.js

@@ -1,21 +0,0 @@
-module.exports = {
-  apps: [{
-    name: 'picpeak',
-    script: './server.js',
-    instances: 'max',
-    exec_mode: 'cluster',
-    env: {
-      NODE_ENV: 'production',
-      PORT: 3000
-    },
-    error_file: './logs/pm2-error.log',
-    out_file: './logs/pm2-out.log',
-    log_date_format: 'YYYY-MM-DD HH:mm:ss',
-    max_memory_restart: '1G',
-    watch: false,
-    ignore_watch: ['node_modules', 'logs', 'storage'],
-    wait_ready: true,
-    listen_timeout: 3000,
-    kill_timeout: 5000
-  }]
-};

backend/jest.config.js

@@ -1,12 +0,0 @@
-module.exports = {
-  testEnvironment: 'node',
-  coverageDirectory: 'coverage',
-  collectCoverageFrom: [
-    'src/**/*.js',
-    '!src/**/*.test.js'
-  ],
-  testMatch: [
-    '**/__tests__/**/*.test.js'
-  ],
-  setupFilesAfterEnv: ['<rootDir>/jest.setup.js']
-};

backend/jest.setup.js

@@ -1,4 +0,0 @@
-beforeAll(() => {
-  process.env.NODE_ENV = 'test';
-  process.env.JWT_SECRET = 'test-secret';
-});

backend/knexfile.js

@@ -1,46 +0,0 @@
-require('dotenv').config();
-
-const path = require('path');
-
-// Database configuration for different environments
-const config = {
-  development: {
-    client: process.env.DATABASE_CLIENT || 'sqlite3',
-    connection: process.env.DATABASE_CLIENT === 'pg' ? {
-      host: process.env.DB_HOST || 'localhost',
-      port: process.env.DB_PORT || 5432,
-      user: process.env.DB_USER || 'postgres',
-      password: process.env.DB_PASSWORD || 'postgres',
-      database: process.env.DB_NAME || 'photo_sharing'
-    } : {
-      filename: path.join(__dirname, process.env.DATABASE_PATH || './data/photo_sharing.db')
-    },
-    useNullAsDefault: process.env.DATABASE_CLIENT !== 'pg',
-    migrations: {
-      directory: './migrations'
-    },
-    seeds: {
-      directory: './seeds'
-    }
-  },
-
-  production: {
-    client: process.env.DATABASE_CLIENT || 'pg',
-    connection: {
-      host: process.env.DB_HOST || 'db',
-      port: process.env.DB_PORT || 5432,
-      user: process.env.DB_USER || 'picpeak',
-      password: process.env.DB_PASSWORD,
-      database: process.env.DB_NAME || 'picpeak'
-    },
-    pool: {
-      min: 2,
-      max: 10
-    },
-    migrations: {
-      directory: './migrations'
-    }
-  }
-};
-
-module.exports = config[process.env.NODE_ENV || 'development'];

backend/migrations/004_add_categories_and_cms.js

@@ -1,101 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function up() {
-  console.log('Adding photo categories and CMS tables...');
-  
-  // Create photo_categories table
-  await db.schema.createTable('photo_categories', (table) => {
-    table.increments('id').primary();
-    table.string('name', 100).notNullable();
-    table.string('slug', 100).notNullable();
-    table.boolean('is_global').defaultTo(true);
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.timestamp('created_at').defaultTo(db.fn.now());
-    
-    // Unique constraint for slug within event scope
-    table.unique(['slug', 'event_id']);
-  });
-
-  // Create cms_pages table
-  await db.schema.createTable('cms_pages', (table) => {
-    table.increments('id').primary();
-    table.string('slug', 100).unique().notNullable();
-    table.text('title_en');
-    table.text('title_de');
-    table.text('content_en');
-    table.text('content_de');
-    table.timestamp('updated_at').defaultTo(db.fn.now());
-  });
-
-  // Add category_id to photos table
-  await db.schema.alterTable('photos', (table) => {
-    table.integer('category_id').references('id').inTable('photo_categories');
-  });
-
-  // Add language preference to admin_users
-  await db.schema.alterTable('admin_users', (table) => {
-    table.string('language', 2).defaultTo('en');
-  });
-
-  // Add language preference to app_settings for global default
-  await db('app_settings').insert({
-    setting_key: 'default_language',
-    setting_value: 'en',
-    setting_type: 'general',
-    updated_at: new Date()
-  });
-
-  // Insert default global categories
-  const defaultCategories = [
-    { name: 'Ceremony', slug: 'ceremony', is_global: true },
-    { name: 'Reception', slug: 'reception', is_global: true },
-    { name: 'Portraits', slug: 'portraits', is_global: true },
-    { name: 'Group Photos', slug: 'group-photos', is_global: true },
-    { name: 'Details', slug: 'details', is_global: true },
-    { name: 'Party', slug: 'party', is_global: true }
-  ];
-
-  await db('photo_categories').insert(defaultCategories);
-
-  // Insert default legal pages
-  await db('cms_pages').insert([
-    {
-      slug: 'impressum',
-      title_en: 'Legal Notice',
-      title_de: 'Impressum',
-      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    },
-    {
-      slug: 'datenschutz',
-      title_en: 'Privacy Policy',
-      title_de: 'Datenschutzerklärung',
-      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    }
-  ]);
-
-  console.log('Photo categories and CMS tables created successfully');
-}
-
-async function down() {
-  // Remove language from app_settings
-  await db('app_settings').where('setting_key', 'default_language').delete();
-  
-  // Drop columns
-  await db.schema.alterTable('admin_users', (table) => {
-    table.dropColumn('language');
-  });
-  
-  await db.schema.alterTable('photos', (table) => {
-    table.dropColumn('category_id');
-  });
-  
-  // Drop tables
-  await db.schema.dropTableIfExists('cms_pages');
-  await db.schema.dropTableIfExists('photo_categories');
-}
-
-module.exports = { up, down };

backend/migrations/006_add_photo_counter_to_categories.js

@@ -1,28 +0,0 @@
-exports.up = async function(knex) {
-  // Add photo_counter column to photo_categories table
-  await knex.schema.alterTable('photo_categories', function(table) {
-    table.integer('photo_counter').defaultTo(0).notNullable();
-  });
-
-  // Initialize counters based on existing photos
-  const categories = await knex('photo_categories').select('id');
-  
-  for (const category of categories) {
-    const photoCount = await knex('photos')
-      .where('category_id', category.id)
-      .count('id as count')
-      .first();
-    
-    if (photoCount && photoCount.count > 0) {
-      await knex('photo_categories')
-        .where('id', category.id)
-        .update({ photo_counter: photoCount.count });
-    }
-  }
-};
-
-exports.down = async function(knex) {
-  await knex.schema.alterTable('photo_categories', function(table) {
-    table.dropColumn('photo_counter');
-  });
-};

backend/migrations/007_add_read_at_to_activity_logs.js

@@ -1,15 +0,0 @@
-exports.up = async function(knex) {
-  // Add read_at column to activity_logs table
-  const hasReadAt = await knex.schema.hasColumn('activity_logs', 'read_at');
-  if (!hasReadAt) {
-    await knex.schema.table('activity_logs', (table) => {
-      table.datetime('read_at').nullable();
-    });
-  }
-};
-
-exports.down = async function(knex) {
-  await knex.schema.table('activity_logs', (table) => {
-    table.dropColumn('read_at');
-  });
-};

backend/migrations/008_add_language_support_to_email_templates.js

@@ -1,35 +0,0 @@
-exports.up = async function(knex) {
-  // Add language-specific columns to email_templates
-  await knex.schema.alterTable('email_templates', function(table) {
-    // Add English versions (rename existing columns for consistency)
-    table.renameColumn('subject', 'subject_en');
-    table.renameColumn('body_html', 'body_html_en');
-    table.renameColumn('body_text', 'body_text_en');
-    
-    // Add German versions
-    table.string('subject_de');
-    table.text('body_html_de');
-    table.text('body_text_de');
-  });
-
-  // Copy existing values to German columns as defaults
-  await knex('email_templates').update({
-    subject_de: knex.raw('subject_en'),
-    body_html_de: knex.raw('body_html_en'),
-    body_text_de: knex.raw('body_text_en')
-  });
-};
-
-exports.down = async function(knex) {
-  await knex.schema.alterTable('email_templates', function(table) {
-    // Remove German columns
-    table.dropColumn('subject_de');
-    table.dropColumn('body_html_de');
-    table.dropColumn('body_text_de');
-    
-    // Rename columns back
-    table.renameColumn('subject_en', 'subject');
-    table.renameColumn('body_html_en', 'body_html');
-    table.renameColumn('body_text_en', 'body_text');
-  });
-};

backend/migrations/009_update_german_email_templates.js

@@ -1,67 +0,0 @@
-exports.up = async function(knex) {
-  // Update gallery_created template with German content
-  await knex('email_templates')
-    .where('template_key', 'gallery_created')
-    .update({
-      subject_de: 'Ihre Fotogalerie ist bereit!',
-      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
-<p><strong>Galerie-Details:</strong></p>
-<ul>
-  <li>Veranstaltungsdatum: {{event_date}}</li>
-  <li>Galerie-Link: {{gallery_link}}</li>
-  <li>Passwort: {{gallery_password}}</li>
-  <li>Gültig bis: {{expiry_date}}</li>
-</ul>
-<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>`,
-      body_text_de: 'Galerie erfolgreich erstellt\n\nLiebe(r) {{host_name}},\n\nIhre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!'
-    });
-  
-  // Update expiration_warning template with German content
-  await knex('email_templates')
-    .where('template_key', 'expiration_warning')
-    .update({
-      subject_de: 'Ihre Fotogalerie läuft bald ab',
-      body_html_de: `<h2>Galerie läuft bald ab</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.</p>
-<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich.</p>
-<p><a href="{{gallery_link}}">Galerie besuchen</a></p>`,
-      body_text_de: 'Galerie läuft bald ab\n\nLiebe(r) {{host_name}},\n\nIhre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.'
-    });
-  
-  // Update gallery_expired template if it exists
-  await knex('email_templates')
-    .where('template_key', 'gallery_expired')
-    .update({
-      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
-      body_html_de: `<h2>Galerie abgelaufen</h2>
-<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
-<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter {{admin_email}}.</p>
-<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
-<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`,
-      body_text_de: 'Ihre Fotogalerie für {{event_name}} ist abgelaufen und nicht mehr zugänglich.\n\nDie Fotos wurden archiviert. Bei Bedarf kontaktieren Sie bitte den Administrator unter {{admin_email}}.'
-    });
-  
-  // Update archive_complete template if it exists
-  await knex('email_templates')
-    .where('template_key', 'archive_complete')
-    .update({
-      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
-      body_html_de: `<h2>Archivierung abgeschlossen</h2>
-<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
-<p>Archivgröße: {{archive_size}}</p>
-<p>Das Archiv wird sicher aufbewahrt und kann bei Bedarf wiederhergestellt werden.</p>`,
-      body_text_de: 'Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.\n\nArchivgröße: {{archive_size}}'
-    });
-};
-
-exports.down = async function(knex) {
-  // Reset German fields to null
-  await knex('email_templates').update({
-    subject_de: null,
-    body_html_de: null,
-    body_text_de: null
-  });
-};

backend/migrations/010_add_missing_email_templates.js

@@ -1,57 +0,0 @@
-exports.up = async function(knex) {
-  // Check if gallery_expired template exists
-  const galleryExpiredExists = await knex('email_templates')
-    .where('template_key', 'gallery_expired')
-    .first();
-    
-  if (!galleryExpiredExists) {
-    await knex('email_templates').insert({
-      template_key: 'gallery_expired',
-      subject_en: 'Your {{event_name}} photo gallery has expired',
-      body_html_en: `<h2>Gallery Expired</h2>
-<p>Your photo gallery for {{event_name}} has expired and is no longer accessible.</p>
-<p>The photos have been archived for safekeeping. If you need access to them, please contact the event administrator at {{admin_email}}.</p>
-<p>Thank you for using our photo sharing service!</p>
-<p>Best regards,<br>The Photo Sharing Team</p>`,
-      body_text_en: 'Your photo gallery for {{event_name}} has expired and is no longer accessible.\n\nThe photos have been archived. Please contact the administrator at {{admin_email}} if you need access.',
-      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
-      body_html_de: `<h2>Galerie abgelaufen</h2>
-<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
-<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter {{admin_email}}.</p>
-<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
-<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`,
-      body_text_de: 'Ihre Fotogalerie für {{event_name}} ist abgelaufen und nicht mehr zugänglich.\n\nDie Fotos wurden archiviert. Bei Bedarf kontaktieren Sie bitte den Administrator unter {{admin_email}}.',
-      variables: JSON.stringify(['event_name', 'admin_email'])
-    });
-  }
-  
-  // Check if archive_complete template exists
-  const archiveCompleteExists = await knex('email_templates')
-    .where('template_key', 'archive_complete')
-    .first();
-    
-  if (!archiveCompleteExists) {
-    await knex('email_templates').insert({
-      template_key: 'archive_complete',
-      subject_en: 'Archive Complete: {{event_name}}',
-      body_html_en: `<h2>Archive Complete</h2>
-<p>The photo gallery "{{event_name}}" has been successfully archived.</p>
-<p>Archive size: {{archive_size}}</p>
-<p>The archive has been stored securely and can be restored if needed.</p>`,
-      body_text_en: 'The photo gallery "{{event_name}}" has been successfully archived.\n\nArchive size: {{archive_size}}',
-      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
-      body_html_de: `<h2>Archivierung abgeschlossen</h2>
-<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
-<p>Archivgröße: {{archive_size}}</p>
-<p>Das Archiv wird sicher aufbewahrt und kann bei Bedarf wiederhergestellt werden.</p>`,
-      body_text_de: 'Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.\n\nArchivgröße: {{archive_size}}',
-      variables: JSON.stringify(['event_name', 'archive_size'])
-    });
-  }
-};
-
-exports.down = async function(knex) {
-  await knex('email_templates')
-    .whereIn('template_key', ['gallery_expired', 'archive_complete'])
-    .del();
-};

backend/migrations/011_add_user_upload_settings.js

@@ -1,23 +0,0 @@
-exports.up = async function(knex) {
-  // Add user upload settings to events table
-  await knex.schema.alterTable('events', function(table) {
-    table.boolean('allow_user_uploads').defaultTo(false);
-    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
-  });
-  
-  // Add uploaded_by field to photos table to track who uploaded
-  await knex.schema.alterTable('photos', function(table) {
-    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
-  });
-};
-
-exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
-    table.dropColumn('allow_user_uploads');
-    table.dropColumn('upload_category_id');
-  });
-  
-  await knex.schema.alterTable('photos', function(table) {
-    table.dropColumn('uploaded_by');
-  });
-};

backend/migrations/012_add_hero_photo_id.js

@@ -1,15 +0,0 @@
-exports.up = async function(knex) {
-  // Add hero_photo_id to events table
-  const hasColumn = await knex.schema.hasColumn('events', 'hero_photo_id');
-  if (!hasColumn) {
-    await knex.schema.alterTable('events', function(table) {
-      table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
-    });
-  }
-};
-
-exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
-    table.dropColumn('hero_photo_id');
-  });
-};

backend/migrations/013_fix_email_links_and_date_format.js

@@ -1,112 +0,0 @@
-exports.up = async function(knex) {
-  // First, add date format configuration to app_settings table
-  const dateFormatSetting = await knex('app_settings').where('setting_key', 'general_date_format').first();
-  if (!dateFormatSetting) {
-    await knex('app_settings').insert({
-      setting_key: 'general_date_format',
-      setting_value: JSON.stringify({
-        format: 'DD/MM/YYYY',  // European format as default
-        locale: 'en-GB'
-      }),
-      setting_type: 'general',
-      updated_at: new Date()
-    });
-  }
-
-  // Update English email templates to use proper HTML links
-  await knex('email_templates')
-    .where('template_key', 'gallery_created')
-    .update({
-      body_html_en: `<h2>Gallery Successfully Created</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
-<p><strong>Gallery Details:</strong></p>
-<ul>
-  <li>Event Date: {{event_date}}</li>
-  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Password: {{gallery_password}}</li>
-  <li>Valid Until: {{expiry_date}}</li>
-</ul>
-<p>Share this link and password with your guests so they can view and download photos.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
-      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
-<p><strong>Galerie-Details:</strong></p>
-<ul>
-  <li>Veranstaltungsdatum: {{event_date}}</li>
-  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Passwort: {{gallery_password}}</li>
-  <li>Gültig bis: {{expiry_date}}</li>
-</ul>
-<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`
-    });
-
-  // Update expiration warning template
-  await knex('email_templates')
-    .where('template_key', 'expiration_warning')
-    .update({
-      body_html_en: `<h2>Gallery Expiring Soon</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
-<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Visit Gallery</a></p>
-<p>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></p>`,
-      body_html_de: `<h2>Galerie läuft bald ab</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.</p>
-<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie besuchen</a></p>
-<p>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></p>`
-    });
-
-  // Update gallery expired template
-  await knex('email_templates')
-    .where('template_key', 'gallery_expired')
-    .update({
-      body_html_en: `<h2>Gallery Expired</h2>
-<p>Your photo gallery for "{{event_name}}" has expired and is no longer accessible.</p>
-<p>The photos have been safely archived. If you need access again, please contact the administrator at <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a>.</p>
-<p>Thank you for using our photo sharing service!</p>
-<p>Best regards,<br>The Photo Sharing Team</p>`,
-      body_html_de: `<h2>Galerie abgelaufen</h2>
-<p>Ihre Fotogalerie für "{{event_name}}" ist abgelaufen und nicht mehr zugänglich.</p>
-<p>Die Fotos wurden zur sicheren Aufbewahrung archiviert. Wenn Sie wieder Zugriff benötigen, wenden Sie sich bitte an den Administrator unter <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a>.</p>
-<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
-<p>Mit freundlichen Grüßen,<br>Das Foto-Sharing-Team</p>`
-    });
-};
-
-exports.down = async function(knex) {
-  // Remove date format setting
-  await knex('app_settings').where('setting_key', 'general_date_format').del();
-  
-  // Revert email templates to plain text links
-  await knex('email_templates')
-    .where('template_key', 'gallery_created')
-    .update({
-      body_html_en: `<h2>Gallery Successfully Created</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
-<p><strong>Gallery Details:</strong></p>
-<ul>
-  <li>Event Date: {{event_date}}</li>
-  <li>Gallery Link: {{gallery_link}}</li>
-  <li>Password: {{gallery_password}}</li>
-  <li>Valid Until: {{expiry_date}}</li>
-</ul>
-<p>Share this link and password with your guests so they can view and download photos.</p>`,
-      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
-<p><strong>Galerie-Details:</strong></p>
-<ul>
-  <li>Veranstaltungsdatum: {{event_date}}</li>
-  <li>Galerie-Link: {{gallery_link}}</li>
-  <li>Passwort: {{gallery_password}}</li>
-  <li>Gültig bis: {{expiry_date}}</li>
-</ul>
-<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>`
-    });
-};

backend/migrations/014_add_default_welcome_message.js

@@ -1,130 +0,0 @@
-exports.up = async function(knex) {
-  // Add default welcome message to app_settings
-  const existingSetting = await knex('app_settings')
-    .where('setting_key', 'general_default_welcome_message')
-    .first();
-  
-  if (!existingSetting) {
-    await knex('app_settings').insert({
-      setting_key: 'general_default_welcome_message',
-      setting_value: JSON.stringify('Thank you for using our photo sharing service! We hope you enjoy your photos.'),
-      setting_type: 'general',
-      updated_at: new Date()
-    });
-  }
-
-  // Update the gallery_created email template to ensure it has the welcome_message placeholder
-  await knex('email_templates')
-    .where('template_key', 'gallery_created')
-    .update({
-      body_html_en: `<h2>Gallery Successfully Created</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
-{{#if welcome_message}}
-<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
-  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Personal Message:</p>
-  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
-</div>
-{{/if}}
-<p><strong>Gallery Details:</strong></p>
-<ul>
-  <li>Event Date: {{event_date}}</li>
-  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Password: {{gallery_password}}</li>
-  <li>Valid Until: {{expiry_date}}</li>
-</ul>
-<p>Share this link and password with your guests so they can view and download photos.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
-      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
-{{#if welcome_message}}
-<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
-  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
-  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
-</div>
-{{/if}}
-<p><strong>Galerie-Details:</strong></p>
-<ul>
-  <li>Veranstaltungsdatum: {{event_date}}</li>
-  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Passwort: {{gallery_password}}</li>
-  <li>Gültig bis: {{expiry_date}}</li>
-</ul>
-<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`,
-      body_text_en: `Gallery Successfully Created
-
-Dear {{host_name}},
-
-Your photo gallery "{{event_name}}" has been successfully created!
-
-{{#if welcome_message}}
-Personal Message:
-{{welcome_message}}
-
-{{/if}}
-Gallery Details:
-- Event Date: {{event_date}}
-- Gallery Link: {{gallery_link}}
-- Password: {{gallery_password}}
-- Valid Until: {{expiry_date}}
-
-Share this link and password with your guests so they can view and download photos.`,
-      body_text_de: `Galerie erfolgreich erstellt
-
-Liebe(r) {{host_name}},
-
-Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
-
-{{#if welcome_message}}
-Persönliche Nachricht:
-{{welcome_message}}
-
-{{/if}}
-Galerie-Details:
-- Veranstaltungsdatum: {{event_date}}
-- Galerie-Link: {{gallery_link}}
-- Passwort: {{gallery_password}}
-- Gültig bis: {{expiry_date}}
-
-Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.`
-    });
-};
-
-exports.down = async function(knex) {
-  // Remove the default welcome message setting
-  await knex('app_settings')
-    .where('setting_key', 'general_default_welcome_message')
-    .del();
-
-  // Revert email templates
-  await knex('email_templates')
-    .where('template_key', 'gallery_created')
-    .update({
-      body_html_en: `<h2>Gallery Successfully Created</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" has been successfully created!</p>
-<p><strong>Gallery Details:</strong></p>
-<ul>
-  <li>Event Date: {{event_date}}</li>
-  <li>Gallery Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Password: {{gallery_password}}</li>
-  <li>Valid Until: {{expiry_date}}</li>
-</ul>
-<p>Share this link and password with your guests so they can view and download photos.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">View Gallery</a></p>`,
-      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
-<p>Liebe(r) {{host_name}},</p>
-<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
-<p><strong>Galerie-Details:</strong></p>
-<ul>
-  <li>Veranstaltungsdatum: {{event_date}}</li>
-  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762; text-decoration: none;">{{gallery_link}}</a></li>
-  <li>Passwort: {{gallery_password}}</li>
-  <li>Gültig bis: {{expiry_date}}</li>
-</ul>
-<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit sie Fotos ansehen und herunterladen können.</p>
-<p><a href="{{gallery_link}}" style="display: inline-block; padding: 10px 20px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px;">Galerie anzeigen</a></p>`
-    });
-};

backend/migrations/014_add_host_name_to_events.js

@@ -1,35 +0,0 @@
-const { db } = require('../src/database/db');
-
-async function up() {
-  // Check if host_name column already exists
-  const hasHostName = await db.schema.hasColumn('events', 'host_name');
-  
-  if (!hasHostName) {
-    await db.schema.table('events', (table) => {
-      table.string('host_name').after('event_date');
-    });
-    
-    console.log('Added host_name column to events table');
-  }
-}
-
-async function down() {
-  await db.schema.table('events', (table) => {
-    table.dropColumn('host_name');
-  });
-}
-
-module.exports = { up, down };
-
-// Run migration if called directly
-if (require.main === module) {
-  up()
-    .then(() => {
-      console.log('Migration completed successfully');
-      process.exit(0);
-    })
-    .catch((error) => {
-      console.error('Migration failed:', error);
-      process.exit(1);
-    });
-}

backend/migrations/015_add_login_attempts_table.js

@@ -1,19 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema.createTable('login_attempts', table => {
-    table.increments('id').primary();
-    table.string('identifier').notNullable(); // username or email
-    table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
-    table.text('user_agent');
-    table.timestamp('attempt_time').defaultTo(knex.fn.now());
-    table.boolean('success').defaultTo(false);
-    
-    // Indexes for performance
-    table.index('identifier');
-    table.index('attempt_time');
-    table.index(['identifier', 'success', 'attempt_time']);
-  });
-};
-
-exports.down = function(knex) {
-  return knex.schema.dropTableIfExists('login_attempts');
-};

backend/migrations/016_add_auth_security_columns.js

@@ -1,25 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema.table('admin_users', table => {
-    // Add password change tracking
-    table.timestamp('password_changed_at').nullable();
-    
-    // Add last login IP for security monitoring
-    table.string('last_login_ip', 45).nullable();
-    
-    // Add account security flags
-    table.boolean('two_factor_enabled').defaultTo(false);
-    table.string('two_factor_secret').nullable();
-    
-    // Add index for performance
-    table.index('password_changed_at');
-  });
-};
-
-exports.down = function(knex) {
-  return knex.schema.table('admin_users', table => {
-    table.dropColumn('password_changed_at');
-    table.dropColumn('last_login_ip');
-    table.dropColumn('two_factor_enabled');
-    table.dropColumn('two_factor_secret');
-  });
-};

backend/migrations/017_add_token_revocation_tables.js

@@ -1,34 +0,0 @@
-exports.up = function(knex) {
-  return knex.schema
-    // Table for individual token revocations
-    .createTable('revoked_tokens', table => {
-      table.increments('id').primary();
-      table.string('token_id').notNullable().unique(); // JWT ID or generated ID
-      table.integer('user_id').nullable(); // User who owned the token
-      table.string('token_type', 20); // admin, gallery, etc.
-      table.timestamp('revoked_at').defaultTo(knex.fn.now());
-      table.timestamp('expires_at').notNullable(); // When token would have expired
-      table.string('reason', 100); // password_change, logout, compromised, etc.
-      table.text('metadata'); // Additional JSON data
-      
-      // Indexes for performance
-      table.index('token_id');
-      table.index('user_id');
-      table.index('expires_at'); // For cleanup
-    })
-    // Table for user-level revocations (revoke all tokens before a certain time)
-    .createTable('user_token_revocations', table => {
-      table.integer('user_id').primary();
-      table.timestamp('revoked_at').notNullable();
-      table.string('reason', 100);
-      
-      // Index for quick lookups
-      table.index('revoked_at');
-    });
-};
-
-exports.down = function(knex) {
-  return knex.schema
-    .dropTableIfExists('user_token_revocations')
-    .dropTableIfExists('revoked_tokens');
-};

backend/migrations/init.js

@@ -1,126 +0,0 @@
-const bcrypt = require('bcrypt');
-const { db, initializeDatabase } = require('../src/database/db');
-const { generateReadablePassword } = require('../src/utils/passwordGenerator');
-const fs = require('fs').promises;
-const path = require('path');
-
-async function runMigrations() {
-  console.log('Running database migrations...');
-  
-  try {
-    // Initialize tables
-    await initializeDatabase();
-    
-    // Create default admin user if none exists
-    const adminExists = await db('admin_users').first();
-    if (!adminExists) {
-      // Generate a secure random password
-      const generatedPassword = generateReadablePassword();
-      const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
-      
-      await db('admin_users').insert({
-        username: 'admin',
-        email: 'admin@example.com',
-        password_hash: passwordHash,
-        must_change_password: true, // Flag for forcing password change
-        created_at: new Date()
-      });
-      
-      // Save the generated password to a file for the user to retrieve
-      const setupInfoPath = path.join(__dirname, '..', '..', 'ADMIN_CREDENTIALS.txt');
-      const setupInfo = `
-========================================
-PicPeak Admin Credentials
-========================================
-
-Your admin account has been created with these credentials:
-
-Username: admin
-Password: ${generatedPassword}
-
-IMPORTANT SECURITY NOTES:
-1. You MUST change this password on first login
-2. This file will be created only once
-3. Store these credentials securely
-4. Delete this file after noting the password
-
-Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
-
-Generated on: ${new Date().toISOString()}
-========================================
-`;
-      
-      await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
-      
-      console.log('\n========================================');
-      console.log('✅ Admin user created successfully!');
-      console.log('========================================');
-      console.log('Username: admin');
-      console.log(`Password: ${generatedPassword}`);
-      console.log('\n⚠️  IMPORTANT:');
-      console.log('1. Save these credentials securely');
-      console.log('2. You will be required to change the password on first login');
-      console.log('3. Credentials are also saved in: ADMIN_CREDENTIALS.txt');
-      console.log('========================================\n');
-    }
-    
-    // Create default email templates if none exist
-    const templateExists = await db('email_templates').first();
-    if (!templateExists) {
-      await db('email_templates').insert([
-        {
-          template_key: 'gallery_created',
-          subject: 'Your Photo Gallery is Ready!',
-          body_html: `<h2>Gallery Created Successfully</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
-<p><strong>Gallery Details:</strong></p>
-<ul>
-  <li>Event Date: {{event_date}}</li>
-  <li>Gallery Link: {{gallery_link}}</li>
-  <li>Password: {{gallery_password}}</li>
-  <li>Expires: {{expiry_date}}</li>
-</ul>
-<p>Share this link and password with your guests to allow them to view and download photos.</p>`,
-          body_text: 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!',
-          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
-        },
-        {
-          template_key: 'expiration_warning',
-          subject: 'Your Photo Gallery Expires Soon',
-          body_html: `<h2>Gallery Expiring Soon</h2>
-<p>Dear {{host_name}},</p>
-<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
-<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
-<p><a href="{{gallery_link}}">Visit Gallery</a></p>`,
-          body_text: 'Gallery Expiring Soon\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" will expire in {{days_remaining}} days.',
-          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
-        }
-      ]);
-      console.log('Default email templates created');
-    }
-
-    // Create default email config if none exists
-    const emailConfig = await db('email_configs').first();
-    if (!emailConfig) {
-      await db('email_configs').insert({
-        smtp_host: process.env.SMTP_HOST || 'mailhog',
-        smtp_port: process.env.SMTP_PORT || 1025,
-        smtp_secure: process.env.SMTP_SECURE === 'true',
-        smtp_user: process.env.SMTP_USER || '',
-        smtp_pass: process.env.SMTP_PASS || '',
-        from_email: process.env.EMAIL_FROM || 'noreply@photo-sharing.local',
-        from_name: 'Photo Sharing'
-      });
-      console.log('Default email configuration created');
-    }
-
-    console.log('Migrations completed successfully');
-    process.exit(0);
-  } catch (error) {
-    console.error('Migration failed:', error);
-    process.exit(1);
-  }
-}
-
-runMigrations();

backend/migrations/run-migrations.js

@@ -1,90 +0,0 @@
-const fs = require('fs').promises;
-const path = require('path');
-const { db } = require('../src/database/db');
-
-// Create migrations table if it doesn't exist
-async function createMigrationsTable() {
-  const tableExists = await db.schema.hasTable('migrations');
-  if (!tableExists) {
-    await db.schema.createTable('migrations', (table) => {
-      table.increments('id').primary();
-      table.string('filename').unique().notNullable();
-      table.timestamp('applied_at').defaultTo(db.fn.now());
-    });
-    console.log('Created migrations table');
-  }
-}
-
-// Get list of applied migrations
-async function getAppliedMigrations() {
-  const migrations = await db('migrations').select('filename');
-  return migrations.map(m => m.filename);
-}
-
-// Run a single migration
-async function runMigration(filename) {
-  const migrationPath = path.join(__dirname, filename);
-  const migration = require(migrationPath);
-  
-  if (migration.up) {
-    console.log(`Running migration: ${filename}`);
-    await migration.up(db);
-    await db('migrations').insert({ filename });
-    console.log(`Migration ${filename} completed`);
-  }
-}
-
-// Main migration runner
-async function runMigrations() {
-  try {
-    console.log('Starting database migrations...');
-    
-    // First run the init.js if it exists but only if migrations table doesn't exist
-    const tableExists = await db.schema.hasTable('migrations');
-    if (!tableExists) {
-      const { initializeDatabase } = require('../src/database/db');
-      console.log('Running initial database setup...');
-      await initializeDatabase();
-    }
-    
-    // Create migrations table
-    await createMigrationsTable();
-    
-    // Get all migration files
-    const files = await fs.readdir(__dirname);
-    const migrationFiles = files
-      .filter(f => f.match(/^\d{3}_.*\.js$/))
-      .sort();
-    
-    // Get applied migrations
-    const appliedMigrations = await getAppliedMigrations();
-    
-    // Run pending migrations
-    let pendingCount = 0;
-    for (const file of migrationFiles) {
-      if (!appliedMigrations.includes(file)) {
-        await runMigration(file);
-        pendingCount++;
-      }
-    }
-    
-    if (pendingCount === 0) {
-      console.log('No pending migrations');
-    } else {
-      console.log(`Applied ${pendingCount} migration(s)`);
-    }
-    
-    console.log('All migrations completed successfully');
-    process.exit(0);
-  } catch (error) {
-    console.error('Migration failed:', error);
-    process.exit(1);
-  }
-}
-
-// Only run if called directly
-if (require.main === module) {
-  runMigrations();
-}
-
-module.exports = { runMigrations };

backend/package.json

@@ -1,49 +0,0 @@
-{
-  "name": "picpeak-backend",
-  "version": "1.0.7",
-  "description": "Backend for PicPeak event photo sharing platform",
-  "main": "server.js",
-  "scripts": {
-    "start": "node server.js",
-    "dev": "nodemon server.js",
-    "migrate": "node migrations/run-migrations.js",
-    "test": "jest",
-    "lint": "eslint src/"
-  },
-  "dependencies": {
-    "adm-zip": "^0.5.16",
-    "archiver": "^5.3.1",
-    "axios": "^1.10.0",
-    "bcrypt": "^5.1.0",
-    "chokidar": "^3.5.3",
-    "cors": "^2.8.5",
-    "dotenv": "^16.0.3",
-    "express": "^4.18.2",
-    "express-rate-limit": "^6.7.0",
-    "express-validator": "^7.0.1",
-    "form-data": "^4.0.3",
-    "helmet": "^7.0.0",
-    "i18next": "^25.3.1",
-    "i18next-browser-languagedetector": "^8.2.0",
-    "i18next-http-backend": "^3.0.2",
-    "joi": "^17.9.1",
-    "jsonwebtoken": "^9.0.0",
-    "knex": "^2.4.2",
-    "multer": "^2.0.1",
-    "node-cron": "^3.0.2",
-    "nodemailer": "^6.9.1",
-    "pg": "^8.16.3",
-    "react-i18next": "^15.6.0",
-    "sharp": "^0.32.0",
-    "sqlite3": "^5.1.6",
-    "uuid": "^11.1.0",
-    "winston": "^3.8.2",
-    "zxcvbn": "^4.4.2"
-  },
-  "devDependencies": {
-    "eslint": "^8.40.0",
-    "jest": "^29.5.0",
-    "nodemon": "^3.1.10",
-    "supertest": "^6.3.3"
-  }
-}

backend/scripts/check-db-schema.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-
-const sqlite3 = require('sqlite3').verbose();
-
-// Connect to the database
-const dbPath = '/app/data/photo_sharing.db';
-console.log(`Connecting to database at: ${dbPath}`);
-
-const db = new sqlite3.Database(dbPath, sqlite3.OPEN_READONLY, (err) => {
-  if (err) {
-    console.error('Error opening database:', err.message);
-    process.exit(1);
-  }
-  console.log('Connected to the SQLite database.\n');
-});
-
-// Get schema for events table
-console.log('=== EVENTS TABLE SCHEMA ===');
-db.all("PRAGMA table_info(events)", [], (err, rows) => {
-  if (err) {
-    console.error('Error getting events schema:', err.message);
-  } else {
-    rows.forEach(row => {
-      console.log(`${row.name} (${row.type})`);
-    });
-  }
-  
-  console.log('\n=== PHOTOS TABLE SCHEMA ===');
-  // Get schema for photos table
-  db.all("PRAGMA table_info(photos)", [], (err, rows) => {
-    if (err) {
-      console.error('Error getting photos schema:', err.message);
-    } else {
-      rows.forEach(row => {
-        console.log(`${row.name} (${row.type})`);
-      });
-    }
-    
-    // Close the database
-    db.close();
-  });
-});

backend/scripts/create-admin.js

@@ -1,77 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Script to create an admin user
- * Usage: node scripts/create-admin.js --email admin@example.com --username admin --password yourpassword
- * 
- * If no password is provided, a random one will be generated and displayed
- */
-
-require('dotenv').config();
-const bcrypt = require('bcryptjs');
-const { db } = require('../src/database/db');
-const crypto = require('crypto');
-
-// Parse command line arguments
-const args = process.argv.slice(2);
-const getArg = (name) => {
-  const index = args.findIndex(arg => arg === `--${name}`);
-  return index !== -1 && args[index + 1] ? args[index + 1] : null;
-};
-
-const email = getArg('email');
-const username = getArg('username') || email?.split('@')[0] || 'admin';
-let password = getArg('password');
-
-// Validate email
-if (!email) {
-  console.error('Error: Email is required. Use --email admin@example.com');
-  process.exit(1);
-}
-
-// Generate password if not provided
-if (!password) {
-  password = crypto.randomBytes(12).toString('base64').slice(0, 16);
-  console.log(`Generated password: ${password}`);
-  console.log('Please save this password securely!');
-}
-
-async function createAdmin() {
-  try {
-    // Check if user already exists
-    const existingUser = await db('admin_users')
-      .where('email', email)
-      .orWhere('username', username)
-      .first();
-
-    if (existingUser) {
-      console.error(`Error: User with email "${email}" or username "${username}" already exists`);
-      process.exit(1);
-    }
-
-    // Hash password
-    const passwordHash = await bcrypt.hash(password, 10);
-
-    // Create admin user
-    await db('admin_users').insert({
-      username,
-      email,
-      password_hash: passwordHash,
-      is_active: true,
-      created_at: new Date(),
-      updated_at: new Date()
-    });
-
-    console.log(`✅ Admin user created successfully!`);
-    console.log(`   Email: ${email}`);
-    console.log(`   Username: ${username}`);
-    console.log(`   Login URL: ${process.env.ADMIN_URL || 'http://localhost:3000'}/admin/login`);
-    
-    process.exit(0);
-  } catch (error) {
-    console.error('Error creating admin user:', error.message);
-    process.exit(1);
-  }
-}
-
-createAdmin();

backend/scripts/create-test-event.js

@@ -1,57 +0,0 @@
-const path = require('path');
-require('dotenv').config({ path: path.join(__dirname, '../.env') });
-const { db } = require('../src/database/db');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { v4: uuidv4 } = require('uuid');
-
-async function createTestEvent() {
-  try {
-    console.log('Creating test event...');
-    
-    // Hash a simple password
-    const passwordHash = await bcrypt.hash('test123', 10);
-    
-    // Generate share token
-    const shareToken = uuidv4().replace(/-/g, '');
-    const shareLink = `http://localhost:3005/gallery/wedding-test123-2025-07-07/${shareToken}`;
-    
-    // Create event
-    const eventData = {
-      slug: 'wedding-test123-2025-07-07',
-      event_type: 'wedding',
-      event_name: 'Test Wedding',
-      event_date: '2025-07-07',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: passwordHash,
-      welcome_message: 'Welcome to our test wedding gallery!',
-      color_theme: null, // Use global theme
-      is_active: 1,
-      expires_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
-      share_link: shareLink
-    };
-    
-    // Delete existing event if it exists
-    await db('events').where('slug', eventData.slug).delete();
-    
-    // Insert new event
-    const [eventId] = await db('events').insert(eventData);
-    console.log('Event created with ID:', eventId);
-    
-    console.log('\nTest event created successfully!');
-    console.log('Event details:');
-    console.log('- Name:', eventData.event_name);
-    console.log('- Slug:', eventData.slug);
-    console.log('- Password:', 'test123');
-    console.log('- Share link:', shareLink);
-    console.log('\nYou can now access the gallery at the share link above');
-    
-    process.exit(0);
-  } catch (error) {
-    console.error('Error creating test event:', error);
-    process.exit(1);
-  }
-}
-
-createTestEvent();

backend/scripts/reset-admin-password.js

@@ -1,109 +0,0 @@
-#!/usr/bin/env node
-
-const bcrypt = require('bcrypt');
-const { db } = require('../src/database/db');
-const { generateReadablePassword } = require('../src/utils/passwordGenerator');
-const fs = require('fs').promises;
-const path = require('path');
-const readline = require('readline');
-
-const rl = readline.createInterface({
-  input: process.stdin,
-  output: process.stdout
-});
-
-async function question(prompt) {
-  return new Promise((resolve) => {
-    rl.question(prompt, resolve);
-  });
-}
-
-async function resetAdminPassword() {
-  console.log('\n========================================');
-  console.log('PicPeak Admin Password Reset Tool');
-  console.log('========================================\n');
-
-  try {
-    // Check if admin user exists
-    const admin = await db('admin_users')
-      .where({ username: 'admin' })
-      .first();
-
-    if (!admin) {
-      console.error('❌ No admin user found in the database.');
-      console.log('Run migrations first: npm run migrate');
-      process.exit(1);
-    }
-
-    console.log('Found admin user:', admin.username);
-    console.log('Email:', admin.email);
-    console.log('\nThis will reset the password for this admin account.');
-    
-    const confirm = await question('\nDo you want to continue? (yes/no): ');
-    
-    if (confirm.toLowerCase() !== 'yes' && confirm.toLowerCase() !== 'y') {
-      console.log('\n❌ Password reset cancelled.');
-      process.exit(0);
-    }
-
-    // Generate new password
-    const newPassword = generateReadablePassword();
-    const passwordHash = await bcrypt.hash(newPassword, 12);
-
-    // Update the admin user
-    await db('admin_users')
-      .where({ username: 'admin' })
-      .update({
-        password_hash: passwordHash,
-        must_change_password: true,
-        updated_at: new Date()
-      });
-
-    // Save to file
-    const resetInfoPath = path.join(__dirname, '..', '..', 'ADMIN_PASSWORD_RESET.txt');
-    const resetInfo = `
-========================================
-PicPeak Admin Password Reset
-========================================
-
-Password has been reset for admin account:
-
-Username: admin
-New Password: ${newPassword}
-
-IMPORTANT:
-1. You MUST change this password on next login
-2. This file contains sensitive information
-3. Delete this file after noting the password
-
-Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
-
-Reset performed on: ${new Date().toISOString()}
-========================================
-`;
-
-    await fs.writeFile(resetInfoPath, resetInfo, 'utf8');
-
-    console.log('\n✅ Password reset successful!\n');
-    console.log('========================================');
-    console.log('New Credentials:');
-    console.log('========================================');
-    console.log('Username: admin');
-    console.log(`Password: ${newPassword}`);
-    console.log('\n⚠️  IMPORTANT:');
-    console.log('1. You will be required to change this password on next login');
-    console.log('2. Credentials are also saved in: ADMIN_PASSWORD_RESET.txt');
-    console.log('3. Delete the file after noting the password');
-    console.log('========================================\n');
-
-  } catch (error) {
-    console.error('❌ Error resetting password:', error.message);
-    process.exit(1);
-  } finally {
-    rl.close();
-    process.exit(0);
-  }
-}
-
-// Run the reset
-resetAdminPassword();

backend/scripts/run-migrations.js

@@ -1,40 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Run database migrations using existing db connection
- */
-
-const { db } = require('../src/database/db');
-
-async function runMigrations() {
-  console.log('Running database migrations...\n');
-  
-  try {
-    // Run all pending migrations
-    const result = await db.migrate.latest({
-      directory: './migrations'
-    });
-    
-    if (result[1].length === 0) {
-      console.log('✓ Database is already up to date');
-    } else {
-      console.log(`✓ Ran ${result[1].length} migrations:`);
-      result[1].forEach(migration => {
-        console.log(`  - ${migration}`);
-      });
-    }
-    
-    // Show current migration status
-    const list = await db.migrate.list();
-    console.log(`\nCurrent status: ${list[0].length} completed migrations`);
-    
-    await db.destroy();
-    process.exit(0);
-  } catch (error) {
-    console.error('Migration error:', error);
-    await db.destroy();
-    process.exit(1);
-  }
-}
-
-runMigrations();

backend/server.js

@@ -1,226 +0,0 @@
-require('dotenv').config();
-
-// Validate critical environment variables before proceeding
-const { validateEnvironment } = require('./src/config/validateEnv');
-validateEnvironment();
-
-const express = require('express');
-const helmet = require('helmet');
-const cors = require('cors');
-const rateLimit = require('express-rate-limit');
-const jwt = require('jsonwebtoken');
-const path = require('path');
-const { initializeDatabase } = require('./src/database/db');
-const { startFileWatcher } = require('./src/services/fileWatcher');
-const { startExpirationChecker } = require('./src/services/expirationChecker');
-const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
-const { maintenanceMiddleware } = require('./src/middleware/maintenance');
-const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
-const logger = require('./src/utils/logger');
-
-// Import routes
-const authRoutes = require('./src/routes/auth-enhanced');
-const eventRoutes = require('./src/routes/events');
-const galleryRoutes = require('./src/routes/gallery');
-const adminRoutes = require('./src/routes/admin');
-const adminAuthRoutes = require('./src/routes/adminAuth');
-
-const app = express();
-const PORT = process.env.PORT || 3000;
-
-// Security middleware with custom CSP
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'"], // Required for React
-      styleSrc: ["'self'", "'unsafe-inline'", "https:"], // Required for styled components
-      imgSrc: ["'self'", "data:", "https:", "blob:"], // Allow data URLs and external images
-      connectSrc: ["'self'"], // API connections
-      fontSrc: ["'self'", "https:", "data:"], // Web fonts
-      objectSrc: ["'none'"], // Disable plugins
-      mediaSrc: ["'self'"], // Audio/video
-      frameSrc: ["'none'"], // Disable iframes
-    },
-  },
-  hsts: {
-    maxAge: 31536000, // 1 year
-    includeSubDomains: true,
-    preload: true
-  },
-  permittedCrossDomainPolicies: false,
-  referrerPolicy: { policy: "strict-origin-when-cross-origin" }
-}));
-
-// Additional security headers
-app.use((req, res, next) => {
-  // Permissions Policy (controls browser features)
-  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
-  next();
-});
-
-// CORS configuration
-const corsOptions = {
-  origin: function (origin, callback) {
-    const allowedOrigins = [
-      process.env.FRONTEND_URL || 'http://localhost:3005',
-      process.env.ADMIN_URL || 'http://localhost:3005'
-    ];
-    
-    // In development, also allow localhost origins
-    if (process.env.NODE_ENV === 'development') {
-      allowedOrigins.push(
-        'http://localhost:5173', // Vite dev server
-        'http://localhost:3002', // Backend server
-        'http://localhost:3001', // For API testing
-        'http://localhost:3000'  // Direct backend access
-      );
-    }
-    
-    // Allow requests with no origin (like mobile apps or curl)
-    if (!origin || allowedOrigins.indexOf(origin) !== -1) {
-      callback(null, true);
-    } else {
-      callback(new Error('Not allowed by CORS'));
-    }
-  },
-  credentials: true
-};
-
-app.use(cors(corsOptions));
-
-// Rate limiting with admin bypass
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: process.env.NODE_ENV === 'development' ? 1000 : 100, // More lenient in development
-  skip: (req) => {
-    // Skip rate limiting for authenticated admin users
-    if (req.path.startsWith('/api/admin/') && req.headers.authorization) {
-      const token = req.headers.authorization.replace('Bearer ', '');
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        return decoded.type === 'admin';
-      } catch (err) {
-        return false;
-      }
-    }
-    // Also skip rate limiting for public settings endpoint in development
-    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
-      return true;
-    }
-    return false;
-  }
-});
-
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5 // limit auth attempts
-});
-
-// Apply rate limiting - admin routes check will skip for valid admin tokens
-app.use('/api/', limiter);
-app.use('/api/auth', authLimiter);
-
-// Body parsing middleware
-app.use(express.json());
-app.use(express.urlencoded({ extended: true }));
-
-// Maintenance mode middleware - add after body parsing but before routes
-app.use(maintenanceMiddleware);
-
-// Session timeout middleware for admin routes
-app.use('/api/admin', sessionTimeoutMiddleware);
-
-// Middleware to set CORS headers for static files
-const setCorsHeaders = (req, res, next) => {
-  res.header('Access-Control-Allow-Origin', req.headers.origin || '*');
-  res.header('Access-Control-Allow-Credentials', 'true');
-  res.header('Cross-Origin-Resource-Policy', 'cross-origin');
-  next();
-};
-
-// Import secure static middleware
-const secureStatic = require('./src/middleware/secureStatic');
-
-// Static file serving for photos (protected)
-app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/events/active')));
-
-// Static file serving for thumbnails (protected)
-app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/thumbnails')));
-
-// Static file serving for uploads (public - logos, favicons)
-app.use('/uploads', setCorsHeaders, secureStatic(path.join(__dirname, 'storage/uploads')));
-
-// Health check endpoint
-app.get('/api/health', async (req, res) => {
-  try {
-    // Check database connectivity
-    await db.raw('SELECT 1');
-    
-    res.json({ 
-      status: 'ok', 
-      database: 'connected',
-      timestamp: new Date().toISOString() 
-    });
-  } catch (error) {
-    logger.error('Health check failed:', error);
-    res.status(503).json({ 
-      status: 'error', 
-      database: 'disconnected',
-      error: error.message,
-      timestamp: new Date().toISOString() 
-    });
-  }
-});
-
-// Routes
-app.use('/api/auth', authRoutes);
-app.use('/api/events', eventRoutes);
-app.use('/api/gallery', galleryRoutes);
-app.use('/api/admin', adminRoutes);
-app.use('/api/admin/auth', adminAuthRoutes);
-app.use('/api/admin/system', require('./src/routes/adminSystem'));
-app.use('/api/public/settings', require('./src/routes/publicSettings'));
-app.use('/api/public', require('./src/routes/publicCMS'));
-app.use('/api/images', require('./src/routes/protectedImages'));
-
-// Error handling middleware
-app.use((err, req, res, next) => {
-  logger.error(err.stack);
-  res.status(500).json({ error: 'Something went wrong!' });
-});
-
-// Initialize services
-async function startServer() {
-  try {
-    // Initialize database
-    await initializeDatabase();
-
-  // Initialize auth security cleanup job
-  const { initializeCleanupJob } = require('./src/utils/authSecurity');
-  initializeCleanupJob();
-    
-    // Start file watcher
-    startFileWatcher();
-    
-    // Start expiration checker
-    startExpirationChecker();
-    
-    // Initialize email transporter and start queue processor
-    await initializeTransporter();
-    startEmailQueueProcessor();
-    
-    app.listen(PORT, () => {
-      logger.info(`Server running on port ${PORT}`);
-      logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);
-      logger.info(`Frontend: ${process.env.FRONTEND_URL || 'http://localhost:3001'}`);
-    });
-  } catch (error) {
-    logger.error('Failed to start server:', error);
-    process.exit(1);
-  }
-}
-
-startServer();
-
-module.exports = app; // For testing

backend/src/config/storage.js

@@ -1,8 +0,0 @@
-const path = require('path');
-
-// Get storage path from environment or default
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-
-module.exports = {
-  getStoragePath
-};

backend/src/config/validateEnv.js

@@ -1,66 +0,0 @@
-const logger = require('../utils/logger');
-
-/**
- * Validates required environment variables are set
- * Exits the process if critical variables are missing
- */
-function validateEnvironment() {
-  const requiredVars = [
-    {
-      name: 'JWT_SECRET',
-      description: 'Secret key for JWT token signing',
-      critical: true
-    }
-  ];
-
-  const warnings = [];
-  const errors = [];
-
-  // Check each required variable
-  requiredVars.forEach(({ name, description, critical }) => {
-    const value = process.env[name];
-    
-    if (!value || value.trim() === '') {
-      const message = `Missing required environment variable: ${name} - ${description}`;
-      
-      if (critical) {
-        errors.push(message);
-      } else {
-        warnings.push(message);
-      }
-    }
-    
-    // Additional validation for JWT_SECRET
-    if (name === 'JWT_SECRET' && value) {
-      // Check for the insecure default value
-      if (value === 'your-secret-key') {
-        errors.push(`CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.`);
-      }
-      
-      // Check minimum length (should be at least 32 characters for security)
-      if (value.length < 32) {
-        warnings.push(`JWT_SECRET should be at least 32 characters long for better security (current: ${value.length} characters)`);
-      }
-    }
-  });
-
-  // Log warnings
-  warnings.forEach(warning => logger.warn(warning));
-
-  // If there are critical errors, log them and exit
-  if (errors.length > 0) {
-    logger.error('=== CRITICAL CONFIGURATION ERRORS ===');
-    errors.forEach(error => logger.error(error));
-    logger.error('=====================================');
-    logger.error('Server cannot start due to missing or invalid configuration.');
-    logger.error('Please set the required environment variables and try again.');
-    
-    // Exit with error code
-    process.exit(1);
-  }
-
-  // Log successful validation
-  logger.info('Environment validation passed');
-}
-
-module.exports = { validateEnvironment };

backend/src/database/db.js

@@ -1,227 +0,0 @@
-const knex = require('knex');
-const knexConfig = require('../../knexfile');
-
-const db = knex(knexConfig);
-
-async function initializeDatabase() {
-  // Events table
-  const hasEventsTable = await db.schema.hasTable('events');
-  if (!hasEventsTable) {
-    await db.schema.createTable('events', (table) => {
-      table.increments('id').primary();
-      table.string('slug').unique().notNullable();
-      table.string('event_type').notNullable();
-      table.string('event_name').notNullable();
-      table.date('event_date').notNullable();
-      table.string('host_email').notNullable();
-      table.string('admin_email').notNullable();
-      table.string('password_hash').notNullable();
-      table.text('welcome_message');
-      table.text('color_theme');
-      table.string('share_link').unique().notNullable();
-      table.datetime('created_at').defaultTo(db.fn.now());
-      table.datetime('expires_at').notNullable();
-      table.boolean('is_active').defaultTo(true);
-      table.boolean('is_archived').defaultTo(false);
-      table.string('archive_path');
-      table.datetime('archived_at');
-    });
-  } else {
-    // Check if color_theme needs to be updated to TEXT type
-    // This is needed for larger theme configurations
-    const isPostgres = knexConfig.client === 'pg';
-    
-    if (!isPostgres) {
-      // SQLite-specific migration
-      try {
-        await db.raw(`
-          CREATE TABLE IF NOT EXISTS events_new (
-            id INTEGER PRIMARY KEY AUTOINCREMENT,
-            slug TEXT UNIQUE NOT NULL,
-            event_type TEXT NOT NULL,
-            event_name TEXT NOT NULL,
-            event_date DATE NOT NULL,
-            host_email TEXT NOT NULL,
-            admin_email TEXT NOT NULL,
-            password_hash TEXT NOT NULL,
-            welcome_message TEXT,
-            color_theme TEXT,
-            share_link TEXT UNIQUE NOT NULL,
-            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-            expires_at DATETIME NOT NULL,
-            is_active BOOLEAN DEFAULT 1,
-            is_archived BOOLEAN DEFAULT 0,
-            archive_path TEXT,
-            archived_at DATETIME,
-            allow_user_uploads BOOLEAN DEFAULT 0,
-            upload_category_id INTEGER
-          )
-        `);
-        
-        await db.raw(`INSERT INTO events_new SELECT * FROM events`);
-        await db.raw(`DROP TABLE events`);
-        await db.raw(`ALTER TABLE events_new RENAME TO events`);
-      } catch (error) {
-        // If the migration fails, it might already have been applied
-        console.log('Color theme migration may have already been applied');
-      }
-    }
-  }
-
-  // Photo metadata table
-  const hasPhotosTable = await db.schema.hasTable('photos');
-  if (!hasPhotosTable) {
-    await db.schema.createTable('photos', (table) => {
-      table.increments('id').primary();
-      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-      table.string('filename').notNullable();
-      table.string('path').notNullable();
-      table.string('thumbnail_path');
-      table.string('type').notNullable(); // 'collage' or 'individual'
-      table.integer('size_bytes');
-      table.datetime('uploaded_at').defaultTo(db.fn.now());
-      table.integer('view_count').defaultTo(0);
-      table.integer('download_count').defaultTo(0);
-    });
-  }
-
-  // Access logs table
-  const hasAccessLogsTable = await db.schema.hasTable('access_logs');
-  if (!hasAccessLogsTable) {
-    await db.schema.createTable('access_logs', (table) => {
-      table.increments('id').primary();
-      table.integer('event_id').references('id').inTable('events');
-      table.string('ip_address');
-      table.string('user_agent');
-      table.string('action'); // 'view', 'download', 'login_success', 'login_fail'
-      table.string('photo_id');
-      table.datetime('timestamp').defaultTo(db.fn.now());
-    });
-  }
-
-  // Email queue table
-  const hasEmailQueueTable = await db.schema.hasTable('email_queue');
-  if (!hasEmailQueueTable) {
-    await db.schema.createTable('email_queue', (table) => {
-      table.increments('id').primary();
-      table.integer('event_id').references('id').inTable('events');
-      table.string('recipient_email').notNullable();
-      table.string('email_type').notNullable(); // 'creation', 'warning', 'expiration', 'archive_complete'
-      table.json('email_data');
-      table.string('status').defaultTo('pending'); // 'pending', 'sent', 'failed'
-      table.datetime('scheduled_at').defaultTo(db.fn.now());
-      table.datetime('sent_at');
-      table.text('error_message');
-      table.integer('retry_count').defaultTo(0);
-    });
-  }
-
-  // Admin users table
-  const hasAdminUsersTable = await db.schema.hasTable('admin_users');
-  if (!hasAdminUsersTable) {
-    await db.schema.createTable('admin_users', (table) => {
-      table.increments('id').primary();
-      table.string('username').unique().notNullable();
-      table.string('email').unique().notNullable();
-      table.string('password_hash').notNullable();
-      table.boolean('is_active').defaultTo(true);
-      table.datetime('created_at').defaultTo(db.fn.now());
-      table.datetime('updated_at').defaultTo(db.fn.now());
-      table.datetime('last_login');
-    });
-  } else {
-    // Check if updated_at column exists
-    const hasUpdatedAt = await db.schema.hasColumn('admin_users', 'updated_at');
-    if (!hasUpdatedAt) {
-      await db.schema.table('admin_users', (table) => {
-        table.datetime('updated_at');
-      });
-      // Set default value for existing rows
-      await db('admin_users').update({ updated_at: new Date() });
-    }
-  }
-
-  // Email configuration table
-  const hasEmailConfigTable = await db.schema.hasTable('email_configs');
-  if (!hasEmailConfigTable) {
-    await db.schema.createTable('email_configs', (table) => {
-      table.increments('id').primary();
-      table.string('smtp_host').notNullable();
-      table.integer('smtp_port').notNullable();
-      table.boolean('smtp_secure').defaultTo(false);
-      table.string('smtp_user');
-      table.string('smtp_pass');
-      table.string('from_email').notNullable();
-      table.string('from_name');
-      table.datetime('updated_at').defaultTo(db.fn.now());
-    });
-  }
-
-  // Email templates table
-  const hasEmailTemplatesTable = await db.schema.hasTable('email_templates');
-  if (!hasEmailTemplatesTable) {
-    await db.schema.createTable('email_templates', (table) => {
-      table.increments('id').primary();
-      table.string('template_key').unique().notNullable(); // 'gallery_created', 'expiration_warning', etc.
-      table.string('subject').notNullable();
-      table.text('body_html').notNullable();
-      table.text('body_text');
-      table.json('variables'); // Available template variables
-      table.datetime('updated_at').defaultTo(db.fn.now());
-    });
-  }
-
-  // App settings table
-  const hasAppSettingsTable = await db.schema.hasTable('app_settings');
-  if (!hasAppSettingsTable) {
-    await db.schema.createTable('app_settings', (table) => {
-      table.increments('id').primary();
-      table.string('setting_key').unique().notNullable();
-      table.json('setting_value');
-      table.string('setting_type'); // 'branding', 'theme', 'general'
-      table.datetime('updated_at').defaultTo(db.fn.now());
-    });
-  }
-
-  // Activity logs table
-  const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
-  if (!hasActivityLogsTable) {
-    await db.schema.createTable('activity_logs', (table) => {
-      table.increments('id').primary();
-      table.string('activity_type').notNullable(); // 'event_created', 'photos_uploaded', etc.
-      table.string('actor_type'); // 'admin', 'system', 'guest'
-      table.integer('actor_id');
-      table.string('actor_name');
-      table.json('metadata'); // Additional data about the activity
-      table.integer('event_id').references('id').inTable('events');
-      table.datetime('created_at').defaultTo(db.fn.now());
-      table.datetime('read_at').nullable();
-    });
-  } else {
-    // Check if read_at column exists
-    const hasReadAt = await db.schema.hasColumn('activity_logs', 'read_at');
-    if (!hasReadAt) {
-      await db.schema.table('activity_logs', (table) => {
-        table.datetime('read_at').nullable();
-      });
-    }
-  }
-}
-
-// Helper function to log activities
-async function logActivity(activityType, metadata = {}, eventId = null, actor = null) {
-  try {
-    await db('activity_logs').insert({
-      activity_type: activityType,
-      actor_type: actor?.type || 'system',
-      actor_id: actor?.id || null,
-      actor_name: actor?.name || null,
-      metadata: JSON.stringify(metadata),
-      event_id: eventId
-    });
-  } catch (error) {
-    console.error('Failed to log activity:', error);
-  }
-}
-
-module.exports = { db, initializeDatabase, logActivity };

backend/src/middleware/auth-enhanced-v2.js

@@ -1,166 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const { isTokenRevoked } = require('../utils/tokenRevocation');
-const logger = require('../utils/logger');
-
-/**
- * Enhanced admin authentication middleware with revocation checking
- */
-async function adminAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      logger.warn('Revoked token used', {
-        userId: decoded.id,
-        tokenType: decoded.type
-      });
-      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'admin') {
-      logger.warn('Non-admin token used for admin endpoint', { 
-        userId: decoded.id,
-        tokenType: decoded.type 
-      });
-      return res.status(403).json({ error: 'Insufficient permissions' });
-    }
-    
-    // IP validation (optional - can be strict or just log)
-    const currentIp = req.ip || req.connection.remoteAddress;
-    if (decoded.ip && decoded.ip !== currentIp) {
-      logger.warn('Token used from different IP', {
-        userId: decoded.id,
-        tokenIp: decoded.ip,
-        currentIp: currentIp
-      });
-    }
-    
-    // Check if admin still exists and is active
-    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
-      .first();
-    
-    if (!admin) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if password was changed after token was issued
-    if (admin.password_changed_at) {
-      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
-      if (decoded.iat < passwordChangedTime) {
-        logger.warn('Token used after password change', { userId: decoded.id });
-        return res.status(401).json({ 
-          error: 'Token invalid due to password change',
-          code: 'PASSWORD_CHANGED'
-        });
-      }
-    }
-    
-    // Add user info to request
-    req.admin = {
-      id: admin.id,
-      username: admin.username,
-      email: admin.email
-    };
-    req.token = token; // Store token for potential revocation
-    
-    next();
-  } catch (error) {
-    logger.error('Auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Enhanced gallery authentication middleware with revocation checking
- */
-async function galleryAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid session' });
-    }
-    
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'gallery') {
-      return res.status(403).json({ error: 'Invalid access token' });
-    }
-    
-    // Check if event still exists and is active
-    const event = await db('events')
-      .where({ 
-        id: decoded.eventId, 
-        is_active: true, 
-        is_archived: false 
-      })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    // Check if gallery has expired
-    if (new Date(event.expires_at) < new Date()) {
-      return res.status(410).json({ 
-        error: 'Gallery has expired',
-        code: 'GALLERY_EXPIRED'
-      });
-    }
-    
-    // Add event info to request
-    req.event = event;
-    req.galleryToken = decoded;
-    req.token = token;
-    
-    next();
-  } catch (error) {
-    logger.error('Gallery auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-// Export other middleware functions from original file...
-module.exports = { 
-  adminAuth, 
-  galleryAuth,
-  // ... other exports
-};

backend/src/middleware/auth-enhanced.js

@@ -1,237 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const logger = require('../utils/logger');
-
-/**
- * Enhanced admin authentication middleware
- * Adds additional security checks beyond basic JWT validation
- */
-async function adminAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload; // Extract payload when using complete: true
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'admin') {
-      logger.warn('Non-admin token used for admin endpoint', { 
-        userId: decoded.id,
-        tokenType: decoded.type 
-      });
-      return res.status(403).json({ error: 'Insufficient permissions' });
-    }
-    
-    // IP validation (optional - can be strict or just log)
-    const currentIp = req.ip || req.connection.remoteAddress;
-    if (decoded.ip && decoded.ip !== currentIp) {
-      logger.warn('Token used from different IP', {
-        userId: decoded.id,
-        tokenIp: decoded.ip,
-        currentIp: currentIp
-      });
-      // Optional: Reject if IP doesn't match
-      // return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if admin still exists and is active
-    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
-      .first();
-    
-    if (!admin) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Check if password was changed after token was issued
-    if (admin.password_changed_at) {
-      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
-      if (decoded.iat < passwordChangedTime) {
-        logger.warn('Token used after password change', { userId: decoded.id });
-        return res.status(401).json({ 
-          error: 'Token invalid due to password change',
-          code: 'PASSWORD_CHANGED'
-        });
-      }
-    }
-    
-    // Add user info to request
-    req.admin = {
-      id: admin.id,
-      username: admin.username,
-      email: admin.email
-    };
-    
-    next();
-  } catch (error) {
-    logger.error('Auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Enhanced gallery authentication middleware
- */
-async function galleryAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid session' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'gallery') {
-      return res.status(403).json({ error: 'Invalid access token' });
-    }
-    
-    // Check if event still exists and is active
-    const event = await db('events')
-      .where({ 
-        id: decoded.eventId, 
-        is_active: true, 
-        is_archived: false 
-      })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    // Check if gallery has expired
-    if (new Date(event.expires_at) < new Date()) {
-      return res.status(410).json({ 
-        error: 'Gallery has expired',
-        code: 'GALLERY_EXPIRED'
-      });
-    }
-    
-    // Add event info to request
-    req.event = event;
-    req.galleryToken = decoded;
-    
-    next();
-  } catch (error) {
-    logger.error('Gallery auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Photo access authentication
- * Validates both admin and gallery tokens for photo access
- */
-async function photoAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET);
-    } catch (err) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    // Allow both admin and gallery tokens
-    if (decoded.type === 'admin') {
-      const admin = await db('admin_users')
-        .where({ id: decoded.id, is_active: true })
-        .first();
-      
-      if (!admin) {
-        return res.status(401).json({ error: 'Invalid token' });
-      }
-      
-      req.auth = { type: 'admin', user: admin };
-    } else if (decoded.type === 'gallery') {
-      const event = await db('events')
-        .where({ 
-          id: decoded.eventId, 
-          is_active: true, 
-          is_archived: false 
-        })
-        .first();
-      
-      if (!event) {
-        return res.status(404).json({ error: 'Gallery not found' });
-      }
-      
-      // For gallery tokens, ensure they can only access their event's photos
-      req.auth = { type: 'gallery', event: event };
-    } else {
-      return res.status(403).json({ error: 'Invalid token type' });
-    }
-    
-    next();
-  } catch (error) {
-    logger.error('Photo auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Verify gallery access for specific operations
- */
-async function verifyGalleryAccess(req, res, next) {
-  try {
-    if (!req.auth) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
-    const { eventId } = req.params;
-    
-    // Admins can access any gallery
-    if (req.auth.type === 'admin') {
-      return next();
-    }
-    
-    // Gallery tokens can only access their own event
-    if (req.auth.type === 'gallery') {
-      if (req.auth.event.id !== parseInt(eventId)) {
-        return res.status(403).json({ error: 'Access denied' });
-      }
-      return next();
-    }
-    
-    res.status(403).json({ error: 'Access denied' });
-  } catch (error) {
-    res.status(500).json({ error: 'Access verification failed' });
-  }
-}
-
-module.exports = { 
-  adminAuth, 
-  galleryAuth,
-  photoAuth,
-  verifyGalleryAccess
-};

backend/src/middleware/auth.js

@@ -1,25 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-
-async function adminAuth(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const admin = await db('admin_users').where({ id: decoded.id, is_active: true }).first();
-    
-    if (!admin) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-    
-    req.admin = admin;
-    next();
-  } catch (error) {
-    res.status(401).json({ error: 'Invalid token' });
-  }
-}
-
-module.exports = { adminAuth };

backend/src/middleware/gallery.js

@@ -1,29 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-
-// Middleware to verify gallery access
-async function verifyGalleryAccess(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const event = await db('events').where({ id: decoded.eventId, is_active: true }).first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    req.event = event;
-    next();
-  } catch (error) {
-    console.error('Error verifying gallery access:', error);
-    res.status(401).json({ error: 'Invalid token', details: error.message });
-  }
-}
-
-module.exports = {
-  verifyGalleryAccess
-};

backend/src/middleware/maintenance.js

@@ -1,73 +0,0 @@
-const { db } = require('../database/db');
-
-// Cache maintenance mode status to avoid DB queries on every request
-let maintenanceMode = false;
-let lastCheck = 0;
-const CACHE_DURATION = 60000; // 1 minute
-
-async function checkMaintenanceMode() {
-  const now = Date.now();
-  
-  // Use cached value if recent
-  if (now - lastCheck < CACHE_DURATION) {
-    return maintenanceMode;
-  }
-  
-  try {
-    const setting = await db('app_settings')
-      .where('setting_key', 'general_maintenance_mode')
-      .where('setting_type', 'general')
-      .first();
-    
-    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
-    lastCheck = now;
-    
-    return maintenanceMode;
-  } catch (error) {
-    console.error('Error checking maintenance mode:', error);
-    return false;
-  }
-}
-
-// Middleware to enforce maintenance mode
-async function maintenanceMiddleware(req, res, next) {
-  // Skip maintenance check for certain paths
-  const skipPaths = [
-    '/api/admin/login',
-    '/api/admin/auth/login',
-    '/api/public/settings',
-    '/health'
-  ];
-  
-  // Allow static assets (uploads, favicons, logos)
-  const isStaticAsset = req.path.startsWith('/uploads/') || 
-                       req.path.startsWith('/favicons/') || 
-                       req.path.startsWith('/logos/');
-  
-  // Allow admin routes if admin is authenticated
-  const isAdminRoute = req.path.startsWith('/api/admin');
-  const hasAdminAuth = req.headers.authorization?.startsWith('Bearer ');
-  
-  if (skipPaths.includes(req.path) || isStaticAsset || (isAdminRoute && hasAdminAuth)) {
-    return next();
-  }
-  
-  const inMaintenance = await checkMaintenanceMode();
-  
-  if (inMaintenance && !isAdminRoute) {
-    return res.status(503).json({
-      error: 'Service Unavailable',
-      message: 'The system is currently undergoing maintenance. Please try again later.',
-      maintenance: true
-    });
-  }
-  
-  next();
-}
-
-// Function to clear cache when settings change
-function clearMaintenanceCache() {
-  lastCheck = 0;
-}
-
-module.exports = { maintenanceMiddleware, clearMaintenanceCache };

backend/src/middleware/photoAuth.js

@@ -1,104 +0,0 @@
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-
-async function photoAuth(req, res, next) {
-  try {
-    // Extract event slug from the path
-    let eventSlug;
-    
-    // For thumbnails, we need to parse the filename to get the event info
-    if (req.path.startsWith('/thumb_')) {
-      // For now, we'll rely on JWT token for thumbnail access
-      eventSlug = null;
-    } else {
-      // For regular photos, the slug is the first part of the path
-      eventSlug = req.path.split('/')[1];
-    }
-    
-    // First check for JWT token (from gallery access)
-    const authHeader = req.headers.authorization;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
-      const token = authHeader.replace('Bearer ', '');
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        
-        // Check if it's a gallery token
-        if (decoded.type === 'gallery') {
-          // For thumbnails, we accept any valid gallery token
-          if (!eventSlug) {
-            const event = await db('events').where({ slug: decoded.eventSlug, is_active: true }).first();
-            if (event) {
-              req.event = event;
-              return next();
-            }
-          }
-          // For regular photos, check if token matches the event
-          else if (decoded.eventSlug === eventSlug) {
-            const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
-            if (event) {
-              req.event = event;
-              return next();
-            }
-          }
-        }
-        
-        // Check if it's an admin token (admins can view all photos)
-        if (decoded.type === 'admin') {
-          if (!eventSlug) {
-            // For thumbnails with admin token, allow access
-            return next();
-          }
-          const event = await db('events').where({ slug: eventSlug }).first();
-          if (event) {
-            req.event = event;
-            return next();
-          }
-        }
-      } catch (err) {
-        // Token invalid, fall through to password check
-      }
-    }
-    
-    // Check for password header (legacy support)
-    const password = req.headers['x-gallery-password'];
-    
-    if (!password && !authHeader) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
-    // If no eventSlug (thumbnails), we require JWT token
-    if (!eventSlug) {
-      return res.status(401).json({ error: 'Authentication required for thumbnails' });
-    }
-    
-    const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found' });
-    }
-    
-    if (password) {
-      const validPassword = await bcrypt.compare(password, event.password_hash);
-      if (!validPassword) {
-        await db('access_logs').insert({
-          event_id: event.id,
-          ip_address: req.ip,
-          user_agent: req.headers['user-agent'],
-          action: 'login_fail'
-        });
-        return res.status(401).json({ error: 'Invalid password' });
-      }
-    } else {
-      // No valid authentication
-      return res.status(401).json({ error: 'Invalid authentication' });
-    }
-    
-    req.event = event;
-    next();
-  } catch (error) {
-    console.error('Photo auth error:', error);
-    res.status(500).json({ error: 'Authentication error' });
-  }
-}
-
-module.exports = photoAuth;

backend/src/middleware/secureStatic.js

@@ -1,46 +0,0 @@
-const path = require('path');
-const express = require('express');
-const { safePathJoin, isPathSafe } = require('../utils/fileSecurityUtils');
-
-/**
- * Create a secure static file serving middleware that prevents path traversal attacks
- * @param {string} basePath - The base directory to serve files from
- * @param {Object} options - Express static options
- * @returns {Function} - Express middleware
- */
-function secureStatic(basePath, options = {}) {
-  const normalizedBase = path.resolve(basePath);
-  
-  return (req, res, next) => {
-    // Get the requested file path - remove leading slash for validation
-    const requestedPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
-    
-    // Validate the path doesn't contain dangerous patterns
-    if (!isPathSafe(requestedPath)) {
-      console.warn(`Potential path traversal attempt blocked: ${requestedPath}`);
-      return res.status(403).json({ error: 'Access denied' });
-    }
-    
-    try {
-      // Validate the full path is within the base directory
-      const fullPath = safePathJoin(normalizedBase, requestedPath);
-      
-      // If validation passes, use express.static
-      const staticMiddleware = express.static(normalizedBase, {
-        ...options,
-        // Disable directory listing for security
-        index: false,
-        // Don't allow dotfiles
-        dotfiles: 'deny'
-      });
-      
-      return staticMiddleware(req, res, next);
-    } catch (error) {
-      // Path traversal detected
-      console.error(`Path traversal blocked: ${requestedPath}`, error.message);
-      return res.status(403).json({ error: 'Access denied' });
-    }
-  };
-}
-
-module.exports = secureStatic;

backend/src/middleware/sessionTimeout.js

@@ -1,122 +0,0 @@
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-
-// In-memory session tracking (in production, use Redis)
-const sessions = new Map();
-
-// Default session timeout (60 minutes)
-const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
-
-// Clean up expired sessions every 5 minutes
-setInterval(() => {
-  const now = Date.now();
-  for (const [token, lastActivity] of sessions.entries()) {
-    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
-      sessions.delete(token);
-    }
-  }
-}, 5 * 60 * 1000);
-
-async function getSessionTimeout() {
-  try {
-    const setting = await db('app_settings')
-      .where('setting_key', 'security_session_timeout_minutes')
-      .first();
-    
-    if (setting && setting.setting_value) {
-      const minutes = parseInt(JSON.parse(setting.setting_value));
-      return minutes * 60 * 1000; // Convert to milliseconds
-    }
-  } catch (error) {
-    console.error('Error getting session timeout:', error);
-  }
-  
-  return DEFAULT_SESSION_TIMEOUT;
-}
-
-async function sessionTimeoutMiddleware(req, res, next) {
-  // Skip for non-authenticated routes
-  if (!req.headers.authorization) {
-    return next();
-  }
-  
-  const token = req.headers.authorization.split(' ')[1];
-  if (!token) {
-    return next();
-  }
-  
-  try {
-    // Verify token is valid
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    
-    // Check if this is an admin token
-    if (!decoded.id) {
-      return next();
-    }
-    
-    const now = Date.now();
-    const lastActivity = sessions.get(token);
-    const timeout = await getSessionTimeout();
-    
-    // If session exists, check if it's expired
-    if (lastActivity) {
-      if (now - lastActivity > timeout) {
-        sessions.delete(token);
-        return res.status(401).json({ 
-          error: 'Session expired', 
-          code: 'SESSION_TIMEOUT' 
-        });
-      }
-    }
-    
-    // Update last activity
-    sessions.set(token, now);
-    
-    // Clean up old token if user has a new one
-    // This prevents memory leaks from token renewals
-    const userId = decoded.id;
-    for (const [oldToken, _] of sessions.entries()) {
-      if (oldToken !== token) {
-        try {
-          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
-          if (oldDecoded.id === userId) {
-            sessions.delete(oldToken);
-          }
-        } catch (e) {
-          // Token is invalid, remove it
-          sessions.delete(oldToken);
-        }
-      }
-    }
-    
-    next();
-  } catch (error) {
-    // Token is invalid
-    next();
-  }
-}
-
-// Function to end a session
-function endSession(token) {
-  sessions.delete(token);
-}
-
-// Function to get active sessions count
-function getActiveSessions() {
-  const now = Date.now();
-  let active = 0;
-  
-  for (const [_, lastActivity] of sessions.entries()) {
-    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
-      active++;
-    }
-  }
-  
-  return active;
-}
-
-module.exports = { 
-  sessionTimeoutMiddleware, 
-  endSession,
-  getActiveSessions 
-};

backend/src/routes/admin.js

@@ -1,26 +0,0 @@
-const express = require('express');
-const router = express.Router();
-
-// Import sub-routers
-const dashboardRoutes = require('./adminDashboard');
-const archiveRoutes = require('./adminArchives');
-const emailRoutes = require('./adminEmail');
-const settingsRoutes = require('./adminSettings');
-const eventsRoutes = require('./adminEvents');
-const photosRoutes = require('./adminPhotos');
-const categoriesRoutes = require('./adminCategories');
-const cmsRoutes = require('./adminCMS');
-const notificationsRoutes = require('./adminNotifications');
-
-// Mount sub-routers
-router.use('/dashboard', dashboardRoutes);
-router.use('/archives', archiveRoutes);
-router.use('/email', emailRoutes);
-router.use('/settings', settingsRoutes);
-router.use('/events', eventsRoutes);
-router.use('/events', photosRoutes);
-router.use('/categories', categoriesRoutes);
-router.use('/cms', cmsRoutes);
-router.use('/notifications', notificationsRoutes);
-
-module.exports = router;

backend/src/routes/adminArchives.js

@@ -1,388 +0,0 @@
-const express = require('express');
-const path = require('path');
-const fs = require('fs').promises;
-const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const archiver = require('archiver');
-const AdmZip = require('adm-zip');
-const router = express.Router();
-
-// Get all archived events
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const page = parseInt(req.query.page) || 1;
-    const limit = parseInt(req.query.limit) || 20;
-    const offset = (page - 1) * limit;
-
-    // Get total count
-    const totalCount = await db('events')
-      .where('is_archived', true)
-      .count('id as count')
-      .first();
-
-    // Get archived events
-    const archives = await db('events')
-      .select(
-        'events.*',
-        db.raw('COUNT(DISTINCT photos.id) as photo_count'),
-        db.raw('SUM(photos.size_bytes) as total_size')
-      )
-      .leftJoin('photos', 'events.id', 'photos.event_id')
-      .where('events.is_archived', true)
-      .groupBy('events.id')
-      .orderBy('events.archived_at', 'desc')
-      .limit(limit)
-      .offset(offset);
-
-    // Check if archive files exist and get their sizes
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const archivesWithFileInfo = await Promise.all(archives.map(async (archive) => {
-      let archiveFileSize = 0;
-      if (archive.archive_path) {
-        try {
-          const fullArchivePath = path.join(storagePath, archive.archive_path);
-          const stats = await fs.stat(fullArchivePath);
-          archiveFileSize = stats.size;
-        } catch (error) {
-          console.error(`Archive file not found: ${archive.archive_path}`);
-        }
-      }
-
-      return {
-        id: archive.id,
-        slug: archive.slug,
-        eventName: archive.event_name,
-        eventDate: archive.event_date,
-        eventType: archive.event_type,
-        hostEmail: archive.host_email,
-        archivedAt: archive.archived_at ? new Date(archive.archived_at).toISOString() : null,
-        expiresAt: archive.expires_at ? new Date(archive.expires_at).toISOString() : null,
-        photoCount: archive.photo_count || 0,
-        originalSize: archive.total_size || 0,
-        archiveSize: archiveFileSize,
-        archivePath: archive.archive_path
-      };
-    }));
-
-    res.json({
-      archives: archivesWithFileInfo,
-      pagination: {
-        page,
-        limit,
-        total: totalCount.count,
-        totalPages: Math.ceil(totalCount.count / limit)
-      }
-    });
-  } catch (error) {
-    console.error('Archives list error:', error);
-    res.status(500).json({ error: 'Failed to fetch archives' });
-  }
-});
-
-// Get single archive details
-router.get('/:id', adminAuth, async (req, res) => {
-  try {
-    const archive = await db('events')
-      .where('id', req.params.id)
-      .where('is_archived', true)
-      .first();
-
-    if (!archive) {
-      return res.status(404).json({ error: 'Archive not found' });
-    }
-
-    // Get photo details
-    const photos = await db('photos')
-      .where('event_id', archive.id)
-      .select('filename', 'type', 'size_bytes', 'uploaded_at');
-
-    // Check archive file
-    let archiveFileInfo = null;
-    if (archive.archive_path) {
-      try {
-        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-        const fullArchivePath = path.join(storagePath, archive.archive_path);
-        const stats = await fs.stat(fullArchivePath);
-        archiveFileInfo = {
-          size: stats.size,
-          createdAt: stats.birthtime,
-          path: archive.archive_path
-        };
-      } catch (error) {
-        console.error('Archive file not found:', error);
-      }
-    }
-
-    res.json({
-      id: archive.id,
-      slug: archive.slug,
-      eventName: archive.event_name,
-      eventDate: archive.event_date,
-      eventType: archive.event_type,
-      hostEmail: archive.host_email,
-      adminEmail: archive.admin_email,
-      welcomeMessage: archive.welcome_message,
-      colorTheme: archive.color_theme,
-      createdAt: archive.created_at,
-      expiresAt: archive.expires_at,
-      archivedAt: archive.archived_at,
-      photos: photos,
-      archiveFile: archiveFileInfo
-    });
-  } catch (error) {
-    console.error('Archive details error:', error);
-    res.status(500).json({ error: 'Failed to fetch archive details' });
-  }
-});
-
-// Restore archive
-router.post('/:id/restore', adminAuth, async (req, res) => {
-  try {
-    const archive = await db('events')
-      .where('id', req.params.id)
-      .where('is_archived', true)
-      .first();
-
-    if (!archive) {
-      return res.status(404).json({ error: 'Archive not found' });
-    }
-
-    // Check if archive file exists
-    if (!archive.archive_path) {
-      return res.status(400).json({ error: 'No archive file found' });
-    }
-
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const fullArchivePath = path.join(storagePath, archive.archive_path);
-
-    try {
-      await fs.access(fullArchivePath);
-    } catch (error) {
-      return res.status(404).json({ error: 'Archive file not found on disk' });
-    }
-
-    // Extract the archive
-    try {
-      const zip = new AdmZip(fullArchivePath);
-      const eventsDir = path.join(storagePath, 'events/active');
-      const eventDir = path.join(eventsDir, archive.slug);
-      
-      // Create event directory if it doesn't exist
-      await fs.mkdir(eventDir, { recursive: true });
-      
-      // Log ZIP contents for debugging
-      console.log(`Extracting archive to: ${eventDir}`);
-      const entries = zip.getEntries();
-      console.log(`Archive contains ${entries.length} entries`);
-      
-      // Extract files to the event directory
-      zip.extractAllTo(eventDir, true);
-      
-      // Get list of extracted files to update database
-      const extractedPhotos = [];
-      
-      // First, collect all category information from the ZIP structure
-      const categoriesMap = new Map();
-      
-      for (const entry of entries) {
-        if (!entry.isDirectory && entry.entryName.match(/\.(jpg|jpeg|png|gif|webp)$/i)) {
-          const filename = path.basename(entry.entryName);
-          const dirPath = path.dirname(entry.entryName);
-          const actualFilePath = path.join(eventDir, entry.entryName);
-          
-          try {
-            // Check if file was extracted successfully
-            const stats = await fs.stat(actualFilePath);
-            
-            // Determine category from directory structure
-            let categoryId = null;
-            if (dirPath && dirPath !== '.') {
-              // Get the first level directory as category
-              const categoryName = dirPath.split(path.sep)[0];
-              
-              if (!categoriesMap.has(categoryName)) {
-                // Check if this category exists in the database
-                const existingCategory = await db('photo_categories')
-                  .where('event_id', archive.id)
-                  .where('name', categoryName)
-                  .first();
-                
-                if (existingCategory) {
-                  categoriesMap.set(categoryName, existingCategory.id);
-                } else {
-                  // Create the category if it doesn't exist
-                  const [newCategoryId] = await db('photo_categories').insert({
-                    event_id: archive.id,
-                    name: categoryName,
-                    slug: categoryName.toLowerCase().replace(/[^a-z0-9]/g, '-'),
-                    created_at: new Date()
-                  });
-                  categoriesMap.set(categoryName, newCategoryId);
-                }
-              }
-              
-              categoryId = categoriesMap.get(categoryName);
-            }
-          
-            // Check if photo already exists in database
-            const existingPhoto = await db('photos')
-              .where('event_id', archive.id)
-              .where('filename', filename)
-              .first();
-            
-            if (!existingPhoto) {
-              // Store relative path from storage root
-              const relativePath = path.relative(storagePath, actualFilePath);
-              extractedPhotos.push({
-                event_id: archive.id,
-                filename: filename,
-                original_filename: filename,
-                path: relativePath,
-                thumbnail_path: null, // Will be regenerated by thumbnail service
-                type: path.extname(filename).substring(1).toLowerCase(),
-                size_bytes: stats.size,
-                category_id: categoryId,
-                uploaded_at: new Date()
-              });
-            }
-          } catch (statError) {
-            console.error(`Failed to stat file: ${actualFilePath}`);
-            console.error(`Entry name was: ${entry.entryName}`);
-            console.error(`Error:`, statError.message);
-            // Skip this file if we can't stat it
-            continue;
-          }
-        }
-      }
-      
-      // Insert new photos if any
-      if (extractedPhotos.length > 0) {
-        await db('photos').insert(extractedPhotos);
-      }
-      
-    } catch (extractError) {
-      console.error('Archive extraction error:', extractError);
-      return res.status(500).json({ error: 'Failed to extract archive: ' + extractError.message });
-    }
-    
-    // Update event status
-    await db('events')
-      .where('id', req.params.id)
-      .update({
-        is_archived: false,
-        is_active: true,
-        archive_path: null,
-        archived_at: null,
-        expires_at: db.raw("datetime('now', '+30 days')") // Reset expiration
-      });
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'archive_restored',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      event_id: archive.id,
-      metadata: JSON.stringify({ event_name: archive.event_name })
-    });
-
-    res.json({ message: 'Archive restored successfully' });
-  } catch (error) {
-    console.error('Archive restore error:', error);
-    res.status(500).json({ error: 'Failed to restore archive' });
-  }
-});
-
-// Download archive
-router.get('/:id/download', adminAuth, async (req, res) => {
-  try {
-    const archive = await db('events')
-      .where('id', req.params.id)
-      .where('is_archived', true)
-      .first();
-
-    if (!archive) {
-      return res.status(404).json({ error: 'Archive not found' });
-    }
-
-    if (!archive.archive_path) {
-      return res.status(404).json({ error: 'Archive file not found' });
-    }
-
-    // Check if file exists
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const fullArchivePath = path.join(storagePath, archive.archive_path);
-    
-    try {
-      await fs.access(fullArchivePath);
-    } catch (error) {
-      return res.status(404).json({ error: 'Archive file not found on disk' });
-    }
-
-    // Set headers for download
-    res.setHeader('Content-Type', 'application/zip');
-    res.setHeader('Content-Disposition', `attachment; filename="${archive.slug}.zip"`);
-
-    // Stream the file
-    const fileStream = require('fs').createReadStream(fullArchivePath);
-    fileStream.pipe(res);
-
-    // Log download
-    await db('activity_logs').insert({
-      activity_type: 'archive_downloaded',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      event_id: archive.id,
-      metadata: JSON.stringify({ event_name: archive.event_name })
-    });
-  } catch (error) {
-    console.error('Archive download error:', error);
-    res.status(500).json({ error: 'Failed to download archive' });
-  }
-});
-
-// Delete archive permanently
-router.delete('/:id', adminAuth, async (req, res) => {
-  try {
-    const archive = await db('events')
-      .where('id', req.params.id)
-      .where('is_archived', true)
-      .first();
-
-    if (!archive) {
-      return res.status(404).json({ error: 'Archive not found' });
-    }
-
-    // Delete archive file if exists
-    if (archive.archive_path) {
-      try {
-        await fs.unlink(archive.archive_path);
-      } catch (error) {
-        console.error('Failed to delete archive file:', error);
-      }
-    }
-
-    // Delete from database (cascade will delete photos and logs)
-    await db('events').where('id', req.params.id).delete();
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'archive_deleted',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      metadata: JSON.stringify({ 
-        event_name: archive.event_name,
-        archived_date: archive.archived_at 
-      })
-    });
-
-    res.json({ message: 'Archive deleted permanently' });
-  } catch (error) {
-    console.error('Archive delete error:', error);
-    res.status(500).json({ error: 'Failed to delete archive' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminAuth.js

@@ -1,99 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcrypt');
-const { body, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const { endSession } = require('../middleware/sessionTimeout');
-const { validatePasswordStrength } = require('../utils/passwordGenerator');
-const router = express.Router();
-
-// Change password
-router.post('/change-password', [
-  adminAuth,
-  body('currentPassword').notEmpty().withMessage('Current password is required'),
-  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const { currentPassword, newPassword } = req.body;
-    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
-
-    // Validate new password strength
-    const passwordValidation = validatePasswordStrength(newPassword);
-    if (!passwordValidation.isValid) {
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.messages
-      });
-    }
-
-    // Get user from database
-    const user = await db('admin_users')
-      .where('id', userId)
-      .first();
-
-    if (!user) {
-      return res.status(404).json({ error: 'User not found' });
-    }
-
-    // Verify current password
-    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
-    if (!validPassword) {
-      return res.status(400).json({ error: 'Current password is incorrect' });
-    }
-
-    // Hash new password with more rounds
-    const newPasswordHash = await bcrypt.hash(newPassword, 12);
-
-    // Update password and clear must_change_password flag
-    await db('admin_users')
-      .where('id', userId)
-      .update({
-        password_hash: newPasswordHash,
-        must_change_password: false,
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await logActivity('password_changed', 
-      { admin_id: userId }, 
-      null,
-      { type: 'admin', id: userId, name: user.username }
-    );
-
-    res.json({ message: 'Password changed successfully' });
-  } catch (error) {
-    console.error('Password change error:', error);
-    res.status(500).json({ error: 'Failed to change password' });
-  }
-});
-
-// Logout
-router.post('/logout', adminAuth, async (req, res) => {
-  try {
-    // Get token from header
-    const token = req.headers.authorization?.split(' ')[1];
-    if (token) {
-      // End the session
-      endSession(token);
-    }
-    
-    // Log activity
-    await logActivity('admin_logout', 
-      { admin_id: req.admin.id }, 
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({ message: 'Logged out successfully' });
-  } catch (error) {
-    console.error('Logout error:', error);
-    res.status(500).json({ error: 'Failed to logout' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminCMS.js

@@ -1,83 +0,0 @@
-const express = require('express');
-const { body, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const router = express.Router();
-
-// Get all CMS pages
-router.get('/pages', adminAuth, async (req, res) => {
-  try {
-    const pages = await db('cms_pages').select('*').orderBy('slug', 'asc');
-    res.json(pages);
-  } catch (error) {
-    console.error('Error fetching CMS pages:', error);
-    res.status(500).json({ error: 'Failed to fetch pages' });
-  }
-});
-
-// Get a single CMS page
-router.get('/pages/:slug', adminAuth, async (req, res) => {
-  try {
-    const { slug } = req.params;
-    const page = await db('cms_pages').where('slug', slug).first();
-    
-    if (!page) {
-      return res.status(404).json({ error: 'Page not found' });
-    }
-    
-    res.json(page);
-  } catch (error) {
-    console.error('Error fetching CMS page:', error);
-    res.status(500).json({ error: 'Failed to fetch page' });
-  }
-});
-
-// Update a CMS page
-router.put('/pages/:slug', adminAuth, [
-  body('title_en').optional().isString(),
-  body('title_de').optional().isString(),
-  body('content_en').optional().isString(),
-  body('content_de').optional().isString()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { slug } = req.params;
-    const { title_en, title_de, content_en, content_de } = req.body;
-    
-    const page = await db('cms_pages').where('slug', slug).first();
-    if (!page) {
-      return res.status(404).json({ error: 'Page not found' });
-    }
-    
-    // Update the page
-    await db('cms_pages')
-      .where('slug', slug)
-      .update({
-        title_en,
-        title_de,
-        content_en,
-        content_de,
-        updated_at: new Date()
-      });
-    
-    const updated = await db('cms_pages').where('slug', slug).first();
-    
-    // Log activity
-    await logActivity('cms_page_updated',
-      { page: slug },
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json(updated);
-  } catch (error) {
-    console.error('Error updating CMS page:', error);
-    res.status(500).json({ error: 'Failed to update page' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminCategories.js

@@ -1,182 +0,0 @@
-const express = require('express');
-const { body, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const router = express.Router();
-
-// Get all global categories
-router.get('/global', adminAuth, async (req, res) => {
-  try {
-    const categories = await db('photo_categories')
-      .where('is_global', true)
-      .orderBy('name', 'asc');
-    
-    res.json(categories);
-  } catch (error) {
-    console.error('Error fetching categories:', error);
-    res.status(500).json({ error: 'Failed to fetch categories' });
-  }
-});
-
-// Get categories for a specific event (global + event-specific)
-router.get('/event/:eventId', adminAuth, async (req, res) => {
-  try {
-    const { eventId } = req.params;
-    
-    const categories = await db('photo_categories')
-      .where(function() {
-        this.where('is_global', true)
-          .orWhere('event_id', eventId);
-      })
-      .orderBy('is_global', 'desc')
-      .orderBy('name', 'asc');
-    
-    res.json(categories);
-  } catch (error) {
-    console.error('Error fetching event categories:', error);
-    res.status(500).json({ error: 'Failed to fetch categories' });
-  }
-});
-
-// Create a new category
-router.post('/', adminAuth, [
-  body('name').notEmpty().withMessage('Category name is required'),
-  body('slug').optional(),
-  body('is_global').optional().isBoolean(),
-  body('event_id').optional().isInt()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { name, slug, is_global = true, event_id = null } = req.body;
-    
-    // Generate slug if not provided
-    const categorySlug = slug || name.toLowerCase()
-      .replace(/[^\w\s-]/g, '')
-      .replace(/\s+/g, '-')
-      .replace(/-+/g, '-')
-      .trim();
-    
-    // Check if slug already exists for this scope
-    const existing = await db('photo_categories')
-      .where('slug', categorySlug)
-      .where(function() {
-        if (is_global) {
-          this.where('is_global', true);
-        } else {
-          this.where('event_id', event_id);
-        }
-      })
-      .first();
-    
-    if (existing) {
-      return res.status(400).json({ error: 'Category with this slug already exists' });
-    }
-    
-    // Create category
-    const [categoryId] = await db('photo_categories').insert({
-      name,
-      slug: categorySlug,
-      is_global,
-      event_id: is_global ? null : event_id
-    });
-    
-    const category = await db('photo_categories').where('id', categoryId).first();
-    
-    // Log activity
-    await logActivity('category_created', 
-      { categoryName: name, isGlobal: is_global },
-      event_id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json(category);
-  } catch (error) {
-    console.error('Error creating category:', error);
-    res.status(500).json({ error: 'Failed to create category' });
-  }
-});
-
-// Update a category
-router.put('/:id', adminAuth, [
-  body('name').notEmpty().withMessage('Category name is required')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { id } = req.params;
-    const { name } = req.body;
-    
-    const category = await db('photo_categories').where('id', id).first();
-    if (!category) {
-      return res.status(404).json({ error: 'Category not found' });
-    }
-    
-    await db('photo_categories')
-      .where('id', id)
-      .update({
-        name,
-        slug: name.toLowerCase()
-          .replace(/[^\w\s-]/g, '')
-          .replace(/\s+/g, '-')
-          .replace(/-+/g, '-')
-          .trim()
-      });
-    
-    const updated = await db('photo_categories').where('id', id).first();
-    
-    // Log activity
-    await logActivity('category_updated',
-      { categoryName: name },
-      category.event_id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json(updated);
-  } catch (error) {
-    console.error('Error updating category:', error);
-    res.status(500).json({ error: 'Failed to update category' });
-  }
-});
-
-// Delete a category
-router.delete('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    
-    const category = await db('photo_categories').where('id', id).first();
-    if (!category) {
-      return res.status(404).json({ error: 'Category not found' });
-    }
-    
-    // Check if category has photos
-    const photoCount = await db('photos').where('category_id', id).count('id as count').first();
-    if (photoCount.count > 0) {
-      return res.status(400).json({ 
-        error: 'Cannot delete category with photos. Please reassign photos first.' 
-      });
-    }
-    
-    await db('photo_categories').where('id', id).delete();
-    
-    // Log activity
-    await logActivity('category_deleted',
-      { categoryName: category.name },
-      category.event_id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({ message: 'Category deleted successfully' });
-  } catch (error) {
-    console.error('Error deleting category:', error);
-    res.status(500).json({ error: 'Failed to delete category' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminDashboard.js

@@ -1,313 +0,0 @@
-const express = require('express');
-const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
-const router = express.Router();
-
-// Get dashboard statistics
-router.get('/stats', adminAuth, async (req, res) => {
-  try {
-    // Get active events count
-    const activeEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .count('id as count')
-      .first();
-
-    // Get events expiring within 7 days
-    const sevenDaysFromNow = new Date();
-    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
-    const now = new Date();
-    
-    const expiringEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
-      .where('expires_at', '>', now.toISOString())
-      .count('id as count')
-      .first();
-
-    // Get total photos count
-    const totalPhotos = await db('photos')
-      .count('id as count')
-      .first();
-
-    // Get storage usage (sum of all photo sizes)
-    const storageUsed = await db('photos')
-      .sum('size_bytes as total')
-      .first();
-
-    // Get total views (last 30 days)
-    const thirtyDaysAgo = new Date();
-    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-    
-    const totalViews = await db('access_logs')
-      .where('action', 'view')
-      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
-      .count('id as count')
-      .first();
-
-    // Get total downloads (last 30 days)
-    const totalDownloads = await db('access_logs')
-      .where('action', 'download')
-      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
-      .count('id as count')
-      .first();
-
-    // Get archived events count
-    const archivedEvents = await db('events')
-      .where('is_archived', true)
-      .count('id as count')
-      .first();
-
-    // Calculate trends (compare with previous 30 days)
-    const sixtyDaysAgo = new Date();
-    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
-    
-    const previousViews = await db('access_logs')
-      .where('action', 'view')
-      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
-      .where('timestamp', '<', thirtyDaysAgo.toISOString())
-      .count('id as count')
-      .first();
-
-    const previousDownloads = await db('access_logs')
-      .where('action', 'download')
-      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
-      .where('timestamp', '<', thirtyDaysAgo.toISOString())
-      .count('id as count')
-      .first();
-
-    // Calculate trend percentages
-    const viewsTrend = previousViews.count > 0 
-      ? ((totalViews.count - previousViews.count) / previousViews.count) * 100 
-      : 0;
-    
-    const downloadsTrend = previousDownloads.count > 0
-      ? ((totalDownloads.count - previousDownloads.count) / previousDownloads.count) * 100
-      : 0;
-
-    res.json({
-      activeEvents: activeEvents.count || 0,
-      expiringEvents: expiringEvents.count || 0,
-      totalPhotos: totalPhotos.count || 0,
-      storageUsed: storageUsed.total || 0,
-      totalViews: totalViews.count || 0,
-      totalDownloads: totalDownloads.count || 0,
-      viewsTrend: Math.round(viewsTrend * 10) / 10,
-      downloadsTrend: Math.round(downloadsTrend * 10) / 10,
-      archivedEvents: archivedEvents.count || 0
-    });
-  } catch (error) {
-    console.error('Dashboard stats error:', error);
-    res.status(500).json({ error: 'Failed to fetch dashboard statistics' });
-  }
-});
-
-// Get recent activity
-router.get('/activity', adminAuth, async (req, res) => {
-  try {
-    const limit = parseInt(req.query.limit) || 10;
-    
-    const activities = await db('activity_logs')
-      .select('activity_logs.*', 'events.event_name')
-      .leftJoin('events', 'activity_logs.event_id', 'events.id')
-      .orderBy('activity_logs.created_at', 'desc')
-      .limit(limit);
-
-    // Format activities
-    const formattedActivities = activities.map(activity => ({
-      id: activity.id,
-      type: activity.activity_type,
-      actorType: activity.actor_type,
-      actorName: activity.actor_name,
-      eventName: activity.event_name,
-      metadata: activity.metadata ? JSON.parse(activity.metadata) : {},
-      createdAt: activity.created_at
-    }));
-
-    res.json(formattedActivities);
-  } catch (error) {
-    console.error('Activity log error:', error);
-    res.status(500).json({ error: 'Failed to fetch activity log' });
-  }
-});
-
-// Get system health status
-router.get('/health', adminAuth, async (req, res) => {
-  try {
-    const os = require('os');
-    
-    // Check database connectivity
-    let dbStatus = 'healthy';
-    try {
-      await db.raw('SELECT 1');
-    } catch (error) {
-      dbStatus = 'error';
-    }
-
-    // Check email queue
-    const [pendingEmails] = await db('email_queue')
-      .where('status', 'pending')
-      .count('* as count');
-    
-    const twentyFourHoursAgo = new Date();
-    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
-    
-    const [failedEmails] = await db('email_queue')
-      .where('status', 'failed')
-      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
-      .count('* as count');
-
-    const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
-
-    // Check disk space (simplified)
-    const storageStatus = 'healthy'; // In production, check actual disk usage
-
-    // Memory usage
-    const memoryUsage = {
-      total: os.totalmem(),
-      free: os.freemem(),
-      used: os.totalmem() - os.freemem(),
-      percentage: Math.round(((os.totalmem() - os.freemem()) / os.totalmem()) * 100)
-    };
-
-    const memoryStatus = memoryUsage.percentage > 90 ? 'warning' : 'healthy';
-
-    // Overall health
-    const statuses = [dbStatus, emailStatus, storageStatus, memoryStatus];
-    let overallHealth = 'healthy';
-    if (statuses.includes('error')) overallHealth = 'error';
-    else if (statuses.includes('warning')) overallHealth = 'warning';
-
-    res.json({
-      overall: overallHealth,
-      services: {
-        database: dbStatus,
-        email: emailStatus,
-        storage: storageStatus,
-        memory: memoryStatus
-      },
-      details: {
-        emailQueue: {
-          pending: pendingEmails.count,
-          failed: failedEmails.count
-        },
-        memory: memoryUsage
-      }
-    });
-  } catch (error) {
-    console.error('Health check error:', error);
-    res.status(500).json({ 
-      overall: 'error',
-      error: 'Failed to check system health' 
-    });
-  }
-});
-
-// Get analytics data for charts
-router.get('/analytics', adminAuth, async (req, res) => {
-  try {
-    const days = sanitizeDays(req.query.days || 7);
-    
-    // Generate date range
-    const dates = [];
-    for (let i = days - 1; i >= 0; i--) {
-      dates.push({
-        date: new Date(Date.now() - i * 24 * 60 * 60 * 1000).toISOString().split('T')[0],
-        views: 0,
-        downloads: 0,
-        uniqueVisitors: 0
-      });
-    }
-
-    // Calculate the start date for queries
-    const startDate = new Date();
-    startDate.setDate(startDate.getDate() - days);
-    const startDateStr = startDate.toISOString();
-
-    // Get views per day
-    const viewsData = await db('access_logs')
-      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
-      .where('action', 'view')
-      .where('timestamp', '>=', startDateStr)
-      .groupByRaw('DATE(timestamp)');
-
-    // Get downloads per day
-    const downloadsData = await db('access_logs')
-      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
-      .where('action', 'download')
-      .where('timestamp', '>=', startDateStr)
-      .groupByRaw('DATE(timestamp)');
-
-    // Get unique visitors per day
-    const visitorsData = await db('access_logs')
-      .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
-      .where('timestamp', '>=', startDateStr)
-      .groupByRaw('DATE(timestamp)');
-
-    // Merge data into dates array
-    viewsData.forEach(row => {
-      const dateObj = dates.find(d => d.date === row.date);
-      if (dateObj) dateObj.views = row.count;
-    });
-
-    downloadsData.forEach(row => {
-      const dateObj = dates.find(d => d.date === row.date);
-      if (dateObj) dateObj.downloads = row.count;
-    });
-
-    visitorsData.forEach(row => {
-      const dateObj = dates.find(d => d.date === row.date);
-      if (dateObj) dateObj.uniqueVisitors = row.count;
-    });
-
-    // Get top galleries by views
-    const topGalleries = await db('access_logs')
-      .select('events.event_name', 'events.slug')
-      .select(db.raw('COUNT(*) as views'))
-      .join('events', 'access_logs.event_id', 'events.id')
-      .where('access_logs.action', 'view')
-      .where('access_logs.timestamp', '>=', startDateStr)
-      .groupBy('events.id')
-      .orderBy('views', 'desc')
-      .limit(5);
-
-    // Get device breakdown (simplified - based on user agent)
-    const deviceData = await db('access_logs')
-      .select(
-        db.raw(`
-          CASE 
-            WHEN user_agent LIKE '%Mobile%' THEN 'mobile'
-            WHEN user_agent LIKE '%Tablet%' OR user_agent LIKE '%iPad%' THEN 'tablet'
-            ELSE 'desktop'
-          END as device_type
-        `),
-        db.raw('COUNT(*) as count')
-      )
-      .where('timestamp', '>=', startDateStr)
-      .groupBy('device_type');
-
-    const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);
-    const devices = {
-      desktop: 0,
-      mobile: 0,
-      tablet: 0
-    };
-
-    deviceData.forEach(d => {
-      devices[d.device_type] = Math.round((d.count / totalDevices) * 100);
-    });
-
-    res.json({
-      chartData: dates,
-      topGalleries,
-      devices
-    });
-  } catch (error) {
-    console.error('Analytics error:', error);
-    res.status(500).json({ error: 'Failed to fetch analytics data' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminEmail.js

@@ -1,314 +0,0 @@
-const express = require('express');
-const nodemailer = require('nodemailer');
-const { body, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const router = express.Router();
-
-// Get email configuration
-router.get('/config', adminAuth, async (req, res) => {
-  try {
-    const config = await db('email_configs').first();
-    
-    if (!config) {
-      return res.json({
-        smtp_host: '',
-        smtp_port: 587,
-        smtp_secure: false,
-        smtp_user: '',
-        smtp_pass: '', // Don't send actual password
-        from_email: '',
-        from_name: ''
-      });
-    }
-
-    // Don't send the actual password
-    res.json({
-      ...config,
-      smtp_pass: config.smtp_pass ? '********' : ''
-    });
-  } catch (error) {
-    console.error('Email config fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch email configuration' });
-  }
-});
-
-// Update email configuration
-router.post('/config', [
-  adminAuth,
-  body('smtp_host').notEmpty().withMessage('SMTP host is required'),
-  body('smtp_port').isInt({ min: 1, max: 65535 }).withMessage('Invalid port number'),
-  body('from_email').isEmail().withMessage('Invalid from email address')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const {
-      smtp_host,
-      smtp_port,
-      smtp_secure,
-      smtp_user,
-      smtp_pass,
-      from_email,
-      from_name
-    } = req.body;
-
-    // Check if config exists
-    const existingConfig = await db('email_configs').first();
-    
-    const configData = {
-      smtp_host,
-      smtp_port: parseInt(smtp_port),
-      smtp_secure: smtp_secure || false,
-      smtp_user: smtp_user || '',
-      from_email,
-      from_name: from_name || 'Photo Sharing',
-      updated_at: new Date()
-    };
-
-    // Only update password if provided and not masked
-    if (smtp_pass && smtp_pass !== '********') {
-      configData.smtp_pass = smtp_pass;
-    }
-
-    if (existingConfig) {
-      await db('email_configs')
-        .where('id', existingConfig.id)
-        .update(configData);
-    } else {
-      await db('email_configs').insert(configData);
-    }
-
-    // Log activity
-    await logActivity('email_config_updated', 
-      { smtp_host, from_email }, 
-      null, 
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ message: 'Email configuration updated successfully' });
-  } catch (error) {
-    console.error('Email config update error:', error);
-    res.status(500).json({ error: 'Failed to update email configuration' });
-  }
-});
-
-// Test email configuration
-router.post('/test', adminAuth, async (req, res) => {
-  try {
-    const { test_email } = req.body;
-    
-    if (!test_email) {
-      return res.status(400).json({ error: 'Test email address is required' });
-    }
-
-    // Get email config
-    const config = await db('email_configs').first();
-    
-    if (!config) {
-      return res.status(400).json({ error: 'Email configuration not found. Please configure SMTP settings first.' });
-    }
-
-    // Create transporter
-    const transporter = nodemailer.createTransport({
-      host: config.smtp_host,
-      port: config.smtp_port,
-      secure: config.smtp_secure,
-      auth: config.smtp_user ? {
-        user: config.smtp_user,
-        pass: config.smtp_pass
-      } : undefined
-    });
-
-    // Send test email
-    await transporter.sendMail({
-      from: `${config.from_name} <${config.from_email}>`,
-      to: test_email,
-      subject: 'Test Email - Photo Sharing Platform',
-      html: `
-        <h2>Test Email Successful!</h2>
-        <p>This is a test email from your Photo Sharing platform.</p>
-        <p>If you're seeing this, your email configuration is working correctly.</p>
-        <hr>
-        <p style="color: #666; font-size: 12px;">
-          Sent from: ${config.from_email}<br>
-          SMTP Host: ${config.smtp_host}<br>
-          Time: ${new Date().toISOString()}
-        </p>
-      `,
-      text: 'Test Email Successful! Your email configuration is working correctly.'
-    });
-
-    res.json({ message: 'Test email sent successfully' });
-  } catch (error) {
-    console.error('Test email error:', error);
-    res.status(500).json({ 
-      error: 'Failed to send test email',
-      details: error.message 
-    });
-  }
-});
-
-// Get email templates
-router.get('/templates', adminAuth, async (req, res) => {
-  try {
-    const templates = await db('email_templates')
-      .select('*')
-      .orderBy('template_key');
-
-    // Parse variables JSON and format for multi-language support
-    const formattedTemplates = templates.map(template => ({
-      id: template.id,
-      template_key: template.template_key,
-      // English versions
-      subject_en: template.subject_en || template.subject,
-      body_html_en: template.body_html_en || template.body_html,
-      body_text_en: template.body_text_en || template.body_text,
-      // German versions
-      subject_de: template.subject_de || template.subject_en || template.subject,
-      body_html_de: template.body_html_de || template.body_html_en || template.body_html,
-      body_text_de: template.body_text_de || template.body_text_en || template.body_text,
-      variables: template.variables ? JSON.parse(template.variables) : [],
-      updated_at: template.updated_at
-    }));
-
-    res.json(formattedTemplates);
-  } catch (error) {
-    console.error('Email templates fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch email templates' });
-  }
-});
-
-// Get single template
-router.get('/templates/:key', adminAuth, async (req, res) => {
-  try {
-    const template = await db('email_templates')
-      .where('template_key', req.params.key)
-      .first();
-
-    if (!template) {
-      return res.status(404).json({ error: 'Template not found' });
-    }
-
-    res.json({
-      id: template.id,
-      template_key: template.template_key,
-      // English versions
-      subject_en: template.subject_en || template.subject,
-      body_html_en: template.body_html_en || template.body_html,
-      body_text_en: template.body_text_en || template.body_text,
-      // German versions
-      subject_de: template.subject_de || template.subject_en || template.subject,
-      body_html_de: template.body_html_de || template.body_html_en || template.body_html,
-      body_text_de: template.body_text_de || template.body_text_en || template.body_text,
-      variables: template.variables ? JSON.parse(template.variables) : [],
-      updated_at: template.updated_at
-    });
-  } catch (error) {
-    console.error('Email template fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch email template' });
-  }
-});
-
-// Update email template
-router.put('/templates/:key', [
-  adminAuth,
-  body('subject_en').optional().notEmpty().withMessage('English subject cannot be empty'),
-  body('subject_de').optional().notEmpty().withMessage('German subject cannot be empty'),
-  body('body_html_en').optional().notEmpty().withMessage('English HTML body cannot be empty'),
-  body('body_html_de').optional().notEmpty().withMessage('German HTML body cannot be empty')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const {
-      subject_en, subject_de,
-      body_html_en, body_html_de,
-      body_text_en, body_text_de
-    } = req.body;
-
-    const updateData = {
-      updated_at: new Date()
-    };
-
-    // Only update provided fields
-    if (subject_en !== undefined) updateData.subject_en = subject_en;
-    if (subject_de !== undefined) updateData.subject_de = subject_de;
-    if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
-    if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
-    if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
-    if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
-
-    const updated = await db('email_templates')
-      .where('template_key', req.params.key)
-      .update(updateData);
-
-    if (!updated) {
-      return res.status(404).json({ error: 'Template not found' });
-    }
-
-    // Log activity
-    await logActivity('email_template_updated',
-      { template_key: req.params.key },
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ message: 'Email template updated successfully' });
-  } catch (error) {
-    console.error('Email template update error:', error);
-    res.status(500).json({ error: 'Failed to update email template' });
-  }
-});
-
-// Preview email template
-router.post('/templates/:key/preview', adminAuth, async (req, res) => {
-  try {
-    const template = await db('email_templates')
-      .where('template_key', req.params.key)
-      .first();
-
-    if (!template) {
-      return res.status(404).json({ error: 'Template not found' });
-    }
-
-    const { preview_data, language = 'en' } = req.body;
-    
-    // Get the appropriate language version
-    const subjectField = language === 'de' && template.subject_de ? 'subject_de' : 'subject_en';
-    const htmlField = language === 'de' && template.body_html_de ? 'body_html_de' : 'body_html_en';
-    const textField = language === 'de' && template.body_text_de ? 'body_text_de' : 'body_text_en';
-    
-    // Handle backward compatibility
-    let htmlContent = template[htmlField] || template.body_html || '';
-    let textContent = template[textField] || template.body_text || '';
-    let subject = template[subjectField] || template.subject || '';
-
-    if (preview_data) {
-      Object.keys(preview_data).forEach(key => {
-        const regex = new RegExp(`{{${key}}}`, 'g');
-        htmlContent = htmlContent.replace(regex, preview_data[key]);
-        textContent = textContent.replace(regex, preview_data[key]);
-        subject = subject.replace(regex, preview_data[key]);
-      });
-    }
-
-    res.json({
-      subject,
-      body_html: htmlContent,
-      body_text: textContent,
-      language
-    });
-  } catch (error) {
-    console.error('Email template preview error:', error);
-    res.status(500).json({ error: 'Failed to preview email template' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminEvents-enhanced.js

@@ -1,121 +0,0 @@
-// This is a partial file showing the enhanced event creation with password validation
-// Only the relevant parts are shown - merge with existing adminEvents.js
-
-const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-
-// Enhanced event creation with password validation
-router.post('/', adminAuth, [
-  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
-  body('event_name').notEmpty().trim(),
-  body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
-  body('admin_email').isEmail().normalizeEmail(),
-  body('password').notEmpty(), // Remove the weak isLength validation
-  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
-  body('welcome_message').optional().trim(),
-  body('color_theme').optional().trim(),
-  body('allow_user_uploads').optional().isBoolean().toBoolean(),
-  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim()
-], async (req, res) => {
-  try {
-    console.log('Create event request body:', req.body);
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      console.error('Validation errors:', errors.array());
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const {
-      event_type,
-      event_name,
-      event_date,
-      host_name,
-      host_email,
-      admin_email,
-      password,
-      welcome_message = '',
-      color_theme = null,
-      expiration_days = 30,
-      allow_user_uploads = false,
-      upload_category_id = null
-    } = req.body;
-    
-    // Validate password strength for gallery
-    const passwordValidation = validatePasswordInContext(password, 'gallery', {
-      eventName: event_name
-    });
-    
-    if (!passwordValidation.valid) {
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.errors,
-        score: passwordValidation.score,
-        feedback: passwordValidation.feedback
-      });
-    }
-    
-    // Generate unique slug
-    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
-    let slug = baseSlug;
-    let counter = 1;
-    
-    while (await db('events').where({ slug }).first()) {
-      slug = `${baseSlug}-${counter}`;
-      counter++;
-    }
-    
-    // Generate share link
-    const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
-    
-    // Hash password with configurable rounds
-    const password_hash = await bcrypt.hash(password, getBcryptRounds());
-    
-    // Calculate expiration date (days after event date)
-    const expires_at = new Date(event_date);
-    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
-    
-    // Create folder structure
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const eventPath = path.join(storagePath, 'events/active', slug);
-    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
-    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
-    
-    // Insert into database
-    const [eventId] = await db('events').insert({
-      slug,
-      event_type,
-      event_name,
-      event_date,
-      host_name,
-      host_email,
-      admin_email,
-      password_hash,
-      welcome_message,
-      color_theme,
-      share_link: shareLink,
-      expires_at: expires_at.toISOString(),
-      created_at: new Date().toISOString(),
-      allow_user_uploads,
-      upload_category_id
-    });
-    
-    // Log activity
-    await logActivity('event_created', 
-      { 
-        event_type, 
-        expires_at,
-        password_strength: passwordValidation.score 
-      }, 
-      eventId, 
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    // Rest of the implementation remains the same...
-    // Queue creation email, etc.
-  } catch (error) {
-    console.error('Error creating event:', error);
-    res.status(500).json({ error: 'Failed to create event' });
-  }
-});

backend/src/routes/adminEvents.js

@@ -1,611 +0,0 @@
-const express = require('express');
-const { body, query, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const router = express.Router();
-const bcrypt = require('bcrypt');
-const crypto = require('crypto');
-const fs = require('fs').promises;
-const path = require('path');
-const { archiveEvent } = require('../services/archiveService');
-const { escapeLikePattern } = require('../utils/sqlSecurity');
-const { formatDate } = require('../utils/dateFormatter');
-const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-
-// Create new event
-router.post('/', adminAuth, [
-  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
-  body('event_name').notEmpty().trim(),
-  body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
-  body('admin_email').isEmail().normalizeEmail(),
-  body('password').isLength({ min: 6 }),
-  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
-  body('welcome_message').optional().trim(),
-  body('color_theme').optional().trim(),
-  body('allow_user_uploads').optional().isBoolean().toBoolean(),
-  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim()
-], async (req, res) => {
-  try {
-    console.log('Create event request body:', req.body);
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      console.error('Validation errors:', errors.array());
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const {
-      event_type,
-      event_name,
-      event_date,
-      host_name,
-      host_email,
-      admin_email,
-      password,
-      welcome_message = '',
-      color_theme = null,
-      expiration_days = 30,
-      allow_user_uploads = false,
-      upload_category_id = null
-    } = req.body;
-    
-    // Validate password strength
-    const passwordValidation = validatePasswordInContext(password, 'gallery', {
-      eventName: event_name
-    });
-    
-    if (!passwordValidation.valid) {
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.errors,
-        score: passwordValidation.score,
-        feedback: passwordValidation.feedback
-      });
-    }
-    
-    // Generate unique slug
-    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
-    let slug = baseSlug;
-    let counter = 1;
-    
-    while (await db('events').where({ slug }).first()) {
-      slug = `${baseSlug}-${counter}`;
-      counter++;
-    }
-    
-    // Generate share link
-    const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
-    
-    // Hash password with configurable rounds
-    const password_hash = await bcrypt.hash(password, getBcryptRounds());
-    
-    // Calculate expiration date (days after event date)
-    const expires_at = new Date(event_date);
-    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
-    
-    // Create folder structure
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const eventPath = path.join(storagePath, 'events/active', slug);
-    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
-    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
-    
-    // Insert into database
-    const [eventId] = await db('events').insert({
-      slug,
-      event_type,
-      event_name,
-      event_date,
-      host_name,
-      host_email,
-      admin_email,
-      password_hash,
-      welcome_message,
-      color_theme,
-      share_link: shareLink,
-      expires_at: expires_at.toISOString(),
-      created_at: new Date().toISOString(),
-      allow_user_uploads,
-      upload_category_id
-    });
-    
-    // Log activity
-    await logActivity('event_created', 
-      { event_type, expires_at }, 
-      eventId, 
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    // Queue creation email
-    // Determine language based on email domain
-    const emailLang = host_email.endsWith('.de') ? 'de' : 'en';
-    
-    await db('email_queue').insert({
-      event_id: eventId,
-      recipient_email: host_email,
-      email_type: 'gallery_created',
-      email_data: JSON.stringify({
-        host_name: host_name,
-        event_name,
-        event_date: await formatDate(event_date, emailLang),
-        gallery_link: shareLink,
-        gallery_password: password,
-        expiry_date: await formatDate(expires_at, emailLang),
-        welcome_message: welcome_message || ''
-      })
-      // scheduled_at will use default value
-    });
-    
-    res.json({
-      id: eventId,
-      slug,
-      event_name,
-      event_type,
-      share_link: shareLink,
-      expires_at: expires_at.toISOString(),
-      created_at: new Date().toISOString()
-    });
-  } catch (error) {
-    console.error('Error creating event:', error);
-    res.status(500).json({ error: 'Failed to create event' });
-  }
-});
-
-// Get all events with pagination and filters
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const page = parseInt(req.query.page) || 1;
-    const limit = parseInt(req.query.limit) || 20;
-    const offset = (page - 1) * limit;
-    const search = req.query.search || '';
-    const status = req.query.status || 'all';
-    const sortBy = req.query.sortBy || 'created_at';
-    const sortOrder = req.query.sortOrder || 'desc';
-
-    // Build query
-    let query = db('events');
-    
-    // Apply search filter
-    if (search) {
-      const escapedSearch = escapeLikePattern(search);
-      query = query.where((builder) => {
-        builder.where('event_name', 'like', `%${escapedSearch}%`)
-          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
-          .orWhere('slug', 'like', `%${escapedSearch}%`);
-      });
-    }
-
-    // Apply status filter
-    if (status === 'active') {
-      query = query.where('is_active', true).where('is_archived', false);
-    } else if (status === 'archived') {
-      query = query.where('is_archived', true);
-    } else if (status === 'inactive') {
-      query = query.where('is_active', false).where('is_archived', false);
-    } else if (status === 'expiring') {
-      const sevenDaysFromNow = new Date();
-      sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
-      query = query
-        .where('is_active', true)
-        .where('is_archived', false)
-        .where('expires_at', '<=', sevenDaysFromNow.toISOString())
-        .where('expires_at', '>', new Date().toISOString());
-    }
-
-    // Get total count for pagination
-    const countQuery = query.clone();
-    const [{ count }] = await countQuery.count('* as count');
-
-    // Apply sorting and pagination
-    const events = await query
-      .orderBy(sortBy, sortOrder)
-      .limit(limit)
-      .offset(offset);
-
-    // Get photo counts for each event
-    const eventIds = events.map(e => e.id);
-    const photoCounts = await db('photos')
-      .whereIn('event_id', eventIds)
-      .groupBy('event_id')
-      .select('event_id')
-      .count('* as count');
-
-    // Map photo counts to events
-    const photoCountMap = photoCounts.reduce((acc, { event_id, count }) => {
-      acc[event_id] = parseInt(count);
-      return acc;
-    }, {});
-
-    // Add photo counts to events and convert dates
-    const eventsWithCounts = events.map(event => ({
-      ...event,
-      photo_count: photoCountMap[event.id] || 0,
-      // Convert Unix timestamps to ISO strings
-      created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
-      expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
-      archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
-    }));
-
-    res.json({
-      events: eventsWithCounts,
-      pagination: {
-        page,
-        limit,
-        total: parseInt(count),
-        totalPages: Math.ceil(count / limit)
-      }
-    });
-  } catch (error) {
-    console.error('Error fetching events:', error);
-    res.status(500).json({ error: 'Failed to fetch events' });
-  }
-});
-
-// Get single event details
-router.get('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    
-    const event = await db('events')
-      .where('id', id)
-      .first();
-
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    // Get photo count
-    const [{ count: photoCount }] = await db('photos')
-      .where('event_id', id)
-      .count('* as count');
-
-    // Get total size
-    const [{ totalSize }] = await db('photos')
-      .where('event_id', id)
-      .sum('size_bytes as totalSize');
-
-    // Get recent photos
-    const recentPhotos = await db('photos')
-      .where('event_id', id)
-      .orderBy('uploaded_at', 'desc')
-      .limit(10)
-      .select('filename', 'type', 'size_bytes', 'uploaded_at');
-
-    // Get view and download statistics
-    const [{ totalViews }] = await db('access_logs')
-      .where('event_id', id)
-      .where('action', 'view')
-      .count('* as totalViews');
-
-    const [{ totalDownloads }] = await db('access_logs')
-      .where('event_id', id)
-      .where('action', 'download')
-      .count('* as totalDownloads');
-
-    const [{ uniqueVisitors }] = await db('access_logs')
-      .where('event_id', id)
-      .countDistinct('ip_address as uniqueVisitors');
-
-    res.json({
-      ...event,
-      photo_count: parseInt(photoCount) || 0,
-      total_size: parseInt(totalSize) || 0,
-      total_views: parseInt(totalViews) || 0,
-      total_downloads: parseInt(totalDownloads) || 0,
-      unique_visitors: parseInt(uniqueVisitors) || 0,
-      recent_photos: recentPhotos
-    });
-  } catch (error) {
-    console.error('Error fetching event:', error);
-    res.status(500).json({ error: 'Failed to fetch event details' });
-  }
-});
-
-// Update event
-router.put('/:id', adminAuth, [
-  body('event_name').optional().trim().notEmpty(),
-  body('admin_email').optional().isEmail(),
-  body('is_active').optional().isBoolean(),
-  body('expires_at').optional().isISO8601(),
-  body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
-  body('color_theme').optional({ nullable: true }),
-  body('allow_user_uploads').optional().isBoolean(),
-  body('host_name').optional().trim().notEmpty(),
-  body('upload_category_id').optional().custom((value) => {
-    // Accept null, undefined, or integer values
-    if (value === null || value === undefined) return true;
-    return Number.isInteger(Number(value));
-  }).withMessage('upload_category_id must be an integer or null'),
-  body('hero_photo_id').optional().custom((value) => {
-    // Accept null, undefined, or numeric values
-    if (value === null || value === undefined) return true;
-    // Check if it's a number or can be converted to a valid integer
-    const num = Number(value);
-    return !isNaN(num) && Number.isInteger(num);
-  }).withMessage('hero_photo_id must be an integer or null')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      console.log('Update event validation errors:', JSON.stringify(errors.array(), null, 2));
-      console.log('Request body:', req.body);
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const { id } = req.params;
-    const updates = req.body;
-
-    // Log the update request for debugging
-    console.log('Update event request:', {
-      id,
-      updates,
-      color_theme_length: updates.color_theme ? updates.color_theme.length : 0,
-      color_theme_type: typeof updates.color_theme,
-      hero_photo_id: updates.hero_photo_id,
-      hero_photo_id_type: typeof updates.hero_photo_id
-    });
-
-    // Check if event exists
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    // Update event
-    await db('events')
-      .where('id', id)
-      .update(updates);
-
-    // Log activity
-    await logActivity('event_updated',
-      { changes: Object.keys(updates), eventName: event.event_name },
-      id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ message: 'Event updated successfully' });
-  } catch (error) {
-    console.error('Error updating event:', error);
-    res.status(500).json({ error: 'Failed to update event' });
-  }
-});
-
-// Delete event
-router.delete('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-
-    // Check if event exists
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    // Delete associated photos
-    await db('photos').where('event_id', id).del();
-
-    // Delete event
-    await db('events').where('id', id).del();
-
-    // Log activity
-    await logActivity('event_deleted',
-      { event_name: event.event_name },
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ message: 'Event deleted successfully' });
-  } catch (error) {
-    console.error('Error deleting event:', error);
-    res.status(500).json({ error: 'Failed to delete event' });
-  }
-});
-
-// Toggle event status
-router.post('/:id/toggle-status', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    const newStatus = !event.is_active;
-    await db('events')
-      .where('id', id)
-      .update({
-        is_active: newStatus,
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await logActivity(newStatus ? 'event_activated' : 'event_deactivated',
-      { eventName: event.event_name },
-      id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ 
-      message: `Event ${newStatus ? 'activated' : 'deactivated'} successfully`,
-      is_active: newStatus
-    });
-  } catch (error) {
-    console.error('Error toggling event status:', error);
-    res.status(500).json({ error: 'Failed to toggle event status' });
-  }
-});
-
-// Reset event password
-router.post('/:id/reset-password', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    const { sendEmail = true } = req.body;
-
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    if (event.is_archived) {
-      return res.status(400).json({ error: 'Cannot reset password for archived event' });
-    }
-
-    // Generate new password
-    const { generatePassword } = require('../utils/passwordGenerator');
-    const newPassword = generatePassword();
-    const passwordHash = await bcrypt.hash(newPassword, 10);
-
-    // Update event with new password
-    await db('events')
-      .where('id', id)
-      .update({
-        password_hash: passwordHash,
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await logActivity('password_reset',
-      { eventName: event.event_name, emailSent: sendEmail },
-      id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    // Queue email notification if requested
-    if (sendEmail) {
-      const { queueEmail } = require('../services/emailProcessor');
-      // For password reset, we'll need to create a template or use a different approach
-      // For now, let's use the gallery_created template with updated password
-      await queueEmail(id, event.host_email, 'gallery_created', {
-        host_name: event.host_email.split('@')[0],
-        event_name: event.event_name,
-        event_date: new Date(event.event_date).toLocaleDateString(),
-        gallery_link: event.share_link,
-        gallery_password: newPassword,
-        expiry_date: new Date(event.expires_at).toLocaleDateString()
-      });
-    }
-
-    res.json({ 
-      message: 'Password reset successfully',
-      newPassword: newPassword,
-      emailSent: sendEmail
-    });
-  } catch (error) {
-    console.error('Error resetting password:', error);
-    res.status(500).json({ error: 'Failed to reset password' });
-  }
-});
-
-// Archive event
-router.post('/:id/archive', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    if (event.is_archived) {
-      return res.status(400).json({ error: 'Event is already archived' });
-    }
-
-    // Use the archive service to create ZIP archive
-    await archiveEvent(event);
-
-    // Log activity
-    await logActivity('event_archived',
-      { eventName: event.event_name },
-      id,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ message: 'Event archived successfully' });
-  } catch (error) {
-    console.error('Error archiving event:', error);
-    res.status(500).json({ error: 'Failed to archive event' });
-  }
-});
-
-// Bulk archive events
-router.post('/bulk-archive', adminAuth, [
-  body('eventIds').isArray().withMessage('eventIds must be an array'),
-  body('eventIds.*').isInt().withMessage('Each eventId must be an integer')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const { eventIds } = req.body;
-    
-    if (eventIds.length === 0) {
-      return res.status(400).json({ error: 'No events selected for archiving' });
-    }
-
-    // Get all events to archive
-    const events = await db('events')
-      .whereIn('id', eventIds)
-      .where('is_archived', false);
-
-    if (events.length === 0) {
-      return res.status(400).json({ error: 'No valid events found to archive' });
-    }
-
-    const results = {
-      successful: [],
-      failed: []
-    };
-
-    // Process each event
-    for (const event of events) {
-      try {
-        // Use the archive service to create ZIP archive
-        await archiveEvent(event);
-        
-        // Log activity
-        await logActivity('event_archived',
-          { eventName: event.event_name, bulkOperation: true },
-          event.id,
-          { type: 'admin', id: req.admin.id, name: req.admin.username }
-        );
-        
-        results.successful.push({
-          id: event.id,
-          name: event.event_name
-        });
-      } catch (error) {
-        console.error(`Failed to archive event ${event.id}:`, error);
-        results.failed.push({
-          id: event.id,
-          name: event.event_name,
-          error: error.message
-        });
-      }
-    }
-
-    // Log bulk archive activity
-    await logActivity('bulk_archive_completed',
-      { 
-        totalEvents: eventIds.length,
-        successfulCount: results.successful.length,
-        failedCount: results.failed.length
-      },
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({
-      message: `Bulk archive completed: ${results.successful.length} succeeded, ${results.failed.length} failed`,
-      results
-    });
-  } catch (error) {
-    console.error('Error in bulk archive:', error);
-    res.status(500).json({ error: 'Failed to perform bulk archive' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminNotifications.js

@@ -1,109 +0,0 @@
-const express = require('express');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const router = express.Router();
-
-// Get notifications (unread activity logs)
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const { limit = 20, includeRead = false } = req.query;
-
-    let query = db('activity_logs')
-      .select(
-        'activity_logs.*',
-        'events.event_name'
-      )
-      .leftJoin('events', 'activity_logs.event_id', 'events.id')
-      .orderBy('activity_logs.created_at', 'desc')
-      .limit(parseInt(limit));
-    
-    // By default, only show unread notifications
-    if (includeRead !== 'true') {
-      query = query.whereNull('activity_logs.read_at');
-    }
-
-    const notifications = await query;
-
-    // Format notifications
-    const formattedNotifications = notifications.map(notification => ({
-      id: notification.id,
-      type: notification.activity_type,
-      actorType: notification.actor_type,
-      actorName: notification.actor_name,
-      eventName: notification.event_name,
-      eventId: notification.event_id,
-      metadata: notification.metadata ? JSON.parse(notification.metadata) : {},
-      createdAt: notification.created_at,
-      readAt: notification.read_at,
-      isRead: !!notification.read_at
-    }));
-
-    // Get unread count
-    const unreadCount = await db('activity_logs')
-      .whereNull('read_at')
-      .count('id as count')
-      .first();
-
-    res.json({
-      notifications: formattedNotifications,
-      unreadCount: unreadCount.count || 0
-    });
-  } catch (error) {
-    console.error('Notifications fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch notifications' });
-  }
-});
-
-// Mark notification as read
-router.put('/:id/read', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-
-    await db('activity_logs')
-      .where('id', id)
-      .update({
-        read_at: new Date()
-      });
-
-    res.json({ message: 'Notification marked as read' });
-  } catch (error) {
-    console.error('Mark notification read error:', error);
-    res.status(500).json({ error: 'Failed to mark notification as read' });
-  }
-});
-
-// Mark all notifications as read
-router.put('/read-all', adminAuth, async (req, res) => {
-  try {
-    await db('activity_logs')
-      .whereNull('read_at')
-      .update({
-        read_at: new Date()
-      });
-
-    res.json({ message: 'All notifications marked as read' });
-  } catch (error) {
-    console.error('Mark all notifications read error:', error);
-    res.status(500).json({ error: 'Failed to mark all notifications as read' });
-  }
-});
-
-// Delete old notifications (older than 30 days and read)
-router.delete('/clear-old', adminAuth, async (req, res) => {
-  try {
-    const deletedCount = await db('activity_logs')
-      .whereNotNull('read_at')
-      .where('created_at', '<', db.raw("datetime('now', '-30 days')"))
-      .delete();
-
-    res.json({ 
-      message: 'Old notifications cleared',
-      deletedCount 
-    });
-  } catch (error) {
-    console.error('Clear old notifications error:', error);
-    res.status(500).json({ error: 'Failed to clear old notifications' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminPhotos.js

@@ -1,598 +0,0 @@
-const express = require('express');
-const multer = require('multer');
-const path = require('path');
-const fs = require('fs').promises;
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
-const { generateThumbnail } = require('../services/imageProcessor');
-const { generatePhotoFilename } = require('../utils/filenameSanitizer');
-const { escapeLikePattern } = require('../utils/sqlSecurity');
-const router = express.Router();
-
-// Get storage path from environment or default
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-
-// Configure multer for file uploads
-const storage = multer.diskStorage({
-  destination: async (req, file, cb) => {
-    console.log('Multer destination called for file:', file.originalname);
-    const { eventId } = req.params;
-    
-    try {
-      // Get event details
-      const event = await db('events').where({ id: eventId }).first();
-      if (!event) {
-        console.error('Event not found in multer destination:', eventId);
-        return cb(new Error('Event not found'));
-      }
-      
-      // Store event in request for use in filename generation
-      req.eventData = event;
-      
-      // Create destination path - now just event folder, no type subfolder
-      const destPath = path.join(getStoragePath(), 'events/active', event.slug);
-      console.log('Destination path:', destPath);
-      
-      // Ensure directory exists
-      await fs.mkdir(destPath, { recursive: true });
-      
-      cb(null, destPath);
-    } catch (error) {
-      console.error('Error in multer destination:', error);
-      cb(error);
-    }
-  },
-  filename: async (req, file, cb) => {
-    console.log('Multer filename called for file:', file.originalname);
-    try {
-      // Use temporary filename for now, will rename after getting category info
-      const tempName = `temp_${Date.now()}_${Math.round(Math.random() * 1E9)}${path.extname(file.originalname)}`;
-      console.log('Temp filename:', tempName);
-      cb(null, tempName);
-    } catch (error) {
-      console.error('Error in multer filename:', error);
-      cb(error);
-    }
-  }
-});
-
-const { validateFileType } = require('../utils/fileSecurityUtils');
-
-const upload = multer({
-  storage: storage,
-  limits: {
-    fileSize: 50 * 1024 * 1024, // 50MB limit
-  },
-  fileFilter: (req, file, cb) => {
-    // Accept images only with proper validation
-    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
-    
-    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
-      return cb(null, true);
-    } else {
-      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
-    }
-  }
-});
-
-const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
-
-// Create content validator middleware
-const validateUploadContent = createFileUploadValidator({
-  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
-  maxFileSize: 50 * 1024 * 1024,
-  validateContent: true
-});
-
-// Upload photos for an event
-router.post('/:eventId/upload', adminAuth, (req, res, next) => {
-  upload.array('photos', 20)(req, res, (err) => {
-    if (err) {
-      console.error('Multer error:', err);
-      if (err instanceof multer.MulterError) {
-        if (err.code === 'LIMIT_FILE_SIZE') {
-          return res.status(400).json({ error: 'File too large. Maximum size is 50MB.' });
-        }
-        return res.status(400).json({ error: `Upload error: ${err.message}` });
-      }
-      return res.status(400).json({ error: err.message || 'Upload failed' });
-    }
-    next();
-  });
-}, validateUploadContent, async (req, res) => {
-  try {
-    const { eventId } = req.params;
-    const { category_id } = req.body;
-    
-    console.log('Upload request received for event:', eventId);
-    console.log('Body:', req.body);
-    console.log('Files:', req.files ? req.files.length : 'none');
-    console.log('File details:', req.files?.map(f => ({ name: f.originalname, size: f.size, mimetype: f.mimetype })));
-    console.log('Category ID received:', category_id);
-    
-    // Verify event exists and admin has access
-    const event = await db('events').where({ id: eventId }).first();
-    if (!event) {
-      console.error('Event not found:', eventId);
-      return res.status(404).json({ error: 'Event not found' });
-    }
-    
-    if (!req.files || req.files.length === 0) {
-      console.error('No files in request. req.files:', req.files);
-      console.error('Request body keys:', Object.keys(req.body));
-      return res.status(400).json({ error: 'No files uploaded' });
-    }
-    
-    // Parse category_id to number if provided
-    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
-    
-    // Get category details if provided
-    let category = null;
-    if (parsedCategoryId) {
-      category = await db('photo_categories').where({ id: parsedCategoryId }).first();
-      if (!category) {
-        return res.status(400).json({ error: 'Invalid category' });
-      }
-    }
-    
-    const uploadedPhotos = [];
-    
-    // Process each uploaded file
-    for (const file of req.files) {
-      let trx;
-      try {
-        // Start transaction for atomic counter update
-        trx = await db.transaction();
-        
-        // Get and increment the counter for this category
-        let counter = 1;
-        if (category) {
-          // Lock the category row and get current counter
-          const categoryData = await trx('photo_categories')
-            .where({ id: parsedCategoryId })
-            .forUpdate()
-            .first();
-          
-          counter = (categoryData.photo_counter || 0) + 1;
-          
-          // Update counter
-          await trx('photo_categories')
-            .where({ id: parsedCategoryId })
-            .update({ photo_counter: counter });
-        } else {
-          // For uncategorized photos, count existing uncategorized photos
-          const uncategorizedCount = await trx('photos')
-            .where({ event_id: eventId })
-            .whereNull('category_id')
-            .count('id as count')
-            .first();
-          
-          counter = (uncategorizedCount.count || 0) + 1;
-        }
-        
-        // Generate new filename
-        const extension = path.extname(file.originalname);
-        const newFilename = generatePhotoFilename(
-          event.event_name,
-          category ? category.name : 'uncategorized',
-          counter,
-          extension
-        );
-        
-        // Rename the file
-        const oldPath = file.path;
-        const newPath = path.join(path.dirname(oldPath), newFilename);
-        await fs.rename(oldPath, newPath);
-        
-        // Update file object
-        file.filename = newFilename;
-        file.path = newPath;
-        
-        // Generate thumbnail with new filename
-        const thumbnailPath = await generateThumbnail(file.path);
-        
-        // Calculate relative paths
-        const storagePath = getStoragePath();
-        const relativePath = path.relative(path.join(storagePath, 'events/active'), file.path);
-        const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
-        
-        // Add to database
-        const [photoId] = await trx('photos').insert({
-          event_id: eventId,
-          filename: file.filename,
-          path: relativePath,
-          thumbnail_path: relativeThumbPath,
-          category_id: parsedCategoryId || null,
-          type: 'individual', // Keep for backwards compatibility
-          size_bytes: file.size
-        });
-        
-        // Commit transaction
-        await trx.commit();
-        
-        uploadedPhotos.push({
-          id: photoId,
-          filename: file.filename,
-          size: file.size,
-          category_id: parsedCategoryId || null
-        });
-      } catch (error) {
-        console.error(`Error processing file ${file.filename}:`, error);
-        if (trx) await trx.rollback();
-        // Continue with other files
-      }
-    }
-    
-    // Log activity
-    await logActivity('photos_uploaded',
-      { count: uploadedPhotos.length, eventName: event.event_name },
-      eventId,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({
-      message: `Successfully uploaded ${uploadedPhotos.length} photos`,
-      photos: uploadedPhotos
-    });
-  } catch (error) {
-    console.error('Error uploading photos:', error);
-    res.status(500).json({ error: 'Failed to upload photos' });
-  }
-});
-
-// Delete a photo
-router.delete('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
-  try {
-    const { eventId, photoId } = req.params;
-    
-    // Get photo details
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: eventId })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Delete physical files
-    const storagePath = getStoragePath();
-    const photoPath = path.join(storagePath, 'events/active', photo.path);
-    
-    try {
-      await fs.unlink(photoPath);
-    } catch (error) {
-      console.error('Error deleting photo file:', error);
-    }
-    
-    // Delete thumbnail if exists
-    if (photo.thumbnail_path) {
-      const thumbPath = path.join(storagePath, 'events/active', photo.thumbnail_path);
-      try {
-        await fs.unlink(thumbPath);
-      } catch (error) {
-        console.error('Error deleting thumbnail:', error);
-      }
-    }
-    
-    // Remove from database
-    await db('photos').where({ id: photoId }).delete();
-    
-    // Log activity
-    const event = await db('events').where({ id: eventId }).first();
-    await logActivity('photo_deleted',
-      { filename: photo.filename, eventName: event.event_name },
-      eventId,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({ message: 'Photo deleted successfully' });
-  } catch (error) {
-    console.error('Error deleting photo:', error);
-    res.status(500).json({ error: 'Failed to delete photo' });
-  }
-});
-
-// Update a photo (e.g., change category)
-router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
-  try {
-    const { eventId, photoId } = req.params;
-    const { category_id } = req.body;
-    
-    // Verify photo belongs to event
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: eventId })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Update photo
-    await db('photos')
-      .where({ id: photoId })
-      .update({ category_id: category_id || null });
-    
-    res.json({ message: 'Photo updated successfully' });
-  } catch (error) {
-    console.error('Error updating photo:', error);
-    res.status(500).json({ error: 'Failed to update photo' });
-  }
-});
-
-// Bulk delete photos
-router.post('/:eventId/photos/bulk-delete', adminAuth, async (req, res) => {
-  try {
-    const { eventId } = req.params;
-    const { photoIds } = req.body;
-    
-    if (!Array.isArray(photoIds) || photoIds.length === 0) {
-      return res.status(400).json({ error: 'Invalid photo IDs' });
-    }
-    
-    // Get all photos to delete
-    const photos = await db('photos')
-      .whereIn('id', photoIds)
-      .where('event_id', eventId);
-    
-    if (photos.length === 0) {
-      return res.status(404).json({ error: 'No photos found' });
-    }
-    
-    // Delete physical files
-    const storagePath = getStoragePath();
-    const event = await db('events').where({ id: eventId }).first();
-    
-    for (const photo of photos) {
-      // Delete photo file
-      const photoPath = path.join(storagePath, 'events/active', photo.path);
-      try {
-        await fs.unlink(photoPath);
-      } catch (error) {
-        console.error('Error deleting photo file:', error);
-      }
-      
-      // Delete thumbnail
-      if (photo.thumbnail_path) {
-        const thumbPath = path.join(storagePath, photo.thumbnail_path);
-        try {
-          await fs.unlink(thumbPath);
-        } catch (error) {
-          console.error('Error deleting thumbnail:', error);
-        }
-      }
-    }
-    
-    // Delete from database
-    await db('photos')
-      .whereIn('id', photoIds)
-      .where('event_id', eventId)
-      .delete();
-    
-    // Log activity
-    await logActivity('photos_bulk_deleted',
-      { count: photos.length, eventName: event.event_name },
-      eventId,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-    
-    res.json({ message: `${photos.length} photos deleted successfully` });
-  } catch (error) {
-    console.error('Error bulk deleting photos:', error);
-    res.status(500).json({ error: 'Failed to delete photos' });
-  }
-});
-
-// Bulk update photos
-router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
-  try {
-    const { eventId } = req.params;
-    const { photoIds, updates } = req.body;
-    
-    if (!Array.isArray(photoIds) || photoIds.length === 0) {
-      return res.status(400).json({ error: 'Invalid photo IDs' });
-    }
-    
-    // Verify all photos belong to the event
-    const photoCount = await db('photos')
-      .whereIn('id', photoIds)
-      .where('event_id', eventId)
-      .count('id as count')
-      .first();
-    
-    if (photoCount.count !== photoIds.length) {
-      return res.status(400).json({ error: 'Some photos do not belong to this event' });
-    }
-    
-    // Update photos
-    const updateData = {};
-    if (updates.category_id !== undefined) {
-      updateData.category_id = updates.category_id || null;
-    }
-    
-    await db('photos')
-      .whereIn('id', photoIds)
-      .where('event_id', eventId)
-      .update(updateData);
-    
-    res.json({ message: `${photoIds.length} photos updated successfully` });
-  } catch (error) {
-    console.error('Error bulk updating photos:', error);
-    res.status(500).json({ error: 'Failed to update photos' });
-  }
-});
-
-// Download a photo
-router.get('/:eventId/photos/:photoId/download', adminAuth, async (req, res) => {
-  try {
-    const { eventId, photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: eventId })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    const storagePath = getStoragePath();
-    const filePath = path.join(storagePath, 'events/active', photo.path);
-    
-    // Check if file exists
-    try {
-      await fs.access(filePath);
-    } catch (error) {
-      return res.status(404).json({ error: 'Photo file not found' });
-    }
-    
-    // Send file
-    res.download(filePath, photo.filename);
-  } catch (error) {
-    console.error('Error downloading photo:', error);
-    res.status(500).json({ error: 'Failed to download photo' });
-  }
-});
-
-// Get all photos for an event
-router.get('/:eventId/photos', adminAuth, async (req, res) => {
-  try {
-    const { eventId } = req.params;
-    const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
-    
-    let query = db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
-      .where({ 'photos.event_id': eventId })
-      .select(
-        'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
-      );
-    
-    // Filter by category (including uncategorized)
-    if (category_id !== undefined) {
-      if (category_id === '' || category_id === '0') {
-        query = query.whereNull('photos.category_id');
-      } else {
-        query = query.where({ 'photos.category_id': category_id });
-      }
-    }
-    
-    // Keep type filter for backwards compatibility
-    if (type) {
-      query = query.where({ 'photos.type': type });
-    }
-    
-    // Search by filename
-    if (search) {
-      const escapedSearch = escapeLikePattern(search);
-      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
-    }
-    
-    // Sorting
-    let orderByColumn = 'photos.uploaded_at';
-    if (sort === 'name') {
-      orderByColumn = 'photos.filename';
-    } else if (sort === 'size') {
-      orderByColumn = 'photos.size_bytes';
-    }
-    
-    const photos = await query.orderBy(orderByColumn, order);
-    
-    res.json({
-      photos: photos.map(photo => ({
-        id: photo.id,
-        filename: photo.filename,
-        url: `/api/admin/events/${eventId}/photo/${photo.id}`,
-        thumbnail_url: photo.thumbnail_path ? `/api/admin/events/${eventId}/thumbnail/${photo.id}` : null,
-        type: photo.type,
-        category_id: photo.category_id,
-        category_name: photo.category_name,
-        category_slug: photo.category_slug,
-        size: photo.size_bytes,
-        uploaded_at: photo.uploaded_at
-      }))
-    });
-  } catch (error) {
-    console.error('Error fetching photos:', error);
-    res.status(500).json({ error: 'Failed to fetch photos' });
-  }
-});
-
-// Serve photo with admin authentication
-router.get('/:eventId/photo/:photoId', adminAuth, async (req, res) => {
-  try {
-    const { eventId, photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: eventId })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    const storagePath = getStoragePath();
-    const filePath = path.join(storagePath, 'events/active', photo.path);
-    
-    // Check if file exists
-    try {
-      await fs.access(filePath);
-    } catch (error) {
-      return res.status(404).json({ error: 'Photo file not found' });
-    }
-    
-    // Set appropriate headers
-    res.setHeader('Content-Type', `image/${path.extname(photo.filename).slice(1)}`);
-    res.setHeader('Cache-Control', 'private, max-age=3600');
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    
-    // Send file (sendFile requires absolute path)
-    res.sendFile(path.resolve(filePath));
-  } catch (error) {
-    console.error('Error serving photo:', error);
-    res.status(500).json({ error: 'Failed to serve photo' });
-  }
-});
-
-// Serve thumbnail with admin authentication
-router.get('/:eventId/thumbnail/:photoId', adminAuth, async (req, res) => {
-  try {
-    const { eventId, photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: eventId })
-      .first();
-    
-    if (!photo || !photo.thumbnail_path) {
-      console.error(`Thumbnail not found for photo ${photoId}, event ${eventId}`);
-      return res.status(404).json({ error: 'Thumbnail not found' });
-    }
-    
-    const storagePath = getStoragePath();
-    const filePath = path.join(storagePath, photo.thumbnail_path);
-    
-    console.log(`Attempting to serve thumbnail: ${filePath}`);
-    
-    // Check if file exists
-    try {
-      await fs.access(filePath);
-    } catch (error) {
-      console.error(`Thumbnail file not found: ${filePath}`, error);
-      return res.status(404).json({ error: 'Thumbnail file not found' });
-    }
-    
-    // Set appropriate headers
-    res.setHeader('Content-Type', `image/${path.extname(photo.thumbnail_path).slice(1)}`);
-    res.setHeader('Cache-Control', 'private, max-age=3600');
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    
-    // Send file (sendFile requires absolute path)
-    res.sendFile(path.resolve(filePath));
-  } catch (error) {
-    console.error('Error serving thumbnail:', error);
-    console.error('Photo ID:', req.params.photoId);
-    console.error('Event ID:', req.params.eventId);
-    res.status(500).json({ error: 'Failed to serve thumbnail' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminSettings.js

@@ -1,580 +0,0 @@
-const express = require('express');
-const multer = require('multer');
-const path = require('path');
-const fs = require('fs').promises;
-const { body, validationResult } = require('express-validator');
-const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
-const { clearMaintenanceCache } = require('../middleware/maintenance');
-const router = express.Router();
-
-// Configure multer for logo uploads
-const storage = multer.diskStorage({
-  destination: async (req, file, cb) => {
-    const uploadDir = path.join(__dirname, '../../storage/uploads/logos');
-    await fs.mkdir(uploadDir, { recursive: true });
-    cb(null, uploadDir);
-  },
-  filename: (req, file, cb) => {
-    const ext = path.extname(file.originalname);
-    cb(null, `logo-${Date.now()}${ext}`);
-  }
-});
-
-const { validateFileType } = require('../utils/fileSecurityUtils');
-
-const upload = multer({
-  storage,
-  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
-  fileFilter: (req, file, cb) => {
-    // Note: SVG files are excluded from magic number validation for logos
-    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
-    
-    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
-      return cb(null, true);
-    } else {
-      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
-    }
-  }
-});
-
-// Configure multer for favicon uploads
-const faviconStorage = multer.diskStorage({
-  destination: async (req, file, cb) => {
-    const uploadDir = path.join(__dirname, '../../storage/uploads/favicons');
-    await fs.mkdir(uploadDir, { recursive: true });
-    cb(null, uploadDir);
-  },
-  filename: (req, file, cb) => {
-    const ext = path.extname(file.originalname);
-    cb(null, `favicon-${Date.now()}${ext}`);
-  }
-});
-
-const faviconUpload = multer({
-  storage: faviconStorage,
-  limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
-  fileFilter: (req, file, cb) => {
-    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
-    
-    // For ICO files, we can't use the standard validateFileType
-    if (file.mimetype === 'image/png') {
-      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
-        cb(null, true);
-      } else {
-        cb(new Error('Invalid PNG file'));
-      }
-    } else if (allowedMimeTypes.includes(file.mimetype) && 
-               (file.originalname.toLowerCase().endsWith('.ico') || 
-                file.originalname.toLowerCase().endsWith('.png'))) {
-      cb(null, true);
-    } else {
-      cb(new Error('Favicon must be PNG or ICO format'));
-    }
-  }
-});
-
-// Get all settings
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const settings = await db('app_settings').select('*');
-    
-    // Convert to object format
-    const settingsObject = {};
-    settings.forEach(setting => {
-      if (setting.setting_value) {
-        try {
-          // Try to parse as JSON first
-          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
-        } catch (e) {
-          // If it's not valid JSON, use the raw value
-          settingsObject[setting.setting_key] = setting.setting_value;
-        }
-      } else {
-        settingsObject[setting.setting_key] = null;
-      }
-    });
-
-    res.json(settingsObject);
-  } catch (error) {
-    console.error('Settings fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch settings' });
-  }
-});
-
-// Get settings by type
-router.get('/:type', adminAuth, async (req, res) => {
-  try {
-    const { type } = req.params;
-    const settings = await db('app_settings')
-      .where('setting_type', type)
-      .select('*');
-    
-    // Convert to object format
-    const settingsObject = {};
-    settings.forEach(setting => {
-      if (setting.setting_value) {
-        try {
-          // Try to parse as JSON first
-          settingsObject[setting.setting_key] = JSON.parse(setting.setting_value);
-        } catch (e) {
-          // If it's not valid JSON, use the raw value
-          settingsObject[setting.setting_key] = setting.setting_value;
-        }
-      } else {
-        settingsObject[setting.setting_key] = null;
-      }
-    });
-
-    res.json(settingsObject);
-  } catch (error) {
-    console.error('Settings fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch settings' });
-  }
-});
-
-// Update branding settings
-router.put('/branding', adminAuth, async (req, res) => {
-  try {
-    const {
-      company_name,
-      company_tagline,
-      support_email,
-      footer_text,
-      watermark_enabled,
-      watermark_position,
-      watermark_opacity,
-      watermark_size,
-      favicon_url,
-      logo_url,
-      watermark_logo_url
-    } = req.body;
-
-    const brandingSettings = {
-      company_name,
-      company_tagline,
-      support_email,
-      footer_text,
-      watermark_enabled,
-      watermark_position,
-      watermark_opacity,
-      watermark_size,
-      favicon_url,
-      logo_url,
-      watermark_logo_url
-    };
-
-    // Handle favicon deletion if empty string or null is provided
-    if (favicon_url === '' || favicon_url === null || favicon_url === undefined) {
-      // Get current favicon path to delete file
-      const currentFaviconSetting = await db('app_settings')
-        .where('setting_key', 'branding_favicon_url')
-        .first();
-      
-      if (currentFaviconSetting && currentFaviconSetting.setting_value) {
-        let currentFaviconUrl;
-        try {
-          // Try to parse as JSON first
-          currentFaviconUrl = JSON.parse(currentFaviconSetting.setting_value);
-        } catch (e) {
-          // If it's not valid JSON, use the raw value
-          currentFaviconUrl = currentFaviconSetting.setting_value;
-        }
-        
-        if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
-          // Delete the file from filesystem
-          const faviconPath = path.join(__dirname, '..', '..', 'storage', currentFaviconUrl.replace('/uploads/', ''));
-          try {
-            await fs.unlink(faviconPath);
-            console.log('Deleted favicon file:', faviconPath);
-          } catch (err) {
-            console.error('Error deleting favicon file:', err);
-          }
-        }
-      }
-    }
-
-    // Handle logo deletion if empty string or null is provided
-    if (logo_url === '' || logo_url === null || logo_url === undefined) {
-      // Get current logo path to delete file
-      const currentLogoSetting = await db('app_settings')
-        .where('setting_key', 'branding_logo_url')
-        .first();
-      
-      if (currentLogoSetting && currentLogoSetting.setting_value) {
-        let currentLogoUrl;
-        try {
-          // Try to parse as JSON first
-          currentLogoUrl = JSON.parse(currentLogoSetting.setting_value);
-        } catch (e) {
-          // If it's not valid JSON, use the raw value
-          currentLogoUrl = currentLogoSetting.setting_value;
-        }
-        
-        if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
-          // Delete the file from filesystem
-          const logoPath = path.join(__dirname, '..', '..', 'storage', currentLogoUrl.replace('/uploads/', ''));
-          try {
-            await fs.unlink(logoPath);
-            console.log('Deleted logo file:', logoPath);
-          } catch (err) {
-            console.error('Error deleting logo file:', err);
-          }
-        }
-      }
-    }
-
-    // Update or insert each setting
-    for (const [key, value] of Object.entries(brandingSettings)) {
-      await db('app_settings')
-        .insert({
-          setting_key: `branding_${key}`,
-          setting_value: JSON.stringify(value),
-          setting_type: 'branding',
-          updated_at: new Date()
-        })
-        .onConflict('setting_key')
-        .merge({
-          setting_value: JSON.stringify(value),
-          updated_at: new Date()
-        });
-    }
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'branding_updated',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      metadata: JSON.stringify({ company_name })
-    });
-
-    res.json({ message: 'Branding settings updated successfully' });
-  } catch (error) {
-    console.error('Branding update error:', error);
-    res.status(500).json({ error: 'Failed to update branding settings' });
-  }
-});
-
-// Upload logo
-router.post('/logo', adminAuth, upload.single('logo'), async (req, res) => {
-  try {
-    if (!req.file) {
-      return res.status(400).json({ error: 'No logo file uploaded' });
-    }
-
-    // Get old logo to delete
-    const oldLogoSetting = await db('app_settings')
-      .where('setting_key', 'branding_logo_path')
-      .first();
-
-    if (oldLogoSetting && oldLogoSetting.setting_value) {
-      const oldPath = JSON.parse(oldLogoSetting.setting_value);
-      try {
-        await fs.unlink(oldPath);
-      } catch (error) {
-        console.error('Failed to delete old logo:', error);
-      }
-    }
-
-    // Save new logo path
-    const logoPath = req.file.path;
-    const publicPath = `/uploads/logos/${req.file.filename}`;
-
-    await db('app_settings')
-      .insert({
-        setting_key: 'branding_logo_path',
-        setting_value: JSON.stringify(logoPath),
-        setting_type: 'branding',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: JSON.stringify(logoPath),
-        updated_at: new Date()
-      });
-
-    // Save public URL
-    await db('app_settings')
-      .insert({
-        setting_key: 'branding_logo_url',
-        setting_value: publicPath,
-        setting_type: 'branding',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: publicPath,
-        updated_at: new Date()
-      });
-
-    res.json({ 
-      message: 'Logo uploaded successfully',
-      logoUrl: publicPath
-    });
-  } catch (error) {
-    console.error('Logo upload error:', error);
-    res.status(500).json({ error: 'Failed to upload logo' });
-  }
-});
-
-// Upload watermark logo
-router.post('/branding/watermark-logo', adminAuth, upload.single('watermarkLogo'), async (req, res) => {
-  try {
-    if (!req.file) {
-      return res.status(400).json({ error: 'No file uploaded' });
-    }
-
-    // Delete old watermark logo if exists
-    const oldWatermarkLogoSetting = await db('app_settings')
-      .where('setting_key', 'branding_watermark_logo_path')
-      .first();
-
-    if (oldWatermarkLogoSetting && oldWatermarkLogoSetting.setting_value) {
-      const oldPath = JSON.parse(oldWatermarkLogoSetting.setting_value);
-      try {
-        await fs.unlink(oldPath);
-      } catch (error) {
-        console.error('Failed to delete old watermark logo:', error);
-      }
-    }
-
-    // Save new watermark logo path
-    const logoPath = req.file.path;
-    const publicPath = `/uploads/logos/${req.file.filename}`;
-
-    await db('app_settings')
-      .insert({
-        setting_key: 'branding_watermark_logo_path',
-        setting_value: JSON.stringify(logoPath),
-        setting_type: 'branding',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: JSON.stringify(logoPath),
-        updated_at: new Date()
-      });
-
-    // Save public URL
-    await db('app_settings')
-      .insert({
-        setting_key: 'branding_watermark_logo_url',
-        setting_value: publicPath,
-        setting_type: 'branding',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: publicPath,
-        updated_at: new Date()
-      });
-
-    res.json({ 
-      message: 'Watermark logo uploaded successfully',
-      watermarkLogoUrl: publicPath
-    });
-  } catch (error) {
-    console.error('Watermark logo upload error:', error);
-    res.status(500).json({ error: 'Failed to upload watermark logo' });
-  }
-});
-
-// Update theme settings
-router.put('/theme', adminAuth, async (req, res) => {
-  try {
-    const themeSettings = req.body;
-
-    // Save theme settings
-    await db('app_settings')
-      .insert({
-        setting_key: 'theme_config',
-        setting_value: JSON.stringify(themeSettings),
-        setting_type: 'theme',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: JSON.stringify(themeSettings),
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'theme_updated',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      metadata: JSON.stringify({ theme_name: themeSettings.name || 'custom' })
-    });
-
-    res.json({ message: 'Theme settings updated successfully' });
-  } catch (error) {
-    console.error('Theme update error:', error);
-    res.status(500).json({ error: 'Failed to update theme settings' });
-  }
-});
-
-// Update general settings
-router.put('/general', adminAuth, async (req, res) => {
-  try {
-    const settings = req.body;
-
-    // Update or insert each setting
-    for (const [key, value] of Object.entries(settings)) {
-      await db('app_settings')
-        .insert({
-          setting_key: key,
-          setting_value: JSON.stringify(value),
-          setting_type: 'general',
-          updated_at: new Date()
-        })
-        .onConflict('setting_key')
-        .merge({
-          setting_value: JSON.stringify(value),
-          updated_at: new Date()
-        });
-    }
-    
-    // Clear maintenance mode cache if it was updated
-    if ('general_maintenance_mode' in settings) {
-      clearMaintenanceCache();
-    }
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'general_settings_updated',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
-    });
-
-    res.json({ message: 'General settings updated successfully' });
-  } catch (error) {
-    console.error('General settings update error:', error);
-    res.status(500).json({ error: 'Failed to update general settings' });
-  }
-});
-
-// Update security settings
-router.put('/security', adminAuth, async (req, res) => {
-  try {
-    const settings = req.body;
-
-    // Update or insert each setting
-    for (const [key, value] of Object.entries(settings)) {
-      await db('app_settings')
-        .insert({
-          setting_key: key,
-          setting_value: JSON.stringify(value),
-          setting_type: 'security',
-          updated_at: new Date()
-        })
-        .onConflict('setting_key')
-        .merge({
-          setting_value: JSON.stringify(value),
-          updated_at: new Date()
-        });
-    }
-
-    // Log activity
-    await db('activity_logs').insert({
-      activity_type: 'security_settings_updated',
-      actor_type: 'admin',
-      actor_id: req.admin.id,
-      actor_name: req.admin.username,
-      metadata: JSON.stringify({ settings_count: Object.keys(settings).length })
-    });
-
-    res.json({ message: 'Security settings updated successfully' });
-  } catch (error) {
-    console.error('Security settings update error:', error);
-    res.status(500).json({ error: 'Failed to update security settings' });
-  }
-});
-
-// Get storage info
-router.get('/storage/info', adminAuth, async (req, res) => {
-  try {
-    // Get total storage used
-    const totalStorage = await db('photos')
-      .sum('size_bytes as total')
-      .first();
-
-    // Get storage by event
-    const storageByEvent = await db('photos')
-      .select('events.event_name', 'events.id')
-      .sum('photos.size_bytes as size')
-      .join('events', 'photos.event_id', 'events.id')
-      .groupBy('events.id')
-      .orderBy('size', 'desc')
-      .limit(10);
-
-    // Get archive storage
-    const archives = await db('events')
-      .where('is_archived', true)
-      .whereNotNull('archive_path')
-      .select('archive_path');
-
-    let archiveStorage = 0;
-    for (const archive of archives) {
-      try {
-        const stats = await fs.stat(archive.archive_path);
-        archiveStorage += stats.size;
-      } catch (error) {
-        console.error('Archive file not found:', archive.archive_path);
-      }
-    }
-
-    res.json({
-      total_used: totalStorage.total || 0,
-      archive_storage: archiveStorage,
-      storage_by_event: storageByEvent,
-      storage_limit: 10 * 1024 * 1024 * 1024 // 10GB default
-    });
-  } catch (error) {
-    console.error('Storage info error:', error);
-    res.status(500).json({ error: 'Failed to fetch storage information' });
-  }
-});
-
-// Upload favicon endpoint
-router.post('/favicon', adminAuth, faviconUpload.single('favicon'), async (req, res) => {
-  try {
-    if (!req.file) {
-      return res.status(400).json({ error: 'No favicon file provided' });
-    }
-
-    // The file is already in the correct location from multer
-    const faviconUrl = `/uploads/favicons/${req.file.filename}`;
-    
-    // Save to database
-    await db('app_settings')
-      .insert({
-        setting_key: 'branding_favicon_url',
-        setting_value: faviconUrl,
-        setting_type: 'branding',
-        updated_at: new Date()
-      })
-      .onConflict('setting_key')
-      .merge({
-        setting_value: faviconUrl,
-        updated_at: new Date()
-      });
-
-    // Log activity
-    await logActivity('favicon_uploaded', 
-      { faviconUrl }, 
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json({ faviconUrl });
-  } catch (error) {
-    console.error('Error uploading favicon:', error);
-    res.status(500).json({ error: 'Failed to upload favicon' });
-  }
-});
-
-module.exports = router;

backend/src/routes/adminSystem.js

@@ -1,171 +0,0 @@
-const express = require('express');
-const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const fs = require('fs').promises;
-const path = require('path');
-const os = require('os');
-const router = express.Router();
-
-// Get system version
-router.get('/version', adminAuth, async (req, res) => {
-  try {
-    // Read backend version from package.json
-    let backendVersion = '1.0.0';
-    try {
-      const packagePath = path.join(__dirname, '../../package.json');
-      const packageContent = await fs.readFile(packagePath, 'utf8');
-      const packageJson = JSON.parse(packageContent);
-      backendVersion = packageJson.version || '1.0.0';
-    } catch (err) {
-      console.error('Could not read package.json:', err);
-    }
-    
-    res.json({
-      backend: backendVersion,
-      frontend: '1.0.0', // This will be set by frontend
-      node: process.version,
-      environment: process.env.NODE_ENV || 'production'
-    });
-  } catch (error) {
-    console.error('Error fetching version:', error);
-    res.status(500).json({ error: 'Failed to fetch version information' });
-  }
-});
-
-// Get comprehensive system status
-router.get('/status', adminAuth, async (req, res) => {
-  try {
-    // Database size
-    const dbPath = path.join(__dirname, '../../data/photo_sharing.db');
-    let dbSize = 0;
-    try {
-      const stats = await fs.stat(dbPath);
-      dbSize = stats.size;
-    } catch (error) {
-      console.error('Error getting database size:', error);
-    }
-
-    // Count various entities
-    const [eventsCount] = await db('events').count('* as count');
-    const [photosCount] = await db('photos').count('* as count');
-    const [adminsCount] = await db('admin_users').count('* as count');
-    const [categoriesCount] = await db('photo_categories').count('* as count');
-    
-    // Email queue status
-    const [pendingEmails] = await db('email_queue').where('status', 'pending').count('* as count');
-    const [sentEmails] = await db('email_queue').where('status', 'sent').count('* as count');
-    const [failedEmails] = await db('email_queue').where('status', 'failed').count('* as count');
-
-    // Activity logs count
-    const [activityCount] = await db('activity_logs').count('* as count');
-    
-    // System info
-    const systemInfo = {
-      platform: os.platform(),
-      arch: os.arch(),
-      hostname: os.hostname(),
-      uptime: Math.floor(process.uptime()),
-      nodeVersion: process.version,
-      memory: {
-        total: os.totalmem(),
-        free: os.freemem(),
-        used: os.totalmem() - os.freemem()
-      },
-      cpu: {
-        model: os.cpus()[0]?.model || 'Unknown',
-        cores: os.cpus().length
-      }
-    };
-
-    // Build response
-    const status = {
-      database: {
-        size: dbSize,
-        tables: {
-          events: eventsCount.count,
-          photos: photosCount.count,
-          admins: adminsCount.count,
-          categories: categoriesCount.count,
-          activityLogs: activityCount.count
-        }
-      },
-      emailQueue: {
-        pending: pendingEmails.count,
-        sent: sentEmails.count,
-        failed: failedEmails.count
-      },
-      system: systemInfo,
-      services: {
-        fileWatcher: { status: 'active' }, // These would ideally check actual service status
-        expirationChecker: { status: 'active' },
-        emailProcessor: { status: 'active' }
-      },
-      timestamp: new Date()
-    };
-
-    res.json(status);
-  } catch (error) {
-    console.error('Error fetching system status:', error);
-    res.status(500).json({ error: 'Failed to fetch system status' });
-  }
-});
-
-// Get database statistics
-router.get('/database', adminAuth, async (req, res) => {
-  try {
-    // Get table info
-    const tables = [
-      'events', 'photos', 'admin_users', 'photo_categories', 
-      'cms_pages', 'email_templates', 'email_queue', 'activity_logs',
-      'app_settings', 'email_configs', 'access_logs', 'migrations'
-    ];
-    
-    const tableInfo = [];
-    
-    for (const table of tables) {
-      try {
-        const [count] = await db(table).count('* as count');
-        
-        // Get last update time
-        let lastUpdate = null;
-        try {
-          const lastRow = await db(table)
-            .orderBy('updated_at', 'desc')
-            .orOrderBy('created_at', 'desc')
-            .orOrderBy('timestamp', 'desc')
-            .orOrderBy('applied_at', 'desc')
-            .first();
-          
-          if (lastRow) {
-            lastUpdate = lastRow.updated_at || lastRow.created_at || lastRow.timestamp || lastRow.applied_at;
-          }
-        } catch (e) {
-          // Table might not have timestamp columns
-        }
-        
-        tableInfo.push({
-          name: table,
-          rows: count.count,
-          lastUpdate
-        });
-      } catch (error) {
-        // Table might not exist
-        tableInfo.push({
-          name: table,
-          rows: 0,
-          error: error.message
-        });
-      }
-    }
-    
-    res.json({
-      tables: tableInfo,
-      timestamp: new Date()
-    });
-  } catch (error) {
-    console.error('Error fetching database info:', error);
-    res.status(500).json({ error: 'Failed to fetch database information' });
-  }
-});
-
-module.exports = router;

backend/src/routes/auth-enhanced-v2.js

@@ -1,374 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { body, validationResult } = require('express-validator');
-const { db } = require('../database/db');
-const { verifyRecaptcha } = require('../services/recaptcha');
-const { 
-  trackFailedAttempt,
-  trackSuccessfulLogin,
-  checkAccountLockout,
-  checkSuspiciousActivity,
-  getGenericAuthError
-} = require('../utils/authSecurity');
-const { 
-  validatePasswordInContext,
-  getBcryptRounds,
-  logPasswordValidationFailure
-} = require('../utils/passwordValidation');
-const { endSession } = require('../middleware/sessionTimeout');
-const logger = require('../utils/logger');
-const router = express.Router();
-
-// Admin login with enhanced security
-router.post('/admin/login', [
-  body('username').notEmpty().trim(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
-    const userAgent = req.headers['user-agent'] || '';
-    
-    // Check account lockout first
-    const lockoutStatus = await checkAccountLockout(username);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Login attempt on locked account', { username, ipAddress });
-      return res.status(423).json({ 
-        error: 'Account temporarily locked due to too many failed attempts',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    // Check for suspicious activity
-    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
-    if (isSuspicious) {
-      // Still allow login but log it
-      logger.warn('Suspicious login pattern detected', { username, ipAddress });
-    }
-    
-    const admin = await db('admin_users')
-      .where({ username })
-      .orWhere({ email: username })
-      .first();
-    
-    // Use generic error to prevent user enumeration
-    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(401).json({ error: getGenericAuthError() });
-    }
-    
-    if (!admin.is_active) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(401).json({ error: getGenericAuthError() });
-    }
-    
-    // Successful login
-    await trackSuccessfulLogin(username, ipAddress, userAgent);
-    
-    // Update last login and login metadata
-    await db('admin_users').where('id', admin.id).update({ 
-      last_login: new Date(),
-      last_login_ip: ipAddress
-    });
-    
-    // Generate token with additional claims
-    const token = jwt.sign({ 
-      id: admin.id,
-      username: admin.username,
-      type: 'admin',
-      ip: ipAddress,
-      loginTime: Date.now()
-    }, process.env.JWT_SECRET, { 
-      expiresIn: '24h',
-      issuer: 'picpeak-auth'
-    });
-    
-    res.json({
-      token,
-      user: {
-        id: admin.id,
-        username: admin.username,
-        email: admin.email,
-        mustChangePassword: admin.must_change_password || false
-      }
-    });
-  } catch (error) {
-    logger.error('Login error:', error);
-    res.status(500).json({ error: 'Login failed' });
-  }
-});
-
-// Admin password change with validation
-router.post('/admin/change-password', [
-  body('currentPassword').notEmpty(),
-  body('newPassword').notEmpty(),
-  body('confirmPassword').notEmpty()
-    .custom((value, { req }) => value === req.body.newPassword)
-    .withMessage('Passwords do not match')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { currentPassword, newPassword } = req.body;
-    const adminId = req.admin.id; // From auth middleware
-    
-    // Get admin user
-    const admin = await db('admin_users').where({ id: adminId }).first();
-    if (!admin) {
-      return res.status(404).json({ error: 'User not found' });
-    }
-    
-    // Verify current password
-    const validPassword = await bcrypt.compare(currentPassword, admin.password_hash);
-    if (!validPassword) {
-      return res.status(401).json({ error: 'Current password is incorrect' });
-    }
-    
-    // Validate new password
-    const passwordValidation = validatePasswordInContext(newPassword, 'admin', {
-      username: admin.username,
-      email: admin.email
-    });
-    
-    if (!passwordValidation.valid) {
-      logPasswordValidationFailure('admin_password_change', passwordValidation.errors, {
-        userId: adminId,
-        username: admin.username
-      });
-      
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.errors,
-        score: passwordValidation.score,
-        feedback: passwordValidation.feedback
-      });
-    }
-    
-    // Hash new password with configurable rounds
-    const hashedPassword = await bcrypt.hash(newPassword, getBcryptRounds());
-    
-    // Update password and track change time
-    await db('admin_users').where('id', adminId).update({
-      password_hash: hashedPassword,
-      password_changed_at: new Date(),
-      must_change_password: false
-    });
-    
-    // Log password change
-    logger.info('Admin password changed', {
-      userId: adminId,
-      username: admin.username,
-      ip: req.ip
-    });
-    
-    res.json({ 
-      message: 'Password changed successfully',
-      score: passwordValidation.score
-    });
-  } catch (error) {
-    logger.error('Password change error:', error);
-    res.status(500).json({ error: 'Failed to change password' });
-  }
-});
-
-// Logout endpoint
-router.post('/logout', async (req, res) => {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    
-    if (token) {
-      // End the session
-      endSession(token);
-      
-      // Log the logout
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        logger.info('User logged out', { 
-          userId: decoded.id,
-          username: decoded.username,
-          type: decoded.type
-        });
-      } catch (err) {
-        // Token might be invalid, but still process logout
-      }
-    }
-    
-    res.json({ message: 'Logged out successfully' });
-  } catch (error) {
-    logger.error('Logout error:', error);
-    res.status(500).json({ error: 'Logout failed' });
-  }
-});
-
-// Gallery password verification with enhanced security
-router.post('/gallery/verify', [
-  body('slug').notEmpty().trim(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
-    const userAgent = req.headers['user-agent'] || '';
-    
-    // Check gallery-specific lockout
-    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
-      return res.status(423).json({ 
-        error: 'Too many failed attempts. Please try again later.',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
-    if (!event) {
-      // Don't reveal if gallery exists
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(401).json({ error: 'Invalid gallery or password' });
-    }
-    
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      await db('access_logs').insert({
-        event_id: event.id,
-        ip_address: ipAddress,
-        user_agent: userAgent,
-        action: 'login_fail'
-      });
-      return res.status(401).json({ error: 'Invalid gallery or password' });
-    }
-    
-    // Successful access
-    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
-    
-    // Log successful access
-    await db('access_logs').insert({
-      event_id: event.id,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      action: 'login_success'
-    });
-    
-    // Generate session token with additional security info
-    const token = jwt.sign({ 
-      eventId: event.id, 
-      eventSlug: event.slug,
-      type: 'gallery',
-      ip: ipAddress,
-      loginTime: Date.now()
-    }, process.env.JWT_SECRET, { 
-      expiresIn: '24h',
-      issuer: 'picpeak-auth'
-    });
-    
-    res.json({
-      token,
-      event: {
-        id: event.id,
-        event_name: event.event_name,
-        event_type: event.event_type,
-        event_date: event.event_date,
-        welcome_message: event.welcome_message,
-        color_theme: event.color_theme,
-        expires_at: event.expires_at,
-        allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id
-      }
-    });
-  } catch (error) {
-    logger.error('Gallery verification error:', error);
-    res.status(500).json({ error: 'Verification failed' });
-  }
-});
-
-// Get current session info
-router.get('/session', async (req, res) => {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    try {
-      const decoded = jwt.verify(token, process.env.JWT_SECRET);
-      
-      // Calculate remaining time
-      const now = Date.now() / 1000;
-      const remainingTime = Math.max(0, decoded.exp - now);
-      
-      res.json({
-        valid: true,
-        type: decoded.type,
-        expiresIn: Math.floor(remainingTime),
-        user: decoded.username || decoded.eventSlug
-      });
-    } catch (err) {
-      res.json({
-        valid: false,
-        error: 'Invalid or expired token'
-      });
-    }
-  } catch (error) {
-    res.status(500).json({ error: 'Session check failed' });
-  }
-});
-
-// Password strength check endpoint (for real-time validation)
-router.post('/password-strength', [
-  body('password').notEmpty(),
-  body('context').isIn(['admin', 'gallery']).optional()
-], async (req, res) => {
-  try {
-    const { password, context = 'gallery' } = req.body;
-    
-    // Get user data if available (for context-aware validation)
-    const userData = {};
-    if (context === 'admin' && req.admin) {
-      userData.username = req.admin.username;
-      userData.email = req.admin.email;
-    }
-    
-    const validation = validatePasswordInContext(password, context, userData);
-    
-    res.json({
-      valid: validation.valid,
-      score: validation.score,
-      errors: validation.errors,
-      feedback: validation.feedback
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to check password strength' });
-  }
-});
-
-module.exports = router;

backend/src/routes/auth-enhanced.js

@@ -1,265 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { body, validationResult } = require('express-validator');
-const { db } = require('../database/db');
-const { verifyRecaptcha } = require('../services/recaptcha');
-const { 
-  trackFailedAttempt,
-  trackSuccessfulLogin,
-  checkAccountLockout,
-  checkSuspiciousActivity,
-  getGenericAuthError
-} = require('../utils/authSecurity');
-const { endSession } = require('../middleware/sessionTimeout');
-const logger = require('../utils/logger');
-const router = express.Router();
-
-// Admin login with enhanced security
-router.post('/admin/login', [
-  body('username').notEmpty().trim(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
-    const userAgent = req.headers['user-agent'] || '';
-    
-    // Check account lockout first
-    const lockoutStatus = await checkAccountLockout(username);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Login attempt on locked account', { username, ipAddress });
-      return res.status(423).json({ 
-        error: 'Account temporarily locked due to too many failed attempts',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    // Check for suspicious activity
-    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
-    if (isSuspicious) {
-      // Still allow login but log it
-      logger.warn('Suspicious login pattern detected', { username, ipAddress });
-    }
-    
-    const admin = await db('admin_users')
-      .where({ username })
-      .orWhere({ email: username })
-      .first();
-    
-    // Use generic error to prevent user enumeration
-    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(401).json({ error: getGenericAuthError() });
-    }
-    
-    if (!admin.is_active) {
-      await trackFailedAttempt(username, ipAddress, userAgent);
-      return res.status(401).json({ error: getGenericAuthError() });
-    }
-    
-    // Successful login
-    await trackSuccessfulLogin(username, ipAddress, userAgent);
-    
-    // Update last login and login metadata
-    await db('admin_users').where('id', admin.id).update({ 
-      last_login: new Date(),
-      last_login_ip: ipAddress
-    });
-    
-    // Generate token with additional claims
-    const token = jwt.sign({ 
-      id: admin.id,
-      username: admin.username,
-      type: 'admin',
-      ip: ipAddress,
-      loginTime: Date.now()
-    }, process.env.JWT_SECRET, { 
-      expiresIn: '24h',
-      issuer: 'picpeak-auth'
-    });
-    
-    res.json({
-      token,
-      user: {
-        id: admin.id,
-        username: admin.username,
-        email: admin.email,
-        mustChangePassword: admin.must_change_password || false
-      }
-    });
-  } catch (error) {
-    logger.error('Login error:', error);
-    res.status(500).json({ error: 'Login failed' });
-  }
-});
-
-// Logout endpoint
-router.post('/logout', async (req, res) => {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    
-    if (token) {
-      // End the session
-      endSession(token);
-      
-      // Log the logout
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        logger.info('User logged out', { 
-          userId: decoded.id,
-          username: decoded.username,
-          type: decoded.type
-        });
-      } catch (err) {
-        // Token might be invalid, but still process logout
-      }
-    }
-    
-    res.json({ message: 'Logged out successfully' });
-  } catch (error) {
-    logger.error('Logout error:', error);
-    res.status(500).json({ error: 'Logout failed' });
-  }
-});
-
-// Gallery password verification with enhanced security
-router.post('/gallery/verify', [
-  body('slug').notEmpty().trim(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
-    const userAgent = req.headers['user-agent'] || '';
-    
-    // Check gallery-specific lockout
-    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
-      return res.status(423).json({ 
-        error: 'Too many failed attempts. Please try again later.',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
-    if (!event) {
-      // Don't reveal if gallery exists
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(401).json({ error: 'Invalid gallery or password' });
-    }
-    
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      await db('access_logs').insert({
-        event_id: event.id,
-        ip_address: ipAddress,
-        user_agent: userAgent,
-        action: 'login_fail'
-      });
-      return res.status(401).json({ error: 'Invalid gallery or password' });
-    }
-    
-    // Successful access
-    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
-    
-    // Log successful access
-    await db('access_logs').insert({
-      event_id: event.id,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      action: 'login_success'
-    });
-    
-    // Generate session token with additional security info
-    const token = jwt.sign({ 
-      eventId: event.id, 
-      eventSlug: event.slug,
-      type: 'gallery',
-      ip: ipAddress,
-      loginTime: Date.now()
-    }, process.env.JWT_SECRET, { 
-      expiresIn: '24h',
-      issuer: 'picpeak-auth'
-    });
-    
-    res.json({
-      token,
-      event: {
-        id: event.id,
-        event_name: event.event_name,
-        event_type: event.event_type,
-        event_date: event.event_date,
-        welcome_message: event.welcome_message,
-        color_theme: event.color_theme,
-        expires_at: event.expires_at,
-        allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id
-      }
-    });
-  } catch (error) {
-    logger.error('Gallery verification error:', error);
-    res.status(500).json({ error: 'Verification failed' });
-  }
-});
-
-// Get current session info
-router.get('/session', async (req, res) => {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    try {
-      const decoded = jwt.verify(token, process.env.JWT_SECRET);
-      
-      // Calculate remaining time
-      const now = Date.now() / 1000;
-      const remainingTime = Math.max(0, decoded.exp - now);
-      
-      res.json({
-        valid: true,
-        type: decoded.type,
-        expiresIn: Math.floor(remainingTime),
-        user: decoded.username || decoded.eventSlug
-      });
-    } catch (err) {
-      res.json({
-        valid: false,
-        error: 'Invalid or expired token'
-      });
-    }
-  } catch (error) {
-    res.status(500).json({ error: 'Session check failed' });
-  }
-});
-
-module.exports = router;

backend/src/routes/auth.js

@@ -1,129 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { body, validationResult } = require('express-validator');
-const { db } = require('../database/db');
-const { verifyRecaptcha } = require('../services/recaptcha');
-const router = express.Router();
-
-// Admin login
-router.post('/admin/login', [
-  body('username').notEmpty(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { username, password, recaptchaToken } = req.body;
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    const admin = await db('admin_users')
-      .where({ username })
-      .orWhere({ email: username })
-      .first();
-    
-    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
-      return res.status(401).json({ error: 'Invalid credentials' });
-    }
-    
-    if (!admin.is_active) {
-      return res.status(401).json({ error: 'Account disabled' });
-    }
-    
-    // Update last login
-    await db('admin_users').where('id', admin.id).update({ last_login: new Date() });
-    
-    const token = jwt.sign({ id: admin.id, type: 'admin' }, process.env.JWT_SECRET, { expiresIn: '24h' });
-    
-    res.json({
-      token,
-      user: {
-        id: admin.id,
-        username: admin.username,
-        email: admin.email,
-        mustChangePassword: admin.must_change_password || false
-      }
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Login failed' });
-  }
-});
-
-// Gallery password verification
-router.post('/gallery/verify', [
-  body('slug').notEmpty(),
-  body('password').notEmpty()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const { slug, password, recaptchaToken } = req.body;
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await db('access_logs').insert({
-        event_id: event.id,
-        ip_address: req.ip,
-        user_agent: req.headers['user-agent'],
-        action: 'login_fail'
-      });
-      return res.status(401).json({ error: 'Invalid password' });
-    }
-    
-    // Log successful access
-    await db('access_logs').insert({
-      event_id: event.id,
-      ip_address: req.ip,
-      user_agent: req.headers['user-agent'],
-      action: 'login_success'
-    });
-    
-    // Generate session token
-    const token = jwt.sign({ 
-      eventId: event.id, 
-      eventSlug: event.slug,
-      type: 'gallery' 
-    }, process.env.JWT_SECRET, { expiresIn: '24h' });
-    
-    res.json({
-      token,
-      event: {
-        id: event.id,
-        event_name: event.event_name,
-        event_type: event.event_type,
-        event_date: event.event_date,
-        welcome_message: event.welcome_message,
-        color_theme: event.color_theme,
-        expires_at: event.expires_at,
-        allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id
-      }
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Verification failed' });
-  }
-});
-
-module.exports = router;

backend/src/routes/events.js

@@ -1,197 +0,0 @@
-const express = require('express');
-const { body, validationResult } = require('express-validator');
-const bcrypt = require('bcrypt');
-const crypto = require('crypto');
-const { db } = require('../database/db');
-const { adminAuth } = require('../middleware/auth-enhanced-v2');
-const fs = require('fs').promises;
-const path = require('path');
-const router = express.Router();
-
-// Create new event
-router.post('/', adminAuth, [
-  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
-  body('event_name').notEmpty(),
-  body('event_date').isDate(),
-  body('host_email').isEmail(),
-  body('admin_email').isEmail(),
-  body('password').isLength({ min: 6 }),
-  body('expiration_days').isInt({ min: 1, max: 365 }).optional()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const {
-      event_type,
-      event_name,
-      event_date,
-      host_email,
-      admin_email,
-      password,
-      welcome_message,
-      color_theme,
-      expiration_days = 30
-    } = req.body;
-    
-    // Generate unique slug
-    const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
-    let slug = baseSlug;
-    let counter = 1;
-    
-    while (await db('events').where({ slug }).first()) {
-      slug = `${baseSlug}-${counter}`;
-      counter++;
-    }
-    
-    // Generate share link
-    const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
-    
-    // Hash password
-    const password_hash = await bcrypt.hash(password, 10);
-    
-    // Calculate expiration date (days after event date)
-    const expires_at = new Date(event_date);
-    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
-    
-    // Create folder structure
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const eventPath = path.join(storagePath, 'events/active', slug);
-    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
-    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
-    
-    // Insert into database
-    const [eventId] = await db('events').insert({
-      slug,
-      event_type,
-      event_name,
-      event_date,
-      host_email,
-      admin_email,
-      password_hash,
-      welcome_message,
-      color_theme,
-      share_link: shareLink,
-      expires_at
-    });
-    
-    // Queue creation email
-    const { queueEmail } = require('../services/emailProcessor');
-    await queueEmail(eventId, host_email, 'gallery_created', {
-      host_name: host_email.split('@')[0], // Extract name from email
-      event_name,
-      event_date: new Date(event_date).toLocaleDateString(),
-      gallery_link: shareLink,
-      gallery_password: password,
-      expiry_date: expires_at.toLocaleDateString(),
-      welcome_message: welcome_message || ''
-    });
-    
-    res.json({
-      id: eventId,
-      slug,
-      share_link: shareLink,
-      expires_at
-    });
-  } catch (error) {
-    console.error(error);
-    res.status(500).json({ error: 'Failed to create event' });
-  }
-});
-
-// Get all events (admin)
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const { status = 'all' } = req.query;
-    
-    let query = db('events').select('*');
-    
-    if (status === 'active') {
-      query = query.where('is_active', true);
-    } else if (status === 'archived') {
-      query = query.where('is_archived', true);
-    }
-    
-    const events = await query.orderBy('created_at', 'desc');
-    
-    // Add photo counts
-    for (const event of events) {
-      const photoCount = await db('photos').where('event_id', event.id).count('id as count').first();
-      event.photo_count = photoCount.count;
-    }
-    
-    res.json(events);
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to fetch events' });
-  }
-});
-
-// Update event
-router.put('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    const updates = req.body;
-    
-    // Don't allow updating certain fields
-    delete updates.id;
-    delete updates.slug;
-    delete updates.created_at;
-    
-    // If updating password, hash it
-    if (updates.password) {
-      updates.password_hash = await bcrypt.hash(updates.password, 10);
-      delete updates.password;
-    }
-    
-    await db('events').where('id', id).update(updates);
-    
-    res.json({ success: true });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to update event' });
-  }
-});
-
-// Delete event (mark as inactive)
-router.delete('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    
-    await db('events').where('id', id).update({ is_active: false });
-    
-    res.json({ success: true });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to delete event' });
-  }
-});
-
-// Extend expiration
-router.post('/:id/extend', adminAuth, [
-  body('days').isInt({ min: 1, max: 365 })
-], async (req, res) => {
-  try {
-    const { id } = req.params;
-    const { days } = req.body;
-    
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-    
-    const newExpiration = new Date(event.expires_at);
-    newExpiration.setDate(newExpiration.getDate() + days);
-    
-    await db('events').where('id', id).update({ 
-      expires_at: newExpiration,
-      is_active: true // Reactivate if expired
-    });
-    
-    res.json({ expires_at: newExpiration });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to extend expiration' });
-  }
-});
-
-module.exports = router;

backend/src/routes/gallery.js

@@ -1,450 +0,0 @@
-const express = require('express');
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const archiver = require('archiver');
-const path = require('path');
-const router = express.Router();
-const watermarkService = require('../services/watermarkService');
-
-// Get storage path from environment or default
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-
-// Middleware to verify gallery access
-async function verifyGalleryAccess(req, res, next) {
-  try {
-    const token = req.headers.authorization?.split(' ')[1];
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const event = await db('events')
-      .where({ id: decoded.eventId, is_active: true, is_archived: false })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    req.event = event;
-    next();
-  } catch (error) {
-    console.error('Error verifying gallery access:', error);
-    res.status(401).json({ error: 'Invalid token', details: error.message });
-  }
-}
-
-// Verify share token
-router.get('/:slug/verify-token/:token', async (req, res) => {
-  try {
-    const { slug, token } = req.params;
-    
-    const event = await db('events')
-      .where({ slug, is_active: true, is_archived: false })
-      .select('id', 'share_link')
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found' });
-    }
-    
-    // Extract token from share link and verify
-    const expectedToken = event.share_link.split('/').pop();
-    if (token !== expectedToken) {
-      return res.status(404).json({ error: 'Invalid gallery link' });
-    }
-    
-    res.json({ valid: true });
-  } catch (error) {
-    console.error('Error verifying token:', error);
-    res.status(500).json({ error: 'Failed to verify token', details: error.message });
-  }
-});
-
-// Get gallery info (with optional token verification)
-router.get('/:slug/info', async (req, res) => {
-  try {
-    const { slug } = req.params;
-    const { token } = req.query;
-    
-    const event = await db('events')
-      .where({ slug })
-      .select('event_name', 'event_type', 'event_date', 'expires_at', 'is_active', 'is_archived', 'share_link')
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found' });
-    }
-    
-    // Check if event is archived
-    if (event.is_archived) {
-      return res.status(404).json({ error: 'Gallery has been archived and is no longer available' });
-    }
-    
-    // If token provided, verify it matches the share link
-    if (token) {
-      const expectedToken = event.share_link.split('/').pop();
-      if (token !== expectedToken) {
-        return res.status(404).json({ error: 'Invalid gallery link' });
-      }
-    }
-    
-    res.json({
-      event_name: event.event_name,
-      event_type: event.event_type,
-      event_date: event.event_date,
-      expires_at: event.expires_at,
-      is_active: event.is_active,
-      is_expired: !event.is_active || new Date(event.expires_at) < new Date(),
-      requires_password: true,
-      color_theme: event.color_theme
-    });
-  } catch (error) {
-    console.error('Error fetching gallery info:', error);
-    res.status(500).json({ error: 'Failed to fetch gallery info', details: error.message });
-  }
-});
-
-// Get all photos
-router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
-  try {
-    const photos = await db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
-      .where('photos.event_id', req.event.id)
-      .select(
-        'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
-      )
-      .orderBy('photos.uploaded_at', 'desc');
-    
-    // Get all categories for this event
-    const categories = await db('photo_categories')
-      .where(function() {
-        this.where('is_global', true)
-          .orWhere('event_id', req.event.id);
-      })
-      .orderBy('is_global', 'desc')
-      .orderBy('name', 'asc');
-    
-    // Log view
-    await db('access_logs').insert({
-      event_id: req.event.id,
-      ip_address: req.ip,
-      user_agent: req.headers['user-agent'],
-      action: 'view'
-    });
-    
-    res.json({
-      event: {
-        id: req.event.id,
-        event_name: req.event.event_name,
-        event_type: req.event.event_type,
-        event_date: req.event.event_date,
-        welcome_message: req.event.welcome_message,
-        color_theme: req.event.color_theme,
-        expires_at: req.event.expires_at,
-        hero_photo_id: req.event.hero_photo_id
-      },
-      categories: categories.map(cat => ({
-        id: cat.id,
-        name: cat.name,
-        slug: cat.slug,
-        is_global: cat.is_global
-      })),
-      photos: photos.map(photo => ({
-        id: photo.id,
-        filename: photo.filename,
-        url: `/photos/${photo.path}`,
-        thumbnail_url: photo.thumbnail_path ? `/thumbnails/${path.basename(photo.thumbnail_path)}` : null,
-        type: photo.type,
-        category_id: photo.category_id,
-        category_name: photo.category_name,
-        category_slug: photo.category_slug,
-        size: photo.size_bytes,
-        uploaded_at: photo.uploaded_at
-      }))
-    });
-  } catch (error) {
-    console.error('Error fetching photos:', error);
-    res.status(500).json({ error: 'Failed to fetch photos', details: error.message });
-  }
-});
-
-// Download single photo
-router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) => {
-  try {
-    const { photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: req.event.id })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Update download count
-    await db('photos').where('id', photoId).increment('download_count', 1);
-    
-    // Log download
-    await db('access_logs').insert({
-      event_id: req.event.id,
-      ip_address: req.ip,
-      user_agent: req.headers['user-agent'],
-      action: 'download',
-      photo_id: photoId
-    });
-    
-    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    if (watermarkSettings && watermarkSettings.enabled) {
-      // Apply watermark and send
-      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-      
-      res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
-        'Content-Disposition': `attachment; filename="${photo.filename}"`,
-        'Content-Length': watermarkedBuffer.length
-      });
-      
-      res.send(watermarkedBuffer);
-    } else {
-      // Send original file
-      res.download(filePath, photo.filename);
-    }
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to download photo' });
-  }
-});
-
-// Download all photos as ZIP
-router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
-  try {
-    // Fetch photos with category information
-    const photos = await db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
-      .where('photos.event_id', req.event.id)
-      .select(
-        'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
-      )
-      .orderBy('photo_categories.name', 'asc')
-      .orderBy('photos.uploaded_at', 'desc');
-    
-    if (photos.length === 0) {
-      return res.status(404).json({ error: 'No photos found' });
-    }
-    
-    // Count unique categories (excluding null)
-    const uniqueCategories = new Set(photos.filter(p => p.category_id).map(p => p.category_id)).size;
-    const hasMultipleCategories = uniqueCategories > 1;
-    
-    res.setHeader('Content-Type', 'application/zip');
-    res.setHeader('Content-Disposition', `attachment; filename="${req.event.slug}.zip"`);
-    
-    const archive = archiver('zip', { zlib: { level: 5 } });
-    archive.on('error', (err) => {
-      throw err;
-    });
-    
-    archive.pipe(res);
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    // Add photos to archive
-    for (const photo of photos) {
-      const filePath = path.join(getStoragePath(), 'events/active', photo.path);
-      
-      // Determine the file name in the archive
-      let archiveName;
-      if (hasMultipleCategories) {
-        if (photo.category_name) {
-          // Use category name as folder (sanitize for filesystem)
-          const folderName = photo.category_name.replace(/[^a-zA-Z0-9-_ ]/g, '').trim();
-          archiveName = path.join(folderName, photo.filename);
-        } else {
-          // Put uncategorized photos in 'Uncategorized' folder
-          archiveName = path.join('Uncategorized', photo.filename);
-        }
-      } else {
-        // No folders, just the filename
-        archiveName = photo.filename;
-      }
-      
-      if (watermarkSettings && watermarkSettings.enabled) {
-        // Apply watermark
-        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-        archive.append(watermarkedBuffer, { name: archiveName });
-      } else {
-        // Add original file
-        archive.file(filePath, { name: archiveName });
-      }
-    }
-    
-    await archive.finalize();
-    
-    // Log bulk download
-    await db('access_logs').insert({
-      event_id: req.event.id,
-      ip_address: req.ip,
-      user_agent: req.headers['user-agent'],
-      action: 'download_all'
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to create download archive' });
-  }
-});
-
-// View single photo (with watermark if enabled)
-router.get('/:slug/photo/:photoId', verifyGalleryAccess, async (req, res) => {
-  try {
-    const { photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: req.event.id })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    if (watermarkSettings && watermarkSettings.enabled) {
-      // Apply watermark and send
-      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-      
-      res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
-        'Cache-Control': 'public, max-age=3600' // Cache for 1 hour
-      });
-      
-      res.send(watermarkedBuffer);
-    } else {
-      // Send original file
-      res.sendFile(filePath);
-    }
-  } catch (error) {
-    console.error('Error serving photo:', error);
-    res.status(500).json({ error: 'Failed to serve photo' });
-  }
-});
-
-// Get photo stats
-router.get('/:slug/stats', verifyGalleryAccess, async (req, res) => {
-  try {
-    const totalPhotos = await db('photos')
-      .where('event_id', req.event.id)
-      .count('id as count')
-      .first();
-    
-    const totalViews = await db('access_logs')
-      .where('event_id', req.event.id)
-      .where('action', 'view')
-      .count('id as count')
-      .first();
-    
-    const totalDownloads = await db('photos')
-      .where('event_id', req.event.id)
-      .sum('download_count as total')
-      .first();
-    
-    const uniqueVisitors = await db('access_logs')
-      .where('event_id', req.event.id)
-      .countDistinct('ip_address as count')
-      .first();
-    
-    res.json({
-      total_photos: totalPhotos.count,
-      total_views: totalViews.count,
-      total_downloads: totalDownloads.total || 0,
-      unique_visitors: uniqueVisitors.count
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to fetch stats' });
-  }
-});
-
-// User photo upload endpoint
-router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
-  try {
-    const eventId = parseInt(req.params.eventId);
-    
-    // Verify the event matches the token
-    if (req.event.id !== eventId) {
-      return res.status(403).json({ error: 'Access denied' });
-    }
-    
-    // Check if user uploads are allowed
-    if (!req.event.allow_user_uploads) {
-      return res.status(403).json({ error: 'User uploads are not allowed for this event' });
-    }
-    
-    // Import multer and photo processing
-    const multer = require('multer');
-    const upload = multer({ 
-      dest: '/tmp/uploads/',
-      limits: { 
-        fileSize: 50 * 1024 * 1024, // 50MB
-        files: 10 // Max 10 files at once
-      },
-      fileFilter: (req, file, cb) => {
-        const allowedTypes = ['image/jpeg', 'image/png', 'image/webp'];
-        if (allowedTypes.includes(file.mimetype)) {
-          cb(null, true);
-        } else {
-          cb(new Error('Invalid file type'));
-        }
-      }
-    }).array('photos', 10);
-    
-    // Handle upload
-    upload(req, res, async (err) => {
-      if (err) {
-        console.error('Upload error:', err);
-        return res.status(400).json({ error: err.message });
-      }
-      
-      if (!req.files || req.files.length === 0) {
-        return res.status(400).json({ error: 'No files uploaded' });
-      }
-      
-      const { processUploadedPhotos } = require('../services/photoProcessor');
-      const categoryId = req.body.category_id || req.event.upload_category_id || null;
-      
-      try {
-        // Process uploaded photos
-        const results = await processUploadedPhotos(req.files, eventId, 'user', categoryId);
-        
-        // Clean up temp files
-        const fs = require('fs').promises;
-        for (const file of req.files) {
-          await fs.unlink(file.path).catch(console.error);
-        }
-        
-        res.json({ 
-          message: 'Photos uploaded successfully',
-          count: results.length,
-          photos: results
-        });
-      } catch (processError) {
-        console.error('Photo processing error:', processError);
-        res.status(500).json({ error: 'Failed to process photos' });
-      }
-    });
-  } catch (error) {
-    console.error('Upload route error:', error);
-    res.status(500).json({ error: 'Failed to upload photos' });
-  }
-});
-
-module.exports = router;

backend/src/routes/protectedImages.js

@@ -1,189 +0,0 @@
-const express = require('express');
-const path = require('path');
-const { db } = require('../database/db');
-const { verifyGalleryAccess } = require('../middleware/gallery');
-const watermarkService = require('../services/watermarkService');
-const { getStoragePath } = require('../config/storage');
-const crypto = require('crypto');
-
-const router = express.Router();
-
-/**
- * Generate a signed URL token for image access
- */
-function generateImageToken(photoId, expiresIn = 3600) {
-  const secret = process.env.JWT_SECRET;
-  const expires = Date.now() + (expiresIn * 1000);
-  const data = `${photoId}:${expires}`;
-  const signature = crypto.createHmac('sha256', secret).update(data).digest('hex');
-  return `${Buffer.from(data).toString('base64')}.${signature}`;
-}
-
-/**
- * Verify image token
- */
-function verifyImageToken(token) {
-  try {
-    const secret = process.env.JWT_SECRET;
-    const [data, signature] = token.split('.');
-    const decoded = Buffer.from(data, 'base64').toString();
-    const [photoId, expires] = decoded.split(':');
-    
-    // Verify signature
-    const expectedSignature = crypto.createHmac('sha256', secret).update(decoded).digest('hex');
-    if (signature !== expectedSignature) {
-      return null;
-    }
-    
-    // Check expiration
-    if (Date.now() > parseInt(expires)) {
-      return null;
-    }
-    
-    return { photoId: parseInt(photoId), expires: parseInt(expires) };
-  } catch (error) {
-    return null;
-  }
-}
-
-/**
- * Serve watermarked image
- */
-router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) => {
-  try {
-    const { photoId } = req.params;
-    
-    // Get photo details
-    const photo = await db('photos')
-      .where({
-        id: photoId,
-        event_id: req.event.id
-      })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    // Build full path to photo
-    const photoPath = path.join(getStoragePath(), 'events/active', req.event.slug, photo.path);
-    
-    // Apply watermark if enabled
-    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
-    
-    // Set appropriate headers
-    res.set({
-      'Content-Type': photo.mime_type || 'image/jpeg',
-      'Content-Length': imageBuffer.length,
-      'Cache-Control': 'private, max-age=3600',
-      'X-Content-Type-Options': 'nosniff'
-    });
-    
-    // Send the watermarked image
-    res.send(imageBuffer);
-    
-  } catch (error) {
-    console.error('Error serving watermarked image:', error);
-    res.status(500).json({ error: 'Failed to serve image' });
-  }
-});
-
-/**
- * Generate signed URL for image access
- */
-router.post('/:slug/photo/:photoId/generate-url', verifyGalleryAccess, async (req, res) => {
-  try {
-    const { photoId } = req.params;
-    
-    // Verify photo belongs to this event
-    const photo = await db('photos')
-      .where({
-        id: photoId,
-        event_id: req.event.id
-      })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Generate signed token
-    const token = generateImageToken(photoId);
-    const signedUrl = `/api/images/${req.params.slug}/photo/${photoId}/signed/${token}`;
-    
-    res.json({ 
-      url: signedUrl,
-      expiresIn: 3600 // 1 hour
-    });
-    
-  } catch (error) {
-    console.error('Error generating signed URL:', error);
-    res.status(500).json({ error: 'Failed to generate URL' });
-  }
-});
-
-/**
- * Serve image with signed URL (no gallery auth required, token is the auth)
- */
-router.get('/:slug/photo/:photoId/signed/:token', async (req, res) => {
-  try {
-    const { slug, photoId, token } = req.params;
-    
-    // Verify token
-    const tokenData = verifyImageToken(token);
-    if (!tokenData || tokenData.photoId !== parseInt(photoId)) {
-      return res.status(403).json({ error: 'Invalid or expired token' });
-    }
-    
-    // Get event
-    const event = await db('events')
-      .where({ slug })
-      .where('is_active', true)
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-    
-    // Get photo
-    const photo = await db('photos')
-      .where({
-        id: photoId,
-        event_id: event.id
-      })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
-    }
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    // Build full path to photo
-    const photoPath = path.join(getStoragePath(), 'events/active', event.slug, photo.path);
-    
-    // Apply watermark if enabled
-    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
-    
-    // Set appropriate headers
-    res.set({
-      'Content-Type': photo.mime_type || 'image/jpeg',
-      'Content-Length': imageBuffer.length,
-      'Cache-Control': 'private, max-age=3600',
-      'X-Content-Type-Options': 'nosniff'
-    });
-    
-    // Send the watermarked image
-    res.send(imageBuffer);
-    
-  } catch (error) {
-    console.error('Error serving signed image:', error);
-    res.status(500).json({ error: 'Failed to serve image' });
-  }
-});
-
-module.exports = router;

backend/src/routes/publicCMS.js

@@ -1,33 +0,0 @@
-const express = require('express');
-const { db } = require('../database/db');
-const router = express.Router();
-
-// Get public CMS page
-router.get('/pages/:slug', async (req, res) => {
-  try {
-    const { slug } = req.params;
-    const { lang = 'en' } = req.query;
-    
-    const page = await db('cms_pages').where('slug', slug).first();
-    
-    if (!page) {
-      return res.status(404).json({ error: 'Page not found' });
-    }
-    
-    // Return the appropriate language version
-    const title = lang === 'de' ? page.title_de : page.title_en;
-    const content = lang === 'de' ? page.content_de : page.content_en;
-    
-    res.json({
-      title,
-      content,
-      slug: page.slug,
-      updated_at: page.updated_at
-    });
-  } catch (error) {
-    console.error('Error fetching public CMS page:', error);
-    res.status(500).json({ error: 'Failed to fetch page' });
-  }
-});
-
-module.exports = router;

backend/src/routes/publicSettings.js

@@ -1,54 +0,0 @@
-const express = require('express');
-const { db } = require('../database/db');
-const router = express.Router();
-
-// Get public settings (branding and theme)
-router.get('/', async (req, res) => {
-  try {
-    // Fetch branding, theme, general, and select security settings
-    const settings = await db('app_settings')
-      .whereIn('setting_type', ['branding', 'theme', 'general', 'security'])
-      .select('setting_key', 'setting_value');
-    
-    // Convert to object format
-    const settingsObject = {};
-    settings.forEach(setting => {
-      try {
-        settingsObject[setting.setting_key] = setting.setting_value 
-          ? JSON.parse(setting.setting_value) 
-          : null;
-      } catch (e) {
-        // If parsing fails, use the raw value
-        settingsObject[setting.setting_key] = setting.setting_value;
-      }
-    });
-
-    // Return only safe public settings
-    const publicSettings = {
-      branding_company_name: settingsObject.branding_company_name || '',
-      branding_company_tagline: settingsObject.branding_company_tagline || '',
-      branding_support_email: settingsObject.branding_support_email || '',
-      branding_footer_text: settingsObject.branding_footer_text || '',
-      branding_watermark_enabled: settingsObject.branding_watermark_enabled || false,
-      branding_watermark_logo_url: settingsObject.branding_watermark_logo_url || '',
-      branding_watermark_position: settingsObject.branding_watermark_position || 'bottom-right',
-      branding_watermark_opacity: settingsObject.branding_watermark_opacity || 50,
-      branding_watermark_size: settingsObject.branding_watermark_size || 15,
-      branding_favicon_url: settingsObject.branding_favicon_url || '',
-      branding_logo_url: settingsObject.branding_logo_url || '',
-      theme_config: settingsObject.theme_config || null,
-      default_language: settingsObject.general_default_language || 'en',
-      enable_analytics: settingsObject.general_enable_analytics !== false,
-      enable_recaptcha: settingsObject.security_enable_recaptcha === true || settingsObject.security_enable_recaptcha === 'true',
-      recaptcha_site_key: settingsObject.security_recaptcha_site_key || null,
-      maintenance_mode: settingsObject.general_maintenance_mode === true || settingsObject.general_maintenance_mode === 'true'
-    };
-
-    res.json(publicSettings);
-  } catch (error) {
-    console.error('Public settings fetch error:', error);
-    res.status(500).json({ error: 'Failed to fetch settings' });
-  }
-});
-
-module.exports = router;

backend/src/services/archiveService.js

@@ -1,70 +0,0 @@
-const archiver = require('archiver');
-const fs = require('fs').promises;
-const path = require('path');
-const { db } = require('../database/db');
-const { queueEmail } = require('./emailProcessor');
-const logger = require('../utils/logger');
-
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-const ACTIVE_PATH = () => path.join(getStoragePath(), 'events/active');
-const ARCHIVE_PATH = () => path.join(getStoragePath(), 'events/archived');
-
-async function archiveEvent(event) {
-  try {
-    const eventPath = path.join(ACTIVE_PATH(), event.slug);
-    const archiveName = `${event.slug}.zip`;
-    const archivePath = path.join(ARCHIVE_PATH(), archiveName);
-    
-    // Ensure archive directory exists
-    await fs.mkdir(ARCHIVE_PATH(), { recursive: true });
-    
-    // Create archive
-    const output = require('fs').createWriteStream(archivePath);
-    const archive = archiver('zip', {
-      zlib: { level: 9 } // Maximum compression
-    });
-    
-    archive.on('error', (err) => {
-      throw err;
-    });
-    
-    output.on('close', async () => {
-      logger.info(`Archive created: ${archiveName} (${archive.pointer()} bytes)`);
-      
-      // Update database
-      await db('events').where('id', event.id).update({
-        is_archived: true,
-        archive_path: path.relative(getStoragePath(), archivePath),
-        archived_at: new Date()
-      });
-      
-      // Delete original files
-      await fs.rm(eventPath, { recursive: true });
-      
-      // Delete thumbnails
-      const photos = await db('photos').where('event_id', event.id);
-      for (const photo of photos) {
-        if (photo.thumbnail_path) {
-          const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
-          await fs.unlink(thumbPath).catch(() => {}); // Ignore if already deleted
-        }
-      }
-      
-      // Queue completion email
-      await queueEmail(event.id, event.admin_email, 'archive_complete', {
-        event_name: event.event_name,
-        archive_size: (archive.pointer() / 1024 / 1024).toFixed(2) + ' MB'
-      });
-    });
-    
-    archive.pipe(output);
-    archive.directory(eventPath, false);
-    await archive.finalize();
-    
-  } catch (error) {
-    logger.error(`Error archiving event ${event.slug}:`, error);
-    throw error;
-  }
-}
-
-module.exports = { archiveEvent };

backend/src/services/emailProcessor.js

@@ -1,412 +0,0 @@
-const nodemailer = require('nodemailer');
-const { db } = require('../database/db');
-const logger = require('../utils/logger');
-
-let transporter = null;
-
-// Initialize transporter from database config
-async function initializeTransporter() {
-  try {
-    const config = await db('email_configs').first();
-    
-    if (!config) {
-      logger.warn('No email configuration found');
-      return null;
-    }
-
-    transporter = nodemailer.createTransport({
-      host: config.smtp_host,
-      port: config.smtp_port,
-      secure: config.smtp_secure,
-      auth: config.smtp_user ? {
-        user: config.smtp_user,
-        pass: config.smtp_pass
-      } : undefined
-    });
-
-    // Verify configuration
-    await transporter.verify();
-    logger.info('Email transporter initialized successfully');
-    
-    return transporter;
-  } catch (error) {
-    logger.error('Failed to initialize email transporter:', error);
-    return null;
-  }
-}
-
-// Get the appropriate language for a recipient
-async function getRecipientLanguage(email) {
-  // For now, check if the email domain ends with .de
-  // In the future, this could check user preferences
-  if (email && email.endsWith('.de')) {
-    return 'de';
-  }
-  
-  // Check if there's a saved preference for this email
-  // This could be expanded to check user preferences in the database
-  
-  return 'en'; // Default to English
-}
-
-// Process email template with variables
-async function processTemplate(template, variables, language = 'en') {
-  // Get the appropriate language fields
-  const subjectField = language === 'de' ? 'subject_de' : 'subject_en';
-  const htmlField = language === 'de' ? 'body_html_de' : 'body_html_en';
-  const textField = language === 'de' ? 'body_text_de' : 'body_text_en';
-  
-  // Fall back to non-language-specific fields for backward compatibility
-  let subject = template[subjectField] || template.subject || '';
-  let htmlBody = template[htmlField] || template.body_html || '';
-  let textBody = template[textField] || template.body_text || '';
-
-  // Get branding settings for logo
-  let logoUrl = '';
-  let companyName = 'PicPeak';
-  try {
-    const brandingSettings = await db('app_settings')
-      .whereIn('setting_key', ['branding_logo_url', 'branding_company_name'])
-      .select('setting_key', 'setting_value');
-    
-    brandingSettings.forEach(setting => {
-      if (setting.setting_key === 'branding_logo_url' && setting.setting_value) {
-        try {
-          logoUrl = JSON.parse(setting.setting_value);
-        } catch (e) {
-          logoUrl = setting.setting_value;
-        }
-      } else if (setting.setting_key === 'branding_company_name' && setting.setting_value) {
-        try {
-          companyName = JSON.parse(setting.setting_value);
-        } catch (e) {
-          companyName = setting.setting_value;
-        }
-      }
-    });
-  } catch (error) {
-    logger.error('Error fetching branding settings:', error);
-  }
-
-  // If no custom logo, use default PicPeak logo
-  const apiUrl = process.env.API_URL || 'http://localhost:3001';
-  const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:3005';
-  const logoFullUrl = logoUrl ? `${apiUrl}${logoUrl}` : `${frontendUrl}/picpeak-logo-transparent.png`;
-
-  // Process welcome message section if present
-  let welcomeMessageSection = '';
-  if (variables.welcome_message && variables.welcome_message.trim() !== '') {
-    const welcomeTitle = language === 'de' ? 'Persönliche Nachricht:' : 'Personal Message:';
-    welcomeMessageSection = `
-<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
-  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">${welcomeTitle}</p>
-  <p style="margin: 0; color: #4b5563;">${variables.welcome_message}</p>
-</div>`;
-  }
-
-  // Replace variables
-  Object.entries(variables).forEach(([key, value]) => {
-    const regex = new RegExp(`{{${key}}}`, 'g');
-    subject = subject.replace(regex, value || '');
-    htmlBody = htmlBody.replace(regex, value || '');
-    textBody = textBody.replace(regex, value || '');
-  });
-
-  // Replace welcome message section placeholder
-  htmlBody = htmlBody.replace(/{{welcome_message_section}}/g, welcomeMessageSection);
-
-  // Wrap HTML body in styled template
-  const styledHtmlBody = `
-<!DOCTYPE html>
-<html lang="${language}">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${subject}</title>
-  <style>
-    body {
-      margin: 0;
-      padding: 0;
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-      background-color: #f5f5f5;
-      color: #333;
-    }
-    .email-wrapper {
-      background-color: #f5f5f5;
-      padding: 40px 20px;
-    }
-    .email-container {
-      max-width: 600px;
-      margin: 0 auto;
-      background-color: #ffffff;
-      border-radius: 8px;
-      box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
-      overflow: hidden;
-    }
-    .email-header {
-      background-color: #5C8762;
-      padding: 30px;
-      text-align: center;
-    }
-    .logo {
-      max-width: 180px;
-      height: auto;
-      margin-bottom: 10px;
-    }
-    .email-content {
-      padding: 40px 30px;
-    }
-    .email-content h2 {
-      color: #5C8762;
-      margin-top: 0;
-      margin-bottom: 20px;
-      font-size: 24px;
-    }
-    .email-content p {
-      line-height: 1.6;
-      margin-bottom: 15px;
-    }
-    .email-content ul {
-      background-color: #f9f9f9;
-      padding: 20px 20px 20px 40px;
-      border-radius: 5px;
-      margin: 20px 0;
-    }
-    .email-content li {
-      margin-bottom: 10px;
-    }
-    .button {
-      display: inline-block;
-      padding: 12px 30px;
-      background-color: #5C8762;
-      color: white !important;
-      text-decoration: none;
-      border-radius: 5px;
-      font-weight: 500;
-      margin: 20px 0;
-    }
-    .button:hover {
-      background-color: #4a6f4f;
-    }
-    .email-footer {
-      background-color: #f9f9f9;
-      padding: 30px;
-      text-align: center;
-      border-top: 1px solid #eee;
-    }
-    .email-footer img {
-      max-width: 120px;
-      height: auto;
-      margin-bottom: 15px;
-      opacity: 0.8;
-    }
-    .email-footer p {
-      color: #666;
-      font-size: 14px;
-      margin: 5px 0;
-    }
-    a {
-      color: #5C8762;
-      text-decoration: underline;
-    }
-    a:hover {
-      color: #4a6f4f;
-    }
-    strong {
-      color: #333;
-    }
-    @media only screen and (max-width: 600px) {
-      .email-wrapper {
-        padding: 20px 10px;
-      }
-      .email-content {
-        padding: 30px 20px;
-      }
-      .email-header {
-        padding: 20px;
-      }
-      .logo {
-        max-width: 150px;
-      }
-    }
-  </style>
-</head>
-<body>
-  <div class="email-wrapper">
-    <div class="email-container">
-      <div class="email-header">
-        <img src="${logoFullUrl}" alt="${companyName}" class="logo">
-      </div>
-      <div class="email-content">
-        ${htmlBody}
-      </div>
-      <div class="email-footer">
-        <img src="${logoFullUrl}" alt="${companyName}">
-        <p>${companyName}</p>
-        <p style="font-size: 12px; color: #999;">© ${new Date().getFullYear()} ${companyName}. All rights reserved.</p>
-      </div>
-    </div>
-  </div>
-</body>
-</html>`;
-
-  return { subject, htmlBody: styledHtmlBody, textBody };
-}
-
-// Send email using template
-async function sendTemplateEmail(to, templateKey, variables) {
-  try {
-    if (!transporter) {
-      transporter = await initializeTransporter();
-      if (!transporter) {
-        throw new Error('Email service not configured');
-      }
-    }
-
-    // Get email template
-    const template = await db('email_templates')
-      .where('template_key', templateKey)
-      .first();
-    
-    if (!template) {
-      throw new Error(`Email template '${templateKey}' not found`);
-    }
-
-    // Get email config for from address
-    const config = await db('email_configs').first();
-    if (!config) {
-      throw new Error('Email configuration not found');
-    }
-
-    // Determine recipient language
-    const language = await getRecipientLanguage(to);
-    
-    // Process template with variables
-    const { subject, htmlBody, textBody } = await processTemplate(template, variables, language);
-
-    // Send email
-    const info = await transporter.sendMail({
-      from: `${config.from_name} <${config.from_email}>`,
-      to: to,
-      subject: subject,
-      html: htmlBody,
-      text: textBody || htmlBody.replace(/<[^>]*>/g, '') // Strip HTML if no text version
-    });
-
-    logger.info(`Email sent successfully: ${info.messageId} (${language})`);
-    return { success: true, messageId: info.messageId, language };
-  } catch (error) {
-    logger.error('Error sending template email:', error);
-    throw error;
-  }
-}
-
-// Process email queue
-async function processEmailQueue() {
-  try {
-    const pendingEmails = await db('email_queue')
-      .where('status', 'pending')
-      .where('retry_count', '<', 3)
-      .orderBy('created_at', 'asc')
-      .limit(10);
-    
-    if (pendingEmails.length === 0) {
-      return;
-    }
-
-    logger.info(`Processing ${pendingEmails.length} emails from queue`);
-    
-    for (const email of pendingEmails) {
-      try {
-        const emailData = JSON.parse(email.email_data || '{}');
-        
-        await sendTemplateEmail(
-          email.recipient_email,
-          email.email_type,
-          emailData
-        );
-        
-        // Mark as sent
-        await db('email_queue')
-          .where('id', email.id)
-          .update({
-            status: 'sent',
-            sent_at: new Date()
-          });
-          
-        logger.info(`Email ${email.id} sent successfully`);
-      } catch (error) {
-        // Increment retry count
-        await db('email_queue')
-          .where('id', email.id)
-          .update({
-            retry_count: email.retry_count + 1,
-            error_message: error.message,
-            updated_at: new Date()
-          });
-          
-        logger.error(`Failed to send email ${email.id}:`, error);
-      }
-    }
-  } catch (error) {
-    logger.error('Error processing email queue:', error);
-  }
-}
-
-// Queue an email for sending
-async function queueEmail(eventId, recipientEmail, emailType, emailData) {
-  try {
-    await db('email_queue').insert({
-      event_id: eventId,
-      recipient_email: recipientEmail,
-      email_type: emailType,
-      email_data: JSON.stringify(emailData),
-      status: 'pending',
-      retry_count: 0,
-      created_at: new Date()
-    });
-    
-    logger.info(`Email queued: ${emailType} to ${recipientEmail}`);
-  } catch (error) {
-    logger.error('Error queueing email:', error);
-    throw error;
-  }
-}
-
-// Start email queue processor
-let emailQueueInterval = null;
-
-function startEmailQueueProcessor() {
-  if (!emailQueueInterval) {
-    // Process immediately on start
-    processEmailQueue();
-    
-    // Then process every minute
-    emailQueueInterval = setInterval(processEmailQueue, 60000);
-    logger.info('Email queue processor started');
-  }
-}
-
-function stopEmailQueueProcessor() {
-  if (emailQueueInterval) {
-    clearInterval(emailQueueInterval);
-    emailQueueInterval = null;
-    logger.info('Email queue processor stopped');
-  }
-}
-
-// Initialize on module load - DISABLED for production startup
-// This will be called from server.js after database is ready
-// initializeTransporter().then(() => {
-//   startEmailQueueProcessor();
-// });
-
-module.exports = {
-  initializeTransporter,
-  startEmailQueueProcessor,
-  sendTemplateEmail,
-  processEmailQueue,
-  queueEmail,
-  startEmailQueueProcessor,
-  stopEmailQueueProcessor
-};

backend/src/services/emailService.js

@@ -1,65 +0,0 @@
-const nodemailer = require('nodemailer');
-const { db } = require('../database/db');
-const { emailTemplates } = require('./emailTemplates');
-const logger = require('../utils/logger');
-
-// Create transporter
-const transporter = nodemailer.createTransport({
-  host: process.env.SMTP_HOST,
-  port: process.env.SMTP_PORT,
-  secure: process.env.SMTP_SECURE === 'true',
-  auth: {
-    user: process.env.SMTP_USER,
-    pass: process.env.SMTP_PASS
-  }
-});
-
-async function sendEmail(to, type, data) {
-  try {
-    const template = emailTemplates[type](data);
-    
-    const info = await transporter.sendMail({
-      from: process.env.EMAIL_FROM,
-      to: to,
-      subject: template.subject,
-      html: template.html,
-      text: template.text
-    });
-    
-    logger.info(`Email sent: ${info.messageId}`);
-    return info;
-  } catch (error) {
-    logger.error('Error sending email:', error);
-    throw error;
-  }
-}
-
-// Process email queue
-async function processEmailQueue() {
-  const pendingEmails = await db('email_queue')
-    .where('status', 'pending')
-    .where('retry_count', '<', 3)
-    .limit(10);
-  
-  for (const email of pendingEmails) {
-    try {
-      const emailData = JSON.parse(email.email_data);
-      await sendEmail(email.recipient_email, email.email_type, emailData);
-      
-      await db('email_queue').where('id', email.id).update({
-        status: 'sent',
-        sent_at: new Date()
-      });
-    } catch (error) {
-      await db('email_queue').where('id', email.id).update({
-        retry_count: email.retry_count + 1,
-        error_message: error.message
-      });
-    }
-  }
-}
-
-// Start email queue processor
-setInterval(processEmailQueue, 60000); // Process every minute
-
-module.exports = { sendEmail, processEmailQueue };

backend/src/services/expirationChecker.js

@@ -1,100 +0,0 @@
-const cron = require('node-cron');
-const { db } = require('../database/db');
-const { archiveEvent } = require('./archiveService');
-const { queueEmail } = require('./emailProcessor');
-const logger = require('../utils/logger');
-const { formatDate } = require('../utils/dateFormatter');
-
-function startExpirationChecker() {
-  // Check every hour for expired events and warnings
-  cron.schedule('0 * * * *', async () => {
-    await checkExpirations();
-  });
-  
-  logger.info('Expiration checker started');
-}
-
-async function checkExpirations() {
-  try {
-    const now = new Date();
-    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000); // 7 days from now
-    
-    // Check for events needing warning emails
-    const eventsNeedingWarning = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', warningDate)
-      .where('expires_at', '>', now);
-    
-    for (const event of eventsNeedingWarning) {
-      // Check if warning email already sent
-      const existingWarning = await db('email_queue')
-        .where('event_id', event.id)
-        .where('email_type', 'expiration_warning')
-        .first();
-      
-      if (!existingWarning) {
-        await queueExpirationWarning(event);
-      }
-    }
-    
-    // Check for expired events
-    const expiredEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', now);
-    
-    for (const event of expiredEvents) {
-      await handleExpiredEvent(event);
-    }
-    
-  } catch (error) {
-    logger.error('Error checking expirations:', error);
-  }
-}
-
-async function queueExpirationWarning(event) {
-  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
-  
-  // Determine language based on email domain
-  const emailLang = event.host_email.endsWith('.de') ? 'de' : 'en';
-  
-  // Queue email to host
-  await queueEmail(event.id, event.host_email, 'expiration_warning', {
-    host_name: event.host_name || event.host_email.split('@')[0],
-    event_name: event.event_name,
-    days_remaining: daysRemaining.toString(),
-    expiration_date: await formatDate(event.expires_at, emailLang),
-    gallery_link: event.share_link
-  });
-  
-  logger.info(`Queued expiration warning for event ${event.slug}`);
-}
-
-async function handleExpiredEvent(event) {
-  try {
-    // Mark as inactive
-    await db('events').where('id', event.id).update({ is_active: false });
-    
-    // Queue expiration emails
-    await queueEmail(event.id, event.host_email, 'gallery_expired', {
-      event_name: event.event_name,
-      admin_email: event.admin_email
-    });
-    
-    // Also notify admin
-    await queueEmail(event.id, event.admin_email, 'gallery_expired', {
-      event_name: event.event_name,
-      admin_email: event.admin_email
-    });
-    
-    // Start archiving process
-    await archiveEvent(event);
-    
-    logger.info(`Handled expiration for event ${event.slug}`);
-  } catch (error) {
-    logger.error(`Error handling expired event ${event.slug}:`, error);
-  }
-}
-
-module.exports = { startExpirationChecker };

backend/src/services/fileWatcher.js

@@ -1,97 +0,0 @@
-const chokidar = require('chokidar');
-const path = require('path');
-const fs = require('fs').promises;
-const { db } = require('../database/db');
-const { generateThumbnail } = require('./imageProcessor');
-const logger = require('../utils/logger');
-
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-const WATCH_PATH = () => path.join(getStoragePath(), 'events/active');
-
-function startFileWatcher() {
-  const watcher = chokidar.watch(WATCH_PATH(), {
-    ignored: /(^|[\/\\])\../, // ignore dotfiles
-    persistent: true,
-    awaitWriteFinish: {
-      stabilityThreshold: 2000,
-      pollInterval: 100
-    }
-  });
-
-  watcher
-    .on('add', async (filePath) => {
-      try {
-        await processNewPhoto(filePath);
-      } catch (error) {
-        logger.error('Error processing new photo:', error);
-      }
-    })
-    .on('unlink', async (filePath) => {
-      try {
-        await removePhoto(filePath);
-      } catch (error) {
-        logger.error('Error removing photo:', error);
-      }
-    });
-
-  logger.info('File watcher started');
-}
-
-async function processNewPhoto(filePath) {
-  const relativePath = path.relative(WATCH_PATH(), filePath);
-  const pathParts = relativePath.split(path.sep);
-  
-  if (pathParts.length < 2) return; // Not in correct folder structure
-  
-  const eventSlug = pathParts[0];
-  const photoType = pathParts[1] === 'collages' ? 'collage' : 'individual';
-  
-  // Check if this is an image file
-  const ext = path.extname(filePath).toLowerCase();
-  if (!['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
-  
-  // Find the event
-  const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
-  if (!event) return;
-  
-  // Get file stats
-  const stats = await fs.stat(filePath);
-  
-  // Generate thumbnail
-  const thumbnailPath = await generateThumbnail(filePath);
-  
-  // Calculate relative thumbnail path
-  const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
-  
-  // Check if photo already exists
-  const existingPhoto = await db('photos')
-    .where({ event_id: event.id, filename: path.basename(filePath) })
-    .first();
-  
-  if (!existingPhoto) {
-    // Add to database
-    await db('photos').insert({
-      event_id: event.id,
-      filename: path.basename(filePath),
-      path: relativePath,
-      thumbnail_path: relativeThumbPath,
-      type: photoType,
-      size_bytes: stats.size
-    });
-    
-    logger.info(`Added new photo: ${relativePath}`);
-  } else {
-    logger.debug(`Photo already exists: ${relativePath}`);
-  }
-}
-
-async function removePhoto(filePath) {
-  const relativePath = path.relative(WATCH_PATH(), filePath);
-  
-  // Remove from database
-  await db('photos').where({ path: relativePath }).delete();
-  
-  logger.info(`Removed photo: ${relativePath}`);
-}
-
-module.exports = { startFileWatcher };

backend/src/services/imageProcessor.js

@@ -1,30 +0,0 @@
-const sharp = require('sharp');
-const path = require('path');
-const fs = require('fs').promises;
-
-const THUMBNAIL_WIDTH = 300;
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-const getThumbnailPath = () => path.join(getStoragePath(), 'thumbnails');
-
-async function generateThumbnail(imagePath) {
-  const filename = path.basename(imagePath);
-  const thumbnailFilename = `thumb_${filename}`;
-  const thumbnailDir = getThumbnailPath();
-  const thumbnailPath = path.join(thumbnailDir, thumbnailFilename);
-  
-  // Ensure thumbnail directory exists
-  await fs.mkdir(thumbnailDir, { recursive: true });
-  
-  // Generate thumbnail
-  await sharp(imagePath)
-    .resize(THUMBNAIL_WIDTH, null, {
-      withoutEnlargement: true,
-      fit: 'inside'
-    })
-    .jpeg({ quality: 80 })
-    .toFile(thumbnailPath);
-  
-  return path.relative(getStoragePath(), thumbnailPath);
-}
-
-module.exports = { generateThumbnail };

backend/src/services/photoProcessor.js

@@ -1,112 +0,0 @@
-const path = require('path');
-const fs = require('fs').promises;
-const { db } = require('../database/db');
-const { generateThumbnail } = require('./imageProcessor');
-const { generatePhotoFilename } = require('../utils/filenameSanitizer');
-
-// Get storage path from environment or default
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-
-async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categoryId = null) {
-  const uploadedPhotos = [];
-  
-  // Get event details
-  const event = await db('events').where({ id: eventId }).first();
-  if (!event) {
-    throw new Error('Event not found');
-  }
-  
-  // Process each file
-  for (const file of files) {
-    const trx = await db.transaction();
-    
-    try {
-      // Get category info if provided
-      let category = null;
-      let counter = 1;
-      const parsedCategoryId = categoryId ? parseInt(categoryId) : null;
-      
-      if (parsedCategoryId) {
-        // Get category and update counter
-        category = await trx('photo_categories')
-          .where({ id: parsedCategoryId })
-          .first();
-        
-        if (category) {
-          counter = (category.photo_counter || 0) + 1;
-          await trx('photo_categories')
-            .where({ id: parsedCategoryId })
-            .update({ photo_counter: counter });
-        }
-      } else {
-        // For uncategorized photos, count existing uncategorized photos
-        const uncategorizedCount = await trx('photos')
-          .where({ event_id: eventId })
-          .whereNull('category_id')
-          .count('id as count')
-          .first();
-        
-        counter = (uncategorizedCount.count || 0) + 1;
-      }
-      
-      // Generate new filename
-      const extension = path.extname(file.originalname);
-      const newFilename = generatePhotoFilename(
-        event.event_name,
-        category ? category.name : 'uncategorized',
-        counter,
-        extension
-      );
-      
-      // Move file to event folder
-      const destPath = path.join(getStoragePath(), 'events/active', event.slug);
-      await fs.mkdir(destPath, { recursive: true });
-      
-      const newPath = path.join(destPath, newFilename);
-      // Use copyFile and unlink instead of rename to avoid cross-device issues
-      await fs.copyFile(file.path, newPath);
-      await fs.unlink(file.path);
-      
-      // Generate thumbnail
-      const thumbnailPath = await generateThumbnail(newPath);
-      
-      // Calculate relative paths
-      const storagePath = getStoragePath();
-      const relativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
-      const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
-      
-      // Add to database with uploaded_by field
-      const [photoId] = await trx('photos').insert({
-        event_id: eventId,
-        filename: newFilename,
-        path: relativePath,
-        thumbnail_path: relativeThumbPath,
-        category_id: parsedCategoryId || null,
-        type: 'individual',
-        size_bytes: file.size,
-        uploaded_by: uploadedBy
-      });
-      
-      // Commit transaction
-      await trx.commit();
-      
-      uploadedPhotos.push({
-        id: photoId,
-        filename: newFilename,
-        size: file.size,
-        category_id: parsedCategoryId || null,
-        uploaded_by: uploadedBy
-      });
-    } catch (error) {
-      console.error(`Error processing file ${file.originalname}:`, error);
-      if (trx) await trx.rollback();
-      // Continue with other files
-    }
-  }
-  
-  return uploadedPhotos;
-}
-
-module.exports = {
-  processUploadedPhotos
-};

backend/src/services/recaptcha.js

@@ -1,58 +0,0 @@
-const axios = require('axios');
-const { db } = require('../database/db');
-
-async function verifyRecaptcha(token) {
-  // Check if reCAPTCHA is enabled
-  const settings = await db('app_settings')
-    .whereIn('setting_key', ['security_enable_recaptcha', 'security_recaptcha_secret_key'])
-    .select('setting_key', 'setting_value');
-  
-  const settingsMap = {};
-  settings.forEach(setting => {
-    try {
-      settingsMap[setting.setting_key] = JSON.parse(setting.setting_value);
-    } catch (e) {
-      settingsMap[setting.setting_key] = setting.setting_value;
-    }
-  });
-  
-  const isEnabled = settingsMap.security_enable_recaptcha === true || 
-                    settingsMap.security_enable_recaptcha === 'true';
-  const secretKey = settingsMap.security_recaptcha_secret_key;
-  
-  // If reCAPTCHA is not enabled, always return true
-  if (!isEnabled) {
-    return true;
-  }
-  
-  // If enabled but no token provided, fail
-  if (!token) {
-    return false;
-  }
-  
-  // If no secret key configured, log warning but pass
-  if (!secretKey) {
-    console.warn('reCAPTCHA enabled but no secret key configured');
-    return true;
-  }
-  
-  try {
-    const response = await axios.post(
-      'https://www.google.com/recaptcha/api/siteverify',
-      null,
-      {
-        params: {
-          secret: secretKey,
-          response: token
-        }
-      }
-    );
-    
-    return response.data.success === true;
-  } catch (error) {
-    console.error('reCAPTCHA verification error:', error);
-    return false;
-  }
-}
-
-module.exports = { verifyRecaptcha };

backend/src/services/watermarkService.js

@@ -1,226 +0,0 @@
-const sharp = require('sharp');
-const path = require('path');
-const fs = require('fs').promises;
-const { db } = require('../database/db');
-
-class WatermarkService {
-  constructor() {
-    this.cache = new Map();
-    this.cacheMaxAge = 3600000; // 1 hour in milliseconds
-  }
-
-  /**
-   * Get watermark settings from database
-   */
-  async getWatermarkSettings() {
-    try {
-      const settings = await db('app_settings')
-        .whereIn('setting_key', [
-          'branding_watermark_enabled',
-          'branding_watermark_logo_path',
-          'branding_watermark_position',
-          'branding_watermark_opacity',
-          'branding_watermark_size',
-          'branding_company_name'
-        ])
-        .select('setting_key', 'setting_value');
-
-      const settingsObj = {};
-      settings.forEach(setting => {
-        try {
-          settingsObj[setting.setting_key] = JSON.parse(setting.setting_value);
-        } catch (e) {
-          settingsObj[setting.setting_key] = setting.setting_value;
-        }
-      });
-
-      return {
-        enabled: settingsObj.branding_watermark_enabled || false,
-        logoPath: settingsObj.branding_watermark_logo_path || null,
-        position: settingsObj.branding_watermark_position || 'bottom-right',
-        opacity: parseInt(settingsObj.branding_watermark_opacity || 50),
-        size: parseInt(settingsObj.branding_watermark_size || 15),
-        companyName: settingsObj.branding_company_name || 'Photo Gallery'
-      };
-    } catch (error) {
-      console.error('Error fetching watermark settings:', error);
-      return null;
-    }
-  }
-
-  /**
-   * Calculate position coordinates based on position string
-   */
-  getPositionCoordinates(imageWidth, imageHeight, watermarkWidth, watermarkHeight, position) {
-    const padding = 20;
-    let left, top;
-
-    switch (position) {
-      case 'top-left':
-        left = padding;
-        top = padding;
-        break;
-      case 'top-right':
-        left = imageWidth - watermarkWidth - padding;
-        top = padding;
-        break;
-      case 'bottom-left':
-        left = padding;
-        top = imageHeight - watermarkHeight - padding;
-        break;
-      case 'bottom-right':
-        left = imageWidth - watermarkWidth - padding;
-        top = imageHeight - watermarkHeight - padding;
-        break;
-      case 'center':
-        left = Math.floor((imageWidth - watermarkWidth) / 2);
-        top = Math.floor((imageHeight - watermarkHeight) / 2);
-        break;
-      default:
-        // Default to bottom-right
-        left = imageWidth - watermarkWidth - padding;
-        top = imageHeight - watermarkHeight - padding;
-    }
-
-    return { left: Math.max(0, left), top: Math.max(0, top) };
-  }
-
-  /**
-   * Apply watermark to an image
-   */
-  async applyWatermark(imagePath, settings) {
-    try {
-      if (!settings || !settings.enabled) {
-        // Return original image if watermarking is disabled
-        return await fs.readFile(imagePath);
-      }
-
-      // Check cache first
-      const cacheKey = `${imagePath}_${JSON.stringify(settings)}`;
-      const cached = this.cache.get(cacheKey);
-      if (cached && Date.now() - cached.timestamp < this.cacheMaxAge) {
-        return cached.buffer;
-      }
-
-      // Load the main image
-      const image = sharp(imagePath);
-      const metadata = await image.metadata();
-
-      let watermarkBuffer;
-      let watermarkMetadata;
-
-      // Try to use logo watermark first
-      if (settings.logoPath) {
-        try {
-          const watermarkImage = sharp(settings.logoPath);
-          watermarkMetadata = await watermarkImage.metadata();
-          
-          // Calculate watermark size based on percentage of main image
-          const scaleFactor = settings.size / 100;
-          const targetWidth = Math.floor(metadata.width * scaleFactor);
-          const targetHeight = Math.floor(watermarkMetadata.height * (targetWidth / watermarkMetadata.width));
-
-          // Resize watermark and apply opacity
-          watermarkBuffer = await watermarkImage
-            .resize(targetWidth, targetHeight, { fit: 'inside' })
-            .composite([{
-              input: Buffer.from([255, 255, 255, Math.floor(255 * (settings.opacity / 100))]),
-              raw: {
-                width: 1,
-                height: 1,
-                channels: 4
-              },
-              tile: true,
-              blend: 'dest-in'
-            }])
-            .toBuffer();
-
-          watermarkMetadata = { width: targetWidth, height: targetHeight };
-        } catch (error) {
-          console.error('Error processing watermark logo:', error);
-          watermarkBuffer = null;
-        }
-      }
-
-      // If no logo or logo failed, create text watermark
-      if (!watermarkBuffer) {
-        const fontSize = Math.max(16, Math.floor(metadata.width * 0.03));
-        const padding = 10;
-        
-        // Create SVG text watermark
-        const svg = `
-          <svg width="${settings.companyName.length * fontSize * 0.6 + padding * 2}" height="${fontSize + padding * 2}">
-            <rect x="0" y="0" width="100%" height="100%" fill="black" opacity="0.5" rx="5"/>
-            <text x="${padding}" y="${fontSize + padding/2}" 
-              font-family="Arial, sans-serif" 
-              font-size="${fontSize}" 
-              fill="white" 
-              opacity="${settings.opacity / 100}">
-              ${settings.companyName}
-            </text>
-          </svg>
-        `;
-        
-        watermarkBuffer = Buffer.from(svg);
-        watermarkMetadata = {
-          width: settings.companyName.length * fontSize * 0.6 + padding * 2,
-          height: fontSize + padding * 2
-        };
-      }
-
-      // Calculate position
-      const position = this.getPositionCoordinates(
-        metadata.width,
-        metadata.height,
-        watermarkMetadata.width,
-        watermarkMetadata.height,
-        settings.position
-      );
-
-      // Apply watermark
-      const watermarkedBuffer = await image
-        .composite([{
-          input: watermarkBuffer,
-          top: position.top,
-          left: position.left
-        }])
-        .toBuffer();
-
-      // Cache the result
-      this.cache.set(cacheKey, {
-        buffer: watermarkedBuffer,
-        timestamp: Date.now()
-      });
-
-      // Clean old cache entries
-      this.cleanCache();
-
-      return watermarkedBuffer;
-    } catch (error) {
-      console.error('Error applying watermark:', error);
-      // Return original image on error
-      return await fs.readFile(imagePath);
-    }
-  }
-
-  /**
-   * Clean old cache entries
-   */
-  cleanCache() {
-    const now = Date.now();
-    for (const [key, value] of this.cache.entries()) {
-      if (now - value.timestamp > this.cacheMaxAge) {
-        this.cache.delete(key);
-      }
-    }
-  }
-
-  /**
-   * Clear entire cache
-   */
-  clearCache() {
-    this.cache.clear();
-  }
-}
-
-module.exports = new WatermarkService();

backend/src/utils/authSecurity.js

@@ -1,189 +0,0 @@
-/**
- * Authentication Security Utilities
- * Provides enhanced security features for authentication
- */
-
-const { db } = require('../database/db');
-const logger = require('./logger');
-
-// Configuration constants
-const MAX_LOGIN_ATTEMPTS = 5;
-const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
-const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
-
-/**
- * Track failed login attempt
- * @param {string} identifier - Username or email
- * @param {string} ipAddress - IP address of the attempt
- * @param {string} userAgent - User agent string
- */
-async function trackFailedAttempt(identifier, ipAddress, userAgent) {
-  try {
-    await db('login_attempts').insert({
-      identifier,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      attempt_time: new Date().toISOString(),
-      success: false
-    });
-
-    // Log security event
-    logger.warn('Failed login attempt', {
-      identifier,
-      ipAddress,
-      userAgent,
-      timestamp: new Date().toISOString()
-    });
-  } catch (error) {
-    logger.error('Error tracking failed login attempt:', error);
-  }
-}
-
-/**
- * Track successful login
- * @param {string} identifier - Username or email
- * @param {string} ipAddress - IP address
- * @param {string} userAgent - User agent string
- */
-async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
-  try {
-    await db('login_attempts').insert({
-      identifier,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      attempt_time: new Date().toISOString(),
-      success: true
-    });
-
-    // Clear old failed attempts for this user
-    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
-    await db('login_attempts')
-      .where('identifier', identifier)
-      .where('success', false)
-      .where('attempt_time', '<', cutoffTime.toISOString())
-      .delete();
-  } catch (error) {
-    logger.error('Error tracking successful login:', error);
-  }
-}
-
-/**
- * Check if account is locked due to too many failed attempts
- * @param {string} identifier - Username or email
- * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
- */
-async function checkAccountLockout(identifier) {
-  try {
-    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
-    
-    // Get recent failed attempts
-    const failedAttempts = await db('login_attempts')
-      .where('identifier', identifier)
-      .where('success', false)
-      .where('attempt_time', '>=', recentWindow.toISOString())
-      .orderBy('attempt_time', 'desc')
-      .limit(MAX_LOGIN_ATTEMPTS);
-
-    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
-      // Check if still within lockout period
-      const oldestAttempt = failedAttempts[failedAttempts.length - 1];
-      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
-      const now = Date.now();
-
-      if (now < lockoutEnd) {
-        return {
-          isLocked: true,
-          remainingTime: Math.ceil((lockoutEnd - now) / 1000) // seconds
-        };
-      }
-    }
-
-    return { isLocked: false };
-  } catch (error) {
-    logger.error('Error checking account lockout:', error);
-    return { isLocked: false }; // Fail open to avoid locking users out due to errors
-  }
-}
-
-/**
- * Check for suspicious login patterns
- * @param {string} identifier - Username or email
- * @param {string} ipAddress - Current IP address
- * @returns {Promise<boolean>} - True if suspicious
- */
-async function checkSuspiciousActivity(identifier, ipAddress) {
-  try {
-    // Check for rapid attempts from different IPs
-    const recentWindow = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes
-    
-    const recentAttempts = await db('login_attempts')
-      .where('identifier', identifier)
-      .where('attempt_time', '>=', recentWindow.toISOString())
-      .select('ip_address')
-      .distinct('ip_address');
-
-    // If more than 3 different IPs in 5 minutes, it's suspicious
-    if (recentAttempts.length > 3) {
-      logger.warn('Suspicious login activity detected', {
-        identifier,
-        uniqueIPs: recentAttempts.length,
-        currentIP: ipAddress
-      });
-      return true;
-    }
-
-    return false;
-  } catch (error) {
-    logger.error('Error checking suspicious activity:', error);
-    return false;
-  }
-}
-
-/**
- * Get generic error message to prevent user enumeration
- * @returns {string}
- */
-function getGenericAuthError() {
-  return 'Invalid credentials';
-}
-
-/**
- * Clean up old login attempts (should be run periodically)
- */
-async function cleanupOldAttempts() {
-  try {
-    const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 7 days
-    
-    const deleted = await db('login_attempts')
-      .where('attempt_time', '<', cutoffDate.toISOString())
-      .delete();
-
-    if (deleted > 0) {
-      logger.info(`Cleaned up ${deleted} old login attempts`);
-    }
-  } catch (error) {
-    logger.error('Error cleaning up login attempts:', error);
-  }
-}
-
-/**
- * Initialize cleanup job
- */
-function initializeCleanupJob() {
-  // Run cleanup every 24 hours
-  setInterval(cleanupOldAttempts, 24 * 60 * 60 * 1000);
-  
-  // Run initial cleanup
-  cleanupOldAttempts();
-}
-
-module.exports = {
-  trackFailedAttempt,
-  trackSuccessfulLogin,
-  checkAccountLockout,
-  checkSuspiciousActivity,
-  getGenericAuthError,
-  initializeCleanupJob,
-  MAX_LOGIN_ATTEMPTS,
-  LOCKOUT_DURATION
-};

backend/src/utils/dateFormatter.js

@@ -1,65 +0,0 @@
-const { db } = require('../database/db');
-
-// Default date format settings
-const DEFAULT_FORMAT = {
-  format: 'DD/MM/YYYY',
-  locale: 'en-GB'
-};
-
-// Format date based on system settings
-async function formatDate(date, language = 'en') {
-  try {
-    // Get date format setting from database
-    const setting = await db('app_settings').where('setting_key', 'general_date_format').first();
-    const dateConfig = setting ? JSON.parse(setting.setting_value) : DEFAULT_FORMAT;
-    
-    const dateObj = date instanceof Date ? date : new Date(date);
-    
-    // Use appropriate locale based on language
-    let locale = dateConfig.locale || 'en-GB';
-    if (language === 'de') {
-      locale = 'de-DE';
-    } else if (language === 'en' && dateConfig.format === 'MM/DD/YYYY') {
-      locale = 'en-US';
-    }
-    
-    // Format based on the configured format
-    switch (dateConfig.format) {
-      case 'MM/DD/YYYY':
-        return dateObj.toLocaleDateString(locale, {
-          month: '2-digit',
-          day: '2-digit',
-          year: 'numeric'
-        });
-      case 'DD/MM/YYYY':
-        return dateObj.toLocaleDateString(locale, {
-          day: '2-digit',
-          month: '2-digit',
-          year: 'numeric'
-        });
-      case 'YYYY-MM-DD':
-        return dateObj.toISOString().split('T')[0];
-      case 'DD.MM.YYYY':
-        return dateObj.toLocaleDateString('de-DE', {
-          day: '2-digit',
-          month: '2-digit',
-          year: 'numeric'
-        });
-      default:
-        // Use long format as fallback
-        return dateObj.toLocaleDateString(locale, {
-          year: 'numeric',
-          month: 'long',
-          day: 'numeric'
-        });
-    }
-  } catch (error) {
-    console.error('Error formatting date:', error);
-    // Fallback to basic formatting
-    return date instanceof Date ? date.toLocaleDateString() : new Date(date).toLocaleDateString();
-  }
-}
-
-module.exports = {
-  formatDate
-};

backend/src/utils/fileSecurityUtils.js

@@ -1,233 +0,0 @@
-const path = require('path');
-const fs = require('fs').promises;
-
-/**
- * Secure file security utilities to prevent path traversal and validate file types
- */
-
-/**
- * Safely join paths and prevent directory traversal attacks
- * @param {string} basePath - The base directory path
- * @param {string} userPath - The user-provided path to join
- * @returns {string} - Safe joined path
- * @throws {Error} - If path traversal is detected
- */
-function safePathJoin(basePath, userPath) {
-  // Normalize the base path
-  const normalizedBase = path.resolve(basePath);
-  
-  // Join and resolve the full path
-  const joinedPath = path.join(normalizedBase, userPath);
-  const resolvedPath = path.resolve(joinedPath);
-  
-  // Ensure the resolved path starts with the base path
-  if (!resolvedPath.startsWith(normalizedBase + path.sep) && resolvedPath !== normalizedBase) {
-    throw new Error('Path traversal attempt detected');
-  }
-  
-  return resolvedPath;
-}
-
-/**
- * Validate file path to prevent directory traversal
- * @param {string} filePath - The file path to validate
- * @returns {boolean} - True if path is safe
- */
-function isPathSafe(filePath) {
-  // Check for common path traversal patterns
-  const dangerousPatterns = [
-    /\.\.[\/\\]/,  // ../ or ..\
-    /^[A-Za-z]:/,  // Windows drive letters
-    /[\x00-\x1f]/  // Control characters
-  ];
-  
-  return !dangerousPatterns.some(pattern => pattern.test(filePath));
-}
-
-/**
- * Enhanced MIME type validation
- */
-const ALLOWED_IMAGE_TYPES = {
-  'image/jpeg': {
-    extensions: ['.jpg', '.jpeg'],
-    magicNumbers: [
-      { offset: 0, bytes: [0xFF, 0xD8, 0xFF] } // JPEG
-    ]
-  },
-  'image/png': {
-    extensions: ['.png'],
-    magicNumbers: [
-      { offset: 0, bytes: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A] } // PNG
-    ]
-  },
-  'image/webp': {
-    extensions: ['.webp'],
-    magicNumbers: [
-      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
-      { offset: 8, bytes: [0x57, 0x45, 0x42, 0x50] }  // WEBP
-    ]
-  },
-  'image/gif': {
-    extensions: ['.gif'],
-    magicNumbers: [
-      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61] }, // GIF87a
-      { offset: 0, bytes: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61] }  // GIF89a
-    ]
-  },
-  'image/svg+xml': {
-    extensions: ['.svg'],
-    // SVG files are XML-based text files, so we skip magic number validation
-    magicNumbers: null
-  }
-};
-
-/**
- * Validate file type by MIME type and extension
- * @param {string} filename - The filename
- * @param {string} mimetype - The MIME type
- * @param {string[]} allowedTypes - Array of allowed MIME types
- * @returns {boolean} - True if file type is valid
- */
-function validateFileType(filename, mimetype, allowedTypes) {
-  // Check if MIME type is allowed
-  if (!allowedTypes.includes(mimetype)) {
-    return false;
-  }
-  
-  // Get file extension
-  const ext = path.extname(filename).toLowerCase();
-  
-  // Check if extension matches the MIME type
-  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
-  if (!typeConfig || !typeConfig.extensions.includes(ext)) {
-    return false;
-  }
-  
-  return true;
-}
-
-/**
- * Validate file content by checking magic numbers (file signatures)
- * @param {string} filePath - Path to the file
- * @param {string} expectedMimeType - Expected MIME type
- * @returns {Promise<boolean>} - True if file content matches expected type
- */
-async function validateFileContent(filePath, expectedMimeType) {
-  try {
-    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
-    if (!typeConfig) {
-      return false;
-    }
-    
-    // Skip validation for file types without magic numbers (like SVG)
-    if (!typeConfig.magicNumbers) {
-      return true;
-    }
-    
-    // Read the first 20 bytes of the file (enough for most magic numbers)
-    const buffer = Buffer.alloc(20);
-    const fileHandle = await fs.open(filePath, 'r');
-    await fileHandle.read(buffer, 0, 20, 0);
-    await fileHandle.close();
-    
-    // Check magic numbers
-    return typeConfig.magicNumbers.every(magic => {
-      for (let i = 0; i < magic.bytes.length; i++) {
-        if (buffer[magic.offset + i] !== magic.bytes[i]) {
-          return false;
-        }
-      }
-      return true;
-    });
-  } catch (error) {
-    console.error('Error validating file content:', error);
-    return false;
-  }
-}
-
-/**
- * Get safe filename for storage
- * @param {string} originalFilename - Original filename
- * @returns {string} - Safe filename
- */
-function getSafeFilename(originalFilename) {
-  const timestamp = Date.now();
-  const randomString = Math.random().toString(36).substring(2, 15);
-  const ext = path.extname(originalFilename).toLowerCase();
-  
-  // Validate extension
-  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
-  if (!validExtensions.includes(ext)) {
-    throw new Error('Invalid file extension');
-  }
-  
-  return `upload_${timestamp}_${randomString}${ext}`;
-}
-
-/**
- * Create a file upload validator middleware
- * @param {Object} options - Validation options
- * @returns {Function} - Express middleware function
- */
-function createFileUploadValidator(options = {}) {
-  const {
-    allowedTypes = ['image/jpeg', 'image/png', 'image/webp'],
-    maxFileSize = 50 * 1024 * 1024, // 50MB default
-    validateContent = true
-  } = options;
-  
-  return async (req, res, next) => {
-    try {
-      if (!req.files || req.files.length === 0) {
-        return next();
-      }
-      
-      for (const file of req.files) {
-        // Validate file type
-        if (!validateFileType(file.originalname, file.mimetype, allowedTypes)) {
-          return res.status(400).json({ 
-            error: `Invalid file type: ${file.originalname}. Allowed types: ${allowedTypes.join(', ')}` 
-          });
-        }
-        
-        // Validate file size
-        if (file.size > maxFileSize) {
-          return res.status(400).json({ 
-            error: `File too large: ${file.originalname}. Maximum size: ${maxFileSize / 1024 / 1024}MB` 
-          });
-        }
-        
-        // Validate file content if enabled
-        if (validateContent && file.path) {
-          const isValidContent = await validateFileContent(file.path, file.mimetype);
-          if (!isValidContent) {
-            // Remove the file if content doesn't match
-            try {
-              await fs.unlink(file.path);
-            } catch (err) {
-              console.error('Error removing invalid file:', err);
-            }
-            return res.status(400).json({ 
-              error: `File content does not match declared type: ${file.originalname}` 
-            });
-          }
-        }
-      }
-      
-      next();
-    } catch (error) {
-      console.error('File validation error:', error);
-      res.status(500).json({ error: 'File validation failed' });
-    }
-  };
-}
-
-module.exports = {
-  safePathJoin,
-  isPathSafe,
-  validateFileType,
-  validateFileContent,
-  getSafeFilename,
-  createFileUploadValidator,
-  ALLOWED_IMAGE_TYPES
-};

backend/src/utils/filenameSanitizer.js

@@ -1,57 +0,0 @@
-/**
- * Sanitize a string to be used as a filename component
- * @param {string} str - The string to sanitize
- * @param {number} maxLength - Maximum length of the sanitized string
- * @returns {string} - Sanitized string
- */
-function sanitizeFilename(str, maxLength = 50) {
-  if (!str) return 'unnamed';
-  
-  // Convert to string and trim
-  let sanitized = String(str).trim();
-  
-  // Replace spaces with underscores
-  sanitized = sanitized.replace(/\s+/g, '_');
-  
-  // Remove special characters except hyphens, underscores, and dots
-  sanitized = sanitized.replace(/[^a-zA-Z0-9_\-\.]/g, '');
-  
-  // Remove multiple consecutive underscores or hyphens
-  sanitized = sanitized.replace(/[_\-]{2,}/g, '_');
-  
-  // Remove leading/trailing underscores or hyphens
-  sanitized = sanitized.replace(/^[_\-]+|[_\-]+$/g, '');
-  
-  // Limit length
-  if (sanitized.length > maxLength) {
-    sanitized = sanitized.substring(0, maxLength);
-  }
-  
-  // If empty after sanitization, use default
-  if (!sanitized) {
-    sanitized = 'unnamed';
-  }
-  
-  return sanitized;
-}
-
-/**
- * Generate a photo filename based on event name, category, and counter
- * @param {string} eventName - The event name
- * @param {string} categoryName - The category name
- * @param {number} counter - The photo counter
- * @param {string} extension - The file extension (including dot)
- * @returns {string} - Generated filename
- */
-function generatePhotoFilename(eventName, categoryName, counter, extension) {
-  const sanitizedEvent = sanitizeFilename(eventName, 30);
-  const sanitizedCategory = sanitizeFilename(categoryName || 'uncategorized', 20);
-  const paddedCounter = String(counter).padStart(4, '0');
-  
-  return `${sanitizedEvent}_${sanitizedCategory}_${paddedCounter}${extension}`;
-}
-
-module.exports = {
-  sanitizeFilename,
-  generatePhotoFilename
-};

backend/src/utils/logger.js

@@ -1,31 +0,0 @@
-const winston = require('winston');
-const path = require('path');
-
-const logger = winston.createLogger({
-  level: process.env.LOG_LEVEL || 'info',
-  format: winston.format.combine(
-    winston.format.timestamp(),
-    winston.format.errors({ stack: true }),
-    winston.format.json()
-  ),
-  transports: [
-    new winston.transports.File({ 
-      filename: path.join(__dirname, '../../logs/error.log'), 
-      level: 'error' 
-    }),
-    new winston.transports.File({ 
-      filename: path.join(__dirname, '../../logs/combined.log') 
-    })
-  ]
-});
-
-if (process.env.NODE_ENV !== 'production') {
-  logger.add(new winston.transports.Console({
-    format: winston.format.combine(
-      winston.format.colorize(),
-      winston.format.simple()
-    )
-  }));
-}
-
-module.exports = logger;