Fix mobile overlay and deps per #43

This reverts commit c127fd829d.

.env.example

@@ -10,10 +10,13 @@ JWT_SECRET=your_very_long_random_jwt_secret_here
 # Database Configuration (PostgreSQL)
 DATABASE_CLIENT=pg
 DB_USER=picpeak
+# IMPORTANT: Avoid $ character in passwords - Docker Compose interprets it as variable substitution
+# If you must use $, escape it as $$ (e.g., Pass$$word instead of Pass$word)
 DB_PASSWORD=your_secure_postgres_password_here
 DB_NAME=picpeak_prod
 
 # Redis Configuration
+# IMPORTANT: Same warning applies - avoid $ or escape as $$
 REDIS_PASSWORD=your_secure_redis_password_here
 
 # Admin Account (initial setup)
@@ -31,9 +34,15 @@ SMTP_PASS=your-app-specific-password
 EMAIL_FROM=noreply@yourdomain.com
 
 # Application URLs
+# Use full origin with scheme, no trailing slash.
+# Admin UI is served by the frontend at /admin.
 FRONTEND_URL=https://yourdomain.com
-ADMIN_URL=https://yourdomain.com:3001
-VITE_API_URL=https://yourdomain.com:3001/api
+ADMIN_URL=https://yourdomain.com
+
+# Frontend API base
+# For pre-built images and production behind a reverse proxy, keep '/api'.
+# If you rebuild the frontend yourself, you may set a full URL at build time.
+VITE_API_URL=/api
 
 # Port Configuration (optional)
 # BACKEND_PORT=3001
@@ -44,7 +53,25 @@ VITE_API_URL=https://yourdomain.com:3001/api
 # Timezone
 TZ=UTC
 
+# Runtime user mapping for Docker (optional)
+# Set these to your host user's UID/GID to avoid permission issues on bind mounts.
+# Run `id -u` and `id -g` on host to get values. Defaults to 1001.
+PUID=1001
+PGID=1001
+
 # Analytics (Optional - Umami)
 VITE_UMAMI_URL=
 VITE_UMAMI_WEBSITE_ID=
-VITE_UMAMI_SHARE_URL=
+VITE_UMAMI_SHARE_URL=
+
+# Storage variables (host paths)
+# These control where data is stored on the host. Defaults are local folders.
+APP_STORAGE=./storage
+APP_DATA=./data
+LOGS=./logs
+
+# Note on FRONTEND_API_URL (documentation only):
+# When using pre-built frontend images, runtime env vars cannot override the built JS.
+# Do NOT rely on FRONTEND_API_URL in Compose. Instead, keep VITE_API_URL=/api and
+# let the frontend Nginx proxy /api to the backend. Only if you rebuild the frontend
+# should you change VITE_API_URL at build time.

.gitea/workflows/mirror-to-github.yml

@@ -1,14 +1,15 @@
 name: Mirror to GitHub
 
 on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:  # Allow manual triggering
+  workflow_dispatch:  # Allow manual triggering only
 
 jobs:
   mirror:
     runs-on: ubuntu-latest
+    # Note: For GitHub fine-grained tokens, ensure the token has:
+    # - Repository access to the-luap/picpeak
+    # - Repository permissions: Contents (Read and Write), Metadata (Read)
+    # For classic tokens: repo scope is sufficient
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -29,12 +30,15 @@ jobs:
           # Remove sensitive files/directories if they exist
           echo "Removing sensitive files..."
           rm -rf .gitea/ || true
-          rm -rf scripts/ || true
+          rm -rf scripts/install-gitea-runner.sh || true
           rm -rf .drone* || true
           rm -rf photo-sharing-prd.md || true
           rm -rf CLAUDE.md || true
           rm -rf storage/ || true
-
+          rm -rf events/ || true
+          rm -rf .playwright-mcp/
+          rm -rf .swarm || true
+          rm -rf .claude-flow || true
 
           
           echo "Sensitive files removal completed"
@@ -57,32 +61,72 @@ jobs:
         run: |
           if [ -z "$GITHUBTOKEN" ]; then
             echo "ERROR: GITHUBTOKEN secret is not set!"
+            echo "Please add a GitHub Personal Access Token as a secret named GITHUBTOKEN"
+            echo ""
+            echo "For fine-grained tokens:"
+            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens"
+            echo "  - Create token with repository access to the-luap/picpeak"
+            echo "  - Grant permissions: Contents (Read and Write), Metadata (Read)"
+            echo ""
+            echo "For classic tokens:"
+            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic)"
+            echo "  - Create token with 'repo' scope"
             exit 1
           else
-            echo "GitHub token is available (length: ${#GITHUBTOKEN})"
+            echo "✅ GitHub token is available (length: ${#GITHUBTOKEN})"
+            # Try to detect token type (fine-grained tokens are typically longer)
+            if [ ${#GITHUBTOKEN} -gt 80 ]; then
+              echo "📌 Token appears to be a fine-grained personal access token"
+            else
+              echo "📌 Token appears to be a classic personal access token"
+            fi
           fi
 
       - name: Push to GitHub
         env:
           GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+          GIT_TRACE: 1  # Enable Git trace for debugging if needed
         run: |
           # Remove existing github remote if it exists
           git remote remove github || true
           
-          # Add GitHub remote
-          git remote add github https://x-access-token:${GITHUBTOKEN}@github.com/the-luap/picpeak.git
+          # Configure Git to use the token for authentication
+          # This method works for both classic and fine-grained tokens
+          git config --global url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf "https://github.com/"
+          
+          # Add GitHub remote (clean URL without credentials)
+          git remote add github https://github.com/the-luap/picpeak.git
           
           # Verify remote was added
-          echo "GitHub remote added:"
+          echo "GitHub remote configuration:"
           git remote -v
           
-          # Push to GitHub main branch
+          # Push to GitHub main branch with error handling
           echo "Pushing to GitHub..."
-          git push github main --force
-          echo "✅ Push to GitHub completed!"
+          if git push github main --force 2>&1; then
+            echo "✅ Push to GitHub completed successfully!"
+          else
+            echo "❌ Push to GitHub failed!"
+            echo ""
+            echo "Common issues and solutions:"
+            echo "1. Token permissions: Ensure your token has 'Contents: write' permission"
+            echo "2. Token expiration: Check if your token has expired"
+            echo "3. Repository access: Verify the token has access to the-luap/picpeak repository"
+            echo ""
+            echo "For fine-grained tokens, required permissions:"
+            echo "  - Repository access: the-luap/picpeak"
+            echo "  - Repository permissions: Contents (Read and Write), Metadata (Read)"
+            echo ""
+            echo "For classic tokens, required scope: 'repo'"
+            exit 1
+          fi
+          
+          # Clean up the git config after push
+          git config --global --unset url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf
 
       - name: Workflow completed
         run: |
           echo "✅ Mirror to GitHub workflow completed successfully!"
           echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
-          echo "🔒 Sensitive files have been removed from the mirror"
+          echo "🔒 Sensitive files have been removed from the mirror"
+

.gitea/workflows/version-and-release.yml

@@ -1,12 +1,7 @@
 name: Version and Release
 
 on:
-  push:
-    branches: [ main ]
-    paths-ignore:
-      - '**.md'
-      - '.gitea/**'
-      - '.drone.yml'
+  workflow_dispatch:
 
 jobs:
   version-bump:
@@ -72,8 +67,8 @@ jobs:
           echo "Root files changed: $ROOT_CHANGED"
           
           # Get current versions
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.0.0")
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.0.0")
+          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.1.0")
+          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.1.0")
           
           echo "Current backend version: $BACKEND_VERSION"
           echo "Current frontend version: $FRONTEND_VERSION"
@@ -133,10 +128,17 @@ jobs:
           MINOR="${version_parts[1]}"
           PATCH="${version_parts[2]}"
           
-          # Increment patch version
+          # Increment patch version and ensure tag uniqueness
+          git fetch --tags --quiet || true
           NEW_PATCH=$((PATCH + 1))
           NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
           
+          while git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; do
+            echo "Tag v${NEW_VERSION} already exists, bumping patch version again"
+            NEW_PATCH=$((NEW_PATCH + 1))
+            NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
+          done
+          
           echo "New version: $NEW_VERSION"
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
           echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
@@ -264,4 +266,4 @@ jobs:
           echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
           echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
           echo "Drone will automatically trigger on the new tag"
-          # Drone CI will automatically trigger on the tag push event
+          # Drone CI will automatically trigger on the tag push event

.github/workflows/README-DOCKER.md

@@ -0,0 +1,213 @@
+# Docker Build and Push Workflow
+
+This GitHub Actions workflow automatically builds and pushes Docker images for both the backend and frontend to GitHub Container Registry (ghcr.io).
+
+## Features
+
+- 🔧 **Automatic builds** on push to main/develop branches, PRs, and releases
+- 🏗️ **Multi-architecture support** (linux/amd64 and linux/arm64)
+- 🏷️ **Smart tagging** based on branches, versions, and commits
+- 🔒 **Security scanning** with Trivy vulnerability scanner
+- 💾 **Build caching** for faster subsequent builds
+- 📊 **Build summaries** in GitHub Actions UI
+
+## Authentication
+
+The workflow uses the built-in `GITHUB_TOKEN` for authentication with GitHub Container Registry. No additional setup or personal access tokens are required.
+
+### Required Permissions
+
+The workflow automatically sets the necessary permissions:
+- `contents: read` - To checkout the repository
+- `packages: write` - To push images to ghcr.io
+- `security-events: write` - To upload security scan results
+
+## Image Tags
+
+Images are automatically tagged based on the trigger event:
+
+| Event | Tags Generated |
+|-------|---------------|
+| Push to main | `latest`, `main`, `main-<short-sha>` |
+| Push to develop | `develop`, `develop-<short-sha>` |
+| Pull Request | `pr-<number>` |
+| Release (v1.2.3) | `1.2.3`, `1.2`, `1`, `latest` |
+| Manual trigger | Based on branch + optional push |
+
+## Usage
+
+### Pull Images
+
+Once published, images can be pulled using:
+
+```bash
+# Pull backend image
+docker pull ghcr.io/the-luap/picpeak/backend:latest
+
+# Pull frontend image
+docker pull ghcr.io/the-luap/picpeak/frontend:latest
+
+# Pull specific version
+docker pull ghcr.io/the-luap/picpeak/backend:v1.0.0
+
+# Pull for specific architecture
+docker pull --platform linux/arm64 ghcr.io/the-luap/picpeak/backend:latest
+```
+
+### Using in Docker Compose
+
+```yaml
+version: '3.8'
+
+services:
+  backend:
+    image: ghcr.io/the-luap/picpeak/backend:latest
+    environment:
+      - NODE_ENV=production
+    ports:
+      - "3001:3000"
+
+  frontend:
+    image: ghcr.io/the-luap/picpeak/frontend:latest
+    ports:
+      - "80:80"
+```
+
+### Using in Kubernetes
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: picpeak-backend
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: ghcr.io/the-luap/picpeak/backend:latest
+        imagePullPolicy: Always
+```
+
+## Manual Workflow Trigger
+
+You can manually trigger the workflow from the Actions tab:
+
+1. Go to Actions → "Build and Push Docker Images"
+2. Click "Run workflow"
+3. Select branch and whether to push images
+4. Click "Run workflow"
+
+## Security Scanning
+
+The workflow includes Trivy vulnerability scanning that:
+- Scans for CRITICAL and HIGH severity vulnerabilities
+- Uploads results to GitHub Security tab
+- Available under Security → Code scanning alerts
+
+## Build Optimization
+
+The workflow uses several optimization techniques:
+
+1. **GitHub Actions Cache**: Speeds up builds by caching layers
+2. **Multi-stage builds**: Reduces final image size
+3. **Parallel builds**: Backend and frontend build simultaneously
+4. **Smart rebuilds**: Only rebuilds changed components
+
+## Troubleshooting
+
+### Permission Denied Errors
+
+If you encounter permission errors when pushing images:
+
+1. **First-time setup**: The first push creates a private package. You may need to:
+   - Go to your package settings at `https://github.com/users/YOUR_USERNAME/packages`
+   - Link the package to your repository
+   - Set package visibility (public/private)
+
+2. **Organization repositories**: Ensure the organization allows GitHub Actions to create packages
+
+### Build Failures
+
+Check the workflow logs in the Actions tab for detailed error messages. Common issues:
+- Missing dependencies in package.json
+- Dockerfile syntax errors
+- Network issues during package installation
+
+### Image Not Found
+
+If images aren't visible after successful push:
+- Check package visibility settings
+- Ensure you're authenticated to pull private images:
+  ```bash
+  echo $GITHUB_TOKEN | docker login ghcr.io -u YOUR_USERNAME --password-stdin
+  ```
+
+## Package Management
+
+### View Packages
+
+Your Docker images are available at:
+- Backend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Fbackend`
+- Frontend: `https://github.com/users/the-luap/packages/container/package/picpeak%2Ffrontend`
+
+### Delete Old Versions
+
+To save storage, you can delete old versions:
+1. Go to package settings
+2. Click on "Manage versions"
+3. Select versions to delete
+4. Click "Delete selected versions"
+
+### Set Retention Policy
+
+Configure automatic cleanup in package settings:
+1. Go to package settings
+2. Click on "Manage Actions access"
+3. Set retention days for untagged versions
+
+## Best Practices
+
+1. **Use semantic versioning** for releases (e.g., v1.2.3)
+2. **Test images locally** before pushing to production
+3. **Monitor security alerts** from Trivy scans
+4. **Clean up old images** regularly to save storage
+5. **Use specific tags** in production (avoid `latest`)
+
+## Advanced Configuration
+
+### Custom Registry
+
+To use a different registry, update the workflow:
+
+```yaml
+env:
+  REGISTRY: docker.io  # or your custom registry
+  BACKEND_IMAGE_NAME: yourusername/picpeak-backend
+```
+
+### Additional Platforms
+
+To build for more platforms:
+
+```yaml
+platforms: linux/amd64,linux/arm64,linux/arm/v7
+```
+
+### Custom Build Arguments
+
+Add build arguments in the workflow:
+
+```yaml
+build-args: |
+  NODE_VERSION=20
+  API_URL=${{ secrets.API_URL }}
+```
+
+## Related Documentation
+
+- [GitHub Container Registry Docs](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry)
+- [Docker Build Action](https://github.com/docker/build-push-action)
+- [Trivy Security Scanner](https://github.com/aquasecurity/trivy)
+- [Multi-platform Builds](https://docs.docker.com/build/building/multi-platform/)

.github/workflows/docker-build.yml

@@ -0,0 +1,229 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    branches: [ main, develop ]
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ main ]
+  release:
+    types: [ published ]
+  workflow_dispatch:
+    inputs:
+      push:
+        description: 'Push images to registry'
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+
+env:
+  REGISTRY: ghcr.io
+  BACKEND_IMAGE_NAME: ${{ github.repository }}/backend
+  FRONTEND_IMAGE_NAME: ${{ github.repository }}/frontend
+
+jobs:
+  build-backend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        platforms: linux/amd64,linux/arm64
+
+    - name: Log in to Container Registry
+      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Extract metadata for Backend
+      id: meta-backend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Backend
+          org.opencontainers.image.description=PicPeak photo sharing platform backend service
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+          type=sha,prefix={{branch}}-,format=short
+          type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Build and push Backend Docker image
+      uses: docker/build-push-action@v5
+      with:
+        context: ./backend
+        file: ./backend/Dockerfile
+        # Always build; only push when registry login succeeded
+        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
+        tags: ${{ steps.meta-backend.outputs.tags }}
+        labels: ${{ steps.meta-backend.outputs.labels }}
+        platforms: linux/amd64,linux/arm64
+        cache-from: type=gha,scope=backend
+        cache-to: type=gha,mode=max,scope=backend
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-backend.outputs.version }}
+
+    - name: Run Trivy vulnerability scanner
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:${{ steps.meta-backend.outputs.version }}
+        format: 'sarif'
+        output: 'trivy-backend.sarif'
+        severity: 'CRITICAL,HIGH'
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: 'trivy-backend.sarif'
+        category: 'backend-vulnerabilities'
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        platforms: linux/amd64,linux/arm64
+
+    - name: Log in to Container Registry
+      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
+      id: login-ghcr
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Extract metadata for Frontend
+      id: meta-frontend
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}
+        labels: |
+          org.opencontainers.image.title=PicPeak Frontend
+          org.opencontainers.image.description=PicPeak photo sharing platform frontend application
+          org.opencontainers.image.vendor=PicPeak
+          maintainer=${{ github.repository_owner }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+          type=sha,prefix={{branch}}-,format=short
+          type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Build and push Frontend Docker image
+      uses: docker/build-push-action@v5
+      with:
+        context: ./frontend
+        file: ./frontend/Dockerfile
+        # Always build; only push when registry login succeeded
+        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
+        tags: ${{ steps.meta-frontend.outputs.tags }}
+        labels: ${{ steps.meta-frontend.outputs.labels }}
+        platforms: linux/amd64,linux/arm64
+        cache-from: type=gha,scope=frontend
+        cache-to: type=gha,mode=max,scope=frontend
+        build-args: |
+          CACHEBUST=${{ github.run_number }}
+          BUILD_DATE=${{ github.event.head_commit.timestamp }}
+          VCS_REF=${{ github.sha }}
+          VERSION=${{ steps.meta-frontend.outputs.version }}
+
+    - name: Run Trivy vulnerability scanner
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ steps.meta-frontend.outputs.version }}
+        format: 'sarif'
+        output: 'trivy-frontend.sarif'
+        severity: 'CRITICAL,HIGH'
+        timeout: '10m'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: 'trivy-frontend.sarif'
+        category: 'frontend-vulnerabilities'
+
+  # Note: The publish-manifest job is not needed since docker/build-push-action@v5
+  # automatically creates multi-arch manifests when building for multiple platforms.
+  # The images are already properly tagged and include all architectures.
+
+  summary:
+    needs: [build-backend, build-frontend]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    
+    steps:
+    - name: Build Summary
+      run: |
+        echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        if [[ "${{ needs.build-backend.result }}" == "success" ]]; then
+          echo "✅ **Backend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Backend**: Build failed" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        if [[ "${{ needs.build-frontend.result }}" == "success" ]]; then
+          echo "✅ **Frontend**: Successfully built" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "❌ **Frontend**: Build failed" >> $GITHUB_STEP_SUMMARY
+        fi
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 📦 Images" >> $GITHUB_STEP_SUMMARY
+        echo "- Backend: \`${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
+        echo "- Frontend: \`${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 🏷️ Tags" >> $GITHUB_STEP_SUMMARY
+        echo "Images are tagged based on:" >> $GITHUB_STEP_SUMMARY
+        echo "- Branch name (for branch pushes)" >> $GITHUB_STEP_SUMMARY
+        echo "- PR number (for pull requests)" >> $GITHUB_STEP_SUMMARY
+        echo "- Version tags (for releases)" >> $GITHUB_STEP_SUMMARY
+        echo "- Short SHA with branch prefix" >> $GITHUB_STEP_SUMMARY
+        echo "- \`latest\` (for main branch)" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -72,3 +72,12 @@ logs/
 storage/
 data/
 certbot/
+
+# Ignore local contributor guide copy
+AGENTS.md
+
+# Local artifacts from browser tooling
+.playwright-mcp/
+
+# Local SQLite files in backend
+backend/*.sqlite*

CLAUDE.md

@@ -334,6 +334,23 @@ Run backup service test: `npm run test-backup`
 - `backup_runs`: Tracks each backup execution with statistics
 - `backup_file_states`: Stores file checksums for change detection
 
+## Thumbnail Generation
+
+### Square Thumbnail Implementation (Issue #12 Fix)
+The system now generates **square 300x300px thumbnails** to prevent blurry/stretched images in the gallery grid:
+
+- **Problem**: Previously generated 300px width with proportional height (e.g., 300x200 for 3:2 photos), but CSS forced square display causing distortion
+- **Solution**: Thumbnails now use `cover` fit mode to crop to exact 300x300px dimensions with center positioning
+- **Configuration**: Settings stored in `app_settings` table with keys: `thumbnail_width`, `thumbnail_height`, `thumbnail_fit`, `thumbnail_quality`, `thumbnail_format`
+- **Migration**: Run `040_add_thumbnail_settings.js` to add default square thumbnail settings
+- **Regeneration Script**: Use `scripts/regenerate-square-thumbnails.js` to update existing thumbnails
+
+### Thumbnail Settings API
+- `GET /api/admin/thumbnails/settings` - Get current thumbnail configuration
+- `PUT /api/admin/thumbnails/settings` - Update thumbnail settings (requires regeneration)
+- `POST /api/admin/thumbnails/regenerate` - Regenerate all thumbnails with new settings
+- `GET /api/admin/thumbnails/regenerate/status` - Check regeneration progress
+
 ## Success Metrics (from PRD)
 - Time to generate gallery: <2 minutes
 - Guest satisfaction: >90%
@@ -365,4 +382,5 @@ Run backup service test: `npm run test-backup`
 - [ ] Backup strategy confirmed
 - [ ] Monitoring alerts configured
 - [ ] Rollback procedure documented
-- [ ] Stakeholders notified of maintenance window
+- [ ] Stakeholders notified of maintenance window
+- always use docker deployment for testing

DEPLOYMENT_GUIDE.md

@@ -1,6 +1,65 @@
 # 🚀 PicPeak Deployment Guide
 
-This guide covers deploying PicPeak using Docker Compose with direct port exposure. For internet-facing deployments, you'll need to add a reverse proxy (nginx, Traefik, Caddy, etc.) for SSL/HTTPS.
+This guide covers multiple deployment options for PicPeak, from simple local setups to production-ready configurations.
+
+## 🎯 Quick Start - Simple Setup (Recommended for Beginners)
+
+For the easiest installation without Docker or complex configurations, use our **unified setup script**:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+chmod +x setup.sh && \
+sudo ./setup.sh
+```
+
+This automated script handles everything including:
+- Choice between Docker or Native installation
+- OS detection and dependency installation
+- Database setup and service configuration
+- SSL/HTTPS setup (optional)
+
+Perfect for:
+- Small to medium deployments
+- Local or VPS installations  
+- Users new to server management
+- Quick testing and evaluation
+
+👉 **See [SIMPLE_SETUP.md](./SIMPLE_SETUP.md) for detailed instructions.**
+
+---
+
+## 🐳 Docker Compose Deployment
+
+### Option 1: Using Pre-built Images (Recommended)
+
+PicPeak provides official Docker images via GitHub Container Registry for quick deployment without building:
+
+```bash
+# Clone repository for configuration files
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy and configure environment
+cp .env.example .env
+nano .env  # Edit with your values
+
+# Use pre-built images deployment
+docker compose -f docker-compose.production.yml up -d
+```
+
+The production compose file uses:
+- **Backend**: `ghcr.io/the-luap/picpeak/backend:latest`
+- **Frontend**: `ghcr.io/the-luap/picpeak/frontend:latest`
+
+Available tags:
+- `latest` - Latest stable release
+- `main` - Latest main branch build
+- `develop` - Development branch (may be unstable)
+- `v1.0.0` - Specific version tags
+
+### Option 2: Building from Source
+
+If you need to customize the application or the pre-built images aren't available, you can build locally:
 
 ## 📋 Table of Contents
 
@@ -8,9 +67,11 @@ This guide covers deploying PicPeak using Docker Compose with direct port exposu
 - [Quick Start](#quick-start)
 - [Configuration](#configuration)
 - [Deployment](#deployment)
+- [First Login](#first-login)
 - [Reverse Proxy Setup](#reverse-proxy-setup)
 - [Maintenance](#maintenance)
 - [Troubleshooting](#troubleshooting)
+ - [External Media Library](#external-media-library)
 
 ## Prerequisites
 
@@ -21,10 +82,12 @@ This guide covers deploying PicPeak using Docker Compose with direct port exposu
 
 ## 🚀 Quick Start
 
-1. **Clone the repository**
+### Method 1: Using Pre-built Images (Fastest)
+
+1. **Clone the repository for configs**
    ```bash
-   git clone https://github.com/yourusername/wedding-photo-sharing.git
-   cd wedding-photo-sharing
+   git clone https://github.com/the-luap/picpeak.git
+   cd picpeak
    ```
 
 2. **Set up environment**
@@ -39,8 +102,76 @@ This guide covers deploying PicPeak using Docker Compose with direct port exposu
    chmod -R 755 events data logs backup storage
    ```
 
-4. **Deploy**
+4. **Deploy using pre-built images**
    ```bash
+   docker compose -f docker-compose.production.yml up -d
+   ```
+
+5. **Check logs**
+   ```bash
+   docker compose -f docker-compose.production.yml logs -f
+   ```
+
+## External Media Library
+
+PicPeak can reference an existing, read‑only media library mounted into the backend container. This avoids copying originals into PicPeak storage.
+
+- Map your host library path to the container as read‑only in `docker-compose.production.yml`:
+  - Add volume under `backend`: `- ${EXTERNAL_MEDIA}:/external-media:ro`
+  - Add backend env: `EXTERNAL_MEDIA_ROOT=/external-media`
+- In `.env`, set:
+  - `EXTERNAL_MEDIA=/mnt/photos` (example host path)
+  - `EXTERNAL_MEDIA_ROOT=/external-media`
+
+Usage:
+- In Admin → Events, set “Source Mode” to “Reference (external folder)”, select a folder under `/external-media`, then import to index and generate thumbnails. Originals stay in your library.
+
+Backups and Archives:
+- Backups only include data under `STORAGE_PATH` and exclude external originals. The backup manifest includes `metadata.external_references = { excluded: true, events: N, photos: M }` and the Admin UI surfaces a warning.
+- Archiving reference events creates a manifest‑only ZIP and deletes thumbnails for that event. External originals are never moved or deleted.
+
+Local (npm) setup (no Docker):
+
+1. Create or choose a folder that contains your external originals, e.g. `/Users/you/Pictures/picpeak-external` (macOS/Linux) or `C:\\Pictures\\picpeak-external` (Windows).
+2. In `backend/.env` (or your shell), set:
+   - `EXTERNAL_MEDIA_ROOT=/absolute/path/to/picpeak-external`
+   - Ensure `STORAGE_PATH` points to your PicPeak storage (defaults to `./storage`).
+3. Start services from source:
+   - Backend: `cd backend && npm install && npm run migrate && JWT_SECRET=... npm start`
+   - Frontend: `cd frontend && npm install && npm run dev` (or build + serve)
+4. In Admin → Events:
+   - Create an event, set “Source Mode” to “Reference (external folder)”.
+   - Use the folder picker to browse under your `EXTERNAL_MEDIA_ROOT` and select the subfolder to reference.
+   - Click “Import from selected folder” to index files and generate thumbnails on demand.
+
+Notes:
+- PicPeak only reads from `EXTERNAL_MEDIA_ROOT`; it never modifies or deletes your originals there.
+- Thumbnails are generated under `STORAGE_PATH/thumbnails` and are included in backups; originals in `EXTERNAL_MEDIA_ROOT` are excluded.
+- On Windows, use absolute paths (e.g., `C:\\Photos\\Library`) for `EXTERNAL_MEDIA_ROOT`.
+
+### Method 2: Building from Source
+
+1. **Clone the repository**
+   ```bash
+   git clone https://github.com/the-luap/picpeak.git
+   cd picpeak
+   ```
+
+2. **Set up environment**
+   ```bash
+   cp .env.example .env
+   nano .env  # Edit with your values
+   ```
+
+3. **Create required directories**
+   ```bash
+   mkdir -p events/active events/archived data logs backup storage
+   chmod -R 755 events data logs backup storage
+   ```
+
+4. **Build and deploy**
+   ```bash
+   docker compose build
    docker compose up -d
    ```
 
@@ -58,21 +189,75 @@ Generate secure values:
 # JWT Secret
 openssl rand -base64 64
 
-# Database Password
-openssl rand -base64 32
+# Database Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
 
-# Redis Password
-openssl rand -base64 32
+# Redis Password (avoid $ character - see warning below)
+openssl rand -base64 32 | tr -d '$'
 ```
 
+⚠️ **PASSWORD WARNING**: Docker Compose interprets `$` as variable substitution. Either:
+- Avoid `$` in passwords (recommended - use the commands above)
+- Escape `$` as `$$` (e.g., `Pass$$word` instead of `Pass$word`)
+- Quote the entire value: `DB_PASSWORD='Pass$word'` (less reliable)
+
+### Public Landing Page
+
+- `npm run migrate` now seeds three general settings: `general_public_site_enabled`, `general_public_site_html`, and `general_public_site_custom_css` so existing installs stay disabled by default.
+- Configure the feature from **Admin → CMS Pages**. The landing page panel exposes the toggle, HTML editor, optional CSS overrides, preview, and a reset-to-default action.
+- All HTML and CSS submitted through the UI is sanitized server-side. Scripts, inline event handlers, disallowed attributes, `@import` rules, and `javascript:` URLs are stripped before content is cached or rendered.
+- Resetting via the UI (or calling `POST /api/admin/settings/public-site/reset`) restores the bundled template and clears custom CSS.
+- The landing page response is cached in-memory. Override the default 60s cache window by setting `PUBLIC_SITE_CACHE_TTL_MS` (milliseconds) in your environment if you need faster cache busting.
+- When the toggle is off PicPeak continues to serve the SPA/login redirect at `/`, preserving legacy behaviour until you explicitly enable the feature.
+
+### Backend Configuration (.env)
 Update `.env` with:
-- `JWT_SECRET` - Authentication secret
+- `JWT_SECRET` - Authentication secret (REQUIRED - generate a secure random value)
 - `DB_PASSWORD` - PostgreSQL password
 - `REDIS_PASSWORD` - Redis password
 - `SMTP_*` - Email configuration
-- `FRONTEND_URL` - Your domain URL
-- `ADMIN_URL` - Backend admin URL
-- `VITE_API_URL` - API URL for frontend
+- **URL Configuration** (for backend CORS):
+  - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
+    - Example (Docker): `http://localhost:3000`
+  - `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+    - Example (Docker): `http://localhost:3000`
+  
+  Notes:
+  - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
+  - Always include the scheme (`http://` or `https://`).
+  - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
+
+#### External Database Example
+To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
+
+```env
+DB_HOST=db.example.com
+DB_PORT=5432
+DB_USER=picpeak
+DB_PASSWORD=change_me
+DB_NAME=picpeak_prod
+```
+
+Compose uses these values via `env_file: .env`. The backend service also defaults `DB_HOST=${DB_HOST:-postgres}` so if you don’t set `DB_HOST` it will use the bundled `postgres` container.
+
+### Frontend Configuration (frontend/.env)
+Create `frontend/.env` from `frontend/.env.example`:
+```bash
+cp frontend/.env.example frontend/.env
+```
+
+Update `frontend/.env` with:
+- `VITE_API_URL` - Backend API URL
+  - Docker (pre-built images) and production behind reverse proxy: `/api` (recommended; avoids CORS and matches the frontend Nginx proxy in the image)
+  - Local dev (Vite): `http://localhost:3001` or `/api` if proxying through a dev proxy
+
+Note: When using pre-built frontend images, runtime container env does not change the already-built JS. Prefer the default `/api` and let the frontend Nginx proxy forward to the backend.
+
+⚠️ **IMPORTANT PORT CONFIGURATION**: 
+- The frontend runs on port **3000** in Docker (exposed via nginx)
+- The backend API runs on port **3001**
+- The frontend `.env` file MUST point to the correct backend port (3001)
+- Default `.env.example` is configured for Docker deployment
 
 ### Email Configuration Examples
 
@@ -96,12 +281,29 @@ SMTP_PASS=your-sendgrid-api-key
 
 ## 📦 Deployment
 
-### Build and Start Services
+### Using Pre-built Images (Fastest)
 
 ```bash
-# Build images
+# Pull latest images from GitHub Container Registry
+docker pull ghcr.io/the-luap/picpeak/backend:latest
+docker pull ghcr.io/the-luap/picpeak/frontend:latest
+
+# Start services using production compose file
+docker compose -f docker-compose.production.yml up -d
+
+# View running containers
+docker compose ps
+```
+
+### Building from Source (For Customization)
+
+```bash
+# Build images locally
 docker compose build
 
+# Or build with no cache for clean build
+docker compose build --no-cache
+
 # Start all services
 docker compose up -d
 
@@ -112,27 +314,135 @@ docker compose ps
 ### Access Points
 
 By default, services are exposed on:
-- Frontend: http://localhost:3000
-- Backend/API: http://localhost:3001
+- Frontend (UI + Admin): http://localhost:3000 (admin at `/admin`)
+- Backend/API: http://localhost:3001 (API only; no UI routes)
 - PostgreSQL: localhost:5432 (if needed)
 - Redis: localhost:6379 (if needed)
 
 ### Initial Admin Setup
 
-The admin credentials are generated during first startup. Check the logs:
+When deploying for the first time, an admin account is automatically created with a secure, randomly generated password. This password is displayed in the Docker logs during initialization and **must be changed** on first login.
 
+#### Finding the Auto-Generated Admin Password
+
+The admin password is automatically generated during the first startup and displayed in the backend container logs. Here's how to find it:
+
+**Option 1: Search Docker logs for admin password** (recommended)
 ```bash
-docker compose logs backend | grep -A 5 "Admin user created"
+# Find the auto-generated admin password in logs
+docker compose logs backend | grep "Admin password"
 ```
 
-Or use the helper script:
+You should see output like:
+```
+✅ Admin password generated: BraveTiger6231!
+```
+
+**Option 2: View the complete initialization logs**
 ```bash
+# View the complete admin setup logs
+docker compose logs backend | grep -A 10 "Admin user created"
+```
+
+**Option 3: Check the saved credentials file**
+```bash
+# The password is also saved in the backend container
+docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
+```
+
+**Option 4: Use the helper script**
+```bash
+# Show current admin username and email (password is hidden)
 docker exec picpeak-backend node scripts/show-admin-credentials.js
 
-# To reset password
+# Reset the admin password to a new random password
 docker exec picpeak-backend node scripts/show-admin-credentials.js --reset
 ```
 
+#### Important Security Notes
+
+- **Login requires the email address**, not username
+- The admin password is only displayed once during initial setup
+- **Password change is MANDATORY** on first login - the system will force you to change it
+- If you lose the password before first login, use the `--reset` option to generate a new one
+- New password requirements: minimum 12 characters, mixed case, numbers, and special characters
+
+## 🔐 First Login
+
+After deployment, you must complete the first login process which includes mandatory password change for security.
+
+### Step 1: Locate Your Admin Password
+
+1. **Find the auto-generated password** from the credentials file:
+   ```bash
+   # Docker deployment
+   docker compose exec backend cat /app/data/ADMIN_CREDENTIALS.txt
+   
+   # Or directly from the host (if you have access)
+   cat data/ADMIN_CREDENTIALS.txt
+   ```
+
+2. **Note the admin email** (default: `admin@example.com` unless customized)
+
+### Step 2: Access Admin Panel
+
+1. Navigate to your frontend domain and open the admin section:
+   - `http://your-domain.com/admin` (behind reverse proxy)
+   - `http://localhost:3000/admin` (Docker local)
+   
+   The backend at `:3001` serves API only and does not serve the admin UI.
+2. Login using:
+   - **Email**: `admin@example.com` (or your custom admin email)
+   - **Password**: The auto-generated password from the logs
+
+### Step 3: Mandatory Password Change
+
+Upon first login, the system will **automatically redirect** you to change your password:
+
+1. **You cannot skip this step** - it's enforced for security
+2. Enter the current auto-generated password
+3. Create a new secure password meeting these requirements:
+   - Minimum 12 characters
+   - At least one uppercase letter
+   - At least one lowercase letter
+   - At least one number
+   - At least one special character (!@#$%^&*)
+
+### Security Best Practices for New Password
+
+- **Use a unique password** not used elsewhere
+- **Consider a password manager** for generation and storage
+- **Include mixed characters**: `MySecureP@ssw0rd2024!`
+- **Avoid personal information** (names, dates, etc.)
+- **Save securely** - you cannot recover this password easily
+
+### If You Lose Access
+
+If you lose your admin credentials after the first login, you'll need to manually reset the password in the database or create a new admin user through the database.
+
+**Note**: The credentials file (`ADMIN_CREDENTIALS.txt`) is only created during initial deployment and contains the first admin password. After changing the password, this file becomes outdated but is kept for reference. If you need to regenerate the password and file during a reinstall, re-run the installer with the `--force-admin-password-reset` flag:
+
+```bash
+# Native reinstall example
+sudo ./setup.sh --native --force-admin-password-reset
+
+# Docker reinstall example
+sudo ./setup.sh --docker --force-admin-password-reset
+```
+
+The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.
+
+#### Configuring Admin Email
+
+By default, the admin email is `admin@example.com`. To use a different email address, set it in your `.env` file before first deployment:
+
+```env
+# .env
+ADMIN_EMAIL=your-email@yourdomain.com
+```
+
+**Note**: This only works on first deployment. To change the admin email after deployment, you'll need to update it in the database or create a new admin user through the admin panel.
+
 ## 🔒 Reverse Proxy Setup
 
 For production deployments, you should use a reverse proxy for SSL/HTTPS. The application exposes ports directly, allowing you to use any reverse proxy solution.
@@ -164,7 +474,16 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # Backend API
+    # Frontend (serves UI and /admin/*)
+    location / {
+        proxy_pass http://localhost:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Backend API and protected resources
     location /api {
         proxy_pass http://localhost:3001;
         proxy_set_header Host $host;
@@ -172,21 +491,11 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
-
-    # Protected photos and uploads
     location ~ ^/(photos|thumbnails|uploads) {
         proxy_pass http://localhost:3001;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
-    # Admin routes
-    location /admin {
-        proxy_pass http://localhost:3001;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
@@ -303,14 +612,50 @@ The application includes a built-in backup service. Configure it in the admin pa
 
 ### Updates
 
+#### Method 1: Using Pre-built Images (Recommended)
+
+```bash
+# Pull latest changes (for configuration updates)
+git pull
+
+# Pull latest images from GitHub Container Registry
+docker compose -f docker-compose.production.yml pull
+
+# Restart with new images
+docker compose -f docker-compose.production.yml down
+docker compose -f docker-compose.production.yml up -d
+
+# Verify services are healthy
+docker compose -f docker-compose.production.yml ps
+```
+
+#### Method 2: Building from Source
+
 ```bash
 # Pull latest changes
 git pull
 
 # Rebuild and restart
 docker compose down
-docker compose build
+docker compose build --no-cache
 docker compose up -d
+
+# Verify services are healthy
+docker compose ps
+```
+
+#### Specific Version Updates
+
+To use a specific version of the images:
+
+```bash
+# Edit docker-compose.production.yml to specify version tags
+# Change: ghcr.io/the-luap/picpeak/backend:latest
+# To:     ghcr.io/the-luap/picpeak/backend:v1.0.0
+
+# Then pull and restart
+docker compose -f docker-compose.production.yml pull
+docker compose -f docker-compose.production.yml up -d
 ```
 
 ### Database Migrations
@@ -325,6 +670,54 @@ docker exec picpeak-backend npm run migrate
 
 ### Common Issues
 
+#### 502 Bad Gateway / Login Failures
+**This is the most common deployment issue!** Usually caused by misconfigured URLs or network problems:
+
+1. **CORS Configuration Errors**:
+   ```bash
+   # WRONG - Missing port will cause CORS errors
+   FRONTEND_URL=http://10.0.252.12
+   
+   # CORRECT - Include the port you're accessing from
+   FRONTEND_URL=http://10.0.252.12:3000
+   ```
+   
+   The backend validates Origin headers against `FRONTEND_URL` for CORS. If they don't match exactly, you'll get 500 errors on login.
+
+2. **After Container Restarts**:
+   - Nginx may have cached old container IPs
+   - Solution: `docker restart picpeak-frontend`
+   - Always wait 30-60 seconds for health checks
+
+3. **Backend Not Starting After Migrations**:
+   - The logs may only show migrations completed
+   - Check if server is actually running: `docker exec picpeak-backend ps aux | grep node`
+   - Should see `node server.js` process
+
+4. **Login After Fresh Install**:
+   - Check backend logs for auto-generated admin password: `docker compose logs backend | grep "Admin password"`
+   - Email: `admin@example.com` (or your custom admin email from .env)
+   - Password: Auto-generated and shown in logs (e.g., `BraveTiger6231!`)
+   - Remember: Password MUST be changed on first login
+
+5. **Complete Fix Sequence**:
+   ```bash
+   # 1. Fix your .env file URLs
+   # 2. Full restart
+   docker-compose down
+   docker-compose up -d
+   
+   # 3. Wait for healthy status
+   sleep 60
+   docker ps  # All should show (healthy)
+   
+   # 4. Test backend directly
+   curl http://localhost:3001/health
+   
+   # 5. Test through frontend
+   curl http://localhost:3000/api/public/settings
+   ```
+
 #### Port Already in Use
 ```bash
 # Check what's using the port
@@ -336,6 +729,17 @@ FRONTEND_PORT=3002
 BACKEND_PORT=3003
 ```
 
+#### Docker Compose Variable Substitution Errors
+If you see warnings like:
+```
+WARN[0000] The "fgbf" variable is not set. Defaulting to a blank string.
+```
+
+This means your password contains `$` which Docker Compose interprets as a variable. Solutions:
+1. **Best**: Generate passwords without `$`: `openssl rand -base64 32 | tr -d '$'`
+2. **Alternative**: Escape `$` as `$$` in your .env file
+3. **Example**: `DB_PASSWORD=Pass@#$$fgbf` instead of `DB_PASSWORD=Pass@#$fgbf`
+
 #### Permission Errors
 ```bash
 # Fix ownership
@@ -412,4 +816,4 @@ For issues and questions:
   - Error messages
   - Log output
   - Environment details (without secrets)
-  - Steps to reproduce
+  - Steps to reproduce

README.md

@@ -28,11 +28,13 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 
 ### For Photographers
 - 📁 **Drag & Drop Upload** - Simply drop photos into folders
+- 🔗 **External Media (Reference Mode)** - Browse and import from a read‑only external folder library without copying originals
 - ⏰ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days)
 - 🔐 **Password Protection** - Secure client galleries
 - 📧 **Automated Emails** - Creation confirmations and expiration warnings
 - 📊 **Analytics Dashboard** - Track views, downloads, and engagement
 - 🎨 **Custom Themes** - Match your brand perfectly
+- 🌐 **Public Landing Page** - Publish a curated marketing page when guests visit your root URL
 
 ### For Clients
 - 🖼️ **Beautiful Galleries** - Clean, modern interface
@@ -40,10 +42,12 @@ Unlike expensive SaaS solutions, PicPeak gives you:
 - ⬇️ **Bulk Downloads** - Download all photos with one click
 - 🔍 **Smart Search** - Find photos quickly
 - 📤 **Guest Uploads** - Optional client photo uploads
+- 🛡️ **Download Protection** - Advanced image protection with watermarking and right-click prevention
 
 ### Technical Excellence
 - 🐳 **Docker Ready** - Deploy in minutes
 - 🔄 **Auto-Processing** - Automatic thumbnail generation
+- 🗂️ **Reference Library Support** - Point PicPeak at `EXTERNAL_MEDIA_ROOT` to reference existing originals, index quickly, and generate thumbnails on demand
 - 💾 **Smart Storage** - Automatic archiving of expired galleries
 - 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
 - 📈 **Scalable** - From small studios to large agencies
@@ -69,14 +73,35 @@ docker-compose up -d
 # Access at http://localhost:3005
 ```
 
+Note on Docker file permissions (PUID/PGID)
+- When using bind mounts (e.g., `./storage`, `./data`, `./logs`, `./events`), ensure the container user can write to these host folders. The backend runs as a non‑root user by default.
+- Set `PUID` and `PGID` in your `.env` to match your host user’s UID/GID (run `id -u` and `id -g` on the host). Compose maps the container user to these values.
+- Example in `.env`:
+  - `PUID=1000`
+  - `PGID=1000`
+- Without this, creating events, uploads, thumbnails, or logs can fail with “Permission denied”.
+
 ## 📖 Documentation
 
-- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
+  - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
 - 📋 [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines
 
+## 🌐 Public Landing Page
+
+Spotlight your studio with a customizable marketing page at `/`:
+
+- Head to **Admin → CMS Pages** to enable the public landing page toggle.
+- Edit the provided HTML template (rich sections, hero, testimonials) and optional CSS overrides.
+- The preview renders in a sandboxed iframe so you can iterate safely before publishing.
+- PicPeak sanitizes stored HTML and CSS server-side—scripts, iframes, and unsafe attributes are stripped automatically.
+- Use **Reset to default** anytime to restore the bundled template.
+- The backend caches the rendered landing page for 60 seconds by default; override with `PUBLIC_SITE_CACHE_TTL_MS` if you need a different TTL.
+- When the landing page is disabled PicPeak continues to serve the admin SPA/login exactly as before.
+
 ## 🎯 Use Cases
 
 Perfect for:
@@ -177,14 +202,27 @@ Organize and manage your photo galleries with intuitive event management tools.
 
 We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone.
 
+### 🚧 Beta Features (Use at your own risk)
+
+These features are currently in beta testing and may have limited functionality or stability:
+
+| Feature | Description | Status |
+|---------|-------------|--------|
+| **Download Protection** | Advanced image protection system with canvas rendering, invisible watermarking, and right-click prevention to protect your photos from unauthorized downloads | 🧪 Beta |
+| **Simple Deployment Script** | One-click deployment script for quick server setup with automated configuration and dependency installation | 🧪 Beta |
+
+### 📋 Future Enhancements
+
 | Feature | Description | Priority | Status |
 |---------|-------------|----------|---------|
 | **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
+| **External Media Library (Reference Mode)** | Use an external folder library as a read‑only source with import and on‑demand thumbnail generation | High | ✅ Implemented |
 | **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
-| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented (not tested) |
+| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
 | **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
 | **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
+| **Filtering & Export Options** | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
 
 **Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
 
@@ -209,7 +247,7 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
 ## 🚀 Ready to Get Started?
 
 1. ⭐ **Star this repository** to show your support
-2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+2. 📖 Read the [Deployment Guide](DEPLOYMENT_GUIDE.md)
 3. 🐛 Report issues or request features
 4. 🤝 Join our community and contribute!
 
@@ -219,6 +257,6 @@ PicPeak is released under the [MIT License](LICENSE). Use it freely for personal
   Made with ❤️ by photographers, for photographers
   <br>
   <a href="https://github.com/the-luap/picpeak">GitHub</a> •
-  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="DEPLOYMENT_GUIDE.md">Documentation</a> •
   <a href="https://github.com/the-luap/picpeak/issues">Support</a>
-</p>
+</p>

SIMPLE_SETUP.md

@@ -0,0 +1,544 @@
+# 🚀 PicPeak Simple Setup Guide
+
+This guide provides easy installation instructions for PicPeak on Linux servers with both Docker and non-Docker options.
+
+## 📋 Quick Start
+
+### One-Line Installation
+
+```bash
+# Download and run the unified setup script
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+chmod +x setup.sh && \
+sudo ./setup.sh
+```
+
+The script will automatically detect your environment and recommend the best installation method.
+
+## 🎯 Installation Methods
+
+### Method 1: Docker Installation (Recommended)
+Best for: Most users, easy updates, isolated environment
+
+```bash
+sudo ./setup.sh --docker
+```
+
+**Pros:**
+- ✅ Easier installation and updates
+- ✅ Better isolation from system
+- ✅ Consistent environment across platforms
+- ✅ Built-in PostgreSQL and Redis
+
+**Cons:**
+- ❌ Requires more resources (~4GB RAM recommended)
+- ❌ Additional Docker overhead
+
+### Method 2: Native Installation
+Best for: Resource-constrained systems, Raspberry Pi, direct control
+
+```bash
+sudo ./setup.sh --native
+```
+
+**Pros:**
+- ✅ Lower resource usage (~1GB RAM minimum)
+- ✅ Direct system control
+- ✅ No Docker overhead
+- ✅ Better for ARM devices
+
+**Cons:**
+- ❌ More complex setup
+- ❌ System dependencies required
+- ❌ Manual update process
+
+## 📋 System Requirements
+
+### Minimum Requirements
+- **OS**: Ubuntu 20.04+, Debian 11+, Fedora 38+, RHEL/CentOS 8+, Raspberry Pi OS
+- **RAM**: 
+  - Docker: 2GB minimum (4GB recommended)
+  - Native: 1GB minimum (2GB recommended)
+- **Storage**: 2GB for application + space for photos
+- **Network**: Port 3001 (or 80/443 with proxy)
+
+### Supported Platforms
+- ✅ Ubuntu 20.04, 22.04, 24.04
+- ✅ Debian 11, 12
+- ✅ Raspberry Pi OS (32-bit and 64-bit)
+- ✅ Fedora 38, 39, 40
+- ✅ RHEL/CentOS/Rocky/AlmaLinux 8, 9
+
+## 🛠️ Installation Options
+
+### Interactive Mode (Default)
+```bash
+sudo ./setup.sh
+```
+
+The script will prompt you to choose:
+1. Installation method (Docker or Native)
+2. Admin email and password
+3. Domain configuration (optional)
+4. Email server settings (optional)
+5. SSL/HTTPS setup (optional)
+
+### Unattended Installation
+
+#### Docker with full configuration:
+```bash
+sudo ./setup.sh --docker --unattended \
+  --domain photos.example.com \
+  --email admin@example.com \
+  --admin-password SecurePass123 \
+  --smtp-host smtp.gmail.com \
+  --smtp-port 587 \
+  --smtp-user your-email@gmail.com \
+  --smtp-pass your-app-password \
+  --enable-ssl
+```
+
+#### Native with minimal configuration:
+```bash
+sudo ./setup.sh --native --unattended \
+  --email admin@example.com \
+  --admin-password SecurePass123
+```
+
+### Command Line Options
+
+| Option | Description | Example |
+|--------|-------------|---------|
+| `--docker` | Use Docker installation | `--docker` |
+| `--native` | Use native installation | `--native` |
+| `--unattended` | Run without prompts | `--unattended` |
+| `--domain` | Domain for HTTPS setup | `--domain photos.example.com` |
+| `--email` | Admin email address | `--email admin@example.com` |
+| `--admin-password` | Set admin password | `--admin-password MySecurePass` |
+| `--smtp-host` | SMTP server hostname | `--smtp-host smtp.gmail.com` |
+| `--smtp-port` | SMTP server port | `--smtp-port 587` |
+| `--smtp-user` | SMTP username | `--smtp-user user@gmail.com` |
+| `--smtp-pass` | SMTP password | `--smtp-pass app-password` |
+| `--enable-ssl` | Enable HTTPS with Let's Encrypt | `--enable-ssl` |
+| `--port` | Custom port (native only) | `--port 8080` |
+| `--update` | Update existing installation | `--update` |
+| `--uninstall` | Remove installation | `--uninstall` |
+| `--help` | Show help message | `--help` |
+
+## 🏗️ What Gets Installed
+
+### Docker Installation
+```
+~/picpeak/                    # Or custom directory
+├── docker-compose.yml        # Service definitions
+├── .env                      # Configuration
+├── storage/
+│   └── events/              # Photo storage
+│       ├── active/          # Current galleries
+│       └── archived/        # Expired galleries
+├── logs/                    # Application logs
+└── backup/                  # Backup directory
+```
+
+**Services:**
+- PicPeak Backend (Node.js application)
+- PostgreSQL Database
+- Redis Cache
+- Nginx Reverse Proxy (optional)
+- Background Workers
+
+### Native Installation
+```
+/opt/picpeak/                # Installation directory
+├── backend/                 # Application code
+├── events/                  # Photo storage
+│   ├── active/             # Current galleries
+│   └── archived/           # Expired galleries
+├── logs/                   # Application logs
+└── config/                 # Configuration files
+```
+
+**Services (systemd):**
+- `picpeak-backend` - Main application
+- `picpeak-workers` - Background workers
+- `caddy` - Web server (optional)
+
+## 🌐 Access Methods
+
+### Direct Access (Simplest)
+- Docker: `http://your-server:3000` (frontend and admin at `/admin`)
+- Backend/API: `http://your-server:3001` (API only; no UI routes)
+  
+For native installs, serve the built frontend (e.g., with nginx or Caddy) and access the admin at `/admin` on the frontend domain.
+
+### With Domain & HTTPS
+If configured during setup:
+- `https://your-domain.com` - Gallery frontend
+- `https://your-domain.com/admin` - Admin panel
+
+### Behind Existing Proxy
+Add to your Nginx/Apache configuration (split frontend vs backend):
+```nginx
+# Frontend (UI + /admin/*)
+location / {
+    proxy_pass http://localhost:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection 'upgrade';
+    proxy_set_header Host $host;
+    proxy_cache_bypass $http_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+# Backend API and protected resources
+location /api {
+    proxy_pass http://localhost:3001;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection 'upgrade';
+    proxy_set_header Host $host;
+    proxy_cache_bypass $http_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    client_max_body_size 100M;
+}
+location ~ ^/(photos|thumbnails|uploads) {
+    proxy_pass http://localhost:3001;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+```
+
+## 📁 Managing Galleries
+
+### Creating a Gallery
+
+#### Method 1: Via Admin Panel (Recommended)
+1. Login to admin panel
+2. Click "Create New Event"
+3. Configure settings and upload photos
+
+#### Method 2: File System
+```bash
+# Docker installation
+mkdir -p ~/picpeak/storage/events/active/wedding-smith-2024
+cp /path/to/photos/* ~/picpeak/storage/events/active/wedding-smith-2024/
+
+# Native installation
+sudo mkdir -p /opt/picpeak/events/active/wedding-smith-2024
+sudo cp /path/to/photos/* /opt/picpeak/events/active/wedding-smith-2024/
+sudo chown -R picpeak:picpeak /opt/picpeak/events/active/wedding-smith-2024
+```
+
+### Gallery Structure
+```
+wedding-smith-2024/
+├── collages/        # Group photos
+├── individual/      # Individual photos
+└── thumbnails/      # Auto-generated thumbnails
+```
+
+## 🔧 Service Management
+
+### Docker Installation
+
+```bash
+cd ~/picpeak
+
+# Check status
+docker compose ps
+
+# View logs
+docker compose logs -f
+
+# Stop services
+docker compose down
+
+# Start services
+docker compose up -d
+
+# Restart services
+docker compose restart
+
+# Update PicPeak
+docker compose pull
+docker compose up -d
+```
+
+### Native Installation
+
+```bash
+# Check status
+sudo systemctl status picpeak-backend
+sudo systemctl status picpeak-workers
+
+# View logs
+sudo journalctl -u picpeak-backend -f
+sudo journalctl -u picpeak-workers -f
+
+# Start services
+sudo systemctl start picpeak-backend picpeak-workers
+
+# Stop services
+sudo systemctl stop picpeak-backend picpeak-workers
+
+# Restart services
+sudo systemctl restart picpeak-backend picpeak-workers
+
+# Update PicPeak
+# (reruns migrations to pick up schema fixes for native installs)
+sudo ./setup.sh --update
+```
+
+## ⚙️ Configuration
+
+### Docker Configuration
+Edit `~/picpeak/.env`:
+```bash
+nano ~/picpeak/.env
+docker compose restart
+```
+
+### Native Configuration
+Edit `/opt/picpeak/app/backend/.env`:
+```bash
+sudo nano /opt/picpeak/app/backend/.env
+sudo systemctl restart picpeak-backend
+```
+
+### Key Settings
+
+| Setting | Description | Default |
+|---------|-------------|---------|
+| `JWT_SECRET` | Token signing secret | Auto-generated |
+| `ADMIN_EMAIL` | Admin email | admin@example.com |
+| `ADMIN_PASSWORD` | Admin password | Auto-generated |
+| `PHOTOS_DIR` | Photo storage path | Varies by method |
+| `SMTP_ENABLED` | Email notifications | false |
+| `DEFAULT_EXPIRY_DAYS` | Gallery expiration | 30 |
+
+## 📧 Email Configuration
+
+### Gmail Setup
+1. Enable 2-Factor Authentication
+2. Generate App Password
+3. Configure:
+```env
+SMTP_ENABLED=true
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@gmail.com
+SMTP_PASS=your-app-password
+SMTP_FROM=noreply@yourdomain.com
+```
+
+### SendGrid Setup
+1. Sign up at sendgrid.com (100 emails/day free)
+2. Create API key
+3. Configure:
+```env
+SMTP_ENABLED=true
+SMTP_HOST=smtp.sendgrid.net
+SMTP_PORT=587
+SMTP_USER=apikey
+SMTP_PASS=your-sendgrid-api-key
+SMTP_FROM=verified-sender@yourdomain.com
+```
+
+## 🔄 Maintenance
+
+### Backups
+
+#### Docker:
+```bash
+# Backup script included
+cd ~/picpeak
+./backup.sh
+
+# Manual backup
+docker exec picpeak-postgres pg_dump -U picpeak picpeak > backup.sql
+tar -czf photos-backup.tar.gz storage/events/
+```
+
+#### Native:
+```bash
+# Database backup
+sudo cp /opt/picpeak/app/backend/data/photo_sharing.db /backup/database-$(date +%Y%m%d).sqlite
+
+# Photos backup
+sudo tar -czf /backup/photos-$(date +%Y%m%d).tar.gz /opt/picpeak/events/
+```
+
+### Updates
+
+```bash
+# Docker
+cd ~/picpeak
+docker compose pull
+docker compose up -d
+
+# Native
+sudo ./setup.sh --update
+```
+
+### Uninstall
+
+```bash
+# Will prompt for confirmation and data removal options
+sudo ./setup.sh --uninstall
+```
+
+## 🐛 Troubleshooting
+
+### Common Issues
+
+#### Service Won't Start
+```bash
+# Docker
+docker compose logs backend
+docker compose down && docker compose up -d
+
+# Native
+sudo journalctl -u picpeak-backend -n 50
+sudo systemctl restart picpeak-backend
+```
+
+#### Can't Access Admin Panel
+1. Check firewall:
+```bash
+# Ubuntu/Debian
+sudo ufw allow 3001
+
+# RHEL/CentOS
+sudo firewall-cmd --add-port=3001/tcp --permanent
+sudo firewall-cmd --reload
+```
+
+2. Verify service:
+```bash
+# Docker
+curl http://localhost:3001/api/health
+
+# Native
+sudo systemctl is-active picpeak-backend
+```
+
+#### Photos Not Showing
+```bash
+# Check permissions (Native)
+sudo chown -R picpeak:picpeak /opt/picpeak/events/
+sudo chmod -R 755 /opt/picpeak/events/
+
+# Check permissions (Docker)
+ls -la ~/picpeak/storage/events/
+```
+
+#### Reset Admin Password
+
+```bash
+# Docker
+docker exec picpeak-backend node scripts/reset-admin-password.js
+
+# Native
+cd /opt/picpeak/app/backend
+sudo -u picpeak node scripts/reset-admin-password.js
+```
+
+### Getting Help
+
+1. **Check logs:**
+   - Docker: `docker compose logs -f`
+   - Native: `sudo journalctl -u picpeak-backend -f`
+   - Installation: `/tmp/picpeak-setup-*.log`
+
+2. **Documentation:**
+   - [Full Documentation](https://github.com/the-luap/picpeak)
+   - [Deployment Guide](./DEPLOYMENT_GUIDE.md)
+
+3. **Support:**
+   - [GitHub Issues](https://github.com/the-luap/picpeak/issues)
+   - Include: Error messages, system info (`uname -a`), installation method
+
+## 🔒 Security Best Practices
+
+### Essential Security
+1. **Change default admin password immediately**
+2. **Use HTTPS for production** (Let's Encrypt included)
+3. **Configure firewall** (only open necessary ports)
+4. **Regular updates** (system and PicPeak)
+5. **Automated backups** (configure in admin panel)
+
+### Advanced Security
+- Use VPN for admin panel access
+- Configure fail2ban for brute force protection
+- Enable audit logging
+- Regular security scans
+- Implement IP whitelisting
+
+## 📊 Performance Optimization
+
+### Docker Optimization
+```yaml
+# Adjust in docker-compose.yml
+services:
+  backend:
+    deploy:
+      resources:
+        limits:
+          cpus: '2'
+          memory: 2G
+```
+
+### Native Optimization
+```bash
+# Increase Node.js memory
+echo "NODE_OPTIONS=--max-old-space-size=2048" >> /opt/picpeak/app/backend/.env
+sudo systemctl restart picpeak-backend
+```
+
+## 🎯 Quick Setup Examples
+
+### Home/Office Network
+```bash
+# Simple local setup without domain
+sudo ./setup.sh --native --email admin@local.com
+```
+
+### Public Website with HTTPS
+```bash
+# Full production setup
+sudo ./setup.sh --docker \
+  --domain photos.company.com \
+  --email admin@company.com \
+  --enable-ssl
+```
+
+### Raspberry Pi Setup
+```bash
+# Optimized for ARM devices
+sudo ./setup.sh --native \
+  --port 8080 \
+  --email pi@local.com
+```
+
+## ✅ Post-Installation Checklist
+
+- [ ] Admin password changed
+- [ ] Email configuration tested
+- [ ] First test gallery created
+- [ ] Backup schedule configured
+- [ ] Firewall rules applied
+- [ ] SSL certificate working (if applicable)
+- [ ] Monitoring setup
+- [ ] Documentation bookmarked
+
+---
+
+**PicPeak Setup v1.0** | [Documentation](https://github.com/the-luap/picpeak) | [Support](https://github.com/the-luap/picpeak/issues)

backend/Dockerfile

@@ -1,7 +1,15 @@
-FROM node:18-alpine AS builder
+FROM node:20-alpine AS builder
 
-# Add build argument for cache busting
+# Add build arguments
 ARG CACHEBUST=1
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION
+
+# Add labels for GitHub Container Registry
+LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
+LABEL org.opencontainers.image.description="PicPeak Backend Service"
+LABEL org.opencontainers.image.licenses="MIT"
 
 WORKDIR /app
 
@@ -15,7 +23,7 @@ RUN npm ci --only=production
 COPY . .
 
 # Production stage
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 

backend/__tests__/adminSettings.logo.test.js

@@ -0,0 +1,184 @@
+const fs = require('fs');
+const fsPromises = fs.promises;
+const os = require('os');
+const path = require('path');
+const express = require('express');
+const request = require('supertest');
+
+describe('Admin settings logo upload flow', () => {
+  let tmpDir;
+  let router;
+  let app;
+  let settingsStore;
+
+  const resetModules = () => {
+    jest.resetModules();
+    jest.clearAllMocks();
+  };
+
+  beforeEach(async () => {
+    resetModules();
+
+    tmpDir = await fsPromises.mkdtemp(path.join(os.tmpdir(), 'picpeak-logo-'));
+    process.env.STORAGE_PATH = tmpDir;
+
+    settingsStore = new Map();
+
+    const buildQuery = (table) => {
+      const filters = [];
+      const applyFilters = (rows) => {
+        if (filters.length === 0) {
+          return rows;
+        }
+        return rows.filter((row) =>
+          filters.every(({ column, value }) => row[column] === value)
+        );
+      };
+
+      const makeRow = (row) => ({ ...row });
+
+      return {
+        where(column, value) {
+          filters.push({ column, value });
+          return this;
+        },
+        first() {
+          if (table === 'app_settings') {
+            const rows = applyFilters(Array.from(settingsStore.values()).map(makeRow));
+            return Promise.resolve(rows[0]);
+          }
+          return Promise.resolve(undefined);
+        },
+        select() {
+          return Promise.resolve([]);
+        },
+        sum() {
+          return Promise.resolve({ total: 0 });
+        },
+        join() {
+          return this;
+        },
+        groupBy() {
+          return this;
+        },
+        orderBy() {
+          return this;
+        },
+        limit() {
+          return this;
+        },
+        insert(payload) {
+          const rows = Array.isArray(payload) ? payload : [payload];
+          const upsert = (row, overrides = {}) => {
+            if (table === 'app_settings') {
+              const key = row.setting_key;
+              const existing = settingsStore.get(key) || {};
+              settingsStore.set(key, { ...existing, ...row, ...overrides });
+            }
+            return Promise.resolve();
+          };
+
+          return {
+            onConflict() {
+              return {
+                merge(overrides) {
+                  return Promise.all(rows.map((row) => upsert(row, overrides))).then(() => undefined);
+                }
+              };
+            }
+          };
+        }
+      };
+    };
+
+    const dbMock = jest.fn((table) => buildQuery(table));
+    dbMock.raw = jest.fn();
+    dbMock.transaction = async (handler) => handler({
+      commit: async () => {},
+      rollback: async () => {}
+    });
+
+    jest.doMock('../src/database/db', () => ({
+      db: dbMock,
+      logActivity: jest.fn()
+    }));
+
+    jest.doMock('../src/middleware/auth', () => ({
+      adminAuth: (req, res, next) => {
+        req.admin = { id: 1, username: 'tester' };
+        next();
+      }
+    }));
+
+    jest.doMock('../src/services/publicSiteService', () => ({
+      clearPublicSiteCache: jest.fn(),
+      getDefaultPublicSitePayload: jest.fn(),
+      getRawPublicSiteSettings: jest.fn().mockResolvedValue({})
+    }));
+
+    jest.doMock('../src/services/rateLimitService', () => ({
+      clearSettingsCache: jest.fn()
+    }));
+
+    jest.doMock('../src/middleware/maintenance', () => ({
+      maintenanceMiddleware: (req, res, next) => next(),
+      clearMaintenanceCache: jest.fn()
+    }));
+
+    router = require('../src/routes/adminSettings');
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/settings', router);
+  });
+
+  afterEach(async () => {
+    resetModules();
+    if (tmpDir) {
+      await fsPromises.rm(tmpDir, { recursive: true, force: true });
+      tmpDir = null;
+    }
+    delete process.env.STORAGE_PATH;
+  });
+
+  it('stores logo uploads under STORAGE_PATH and deletes on branding reset', async () => {
+    const fileBuffer = Buffer.from('fake image data');
+
+    const uploadResponse = await request(app)
+      .post('/api/admin/settings/logo')
+      .attach('logo', fileBuffer, 'logo.png');
+
+    expect(uploadResponse.status).toBe(200);
+    expect(uploadResponse.body).toHaveProperty('logoUrl');
+    const logoUrl = uploadResponse.body.logoUrl;
+    expect(logoUrl.startsWith('/uploads/logos/')).toBe(true);
+
+    const storedPath = path.join(tmpDir, logoUrl.replace('/uploads/', 'uploads/'));
+    await expect(fsPromises.access(storedPath)).resolves.toBeUndefined();
+
+    await request(app)
+      .put('/api/admin/settings/branding')
+      .send({
+        company_name: 'Test Co',
+        company_tagline: 'Tagline',
+        support_email: 'test@example.com',
+        footer_text: 'Footer',
+        watermark_enabled: false,
+        watermark_position: 'bottom-right',
+        watermark_opacity: 0.5,
+        watermark_size: 'medium',
+        favicon_url: null,
+        logo_url: '',
+        watermark_logo_url: null,
+        logo_size: 'medium',
+        logo_max_height: 120,
+        logo_position: 'left',
+        logo_display_header: true,
+        logo_display_hero: false,
+        logo_display_mode: 'default'
+      })
+      .expect(200);
+
+    await expect(fsPromises.access(storedPath)).rejects.toThrow();
+  });
+});

backend/__tests__/integration/adminPhotos.reference.test.js

@@ -0,0 +1,207 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const express = require('express');
+const request = require('supertest');
+
+describe('Admin photos in reference mode', () => {
+  let tmpDir;
+  let storagePath;
+  let db;
+  let app;
+  let categoryId;
+
+  const resetModules = () => {
+    jest.resetModules();
+    jest.clearAllMocks();
+  };
+
+  beforeAll(async () => {
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-admin-photos-'));
+    storagePath = path.join(tmpDir, 'storage');
+    await fs.promises.mkdir(storagePath, { recursive: true });
+
+    process.env.NODE_ENV = 'test';
+    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'photo_sharing_test.db');
+    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
+    try {
+      await fs.promises.unlink(process.env.TEST_DATABASE_PATH);
+    } catch (_) {
+      /* ignore */
+    }
+    process.env.STORAGE_PATH = storagePath;
+
+    resetModules();
+
+    jest.doMock('../../src/middleware/auth', () => ({
+      adminAuth: (req, _res, next) => {
+        req.admin = { id: 1, username: 'tester' };
+        next();
+      }
+    }));
+
+    jest.doMock('../../src/services/imageProcessor', () => ({
+      generateThumbnail: jest.fn().mockResolvedValue('thumbnails/mock-thumb.jpg'),
+      ensureThumbnail: jest.fn()
+    }));
+
+    jest.doMock('../../src/middleware/uploadValidation', () => ({
+      validateUploadedFiles: (_req, _res, next) => next()
+    }));
+
+    jest.doMock('../../src/utils/fileSecurityUtils', () => {
+      const actual = jest.requireActual('../../src/utils/fileSecurityUtils');
+      return {
+        ...actual,
+        validateFileType: () => true,
+        createFileUploadValidator: () => (_req, _res, next) => next()
+      };
+    });
+
+    jest.doMock('../../src/utils/logger', () => ({
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn()
+    }));
+
+    const dbModule = require('../../src/database/db');
+    db = dbModule.db;
+
+    await db.schema.dropTableIfExists('photo_feedback');
+    await db.schema.dropTableIfExists('photos');
+    await db.schema.dropTableIfExists('photo_categories');
+    await db.schema.dropTableIfExists('events');
+
+    await db.schema.createTable('events', (table) => {
+      table.increments('id').primary();
+      table.string('slug').notNullable();
+      table.string('event_name').notNullable();
+      table.string('source_mode').notNullable();
+      table.string('external_path');
+    });
+
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name').notNullable();
+      table.string('slug').notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id');
+    });
+
+    await db.schema.createTable('photos', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').notNullable();
+      table.string('filename').notNullable();
+      table.string('path').notNullable();
+      table.string('thumbnail_path');
+      table.string('type').notNullable();
+      table.integer('size_bytes');
+      table.integer('category_id');
+      table.string('source_origin');
+      table.string('external_relpath');
+      table.datetime('uploaded_at').defaultTo(db.fn.now());
+      table.float('average_rating').defaultTo(0);
+      table.integer('like_count').defaultTo(0);
+      table.integer('favorite_count').defaultTo(0);
+    });
+
+    await db.schema.createTable('photo_feedback', (table) => {
+      table.increments('id');
+      table.integer('photo_id');
+      table.string('feedback_type');
+      table.boolean('is_approved');
+      table.boolean('is_hidden');
+    });
+
+    await db('events').insert({
+      id: 1,
+      slug: 'test-event',
+      event_name: 'Test Event',
+      source_mode: 'reference',
+      external_path: 'external/library'
+    });
+
+    const insertedCategory = await db('photo_categories').insert({
+      name: 'Highlights',
+      slug: 'highlights',
+      is_global: true
+    });
+    categoryId = Array.isArray(insertedCategory) ? insertedCategory[0] : insertedCategory;
+
+    const router = require('../../src/routes/adminPhotos');
+    app = express();
+    app.use(express.json());
+    app.use('/api/admin/events', router);
+  });
+
+  afterAll(async () => {
+    if (db) {
+      await db.destroy();
+    }
+    resetModules();
+    delete process.env.TEST_DATABASE_PATH;
+    delete process.env.STORAGE_PATH;
+    if (tmpDir) {
+      await fs.promises.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it('stores managed uploads with category information and managed origin', async () => {
+    const uploadResponse = await request(app)
+      .post(`/api/admin/events/1/upload`)
+      .field('category_id', String(categoryId))
+      .attach('photos', Buffer.from('fake image data'), 'photo.jpg');
+
+    expect(uploadResponse.status).toBe(200);
+    expect(uploadResponse.body).toHaveProperty('photos');
+    expect(Array.isArray(uploadResponse.body.photos)).toBe(true);
+
+    const photo = await db('photos').first();
+    expect(photo).toBeTruthy();
+    expect(photo.category_id).toBe(categoryId);
+    expect(photo.source_origin).toBe('managed');
+    expect(photo.external_relpath).toBeNull();
+  });
+
+  it('returns numeric category metadata when listing photos', async () => {
+    await db('photos').insert({
+      event_id: 1,
+      filename: 'external.jpg',
+      path: 'test-event/external.jpg',
+      thumbnail_path: null,
+      type: 'individual',
+      size_bytes: 123,
+      source_origin: 'external',
+      external_relpath: 'individual/external.jpg'
+    });
+
+    const response = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .expect(200);
+
+    expect(Array.isArray(response.body.photos)).toBe(true);
+    const managedPhoto = response.body.photos.find((p) => p.category_id === categoryId);
+    expect(managedPhoto).toBeTruthy();
+    expect(managedPhoto.category_name).toBe('Highlights');
+
+    const filtered = await request(app)
+      .get(`/api/admin/events/1/photos`)
+      .query({ category_id: String(categoryId) })
+      .expect(200);
+
+    expect(filtered.body.photos.every((p) => p.category_id === categoryId)).toBe(true);
+  });
+
+  it('normalizes category updates', async () => {
+    const photo = await db('photos').first();
+
+    await request(app)
+      .patch(`/api/admin/events/1/photos/${photo.id}`)
+      .send({ category_id: '0' })
+      .expect(200);
+
+    const updated = await db('photos').where({ id: photo.id }).first();
+    expect(updated.category_id).toBeNull();
+  });
+});

backend/__tests__/integration/backup-s3.test.js

@@ -1,4 +1,4 @@
-const { describe, it, expect, jest, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
+const { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
 const { S3Client, CreateBucketCommand, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand } = require('@aws-sdk/client-s3');
 const path = require('path');
 const fs = require('fs').promises;
@@ -503,4 +503,4 @@ describe('S3 Backup Integration Tests', () => {
       console.error('Failed to cleanup S3 objects:', error);
     }
   }
-});
+});

backend/__tests__/services/backupService.enhanced.test.js

@@ -1,4 +1,4 @@
-const { describe, it, expect, jest, beforeEach, afterEach } = require('@jest/globals');
+const { describe, it, expect, beforeEach, afterEach } = require('@jest/globals');
 const mockFs = require('mock-fs');
 const path = require('path');
 const crypto = require('crypto');
@@ -748,4 +748,4 @@ describe('Enhanced Backup Service Tests', () => {
       );
     });
   });
-});
+});

backend/__tests__/services/photoResolver.test.js

@@ -0,0 +1,85 @@
+const path = require('path');
+const mockPath = path;
+
+jest.mock('../../src/services/externalMediaService', () => ({
+  resolveExternalPath: jest.fn((event, relPath) => mockPath.join('/mock/external', event.external_path || '', relPath || '')),
+}));
+
+const { resolveExternalPath } = require('../../src/services/externalMediaService');
+const { resolvePhotoFilePath } = require('../../src/services/photoResolver');
+
+describe('resolvePhotoFilePath', () => {
+  const backendRoot = path.resolve(__dirname, '../../');
+  const originalStoragePath = process.env.STORAGE_PATH;
+
+  beforeEach(() => {
+    process.env.STORAGE_PATH = path.join(backendRoot, 'storage');
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    if (typeof originalStoragePath === 'string') {
+      process.env.STORAGE_PATH = originalStoragePath;
+    } else {
+      delete process.env.STORAGE_PATH;
+    }
+  });
+
+  it('returns absolute path for managed photos with legacy slug paths', () => {
+    const event = { slug: 'wedding-party', source_mode: 'managed' };
+    const photo = { path: 'wedding-party/hero.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'wedding-party', 'hero.jpg'));
+  });
+
+  it('normalizes prefixed managed paths without duplicating segments', () => {
+    const event = { slug: 'wedding-party', source_mode: 'managed' };
+    const photo = { path: 'events/active/wedding-party/hero.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'wedding-party', 'hero.jpg'));
+  });
+
+  it('delegates external photos to external media resolver', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { source_origin: 'external', external_relpath: 'individual/look-01.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).toHaveBeenCalledWith(event, 'individual/look-01.jpg');
+    expect(result).toBe(path.join('/mock/external', 'picsum-demo', 'individual', 'look-01.jpg'));
+  });
+
+  it('deduplicates folder names when event external path already ends with segment', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo/individual' };
+    const photo = { source_origin: 'external', external_relpath: 'individual/look-02.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).toHaveBeenCalledWith(event, 'look-02.jpg');
+    expect(result).toBe(path.join('/mock/external', 'picsum-demo/individual', 'look-02.jpg'));
+  });
+
+  it('falls back to managed storage when external metadata is missing', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { path: 'fashion-show/new-upload.jpg' };
+
+    const result = resolvePhotoFilePath(event, photo);
+
+    expect(resolveExternalPath).not.toHaveBeenCalled();
+    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'fashion-show', 'new-upload.jpg'));
+  });
+
+  it('throws when external photo is missing relative path data', () => {
+    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
+    const photo = { source_origin: 'external' };
+
+    expect(() => resolvePhotoFilePath(event, photo)).toThrow('Missing external_relpath for external photo');
+  });
+});

backend/jest.setup.js

@@ -1,4 +1,10 @@
 beforeAll(() => {
   process.env.NODE_ENV = 'test';
   process.env.JWT_SECRET = 'test-secret';
+  if (!process.env.SKIP_S3_TESTS) {
+    process.env.SKIP_S3_TESTS = 'true';
+  }
+  if (!process.env.STORAGE_PATH) {
+    process.env.STORAGE_PATH = '/storage';
+  }
 });

backend/knexfile.js

@@ -3,6 +3,54 @@ require('dotenv').config();
 const path = require('path');
 
 // Database configuration for different environments
+const resolveSqliteFilename = (filenameEnv) => {
+  const fallback = path.join(__dirname, './data/photo_sharing.db');
+
+  if (!filenameEnv) {
+    return fallback;
+  }
+
+  const trimmed = String(filenameEnv).trim();
+  if (!trimmed) {
+    return fallback;
+  }
+
+  let resolved;
+  if (path.isAbsolute(trimmed)) {
+    resolved = trimmed;
+  } else if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    resolved = path.resolve(__dirname, trimmed);
+  } else {
+    resolved = path.join(__dirname, trimmed);
+  }
+
+  const normalized = path.normalize(resolved);
+  const baseSuffix = path.relative(path.parse(__dirname).root, path.normalize(__dirname));
+  const duplicatePattern = `${path.sep}${baseSuffix}${path.sep}${baseSuffix}`;
+
+  if (normalized.includes(duplicatePattern)) {
+    return normalized.replace(duplicatePattern, `${path.sep}${baseSuffix}`);
+  }
+
+  return normalized;
+};
+
+const sqliteConnection = (filenameEnv) => ({
+  filename: resolveSqliteFilename(filenameEnv)
+});
+
+const baseSqliteConfig = {
+  client: 'sqlite3',
+  connection: sqliteConnection(),
+  useNullAsDefault: true,
+  migrations: {
+    directory: './migrations'
+  },
+  seeds: {
+    directory: './seeds'
+  }
+};
+
 const config = {
   development: {
     client: process.env.DATABASE_CLIENT || 'sqlite3',
@@ -13,7 +61,7 @@ const config = {
       password: process.env.DB_PASSWORD || 'postgres',
       database: process.env.DB_NAME || 'photo_sharing'
     } : {
-      filename: path.join(__dirname, process.env.DATABASE_PATH || './data/photo_sharing.db')
+      filename: resolveSqliteFilename(process.env.DATABASE_PATH || './data/photo_sharing.db')
     },
     useNullAsDefault: process.env.DATABASE_CLIENT !== 'pg',
     migrations: {
@@ -24,36 +72,65 @@ const config = {
     }
   },
 
+  test: (() => {
+    const client = process.env.DATABASE_CLIENT || 'sqlite3';
+    const isPostgres = client === 'pg';
+
+    return {
+      ...baseSqliteConfig,
+      client,
+      useNullAsDefault: !isPostgres,
+      connection: isPostgres
+        ? {
+            host: process.env.DB_HOST || 'localhost',
+            port: process.env.DB_PORT || 5432,
+            user: process.env.DB_USER || 'postgres',
+            password: process.env.DB_PASSWORD || 'postgres',
+            database: process.env.DB_NAME || 'photo_sharing_test'
+          }
+        : sqliteConnection(process.env.TEST_DATABASE_PATH || './data/photo_sharing_test.db')
+    };
+  })(),
+
   production: {
     client: process.env.DATABASE_CLIENT || 'pg',
-    connection: {
-      host: process.env.DB_HOST || 'db',
-      port: process.env.DB_PORT || 5432,
-      user: process.env.DB_USER || 'picpeak',
-      password: process.env.DB_PASSWORD,
-      database: process.env.DB_NAME || 'picpeak',
-      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
-      // Connection stability settings
-      connectionTimeoutMillis: 30000,
-      idleTimeoutMillis: 30000,
-      keepAlive: true,
-      keepAliveInitialDelayMillis: 0
-    },
-    pool: {
-      min: 5,
-      max: 25,
-      acquireTimeoutMillis: 60000,
-      createTimeoutMillis: 60000,
-      idleTimeoutMillis: 30000,
-      reapIntervalMillis: 1000,
-      createRetryIntervalMillis: 200,
-      propagateCreateError: false
-    },
+    // Support both Postgres and SQLite in production based on DATABASE_CLIENT
+    connection: (process.env.DATABASE_CLIENT || 'pg') === 'pg'
+      ? {
+          host: process.env.DB_HOST || 'db',
+          port: process.env.DB_PORT || 5432,
+          user: process.env.DB_USER || 'picpeak',
+          password: process.env.DB_PASSWORD,
+          database: process.env.DB_NAME || 'picpeak',
+          ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
+          // Connection stability settings
+          connectionTimeoutMillis: 30000,
+          idleTimeoutMillis: 30000,
+          keepAlive: true,
+          keepAliveInitialDelayMillis: 0
+        }
+      : {
+          filename: resolveSqliteFilename(process.env.DATABASE_PATH || './data/photo_sharing.db')
+        },
+    useNullAsDefault: (process.env.DATABASE_CLIENT || 'pg') !== 'pg',
+    pool: (process.env.DATABASE_CLIENT || 'pg') === 'pg'
+      ? {
+          min: 5,
+          max: 25,
+          acquireTimeoutMillis: 60000,
+          createTimeoutMillis: 60000,
+          idleTimeoutMillis: 30000,
+          reapIntervalMillis: 1000,
+          createRetryIntervalMillis: 200,
+          propagateCreateError: false
+        }
+      : undefined,
     migrations: {
       directory: './migrations'
     },
     acquireConnectionTimeout: 60000
   }
 };
+const env = process.env.NODE_ENV || 'development';
 
-module.exports = config[process.env.NODE_ENV || 'development'];
+module.exports = config[env] || config.development;

backend/migrations/041_add_logo_customization_settings.js

@@ -0,0 +1,89 @@
+exports.up = async function(knex) {
+  console.log('Running migration: 041_add_logo_customization_settings');
+  
+  // Add default logo customization settings
+  const logoSettings = [
+    {
+      setting_key: 'branding_logo_size',
+      setting_value: JSON.stringify('medium'),
+      setting_type: 'branding',
+      description: 'Logo size: small, medium, large, xlarge, or custom',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_max_height',
+      setting_value: JSON.stringify(48),
+      setting_type: 'branding', 
+      description: 'Maximum logo height in pixels (used when size is custom)',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_position',
+      setting_value: JSON.stringify('left'),
+      setting_type: 'branding',
+      description: 'Logo position in header: left, center, right',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_header',
+      setting_value: JSON.stringify(true),
+      setting_type: 'branding',
+      description: 'Show logo in gallery header',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_hero',
+      setting_value: JSON.stringify(true),
+      setting_type: 'branding',
+      description: 'Show logo in hero section (for non-grid layouts)',
+      created_at: new Date(),
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'branding_logo_display_mode',
+      setting_value: JSON.stringify('logo_and_text'),
+      setting_type: 'branding',
+      description: 'Display mode: logo_only, text_only, logo_and_text',
+      created_at: new Date(),
+      updated_at: new Date()
+    }
+  ];
+
+  // Insert settings that don't already exist
+  for (const setting of logoSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert(setting);
+      console.log(`Added setting: ${setting.setting_key}`);
+    } else {
+      console.log(`Setting already exists: ${setting.setting_key}`);
+    }
+  }
+
+  console.log('Migration 041_add_logo_customization_settings completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rolling back migration: 041_add_logo_customization_settings');
+  
+  // Remove the logo customization settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'branding_logo_size',
+      'branding_logo_max_height',
+      'branding_logo_position',
+      'branding_logo_display_header',
+      'branding_logo_display_hero',
+      'branding_logo_display_mode'
+    ])
+    .del();
+  
+  console.log('Rollback of 041_add_logo_customization_settings completed');
+};

backend/migrations/core/001_init.js

@@ -18,10 +18,15 @@ exports.up = async function(knex) {
       const generatedPassword = generateReadablePassword();
       const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
+      // Get admin credentials from environment or use defaults
+      const adminUsername = process.env.ADMIN_USERNAME || 'admin';
+      const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
+      
       await knex('admin_users').insert({
-        username: 'admin',
-        email: 'admin@example.com',
+        username: adminUsername,
+        email: adminEmail,
         password_hash: passwordHash,
+        must_change_password: true,
         created_at: new Date()
       });
       
@@ -36,7 +41,7 @@ PicPeak Admin Credentials
 
 Your admin account has been created with these credentials:
 
-Username: admin
+Email: ${adminEmail}
 Password: ${generatedPassword}
 
 IMPORTANT SECURITY NOTES:
@@ -47,6 +52,8 @@ IMPORTANT SECURITY NOTES:
 
 Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
 
+Login with the email address shown above
+
 Generated on: ${new Date().toISOString()}
 ========================================
 `;
@@ -65,7 +72,7 @@ Generated on: ${new Date().toISOString()}
       console.log('\n========================================');
       console.log('✅ Admin user created successfully!');
       console.log('========================================');
-      console.log('Username: admin');
+      console.log(`Email: ${adminEmail}`);
       console.log(`Password: ${generatedPassword}`);
       console.log('\n⚠️  IMPORTANT:');
       console.log('1. Save these credentials securely');

backend/migrations/core/033_add_gallery_feedback.js

@@ -3,102 +3,125 @@
 exports.up = async function(knex) {
   console.log('Adding gallery feedback tables...');
   
+  // Check if tables and columns already exist
+  const hasEventFeedbackSettingsTable = await knex.schema.hasTable('event_feedback_settings');
+  const hasPhotoFeedbackTable = await knex.schema.hasTable('photo_feedback');
+  const hasFeedbackRateLimitsTable = await knex.schema.hasTable('feedback_rate_limits');
+  const hasFeedbackWordFiltersTable = await knex.schema.hasTable('feedback_word_filters');
+  const hasFeedbackCountColumn = await knex.schema.hasColumn('photos', 'feedback_count');
+  
   // Create event_feedback_settings table
-  await knex.schema.createTable('event_feedback_settings', (table) => {
-    table.increments('id').primary();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.boolean('feedback_enabled').defaultTo(false);
-    table.boolean('allow_ratings').defaultTo(true);
-    table.boolean('allow_likes').defaultTo(true);
-    table.boolean('allow_comments').defaultTo(false);
-    table.boolean('allow_favorites').defaultTo(true);
-    table.boolean('require_name_email').defaultTo(false);
-    table.boolean('moderate_comments').defaultTo(true);
-    table.boolean('show_feedback_to_guests').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    table.unique(['event_id']);
-  });
+  if (!hasEventFeedbackSettingsTable) {
+    await knex.schema.createTable('event_feedback_settings', (table) => {
+      table.increments('id').primary();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.boolean('feedback_enabled').defaultTo(false);
+      table.boolean('allow_ratings').defaultTo(true);
+      table.boolean('allow_likes').defaultTo(true);
+      table.boolean('allow_comments').defaultTo(false);
+      table.boolean('allow_favorites').defaultTo(true);
+      table.boolean('require_name_email').defaultTo(false);
+      table.boolean('moderate_comments').defaultTo(true);
+      table.boolean('show_feedback_to_guests').defaultTo(true);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+      table.unique(['event_id']);
+    });
+  }
 
   // Create photo_feedback table
-  await knex.schema.createTable('photo_feedback', (table) => {
-    table.increments('id').primary();
-    table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('feedback_type', 20).notNullable();
-    table.integer('rating');
-    table.text('comment_text');
-    table.string('guest_name', 100);
-    table.string('guest_email', 255);
-    table.string('guest_identifier', 64);
-    table.string('ip_address', 45);
-    table.text('user_agent');
-    table.boolean('is_approved').defaultTo(true);
-    table.boolean('is_hidden').defaultTo(false);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.timestamp('updated_at').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['photo_id']);
-    table.index(['event_id']);
-    table.index(['feedback_type']);
-    table.index(['guest_identifier']);
-    
-    // Add check constraint for rating (PostgreSQL)
-    if (knex.client.config.client === 'pg') {
-      table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
-    }
-  });
+  if (!hasPhotoFeedbackTable) {
+    await knex.schema.createTable('photo_feedback', (table) => {
+      table.increments('id').primary();
+      table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('feedback_type', 20).notNullable();
+      table.integer('rating');
+      table.text('comment_text');
+      table.string('guest_name', 100);
+      table.string('guest_email', 255);
+      table.string('guest_identifier', 64);
+      table.string('ip_address', 45);
+      table.text('user_agent');
+      table.boolean('is_approved').defaultTo(true);
+      table.boolean('is_hidden').defaultTo(false);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.timestamp('updated_at').defaultTo(knex.fn.now());
+      
+      // Add indexes
+      table.index(['photo_id']);
+      table.index(['event_id']);
+      table.index(['feedback_type']);
+      table.index(['guest_identifier']);
+      
+      // Add check constraint for rating (PostgreSQL)
+      if (knex.client.config.client === 'pg') {
+        table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
+      }
+    });
+  }
 
   // Create feedback_rate_limits table
-  await knex.schema.createTable('feedback_rate_limits', (table) => {
-    table.increments('id').primary();
-    table.string('identifier', 64).notNullable();
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.string('action_type', 20).notNullable();
-    table.integer('action_count').defaultTo(1);
-    table.timestamp('window_start').defaultTo(knex.fn.now());
-    
-    // Add indexes
-    table.index(['identifier', 'event_id', 'action_type']);
-    table.index(['window_start']);
-  });
+  if (!hasFeedbackRateLimitsTable) {
+    await knex.schema.createTable('feedback_rate_limits', (table) => {
+      table.increments('id').primary();
+      table.string('identifier', 64).notNullable();
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.string('action_type', 20).notNullable();
+      table.integer('action_count').defaultTo(1);
+      table.timestamp('window_start').defaultTo(knex.fn.now());
+      
+      // Add indexes
+      table.index(['identifier', 'event_id', 'action_type']);
+      table.index(['window_start']);
+    });
+  }
 
   // Create feedback_word_filters table
-  await knex.schema.createTable('feedback_word_filters', (table) => {
-    table.increments('id').primary();
-    table.string('word', 100).notNullable();
-    table.string('severity', 20).defaultTo('moderate');
-    table.boolean('is_active').defaultTo(true);
-    table.timestamp('created_at').defaultTo(knex.fn.now());
-    table.unique(['word']);
-  });
+  if (!hasFeedbackWordFiltersTable) {
+    await knex.schema.createTable('feedback_word_filters', (table) => {
+      table.increments('id').primary();
+      table.string('word', 100).notNullable();
+      table.string('severity', 20).defaultTo('moderate');
+      table.boolean('is_active').defaultTo(true);
+      table.timestamp('created_at').defaultTo(knex.fn.now());
+      table.unique(['word']);
+    });
+  }
 
   // Add feedback summary columns to photos table
-  await knex.schema.alterTable('photos', (table) => {
-    table.integer('feedback_count').defaultTo(0);
-    table.integer('like_count').defaultTo(0);
-    table.decimal('average_rating', 3, 2).defaultTo(0);
-    table.integer('favorite_count').defaultTo(0);
-  });
+  if (!hasFeedbackCountColumn) {
+    await knex.schema.alterTable('photos', (table) => {
+      table.integer('feedback_count').defaultTo(0);
+      table.integer('like_count').defaultTo(0);
+      table.decimal('average_rating', 3, 2).defaultTo(0);
+      table.integer('favorite_count').defaultTo(0);
+    });
+  }
 
   // Add feedback notification settings to app_settings
-  await knex('app_settings').insert([
-    {
-      setting_key: 'feedback_notification_email',
-      setting_value: JSON.stringify(''),
-      setting_type: 'feedback'
-    },
-    {
-      setting_key: 'feedback_rate_limits',
-      setting_value: JSON.stringify({
-        rating: { max: 100, window: 3600 }, // 100 ratings per hour
-        comment: { max: 20, window: 3600 }, // 20 comments per hour
-        like: { max: 200, window: 3600 } // 200 likes per hour
-      }),
-      setting_type: 'feedback'
-    }
-  ]);
+  const hasFeedbackNotificationEmail = await knex('app_settings')
+    .where('setting_key', 'feedback_notification_email')
+    .first();
+    
+  if (!hasFeedbackNotificationEmail) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'feedback_notification_email',
+        setting_value: JSON.stringify(''),
+        setting_type: 'feedback'
+      },
+      {
+        setting_key: 'feedback_rate_limits',
+        setting_value: JSON.stringify({
+          rating: { max: 100, window: 3600 }, // 100 ratings per hour
+          comment: { max: 20, window: 3600 }, // 20 comments per hour
+          like: { max: 200, window: 3600 } // 200 likes per hour
+        }),
+        setting_type: 'feedback'
+      }
+    ]);
+  }
   
   console.log('Gallery feedback tables created successfully');
 };

backend/migrations/core/036_fix_missing_columns.js

@@ -0,0 +1,87 @@
+// Fix missing columns identified in GitHub issues
+
+exports.up = async function(knex) {
+  console.log('Adding missing columns to database tables...');
+  
+  // Add must_change_password column to admin_users table
+  const hasMustChangePassword = await knex.schema.hasColumn('admin_users', 'must_change_password');
+  if (!hasMustChangePassword) {
+    console.log('Adding must_change_password column to admin_users table...');
+    await knex.schema.table('admin_users', (table) => {
+      table.boolean('must_change_password').defaultTo(false);
+    });
+  }
+  
+  // Add password_changed_at column to admin_users table
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  if (!hasPasswordChangedAt) {
+    console.log('Adding password_changed_at column to admin_users table...');
+    await knex.schema.table('admin_users', (table) => {
+      table.datetime('password_changed_at');
+    });
+  }
+  
+  // Add require_moderation column to event_feedback_settings table
+  const hasEventFeedbackSettings = await knex.schema.hasTable('event_feedback_settings');
+  if (hasEventFeedbackSettings) {
+    const hasRequireModeration = await knex.schema.hasColumn('event_feedback_settings', 'require_moderation');
+    if (!hasRequireModeration) {
+      console.log('Adding require_moderation column to event_feedback_settings table...');
+      await knex.schema.table('event_feedback_settings', (table) => {
+        table.boolean('require_moderation').defaultTo(true);
+      });
+    }
+  }
+  
+  // Add host_name column to events table if missing
+  const hasHostName = await knex.schema.hasColumn('events', 'host_name');
+  if (!hasHostName) {
+    console.log('Adding host_name column to events table...');
+    await knex.schema.table('events', (table) => {
+      table.string('host_name');
+    });
+  }
+  
+  console.log('Missing columns have been added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing added columns...');
+  
+  // Remove must_change_password column from admin_users table
+  const hasMustChangePassword = await knex.schema.hasColumn('admin_users', 'must_change_password');
+  if (hasMustChangePassword) {
+    await knex.schema.table('admin_users', (table) => {
+      table.dropColumn('must_change_password');
+    });
+  }
+  
+  // Remove password_changed_at column from admin_users table
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  if (hasPasswordChangedAt) {
+    await knex.schema.table('admin_users', (table) => {
+      table.dropColumn('password_changed_at');
+    });
+  }
+  
+  // Remove require_moderation column from event_feedback_settings table
+  const hasEventFeedbackSettings = await knex.schema.hasTable('event_feedback_settings');
+  if (hasEventFeedbackSettings) {
+    const hasRequireModeration = await knex.schema.hasColumn('event_feedback_settings', 'require_moderation');
+    if (hasRequireModeration) {
+      await knex.schema.table('event_feedback_settings', (table) => {
+        table.dropColumn('require_moderation');
+      });
+    }
+  }
+  
+  // Remove host_name column from events table
+  const hasHostName = await knex.schema.hasColumn('events', 'host_name');
+  if (hasHostName) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('host_name');
+    });
+  }
+  
+  console.log('Columns removed');
+};

backend/migrations/core/037_add_download_controls.js

@@ -0,0 +1,69 @@
+// Add download control features to events table
+
+exports.up = async function(knex) {
+  console.log('Adding download control columns to events table...');
+  
+  // Add download control columns to events table
+  const hasAllowDownloads = await knex.schema.hasColumn('events', 'allow_downloads');
+  if (!hasAllowDownloads) {
+    await knex.schema.table('events', (table) => {
+      table.boolean('allow_downloads').defaultTo(true);
+      table.boolean('disable_right_click').defaultTo(false);
+      table.boolean('watermark_downloads').defaultTo(false);
+      table.text('watermark_text');
+    });
+  }
+  
+  // Add download control settings to app_settings
+  const downloadSettingExists = await knex('app_settings')
+    .where('setting_key', 'default_allow_downloads')
+    .first();
+    
+  if (!downloadSettingExists) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'default_allow_downloads',
+        setting_value: JSON.stringify(true),
+        setting_type: 'gallery'
+      },
+      {
+        setting_key: 'default_disable_right_click',
+        setting_value: JSON.stringify(false),
+        setting_type: 'gallery'
+      },
+      {
+        setting_key: 'default_watermark_downloads',
+        setting_value: JSON.stringify(false),
+        setting_type: 'gallery'
+      }
+    ]);
+  }
+  
+  console.log('Download control features added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing download control columns...');
+  
+  // Remove app settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'default_allow_downloads',
+      'default_disable_right_click', 
+      'default_watermark_downloads'
+    ])
+    .delete();
+  
+  // Remove columns from events table
+  const hasAllowDownloads = await knex.schema.hasColumn('events', 'allow_downloads');
+  if (hasAllowDownloads) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('allow_downloads');
+      table.dropColumn('disable_right_click');
+      table.dropColumn('watermark_downloads');
+      table.dropColumn('watermark_text');
+    });
+  }
+  
+  console.log('Download control columns removed');
+};

backend/migrations/core/038_add_enhanced_image_protection.js

@@ -0,0 +1,128 @@
+// Add enhanced image protection features
+
+exports.up = async function(knex) {
+  console.log('Adding enhanced image protection features...');
+  
+  // Add protection columns to events table
+  const hasProtectionLevel = await knex.schema.hasColumn('events', 'protection_level');
+  if (!hasProtectionLevel) {
+    await knex.schema.table('events', (table) => {
+      table.enum('protection_level', ['basic', 'standard', 'enhanced', 'maximum']).defaultTo('standard');
+      table.integer('image_quality').defaultTo(85);
+      table.boolean('add_fingerprint').defaultTo(true);
+      table.boolean('enable_devtools_protection').defaultTo(true);
+      table.boolean('use_canvas_rendering').defaultTo(false);
+      table.integer('fragmentation_level').defaultTo(3);
+      table.boolean('overlay_protection').defaultTo(true);
+    });
+  }
+  
+  // Create image access logs table
+  const hasImageAccessLogs = await knex.schema.hasTable('image_access_logs');
+  if (!hasImageAccessLogs) {
+    await knex.schema.createTable('image_access_logs', (table) => {
+      table.increments('id').primary();
+      table.integer('photo_id').unsigned().notNullable();
+      table.integer('event_id').unsigned().notNullable();
+      table.string('client_ip', 45).notNullable();
+      table.text('user_agent');
+      table.string('access_type', 20).defaultTo('view'); // view, download, suspicious
+      table.string('client_fingerprint', 32).notNullable();
+      table.timestamp('accessed_at').defaultTo(knex.fn.now());
+      table.json('metadata'); // Additional security metadata
+      
+      table.foreign('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+      table.foreign('event_id').references('id').inTable('events').onDelete('CASCADE');
+      
+      table.index(['photo_id', 'accessed_at']);
+      table.index(['client_fingerprint', 'accessed_at']);
+      table.index(['client_ip', 'accessed_at']);
+    });
+  }
+  
+  // Add protection settings to app_settings
+  const protectionSettingExists = await knex('app_settings')
+    .where('setting_key', 'default_protection_level')
+    .first();
+    
+  if (!protectionSettingExists) {
+    await knex('app_settings').insert([
+      {
+        setting_key: 'default_protection_level',
+        setting_value: JSON.stringify('standard'),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'default_image_quality',
+        setting_value: JSON.stringify(85),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'enable_devtools_protection',
+        setting_value: JSON.stringify(true),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'max_image_requests_per_minute',
+        setting_value: JSON.stringify(30),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'suspicious_activity_threshold',
+        setting_value: JSON.stringify(10),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'enable_canvas_rendering',
+        setting_value: JSON.stringify(false),
+        setting_type: 'security'
+      },
+      {
+        setting_key: 'default_fragmentation_level',
+        setting_value: JSON.stringify(3),
+        setting_type: 'security'
+      }
+    ]);
+  }
+  
+  console.log('Enhanced image protection features added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing enhanced image protection features...');
+  
+  // Remove app settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'default_protection_level',
+      'default_image_quality',
+      'enable_devtools_protection',
+      'max_image_requests_per_minute',
+      'suspicious_activity_threshold',
+      'enable_canvas_rendering',
+      'default_fragmentation_level'
+    ])
+    .delete();
+  
+  // Drop image access logs table
+  const hasImageAccessLogs = await knex.schema.hasTable('image_access_logs');
+  if (hasImageAccessLogs) {
+    await knex.schema.dropTable('image_access_logs');
+  }
+  
+  // Remove protection columns from events table
+  const hasProtectionLevel = await knex.schema.hasColumn('events', 'protection_level');
+  if (hasProtectionLevel) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('protection_level');
+      table.dropColumn('image_quality');
+      table.dropColumn('add_fingerprint');
+      table.dropColumn('enable_devtools_protection');
+      table.dropColumn('use_canvas_rendering');
+      table.dropColumn('fragmentation_level');
+      table.dropColumn('overlay_protection');
+    });
+  }
+  
+  console.log('Enhanced image protection features removed');
+};

backend/migrations/core/039_add_security_logging.js

@@ -0,0 +1,117 @@
+// Add security logging and monitoring tables
+
+exports.up = async function(knex) {
+  console.log('Adding security logging and monitoring tables...');
+  
+  // Create security logs table for general security events
+  const hasSecurityLogs = await knex.schema.hasTable('security_logs');
+  if (!hasSecurityLogs) {
+    await knex.schema.createTable('security_logs', (table) => {
+      table.increments('id').primary();
+      table.string('event_type', 50).notNullable(); // rate_limit_exceeded, suspicious_activity, etc.
+      table.string('client_ip', 45).notNullable();
+      table.string('client_fingerprint', 32);
+      table.text('user_agent');
+      table.string('request_path');
+      table.string('request_method', 10);
+      table.json('details'); // Additional event details
+      table.timestamp('timestamp').defaultTo(knex.fn.now());
+      
+      // Indexes for performance
+      table.index(['event_type', 'timestamp']);
+      table.index(['client_ip', 'timestamp']);
+      table.index(['client_fingerprint', 'timestamp']);
+    });
+  }
+  
+  // Add security monitoring settings to app_settings
+  const securitySettings = [
+    {
+      setting_key: 'security_monitoring_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'max_image_requests_per_5_minutes',
+      setting_value: JSON.stringify(100),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'max_image_requests_per_hour',
+      setting_value: JSON.stringify(500),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'block_suspicious_ips',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'log_security_events_to_db',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'auto_block_threshold',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    }
+  ];
+
+  for (const setting of securitySettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+      
+    if (!exists) {
+      await knex('app_settings').insert(setting);
+    }
+  }
+  
+  // Add mime_type column to photos table if it doesn't exist
+  const hasMimeType = await knex.schema.hasColumn('photos', 'mime_type');
+  if (!hasMimeType) {
+    await knex.schema.table('photos', (table) => {
+      table.string('mime_type', 100);
+    });
+    
+    // Update existing photos with default mime type
+    await knex('photos')
+      .whereNull('mime_type')
+      .update({ mime_type: 'image/jpeg' });
+  }
+  
+  console.log('Security logging and monitoring tables added successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing security logging and monitoring tables...');
+  
+  // Remove security settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'security_monitoring_enabled',
+      'max_image_requests_per_5_minutes', 
+      'max_image_requests_per_hour',
+      'block_suspicious_ips',
+      'log_security_events_to_db',
+      'auto_block_threshold'
+    ])
+    .delete();
+  
+  // Drop security logs table
+  const hasSecurityLogs = await knex.schema.hasTable('security_logs');
+  if (hasSecurityLogs) {
+    await knex.schema.dropTable('security_logs');
+  }
+  
+  // Remove mime_type column from photos table
+  const hasMimeType = await knex.schema.hasColumn('photos', 'mime_type');
+  if (hasMimeType) {
+    await knex.schema.table('photos', (table) => {
+      table.dropColumn('mime_type');
+    });
+  }
+  
+  console.log('Security logging and monitoring tables removed');
+};

backend/migrations/core/040_add_thumbnail_settings.js

@@ -0,0 +1,33 @@
+exports.up = async function(knex) {
+  // Add thumbnail settings to app_settings table
+  const thumbnailSettings = [
+    { setting_key: 'thumbnail_width', setting_value: 300, setting_type: 'number' },
+    { setting_key: 'thumbnail_height', setting_value: 300, setting_type: 'number' },
+    { setting_key: 'thumbnail_fit', setting_value: JSON.stringify('cover'), setting_type: 'string' },
+    { setting_key: 'thumbnail_quality', setting_value: 85, setting_type: 'number' },
+    { setting_key: 'thumbnail_format', setting_value: JSON.stringify('jpeg'), setting_type: 'string' }
+  ];
+
+  for (const setting of thumbnailSettings) {
+    const exists = await knex('app_settings').where('setting_key', setting.setting_key).first();
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove thumbnail settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'thumbnail_width',
+      'thumbnail_height', 
+      'thumbnail_fit',
+      'thumbnail_quality',
+      'thumbnail_format'
+    ])
+    .del();
+};

backend/migrations/core/041_add_external_media.js

@@ -0,0 +1,54 @@
+/**
+ * Migration 041: Add external media reference support
+ * - events.source_mode: 'managed' | 'reference'
+ * - events.external_path: relative path under external media root
+ * - photos.source_origin: 'managed' | 'external'
+ * - photos.external_relpath: relative path within event.external_path
+ */
+
+const { addColumnIfNotExists } = require('../helpers');
+
+exports.up = async function(knex) {
+  console.log('Running migration: 041_add_external_media');
+
+  // events.source_mode (default 'managed')
+  await addColumnIfNotExists(knex, 'events', 'source_mode', (table) => {
+    table.string('source_mode').notNullable().defaultTo('managed');
+  });
+
+  // events.external_path (nullable)
+  await addColumnIfNotExists(knex, 'events', 'external_path', (table) => {
+    table.text('external_path');
+  });
+
+  // photos.source_origin (default 'managed')
+  await addColumnIfNotExists(knex, 'photos', 'source_origin', (table) => {
+    table.string('source_origin').notNullable().defaultTo('managed');
+  });
+
+  // photos.external_relpath (nullable)
+  await addColumnIfNotExists(knex, 'photos', 'external_relpath', (table) => {
+    table.text('external_relpath');
+  });
+
+  // Helpful index for queries
+  try {
+    if (knex.client.config.client === 'pg') {
+      await knex.raw("CREATE INDEX IF NOT EXISTS photos_event_source_idx ON photos (event_id, source_origin)");
+    } else {
+      await knex.schema.alterTable('photos', (table) => {
+        table.index(['event_id', 'source_origin'], 'photos_event_source_idx');
+      });
+    }
+  } catch (e) {
+    console.log('Index creation skipped or failed (may already exist):', e.message);
+  }
+
+  console.log('Migration 041_add_external_media completed');
+};
+
+exports.down = async function(knex) {
+  console.log('Rollback: 041_add_external_media');
+  // Keep columns (safe rollback not removing data). Intentionally no-op.
+};
+

backend/migrations/core/042_backfill_event_upload_columns.js

@@ -0,0 +1,51 @@
+const logger = require('../../src/utils/logger');
+
+async function ensureColumn(knex, tableName, columnName, alterFn) {
+  const exists = await knex.schema.hasColumn(tableName, columnName);
+  if (!exists) {
+    logger.info(`Adding column ${tableName}.${columnName}`);
+    await knex.schema.table(tableName, alterFn);
+  }
+}
+
+exports.up = async function(knex) {
+  await ensureColumn(knex, 'events', 'host_name', (table) => {
+    table.string('host_name');
+  });
+
+  await ensureColumn(knex, 'events', 'allow_user_uploads', (table) => {
+    table.boolean('allow_user_uploads').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'upload_category_id', (table) => {
+    table.integer('upload_category_id');
+  });
+
+  await ensureColumn(knex, 'events', 'allow_downloads', (table) => {
+    table.boolean('allow_downloads').defaultTo(true);
+  });
+
+  await ensureColumn(knex, 'events', 'disable_right_click', (table) => {
+    table.boolean('disable_right_click').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'watermark_downloads', (table) => {
+    table.boolean('watermark_downloads').defaultTo(false);
+  });
+
+  await ensureColumn(knex, 'events', 'watermark_text', (table) => {
+    table.text('watermark_text');
+  });
+
+  await ensureColumn(knex, 'events', 'hero_photo_id', (table) => {
+    table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
+  });
+
+  await ensureColumn(knex, 'photos', 'uploaded_by', (table) => {
+    table.string('uploaded_by').defaultTo('admin');
+  });
+};
+
+exports.down = async function() {
+  // Non destructive migration; no rollback
+};

backend/migrations/core/043_add_public_site_settings.js

@@ -0,0 +1,46 @@
+const {
+  DEFAULT_PUBLIC_SITE_HTML,
+} = require('../../src/constants/publicSiteDefaults');
+
+exports.up = async function(knex) {
+  const defaults = [
+    {
+      setting_key: 'general_public_site_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'general'
+    },
+    {
+      setting_key: 'general_public_site_html',
+      setting_value: JSON.stringify(DEFAULT_PUBLIC_SITE_HTML.trim()),
+      setting_type: 'general'
+    },
+    {
+      setting_key: 'general_public_site_custom_css',
+      setting_value: JSON.stringify(''),
+      setting_type: 'general'
+    }
+  ];
+
+  for (const setting of defaults) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'general_public_site_enabled',
+      'general_public_site_html',
+      'general_public_site_custom_css'
+    ])
+    .del();
+};

backend/migrations/core/044_add_event_password_toggle.js

@@ -0,0 +1,18 @@
+exports.up = async function (knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'require_password');
+  if (!hasColumn) {
+    await knex.schema.table('events', (table) => {
+      table.boolean('require_password').notNullable().defaultTo(true);
+    });
+    await knex('events').update({ require_password: true });
+  }
+};
+
+exports.down = async function (knex) {
+  const hasColumn = await knex.schema.hasColumn('events', 'require_password');
+  if (hasColumn) {
+    await knex.schema.table('events', (table) => {
+      table.dropColumn('require_password');
+    });
+  }
+};

backend/migrations/legacy/004_add_categories_and_cms.js

@@ -3,79 +3,103 @@ const { db } = require('../../src/database/db');
 async function up() {
   console.log('Adding photo categories and CMS tables...');
   
+  // Check if tables already exist
+  const hasPhotoCategoriesTable = await db.schema.hasTable('photo_categories');
+  const hasCmsPagesTable = await db.schema.hasTable('cms_pages');
+  const hasCategoryIdColumn = await db.schema.hasColumn('photos', 'category_id');
+  const hasLanguageColumn = await db.schema.hasColumn('admin_users', 'language');
+  
   // Create photo_categories table
-  await db.schema.createTable('photo_categories', (table) => {
-    table.increments('id').primary();
-    table.string('name', 100).notNullable();
-    table.string('slug', 100).notNullable();
-    table.boolean('is_global').defaultTo(true);
-    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
-    table.timestamp('created_at').defaultTo(db.fn.now());
-    
-    // Unique constraint for slug within event scope
-    table.unique(['slug', 'event_id']);
-  });
+  if (!hasPhotoCategoriesTable) {
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).notNullable();
+      table.string('slug', 100).notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.timestamp('created_at').defaultTo(db.fn.now());
+      
+      // Unique constraint for slug within event scope
+      table.unique(['slug', 'event_id']);
+    });
+  }
 
   // Create cms_pages table
-  await db.schema.createTable('cms_pages', (table) => {
-    table.increments('id').primary();
-    table.string('slug', 100).unique().notNullable();
-    table.text('title_en');
-    table.text('title_de');
-    table.text('content_en');
-    table.text('content_de');
-    table.timestamp('updated_at').defaultTo(db.fn.now());
-  });
+  if (!hasCmsPagesTable) {
+    await db.schema.createTable('cms_pages', (table) => {
+      table.increments('id').primary();
+      table.string('slug', 100).unique().notNullable();
+      table.text('title_en');
+      table.text('title_de');
+      table.text('content_en');
+      table.text('content_de');
+      table.timestamp('updated_at').defaultTo(db.fn.now());
+    });
+  }
 
   // Add category_id to photos table
-  await db.schema.alterTable('photos', (table) => {
-    table.integer('category_id').references('id').inTable('photo_categories');
-  });
+  if (!hasCategoryIdColumn) {
+    await db.schema.alterTable('photos', (table) => {
+      table.integer('category_id').references('id').inTable('photo_categories');
+    });
+  }
 
   // Add language preference to admin_users
-  await db.schema.alterTable('admin_users', (table) => {
-    table.string('language', 2).defaultTo('en');
-  });
+  if (!hasLanguageColumn) {
+    await db.schema.alterTable('admin_users', (table) => {
+      table.string('language', 2).defaultTo('en');
+    });
+  }
 
   // Add language preference to app_settings for global default
-  await db('app_settings').insert({
-    setting_key: 'default_language',
-    setting_value: JSON.stringify('en'),
-    setting_type: 'general',
-    updated_at: new Date()
-  });
+  const hasDefaultLanguageSetting = await db('app_settings')
+    .where('setting_key', 'default_language')
+    .first();
+    
+  if (!hasDefaultLanguageSetting) {
+    await db('app_settings').insert({
+      setting_key: 'default_language',
+      setting_value: JSON.stringify('en'),
+      setting_type: 'general',
+      updated_at: new Date()
+    });
+  }
 
   // Insert default global categories
-  const defaultCategories = [
-    { name: 'Ceremony', slug: 'ceremony', is_global: true },
-    { name: 'Reception', slug: 'reception', is_global: true },
-    { name: 'Portraits', slug: 'portraits', is_global: true },
-    { name: 'Group Photos', slug: 'group-photos', is_global: true },
-    { name: 'Details', slug: 'details', is_global: true },
-    { name: 'Party', slug: 'party', is_global: true }
-  ];
+  if (!hasPhotoCategoriesTable) {
+    const defaultCategories = [
+      { name: 'Ceremony', slug: 'ceremony', is_global: true },
+      { name: 'Reception', slug: 'reception', is_global: true },
+      { name: 'Portraits', slug: 'portraits', is_global: true },
+      { name: 'Group Photos', slug: 'group-photos', is_global: true },
+      { name: 'Details', slug: 'details', is_global: true },
+      { name: 'Party', slug: 'party', is_global: true }
+    ];
 
-  await db('photo_categories').insert(defaultCategories);
+    await db('photo_categories').insert(defaultCategories);
+  }
 
   // Insert default legal pages
-  await db('cms_pages').insert([
-    {
-      slug: 'impressum',
-      title_en: 'Legal Notice',
-      title_de: 'Impressum',
-      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    },
-    {
-      slug: 'datenschutz',
-      title_en: 'Privacy Policy',
-      title_de: 'Datenschutzerklärung',
-      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
-      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
-      updated_at: new Date()
-    }
-  ]);
+  if (!hasCmsPagesTable) {
+    await db('cms_pages').insert([
+      {
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      },
+      {
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
+        content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+        updated_at: new Date()
+      }
+    ]);
+  }
 
   console.log('Photo categories and CMS tables created successfully');
 }

backend/migrations/legacy/015_add_login_attempts_table.js

@@ -1,17 +1,21 @@
-exports.up = function(knex) {
-  return knex.schema.createTable('login_attempts', table => {
-    table.increments('id').primary();
-    table.string('identifier').notNullable(); // username or email
-    table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
-    table.text('user_agent');
-    table.timestamp('attempt_time').defaultTo(knex.fn.now());
-    table.boolean('success').defaultTo(false);
-    
-    // Indexes for performance
-    table.index('identifier');
-    table.index('attempt_time');
-    table.index(['identifier', 'success', 'attempt_time']);
-  });
+exports.up = async function(knex) {
+  const hasLoginAttemptsTable = await knex.schema.hasTable('login_attempts');
+  
+  if (!hasLoginAttemptsTable) {
+    return knex.schema.createTable('login_attempts', table => {
+      table.increments('id').primary();
+      table.string('identifier').notNullable(); // username or email
+      table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
+      table.text('user_agent');
+      table.timestamp('attempt_time').defaultTo(knex.fn.now());
+      table.boolean('success').defaultTo(false);
+      
+      // Indexes for performance
+      table.index('identifier');
+      table.index('attempt_time');
+      table.index(['identifier', 'success', 'attempt_time']);
+    });
+  }
 };
 
 exports.down = function(knex) {

backend/migrations/legacy/016_add_auth_security_columns.js

@@ -1,17 +1,28 @@
-exports.up = function(knex) {
+exports.up = async function(knex) {
+  // Check if columns already exist to avoid conflicts
+  const hasPasswordChangedAt = await knex.schema.hasColumn('admin_users', 'password_changed_at');
+  const hasLastLoginIp = await knex.schema.hasColumn('admin_users', 'last_login_ip');
+  const hasTwoFactorEnabled = await knex.schema.hasColumn('admin_users', 'two_factor_enabled');
+  const hasTwoFactorSecret = await knex.schema.hasColumn('admin_users', 'two_factor_secret');
+  
   return knex.schema.table('admin_users', table => {
     // Add password change tracking
-    table.timestamp('password_changed_at').nullable();
+    if (!hasPasswordChangedAt) {
+      table.timestamp('password_changed_at').nullable();
+    }
     
-    // Add last login IP for security monitoring
-    table.string('last_login_ip', 45).nullable();
+    // Add last login IP for security monitoring  
+    if (!hasLastLoginIp) {
+      table.string('last_login_ip', 45).nullable();
+    }
     
     // Add account security flags
-    table.boolean('two_factor_enabled').defaultTo(false);
-    table.string('two_factor_secret').nullable();
-    
-    // Add index for performance
-    table.index('password_changed_at');
+    if (!hasTwoFactorEnabled) {
+      table.boolean('two_factor_enabled').defaultTo(false);
+    }
+    if (!hasTwoFactorSecret) {
+      table.string('two_factor_secret').nullable();
+    }
   });
 };
 

backend/migrations/legacy/017_add_token_revocation_tables.js

@@ -1,7 +1,11 @@
-exports.up = function(knex) {
-  return knex.schema
-    // Table for individual token revocations
-    .createTable('revoked_tokens', table => {
+exports.up = async function(knex) {
+  // Check if tables already exist to avoid conflicts
+  const hasRevokedTokensTable = await knex.schema.hasTable('revoked_tokens');
+  const hasUserTokenRevocationsTable = await knex.schema.hasTable('user_token_revocations');
+  
+  // Create revoked_tokens table if it doesn't exist
+  if (!hasRevokedTokensTable) {
+    await knex.schema.createTable('revoked_tokens', table => {
       table.increments('id').primary();
       table.string('token_id').notNullable().unique(); // JWT ID or generated ID
       table.integer('user_id').nullable(); // User who owned the token
@@ -15,9 +19,12 @@ exports.up = function(knex) {
       table.index('token_id');
       table.index('user_id');
       table.index('expires_at'); // For cleanup
-    })
-    // Table for user-level revocations (revoke all tokens before a certain time)
-    .createTable('user_token_revocations', table => {
+    });
+  }
+  
+  // Create user_token_revocations table if it doesn't exist
+  if (!hasUserTokenRevocationsTable) {
+    await knex.schema.createTable('user_token_revocations', table => {
       table.integer('user_id').primary();
       table.timestamp('revoked_at').notNullable();
       table.string('reason', 100);
@@ -25,6 +32,28 @@ exports.up = function(knex) {
       // Index for quick lookups
       table.index('revoked_at');
     });
+  }
+  
+  // Add any missing indexes if tables already existed
+  if (hasRevokedTokensTable) {
+    try {
+      // Try to add indexes if they don't exist (PostgreSQL syntax)
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_token_id_index" ON "revoked_tokens" ("token_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_user_id_index" ON "revoked_tokens" ("user_id")');
+      await knex.raw('CREATE INDEX IF NOT EXISTS "revoked_tokens_expires_at_index" ON "revoked_tokens" ("expires_at")');
+    } catch (error) {
+      // For SQLite compatibility, ignore errors if indexes already exist
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
+  
+  if (hasUserTokenRevocationsTable) {
+    try {
+      await knex.raw('CREATE INDEX IF NOT EXISTS "user_token_revocations_revoked_at_index" ON "user_token_revocations" ("revoked_at")');
+    } catch (error) {
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
 };
 
 exports.down = function(knex) {

backend/migrations/run-migrations-safe.js

@@ -120,7 +120,9 @@ async function runMigrations() {
     
     // Check if this is a new deployment
     // It's new if no essential tables exist OR no migrations have been applied
-    const isNewDeployment = (!hasEventsTable || !hasPhotosTable || !hasAdminTable || !hasActivityLogsTable) || appliedFilenames.length === 0;
+    const hasEssentialTables = hasEventsTable && hasPhotosTable && hasAdminTable && hasActivityLogsTable;
+    const isDatabaseEmpty = !hasEventsTable && !hasPhotosTable && !hasAdminTable && !hasActivityLogsTable;
+    const isNewDeployment = isDatabaseEmpty || (appliedFilenames.length === 0 && !hasEssentialTables);
     
     // Only detect existing schema for truly existing deployments
     if (!isNewDeployment) {
@@ -227,4 +229,4 @@ if (require.main === module) {
   waitAndRun();
 }
 
-module.exports = { runMigrations };
+module.exports = { runMigrations };

backend/package-lock.json

@@ -1,21 +1,22 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.98",
+  "version": "1.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-backend",
-      "version": "1.0.98",
+      "version": "1.1.5",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.850.0",
         "@aws-sdk/lib-storage": "^3.850.0",
         "@aws-sdk/s3-request-presigner": "^3.850.0",
         "adm-zip": "^0.5.16",
         "archiver": "^5.3.1",
-        "axios": "^1.10.0",
+        "axios": "^1.12.2",
         "bcrypt": "6.0.0",
         "chokidar": "4.0.3",
+        "cookie-parser": "^1.4.7",
         "cors": "^2.8.5",
         "dotenv": "^16.0.3",
         "express": "^4.18.2",
@@ -34,9 +35,10 @@
         "mime-types": "^3.0.1",
         "multer": "^2.0.2",
         "node-cron": "^3.0.2",
-        "nodemailer": "7.0.5",
+        "nodemailer": "^7.0.10",
         "pg": "^8.16.3",
         "react-i18next": "^15.6.0",
+        "sanitize-html": "^2.17.0",
         "sharp": "0.34.3",
         "sqlite3": "^5.1.6",
         "uuid": "^11.1.0",
@@ -46,6 +48,7 @@
       "devDependencies": {
         "eslint": "^8.40.0",
         "jest": "^29.5.0",
+        "mock-fs": "^5.5.0",
         "nodemon": "^3.1.10",
         "supertest": "^6.3.3"
       }
@@ -3889,13 +3892,13 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.10.0.tgz",
-      "integrity": "sha512-/1xYAC4MP/HEG+3duIhFr4ZQXR4sQXOIe+o6sdqzeykGLx6Upp/1p8MHqhINOvGeP7xyNHe7tsiJByc4SSVUxw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.2.tgz",
+      "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.0",
+        "form-data": "^4.0.4",
         "proxy-from-env": "^1.1.0"
       }
     },
@@ -4727,6 +4730,28 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/cookie-parser": {
+      "version": "1.4.7",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.7.tgz",
+      "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "0.7.2",
+        "cookie-signature": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/cookie-parser/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -4898,7 +4923,6 @@
       "version": "4.3.1",
       "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
       "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -4992,6 +5016,61 @@
         "node": ">=6.0.0"
       }
     },
+    "node_modules/dom-serializer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
+      "integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.2",
+        "entities": "^4.2.0"
+      },
+      "funding": {
+        "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+      }
+    },
+    "node_modules/domelementtype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/domhandler": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
+      "integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "domelementtype": "^2.3.0"
+      },
+      "engines": {
+        "node": ">= 4"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domhandler?sponsor=1"
+      }
+    },
+    "node_modules/domutils": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+      "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "dom-serializer": "^2.0.0",
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domutils?sponsor=1"
+      }
+    },
     "node_modules/dotenv": {
       "version": "16.6.1",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@ -5107,6 +5186,18 @@
         "once": "^1.4.0"
       }
     },
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/env-paths": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
@@ -5198,7 +5289,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
       "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -5530,13 +5620,13 @@
       }
     },
     "node_modules/express-validator": {
-      "version": "7.2.1",
-      "resolved": "https://registry.npmjs.org/express-validator/-/express-validator-7.2.1.tgz",
-      "integrity": "sha512-CjNE6aakfpuwGaHQZ3m8ltCG2Qvivd7RHtVMS/6nVxOM7xVGqr4bhflsm4+N5FP5zI7Zxp+Hae+9RE+o8e3ZOQ==",
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/express-validator/-/express-validator-7.3.0.tgz",
+      "integrity": "sha512-ujK2BX5JUun5NR4JuBo83YSXoDDIpoGz3QxgHTzQcHFevkKnwV1in4K7YNuuXQ1W3a2ObXB/P4OTnTZpUyGWiw==",
       "license": "MIT",
       "dependencies": {
         "lodash": "^4.17.21",
-        "validator": "~13.12.0"
+        "validator": "~13.15.15"
       },
       "engines": {
         "node": ">= 8.0.0"
@@ -6146,6 +6236,25 @@
         "void-elements": "3.1.0"
       }
     },
+    "node_modules/htmlparser2": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-8.0.2.tgz",
+      "integrity": "sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==",
+      "funding": [
+        "https://github.com/fb55/htmlparser2?sponsor=1",
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^2.3.0",
+        "domhandler": "^5.0.3",
+        "domutils": "^3.0.1",
+        "entities": "^4.4.0"
+      }
+    },
     "node_modules/http-cache-semantics": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
@@ -6540,6 +6649,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/is-stream": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
@@ -7991,6 +8109,16 @@
       "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
       "license": "MIT"
     },
+    "node_modules/mock-fs": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/mock-fs/-/mock-fs-5.5.0.tgz",
+      "integrity": "sha512-d/P1M/RacgM3dB0sJ8rjeRNXxtapkPCUnMGmIN0ixJ16F/E4GUZCvWcSGfWGz8eaXYvn1s9baUwNjI4LOPEjiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -8015,6 +8143,24 @@
         "node": ">= 10.16.0"
       }
     },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/napi-build-utils": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
@@ -8209,9 +8355,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.5.tgz",
-      "integrity": "sha512-nsrh2lO3j4GkLLXoeEksAMgAOqxOv6QumNRVQTJwKH4nuiww6iC2y7GyANs9kRAxCexg3+lTWM3PZ91iLlVjfg==",
+      "version": "7.0.10",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.10.tgz",
+      "integrity": "sha512-Us/Se1WtT0ylXgNFfyFSx4LElllVLJXQjWi2Xz17xWw7amDKO2MLtFnVp1WACy7GkVGs+oBlRopVNUzlrGSw1w==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -8520,6 +8666,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/parse-srcset": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/parse-srcset/-/parse-srcset-1.0.2.tgz",
+      "integrity": "sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==",
+      "license": "MIT"
+    },
     "node_modules/parseurl": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -8669,7 +8821,6 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
@@ -8764,6 +8915,34 @@
         "node": ">=8"
       }
     },
+    "node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -8829,24 +9008,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/prebuild-install/node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "license": "ISC"
-    },
-    "node_modules/prebuild-install/node_modules/tar-fs": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
-      "license": "MIT",
-      "dependencies": {
-        "chownr": "^1.1.1",
-        "mkdirp-classic": "^0.5.2",
-        "pump": "^3.0.0",
-        "tar-stream": "^2.1.4"
-      }
-    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -9355,6 +9516,20 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/sanitize-html": {
+      "version": "2.17.0",
+      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.0.tgz",
+      "integrity": "sha512-dLAADUSS8rBwhaevT12yCezvioCA+bmUTPH/u57xKPT8d++voeYE6HeluA/bPbQ15TwDBG2ii+QZIEmYx8VdxA==",
+      "license": "MIT",
+      "dependencies": {
+        "deepmerge": "^4.2.2",
+        "escape-string-regexp": "^4.0.0",
+        "htmlparser2": "^8.0.0",
+        "is-plain-object": "^5.0.0",
+        "parse-srcset": "^1.0.2",
+        "postcss": "^8.3.11"
+      }
+    },
     "node_modules/semver": {
       "version": "7.7.2",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
@@ -9727,6 +9902,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/source-map-support": {
       "version": "0.5.13",
       "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
@@ -10044,6 +10228,24 @@
         "node": ">=10"
       }
     },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
     "node_modules/tar-stream": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
@@ -10422,9 +10624,9 @@
       }
     },
     "node_modules/validator": {
-      "version": "13.12.0",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.12.0.tgz",
-      "integrity": "sha512-c1Q0mCiPlgdTVVVIJIrBuxNicYE+t/7oKeI9MWLj3fh/uq2Pxh/3eeWbVZ4OcGW1TUf53At0njHw5SMdA3tmMg==",
+      "version": "13.15.20",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.20.tgz",
+      "integrity": "sha512-KxPOq3V2LmfQPP4eqf3Mq/zrT0Dqp2Vmx2Bn285LwVahLc+CsxOM0crBHczm8ijlcjZ0Q5Xd6LW3z3odTPnlrw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "1.0.98",
+  "version": "1.1.5",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {
@@ -8,11 +8,8 @@
     "dev": "nodemon server.js",
     "migrate": "node migrations/run-migrations.js",
     "migrate:safe": "node migrations/run-migrations-safe.js",
-    "fix-temp-photos": "node scripts/fix-temp-photos.js",
     "test": "jest",
-    "lint": "eslint src/",
-    "test-backup": "node scripts/test-backup-service.js",
-    "test-restore": "node scripts/test-restore-service.js"
+    "lint": "eslint src/"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.850.0",
@@ -20,9 +17,10 @@
     "@aws-sdk/s3-request-presigner": "^3.850.0",
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
-    "axios": "^1.10.0",
+    "axios": "^1.12.2",
     "bcrypt": "6.0.0",
     "chokidar": "4.0.3",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
@@ -41,9 +39,10 @@
     "mime-types": "^3.0.1",
     "multer": "^2.0.2",
     "node-cron": "^3.0.2",
-    "nodemailer": "7.0.5",
+    "nodemailer": "^7.0.10",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
+    "sanitize-html": "^2.17.0",
     "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "uuid": "^11.1.0",
@@ -53,6 +52,7 @@
   "devDependencies": {
     "eslint": "^8.40.0",
     "jest": "^29.5.0",
+    "mock-fs": "^5.5.0",
     "nodemon": "^3.1.10",
     "supertest": "^6.3.3"
   }

backend/scripts/fix-migration-state.js

@@ -1,61 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Fix migration state by marking migrations as applied if their tables already exist
- */
-
-const { db } = require('../src/database/db');
-
-async function fixMigrationState() {
-  try {
-    console.log('Checking migration state...');
-    
-    // Ensure migrations table exists
-    const hasMigrationsTable = await db.schema.hasTable('migrations');
-    if (!hasMigrationsTable) {
-      await db.schema.createTable('migrations', (table) => {
-        table.increments('id').primary();
-        table.string('filename').unique().notNullable();
-        table.timestamp('applied_at').defaultTo(db.fn.now());
-      });
-      console.log('Created migrations tracking table');
-    }
-    
-    // Check for specific tables and mark their migrations as applied
-    const tableChecks = [
-      { table: 'restore_runs', migration: '032_add_restore_runs_table.js' },
-      { table: 'restore_file_operations', migration: '032_add_restore_runs_table.js' },
-      { table: 'restore_validation_results', migration: '032_add_restore_runs_table.js' },
-      { table: 'gallery_feedback', migration: '033_add_gallery_feedback.js' },
-      { table: 'feedback_photos', migration: '033_add_gallery_feedback.js' },
-    ];
-    
-    for (const check of tableChecks) {
-      const tableExists = await db.schema.hasTable(check.table);
-      if (tableExists) {
-        const migrationApplied = await db('migrations')
-          .where('filename', check.migration)
-          .first();
-        
-        if (!migrationApplied) {
-          await db('migrations').insert({ 
-            filename: check.migration,
-            applied_at: new Date()
-          });
-          console.log(`✅ Marked ${check.migration} as applied (table ${check.table} exists)`);
-        } else {
-          console.log(`ℹ️  ${check.migration} already marked as applied`);
-        }
-      }
-    }
-    
-    console.log('\nMigration state fixed successfully!');
-  } catch (error) {
-    console.error('Error fixing migration state:', error.message);
-    process.exit(1);
-  } finally {
-    await db.destroy();
-  }
-}
-
-fixMigrationState();

backend/scripts/fix-temp-photos.js

@@ -1,171 +0,0 @@
-require('dotenv').config({ path: '../.env' });
-const path = require('path');
-const fs = require('fs').promises;
-const { db } = require('../src/database/db');
-const { generatePhotoFilename } = require('../src/utils/filenameSanitizer');
-
-async function fixTempPhotos() {
-  console.log('Starting to fix temporary photo files...\n');
-  
-  try {
-    // Find all photos with temp_ filenames
-    const tempPhotos = await db('photos')
-      .where('filename', 'like', 'temp_%')
-      .orderBy('event_id', 'asc')
-      .orderBy('category_id', 'asc')
-      .orderBy('id', 'asc');
-    
-    console.log(`Found ${tempPhotos.length} photos with temporary filenames\n`);
-    
-    if (tempPhotos.length === 0) {
-      console.log('No temporary photos found. Exiting.');
-      return;
-    }
-    
-    // Group photos by event and category
-    const grouped = {};
-    for (const photo of tempPhotos) {
-      const key = `${photo.event_id}_${photo.category_id || 'null'}`;
-      if (!grouped[key]) {
-        grouped[key] = [];
-      }
-      grouped[key].push(photo);
-    }
-    
-    console.log(`Processing ${Object.keys(grouped).length} event/category groups...\n`);
-    
-    // Process each group
-    for (const [key, photos] of Object.entries(grouped)) {
-      const [eventId, categoryIdStr] = key.split('_');
-      const categoryId = categoryIdStr === 'null' ? null : parseInt(categoryIdStr);
-      
-      console.log(`\nProcessing Event ID: ${eventId}, Category ID: ${categoryId || 'uncategorized'}`);
-      console.log(`Photos in group: ${photos.length}`);
-      
-      // Get event details
-      const event = await db('events').where({ id: eventId }).first();
-      if (!event) {
-        console.error(`Event ${eventId} not found! Skipping...`);
-        continue;
-      }
-      
-      // Get category details if applicable
-      let category = null;
-      let startCounter = 1;
-      
-      if (categoryId) {
-        category = await db('photo_categories').where({ id: categoryId }).first();
-        if (!category) {
-          console.error(`Category ${categoryId} not found! Treating as uncategorized...`);
-        } else {
-          // Get the highest counter for this category
-          const maxPhoto = await db('photos')
-            .where({ event_id: eventId, category_id: categoryId })
-            .whereNot('filename', 'like', 'temp_%')
-            .orderBy('id', 'desc')
-            .first();
-          
-          if (maxPhoto && maxPhoto.filename) {
-            // Extract counter from filename
-            const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
-            if (match) {
-              startCounter = parseInt(match[1]) + 1;
-            }
-          }
-        }
-      } else {
-        // For uncategorized, get the highest counter
-        const maxPhoto = await db('photos')
-          .where({ event_id: eventId })
-          .whereNull('category_id')
-          .whereNot('filename', 'like', 'temp_%')
-          .orderBy('id', 'desc')
-          .first();
-        
-        if (maxPhoto && maxPhoto.filename) {
-          const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
-          if (match) {
-            startCounter = parseInt(match[1]) + 1;
-          }
-        }
-      }
-      
-      console.log(`Starting counter: ${startCounter}`);
-      
-      // Process each photo in the group
-      let successCount = 0;
-      let errorCount = 0;
-      
-      for (let i = 0; i < photos.length; i++) {
-        const photo = photos[i];
-        const counter = startCounter + i;
-        
-        try {
-          // Generate new filename
-          const extension = path.extname(photo.filename);
-          const newFilename = generatePhotoFilename(
-            event.event_name,
-            category ? category.name : 'uncategorized',
-            counter,
-            extension
-          );
-          
-          // Build full paths
-          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
-          const oldPath = path.join(storagePath, 'events/active', photo.path);
-          const newPath = path.join(path.dirname(oldPath), newFilename);
-          
-          // Check if old file exists
-          try {
-            await fs.access(oldPath);
-          } catch (e) {
-            console.error(`File not found: ${oldPath}`);
-            errorCount++;
-            continue;
-          }
-          
-          // Rename the file
-          await fs.rename(oldPath, newPath);
-          
-          // Update database
-          const newRelativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
-          await db('photos')
-            .where({ id: photo.id })
-            .update({
-              filename: newFilename,
-              path: newRelativePath
-            });
-          
-          console.log(`✓ Renamed: ${photo.filename} → ${newFilename}`);
-          successCount++;
-          
-        } catch (error) {
-          console.error(`✗ Failed to process photo ${photo.id}: ${error.message}`);
-          errorCount++;
-        }
-      }
-      
-      // Update category counter if needed
-      if (category && successCount > 0) {
-        const newCounter = startCounter + photos.length - 1;
-        await db('photo_categories')
-          .where({ id: categoryId })
-          .update({ photo_counter: newCounter });
-        console.log(`Updated category counter to ${newCounter}`);
-      }
-      
-      console.log(`\nGroup summary: ${successCount} successful, ${errorCount} errors`);
-    }
-    
-    console.log('\n=== COMPLETE ===');
-    console.log('All temporary photos have been processed.');
-    
-  } catch (error) {
-    console.error('Fatal error:', error);
-  } finally {
-    await db.destroy();
-  }
-}
-
-// Run the script
-fixTempPhotos().catch(console.error);

backend/scripts/mark-migration-applied.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Mark a specific migration as applied without running it
- * Usage: node scripts/mark-migration-applied.js <migration-filename>
- */
-
-const { db } = require('../src/database/db');
-
-async function markMigrationAsApplied(filename) {
-  try {
-    // Check if migration is already marked
-    const existing = await db('migrations')
-      .where('filename', filename)
-      .first();
-    
-    if (existing) {
-      console.log(`Migration ${filename} is already marked as applied`);
-      return;
-    }
-    
-    // Mark as applied
-    await db('migrations').insert({ 
-      filename,
-      applied_at: new Date()
-    });
-    
-    console.log(`✅ Migration ${filename} marked as applied`);
-  } catch (error) {
-    console.error('Error marking migration:', error.message);
-    process.exit(1);
-  } finally {
-    await db.destroy();
-  }
-}
-
-// Get migration filename from command line
-const migrationFile = process.argv[2];
-
-if (!migrationFile) {
-  console.error('Usage: node scripts/mark-migration-applied.js <migration-filename>');
-  console.error('Example: node scripts/mark-migration-applied.js 032_add_restore_runs_table.js');
-  process.exit(1);
-}
-
-markMigrationAsApplied(migrationFile);

backend/scripts/migrate-upload-assets.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+
+const fsp = fs.promises;
+
+async function pathExists(location) {
+  try {
+    await fsp.access(location);
+    return true;
+  } catch (error) {
+    if (error && error.code === 'ENOENT') {
+      return false;
+    }
+    throw error;
+  }
+}
+
+async function moveFile(source, destination) {
+  await fsp.mkdir(path.dirname(destination), { recursive: true });
+  try {
+    await fsp.rename(source, destination);
+  } catch (error) {
+    if (error.code === 'EXDEV') {
+      await fsp.copyFile(source, destination);
+      await fsp.unlink(source);
+    } else if (error.code === 'EEXIST') {
+      console.warn(`Destination already exists, leaving original in place: ${destination}`);
+      return;
+    } else {
+      throw error;
+    }
+  }
+}
+
+async function migrate() {
+  const backendRoot = path.resolve(__dirname, '..');
+  const defaultStorage = path.resolve(backendRoot, '../storage');
+  const targetStorage = path.resolve(process.env.STORAGE_PATH || defaultStorage);
+  const legacyUploadsRoot = path.resolve(backendRoot, 'storage/uploads');
+  const targetUploadsRoot = path.join(targetStorage, 'uploads');
+
+  if (legacyUploadsRoot === targetUploadsRoot) {
+    console.log('Legacy uploads directory already matches target STORAGE_PATH. Nothing to migrate.');
+    return;
+  }
+
+  if (!fs.existsSync(legacyUploadsRoot)) {
+    console.log(`Legacy uploads directory not found at ${legacyUploadsRoot}. Nothing to migrate.`);
+    return;
+  }
+
+  const categories = ['logos', 'favicons'];
+  let migratedCounter = 0;
+
+  for (const category of categories) {
+    const legacyDir = path.join(legacyUploadsRoot, category);
+    if (!fs.existsSync(legacyDir)) {
+      continue;
+    }
+
+    const targetDir = path.join(targetUploadsRoot, category);
+    await fsp.mkdir(targetDir, { recursive: true });
+
+    const entries = await fsp.readdir(legacyDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isFile()) {
+        continue;
+      }
+
+      const sourcePath = path.join(legacyDir, entry.name);
+      const destinationPath = path.join(targetDir, entry.name);
+
+      if (await pathExists(destinationPath)) {
+        console.warn(`Skipping ${sourcePath} because ${destinationPath} already exists.`);
+        continue;
+      }
+
+      await moveFile(sourcePath, destinationPath);
+      migratedCounter += 1;
+    }
+
+    const remaining = await fsp.readdir(legacyDir);
+    if (remaining.length === 0) {
+      await fsp.rm(legacyDir, { recursive: true, force: true });
+    }
+  }
+
+  if (migratedCounter === 0) {
+    console.log('No legacy logo or favicon files needed migration.');
+    return;
+  }
+
+  console.log(`Migrated ${migratedCounter} files into ${targetUploadsRoot}.`);
+  console.log('If the database still references legacy absolute paths, they will be cleaned up automatically on the next upload.');
+}
+
+migrate().catch((error) => {
+  console.error('Migration failed:', error);
+  process.exitCode = 1;
+});

backend/scripts/regenerate-square-thumbnails.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate all thumbnails with new square dimensions
+ * This fixes the blurry thumbnail issue by creating proper 300x300 square thumbnails
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generateThumbnail } = require('../src/services/imageProcessor');
+const logger = require('../src/utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function regenerateAllThumbnails() {
+  try {
+    console.log('Starting thumbnail regeneration with square dimensions...');
+    
+    // First, ensure the new thumbnail settings are in the database
+    const settings = [
+      { key: 'thumbnail_width', value: '300' },
+      { key: 'thumbnail_height', value: '300' },
+      { key: 'thumbnail_fit', value: 'cover' },
+      { key: 'thumbnail_quality', value: '85' },
+      { key: 'thumbnail_format', value: 'jpeg' }
+    ];
+    
+    for (const setting of settings) {
+      const exists = await db('app_settings').where('key', setting.key).first();
+      if (!exists) {
+        await db('app_settings').insert({
+          ...setting,
+          description: `Thumbnail ${setting.key.replace('thumbnail_', '')}`,
+          created_at: db.fn.now(),
+          updated_at: db.fn.now()
+        });
+        console.log(`Added setting: ${setting.key} = ${setting.value}`);
+      }
+    }
+    
+    // Get all photos
+    const photos = await db('photos')
+      .select('id', 'event_id', 'path', 'filename')
+      .orderBy('id');
+    
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let errorCount = 0;
+    let skippedCount = 0;
+    
+    for (let i = 0; i < photos.length; i++) {
+      const photo = photos[i];
+      const progress = Math.round((i + 1) / photos.length * 100);
+      
+      try {
+        const storagePath = getStoragePath();
+        const originalPath = path.join(storagePath, 'events/active', photo.path);
+        
+        // Check if original file exists
+        try {
+          await fs.access(originalPath);
+        } catch (err) {
+          console.log(`[${progress}%] Skipping photo ${photo.id} - original file not found`);
+          skippedCount++;
+          continue;
+        }
+        
+        // Regenerate thumbnail with new square dimensions
+        const thumbnailPath = await generateThumbnail(originalPath, { regenerate: true });
+        
+        if (thumbnailPath) {
+          // Update database with new thumbnail path
+          await db('photos')
+            .where({ id: photo.id })
+            .update({ 
+              thumbnail_path: thumbnailPath,
+              updated_at: db.fn.now()
+            });
+          
+          successCount++;
+          console.log(`[${progress}%] ✓ Regenerated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+          console.error(`[${progress}%] ✗ Failed to generate thumbnail for ${photo.filename}`);
+        }
+      } catch (error) {
+        errorCount++;
+        console.error(`[${progress}%] ✗ Error processing photo ${photo.id}:`, error.message);
+      }
+    }
+    
+    console.log('\n=== Regeneration Complete ===');
+    console.log(`✓ Success: ${successCount} thumbnails`);
+    console.log(`✗ Errors: ${errorCount} thumbnails`);
+    console.log(`⊘ Skipped: ${skippedCount} thumbnails (original files not found)`);
+    console.log(`Total processed: ${photos.length} photos`);
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('Fatal error during thumbnail regeneration:', error);
+    process.exit(1);
+  }
+}
+
+// Run the script
+regenerateAllThumbnails();

backend/scripts/reset-admin-password.js

@@ -7,12 +7,32 @@ const fs = require('fs').promises;
 const path = require('path');
 const readline = require('readline');
 
-const rl = readline.createInterface({
+const args = process.argv.slice(2);
+const hasFlag = (flag) => args.includes(flag);
+const getOption = (name) => {
+  const index = args.indexOf(`--${name}`);
+  if (index !== -1 && index + 1 < args.length) {
+    return args[index + 1];
+  }
+  return null;
+};
+
+const force = hasFlag('--force') || hasFlag('--yes') || hasFlag('--non-interactive');
+const credentialsFileArg = getOption('credentials-file');
+const resolvedCredentialsFile = credentialsFileArg
+  ? path.resolve(process.cwd(), credentialsFileArg)
+  : path.join(__dirname, '..', '..', 'ADMIN_PASSWORD_RESET.txt');
+
+const rl = force ? null : readline.createInterface({
   input: process.stdin,
   output: process.stdout
 });
 
-async function question(prompt) {
+async function ask(prompt) {
+  if (force) {
+    return 'yes';
+  }
+
   return new Promise((resolve) => {
     rl.question(prompt, resolve);
   });
@@ -37,13 +57,18 @@ async function resetAdminPassword() {
 
     console.log('Found admin user:', admin.username);
     console.log('Email:', admin.email);
-    console.log('\nThis will reset the password for this admin account.');
-    
-    const confirm = await question('\nDo you want to continue? (yes/no): ');
-    
-    if (confirm.toLowerCase() !== 'yes' && confirm.toLowerCase() !== 'y') {
-      console.log('\n❌ Password reset cancelled.');
-      process.exit(0);
+    if (!force) {
+      console.log('\nThis will reset the password for this admin account.');
+    }
+
+    const confirm = await ask('\nDo you want to continue? (yes/no): ');
+
+    if (!force) {
+      const normalized = confirm.trim().toLowerCase();
+      if (normalized !== 'yes' && normalized !== 'y') {
+        console.log('\n❌ Password reset cancelled.');
+        process.exit(0);
+      }
     }
 
     // Generate new password
@@ -60,39 +85,44 @@ async function resetAdminPassword() {
       });
 
     // Save to file
-    const resetInfoPath = path.join(__dirname, '..', '..', 'ADMIN_PASSWORD_RESET.txt');
+    const credentialsDir = path.dirname(resolvedCredentialsFile);
+    await fs.mkdir(credentialsDir, { recursive: true });
+
+    const adminUrl = `${process.env.ADMIN_URL || 'http://localhost:3001'}/admin`;
     const resetInfo = `
 ========================================
-PicPeak Admin Password Reset
+PicPeak Admin Credentials
 ========================================
 
-Password has been reset for admin account:
+Your admin account has been reset with these credentials:
 
-Username: admin
-New Password: ${newPassword}
+Username: ${admin.username}
+Email: ${admin.email}
+Password: ${newPassword}
 
-IMPORTANT:
-1. You MUST change this password on next login
+IMPORTANT SECURITY NOTES:
+1. You MUST change this password after first login
 2. This file contains sensitive information
 3. Delete this file after noting the password
 
-Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
+Login URL: ${adminUrl}
 
 Reset performed on: ${new Date().toISOString()}
 ========================================
 `;
 
-    await fs.writeFile(resetInfoPath, resetInfo, 'utf8');
+    await fs.writeFile(resolvedCredentialsFile, resetInfo, 'utf8');
 
     console.log('\n✅ Password reset successful!\n');
     console.log('========================================');
     console.log('New Credentials:');
     console.log('========================================');
-    console.log('Username: admin');
+    console.log(`Username: ${admin.username}`);
+    console.log(`Email: ${admin.email}`);
     console.log(`Password: ${newPassword}`);
     console.log('\n⚠️  IMPORTANT:');
     console.log('1. You will be required to change this password on next login');
-    console.log('2. Credentials are also saved in: ADMIN_PASSWORD_RESET.txt');
+    console.log(`2. Credentials are also saved in: ${resolvedCredentialsFile}`);
     console.log('3. Delete the file after noting the password');
     console.log('========================================\n');
 
@@ -100,10 +130,12 @@ Reset performed on: ${new Date().toISOString()}
     console.error('❌ Error resetting password:', error.message);
     process.exit(1);
   } finally {
-    rl.close();
+    if (rl) {
+      rl.close();
+    }
     process.exit(0);
   }
 }
 
 // Run the reset
-resetAdminPassword();
+resetAdminPassword();

backend/scripts/set-admin-password.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+const bcrypt = require('bcrypt');
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '../.env') });
+
+const knex = require('knex');
+const db = knex({
+  client: process.env.DB_CLIENT || 'pg',
+  connection: {
+    host: process.env.DB_HOST || 'localhost',
+    port: process.env.DB_PORT || 5432,
+    user: process.env.DB_USER || 'picpeak',
+    password: process.env.DB_PASSWORD || 'picpeak',
+    database: process.env.DB_NAME || 'picpeak_dev'
+  }
+});
+
+async function setAdminPassword() {
+  try {
+    const password = 'admin123';
+    const hashedPassword = await bcrypt.hash(password, 10);
+    
+    await db('admin_users')
+      .where('username', 'admin')
+      .update({
+        password_hash: hashedPassword,
+        updated_at: new Date()
+      });
+    
+    console.log('✅ Admin password set to: admin123');
+    process.exit(0);
+  } catch (error) {
+    console.error('❌ Error setting password:', error);
+    process.exit(1);
+  }
+}
+
+setAdminPassword();

backend/scripts/show-admin-credentials.js

@@ -39,8 +39,9 @@ async function showAdminCredentials(resetPassword = false) {
           updated_at: new Date()
         });
       
-      console.log(`Password: ${newPassword} (NEWLY RESET)`);
-      console.log('\n⚠️  IMPORTANT: Please save this password securely!');
+      // Password logging removed for security - check logs or database if needed
+      console.log('Password: [NEWLY RESET - stored in database]');
+      console.log('\n⚠️  IMPORTANT: New password has been set in database!');
     } else {
       console.log('Password: [hidden - use --reset flag to generate new password]');
     }

backend/scripts/test-backup-integration.js

@@ -1,577 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Manual Integration Test Script for Enhanced Backup System
- * 
- * This script provides a comprehensive test of the backup system with real services.
- * It can be used to test against MinIO, AWS S3, or other S3-compatible services.
- * 
- * Usage:
- *   node scripts/test-backup-integration.js [options]
- * 
- * Options:
- *   --endpoint <url>     S3 endpoint URL (default: http://localhost:9000)
- *   --access-key <key>   S3 access key (default: minioadmin)
- *   --secret-key <key>   S3 secret key (default: minioadmin)
- *   --bucket <name>      S3 bucket name (default: test-backup-<timestamp>)
- *   --type <type>        Backup type: s3, local, rsync (default: s3)
- *   --cleanup            Clean up test data after completion
- *   --verbose            Enable verbose logging
- *   --help               Show this help message
- * 
- * Examples:
- *   # Test with local MinIO
- *   node scripts/test-backup-integration.js
- * 
- *   # Test with AWS S3
- *   node scripts/test-backup-integration.js \
- *     --endpoint https://s3.amazonaws.com \
- *     --access-key AKIAIOSFODNN7EXAMPLE \
- *     --secret-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
- *     --bucket my-test-bucket
- * 
- *   # Test local backup
- *   node scripts/test-backup-integration.js --type local
- */
-
-const path = require('path');
-const fs = require('fs').promises;
-const crypto = require('crypto');
-const { S3Client, CreateBucketCommand, HeadBucketCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand, DeleteBucketCommand } = require('@aws-sdk/client-s3');
-
-// Parse command line arguments
-const args = process.argv.slice(2);
-const options = {
-  endpoint: 'http://localhost:9000',
-  accessKey: 'minioadmin',
-  secretKey: 'minioadmin',
-  bucket: `test-backup-${Date.now()}`,
-  type: 's3',
-  cleanup: false,
-  verbose: false
-};
-
-for (let i = 0; i < args.length; i++) {
-  switch (args[i]) {
-    case '--endpoint':
-      options.endpoint = args[++i];
-      break;
-    case '--access-key':
-      options.accessKey = args[++i];
-      break;
-    case '--secret-key':
-      options.secretKey = args[++i];
-      break;
-    case '--bucket':
-      options.bucket = args[++i];
-      break;
-    case '--type':
-      options.type = args[++i];
-      break;
-    case '--cleanup':
-      options.cleanup = true;
-      break;
-    case '--verbose':
-      options.verbose = true;
-      break;
-    case '--help':
-      console.log(module.exports.description || 'Manual Integration Test Script');
-      process.exit(0);
-  }
-}
-
-// Load environment and services
-require('dotenv').config();
-const { db, initialize: initDb } = require('../src/database/db');
-const backupService = require('../src/services/backupService');
-const S3StorageAdapter = require('../src/services/storage/s3Storage');
-const logger = require('../src/utils/logger');
-
-// Configure logger based on verbose flag
-if (!options.verbose) {
-  logger.info = () => {};
-  logger.debug = () => {};
-}
-
-// Test results
-const results = {
-  passed: 0,
-  failed: 0,
-  skipped: 0,
-  tests: []
-};
-
-// Test utilities
-async function runTest(name, testFn) {
-  console.log(`\n📋 Running: ${name}`);
-  try {
-    const startTime = Date.now();
-    await testFn();
-    const duration = Date.now() - startTime;
-    console.log(`✅ PASSED: ${name} (${duration}ms)`);
-    results.passed++;
-    results.tests.push({ name, status: 'passed', duration });
-  } catch (error) {
-    console.error(`❌ FAILED: ${name}`);
-    console.error(`   Error: ${error.message}`);
-    if (options.verbose) {
-      console.error(error.stack);
-    }
-    results.failed++;
-    results.tests.push({ name, status: 'failed', error: error.message });
-  }
-}
-
-async function skipTest(name, reason) {
-  console.log(`\n⏭️  Skipping: ${name}`);
-  console.log(`   Reason: ${reason}`);
-  results.skipped++;
-  results.tests.push({ name, status: 'skipped', reason });
-}
-
-// Test functions
-async function testS3Connection() {
-  const s3Adapter = new S3StorageAdapter({
-    bucket: options.bucket,
-    endpoint: options.endpoint,
-    accessKeyId: options.accessKey,
-    secretAccessKey: options.secretKey,
-    region: 'us-east-1',
-    forcePathStyle: true,
-    sslEnabled: options.endpoint.startsWith('https')
-  });
-
-  await s3Adapter.testConnection();
-  console.log(`   ✓ Connected to S3 endpoint: ${options.endpoint}`);
-  console.log(`   ✓ Bucket accessible: ${options.bucket}`);
-}
-
-async function setupTestData() {
-  const storagePath = path.join(__dirname, '../test-storage');
-  process.env.STORAGE_PATH = storagePath;
-
-  // Create directory structure
-  const dirs = [
-    'events/active/wedding-2024',
-    'events/active/birthday-2024',
-    'events/archived',
-    'thumbnails',
-    'uploads',
-    'backups'
-  ];
-
-  for (const dir of dirs) {
-    await fs.mkdir(path.join(storagePath, dir), { recursive: true });
-  }
-
-  // Create test files with various sizes
-  const files = [
-    { path: 'events/active/wedding-2024/photo1.jpg', size: 1024 * 1024 }, // 1MB
-    { path: 'events/active/wedding-2024/photo2.jpg', size: 512 * 1024 },  // 512KB
-    { path: 'events/active/birthday-2024/photo1.jpg', size: 2 * 1024 * 1024 }, // 2MB
-    { path: 'events/archived/old-event.zip', size: 5 * 1024 * 1024 }, // 5MB
-    { path: 'thumbnails/thumb1.jpg', size: 50 * 1024 }, // 50KB
-    { path: 'uploads/logo.png', size: 100 * 1024 } // 100KB
-  ];
-
-  let totalSize = 0;
-  for (const file of files) {
-    const content = crypto.randomBytes(file.size);
-    await fs.writeFile(path.join(storagePath, file.path), content);
-    totalSize += file.size;
-  }
-
-  console.log(`   ✓ Created ${files.length} test files`);
-  console.log(`   ✓ Total size: ${(totalSize / 1024 / 1024).toFixed(2)} MB`);
-
-  return { storagePath, fileCount: files.length, totalSize };
-}
-
-async function configureBackup(type) {
-  const baseSettings = [
-    { setting_key: 'backup_enabled', setting_value: 'true' },
-    { setting_key: 'backup_destination_type', setting_value: `"${type}"` },
-    { setting_key: 'backup_include_archived', setting_value: 'true' },
-    { setting_key: 'backup_include_database', setting_value: 'true' },
-    { setting_key: 'backup_incremental', setting_value: 'true' },
-    { setting_key: 'backup_manifest_format', setting_value: '"json"' },
-    { setting_key: 'backup_max_file_size_mb', setting_value: '100' }
-  ];
-
-  const typeSpecificSettings = {
-    s3: [
-      { setting_key: 'backup_s3_bucket', setting_value: `"${options.bucket}"` },
-      { setting_key: 'backup_s3_endpoint', setting_value: `"${options.endpoint}"` },
-      { setting_key: 'backup_s3_access_key', setting_value: `"${options.accessKey}"` },
-      { setting_key: 'backup_s3_secret_key', setting_value: `"${options.secretKey}"` },
-      { setting_key: 'backup_s3_region', setting_value: '"us-east-1"' },
-      { setting_key: 'backup_s3_force_path_style', setting_value: 'true' },
-      { setting_key: 'backup_s3_ssl_enabled', setting_value: options.endpoint.startsWith('https') ? 'true' : 'false' }
-    ],
-    local: [
-      { setting_key: 'backup_destination_path', setting_value: `"${path.join(__dirname, '../test-backup')}"` }
-    ],
-    rsync: [
-      { setting_key: 'backup_rsync_host', setting_value: '"localhost"' },
-      { setting_key: 'backup_rsync_path', setting_value: `"${path.join(__dirname, '../test-backup-rsync')}"` }
-    ]
-  };
-
-  const settings = [...baseSettings, ...(typeSpecificSettings[type] || [])];
-
-  // Clear existing settings
-  await db('app_settings').where('setting_type', 'backup').del();
-
-  // Insert new settings
-  for (const setting of settings) {
-    await db('app_settings').insert({
-      setting_type: 'backup',
-      ...setting,
-      created_at: new Date(),
-      updated_at: new Date()
-    });
-  }
-
-  console.log(`   ✓ Configured ${type} backup with ${settings.length} settings`);
-}
-
-async function performBackup() {
-  const startTime = Date.now();
-  
-  // Run the backup
-  await backupService.runBackup();
-
-  // Get backup results
-  const backupRun = await db('backup_runs')
-    .orderBy('started_at', 'desc')
-    .first();
-
-  if (!backupRun) {
-    throw new Error('No backup run found');
-  }
-
-  if (backupRun.status !== 'completed') {
-    throw new Error(`Backup failed with status: ${backupRun.status}, error: ${backupRun.error_message}`);
-  }
-
-  const duration = Date.now() - startTime;
-
-  console.log(`   ✓ Backup completed in ${duration}ms`);
-  console.log(`   ✓ Files backed up: ${backupRun.files_backed_up}`);
-  console.log(`   ✓ Total size: ${(backupRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
-  console.log(`   ✓ Manifest: ${backupRun.manifest_path ? 'Generated' : 'Not generated'}`);
-
-  return backupRun;
-}
-
-async function verifyS3Backup(backupRun) {
-  const s3Client = new S3Client({
-    endpoint: options.endpoint,
-    region: 'us-east-1',
-    credentials: {
-      accessKeyId: options.accessKey,
-      secretAccessKey: options.secretKey
-    },
-    forcePathStyle: true
-  });
-
-  // List objects in bucket
-  const listResponse = await s3Client.send(new ListObjectsV2Command({
-    Bucket: options.bucket
-  }));
-
-  const objects = listResponse.Contents || [];
-  console.log(`   ✓ Objects in S3: ${objects.length}`);
-
-  // Verify key components
-  const hasBackupFolder = objects.some(obj => obj.Key.includes('backup-'));
-  const hasManifest = objects.some(obj => obj.Key.includes('backup-manifest'));
-  const hasSummary = objects.some(obj => obj.Key.includes('backup-summary.json'));
-  const hasPhotos = objects.some(obj => obj.Key.includes('events/active'));
-
-  if (!hasBackupFolder) throw new Error('No backup folder found in S3');
-  if (!hasManifest) throw new Error('No manifest found in S3');
-  if (!hasSummary) throw new Error('No summary found in S3');
-  if (!hasPhotos) throw new Error('No photos found in S3');
-
-  console.log(`   ✓ Backup structure verified`);
-
-  // Download and verify a file
-  const photoObject = objects.find(obj => obj.Key.includes('photo1.jpg'));
-  if (photoObject) {
-    const getResponse = await s3Client.send(new GetObjectCommand({
-      Bucket: options.bucket,
-      Key: photoObject.Key
-    }));
-
-    const chunks = [];
-    for await (const chunk of getResponse.Body) {
-      chunks.push(chunk);
-    }
-    const content = Buffer.concat(chunks);
-
-    console.log(`   ✓ Downloaded test file: ${photoObject.Key} (${content.length} bytes)`);
-  }
-}
-
-async function testIncrementalBackup(testData) {
-  // Modify a file
-  const modifiedFile = path.join(testData.storagePath, 'events/active/wedding-2024/photo1.jpg');
-  const newContent = crypto.randomBytes(1024 * 1024 + 100); // Slightly larger
-  await fs.writeFile(modifiedFile, newContent);
-
-  console.log(`   ✓ Modified test file`);
-
-  // Perform incremental backup
-  const backupRun = await performBackup();
-
-  if (backupRun.files_backed_up !== 1) {
-    throw new Error(`Expected 1 file in incremental backup, got ${backupRun.files_backed_up}`);
-  }
-
-  console.log(`   ✓ Incremental backup correctly identified changed file`);
-
-  // Verify manifest indicates incremental
-  if (backupRun.manifest_path) {
-    const { manifest } = await backupService.getBackupManifest(backupRun.id);
-    if (!manifest.incremental) {
-      throw new Error('Manifest does not indicate incremental backup');
-    }
-    console.log(`   ✓ Manifest correctly marked as incremental`);
-  }
-
-  return backupRun;
-}
-
-async function testManifestValidation(backupRun) {
-  if (!backupRun.manifest_path) {
-    throw new Error('No manifest path in backup run');
-  }
-
-  const result = await backupService.validateBackupManifest(backupRun.manifest_path);
-
-  if (!result.valid) {
-    throw new Error(`Manifest validation failed: ${result.error}`);
-  }
-
-  console.log(`   ✓ Manifest validation passed`);
-  console.log(`   ✓ Manifest version: ${result.manifest.manifest.version}`);
-  console.log(`   ✓ Files in manifest: ${result.manifest.files.count}`);
-}
-
-async function testBackupStatus() {
-  const status = await backupService.getBackupStatus(5);
-
-  console.log(`   ✓ Backup service running: ${status.isRunning}`);
-  console.log(`   ✓ Backup service healthy: ${status.isHealthy}`);
-  console.log(`   ✓ Recent runs: ${status.recentRuns.length}`);
-
-  if (status.lastRun) {
-    console.log(`   ✓ Last run status: ${status.lastRun.status}`);
-    console.log(`   ✓ Manifest valid: ${status.lastRun.manifestValid}`);
-  }
-}
-
-async function cleanupTestData() {
-  if (!options.cleanup) {
-    console.log('\n📌 Test data retained for inspection');
-    console.log(`   Storage: ${process.env.STORAGE_PATH}`);
-    if (options.type === 's3') {
-      console.log(`   S3 Bucket: ${options.bucket}`);
-    }
-    return;
-  }
-
-  console.log('\n🧹 Cleaning up test data...');
-
-  // Clean storage directory
-  if (process.env.STORAGE_PATH) {
-    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true });
-    console.log('   ✓ Removed test storage directory');
-  }
-
-  // Clean S3 bucket if used
-  if (options.type === 's3') {
-    const s3Client = new S3Client({
-      endpoint: options.endpoint,
-      region: 'us-east-1',
-      credentials: {
-        accessKeyId: options.accessKey,
-        secretAccessKey: options.secretKey
-      },
-      forcePathStyle: true
-    });
-
-    try {
-      // List and delete all objects
-      const listResponse = await s3Client.send(new ListObjectsV2Command({
-        Bucket: options.bucket
-      }));
-
-      if (listResponse.Contents && listResponse.Contents.length > 0) {
-        await s3Client.send(new DeleteObjectsCommand({
-          Bucket: options.bucket,
-          Delete: {
-            Objects: listResponse.Contents.map(obj => ({ Key: obj.Key }))
-          }
-        }));
-        console.log(`   ✓ Deleted ${listResponse.Contents.length} objects from S3`);
-      }
-
-      // Delete bucket
-      await s3Client.send(new DeleteBucketCommand({
-        Bucket: options.bucket
-      }));
-      console.log(`   ✓ Deleted S3 bucket: ${options.bucket}`);
-    } catch (error) {
-      console.error(`   ⚠️  Failed to cleanup S3: ${error.message}`);
-    }
-  }
-
-  // Clean backup directories
-  const backupDirs = [
-    path.join(__dirname, '../test-backup'),
-    path.join(__dirname, '../test-backup-rsync')
-  ];
-
-  for (const dir of backupDirs) {
-    await fs.rm(dir, { recursive: true, force: true }).catch(() => {});
-  }
-  console.log('   ✓ Removed backup directories');
-}
-
-// Main test runner
-async function main() {
-  console.log('🚀 Enhanced Backup System Integration Test');
-  console.log('==========================================');
-  console.log(`Type: ${options.type}`);
-  console.log(`Endpoint: ${options.endpoint}`);
-  console.log(`Bucket: ${options.bucket}`);
-  console.log('');
-
-  let s3Client;
-  let testData;
-
-  try {
-    // Initialize database
-    console.log('📦 Initializing database...');
-    await initDb();
-    await db.migrate.latest();
-    console.log('   ✓ Database initialized');
-
-    // S3-specific setup
-    if (options.type === 's3') {
-      // Test S3 connection
-      await runTest('S3 Connection Test', testS3Connection);
-
-      // Create S3 bucket if needed
-      s3Client = new S3Client({
-        endpoint: options.endpoint,
-        region: 'us-east-1',
-        credentials: {
-          accessKeyId: options.accessKey,
-          secretAccessKey: options.secretKey
-        },
-        forcePathStyle: true
-      });
-
-      try {
-        await s3Client.send(new HeadBucketCommand({ Bucket: options.bucket }));
-        console.log(`\n📦 Using existing bucket: ${options.bucket}`);
-      } catch (error) {
-        if (error.name === 'NotFound') {
-          await s3Client.send(new CreateBucketCommand({ Bucket: options.bucket }));
-          console.log(`\n📦 Created new bucket: ${options.bucket}`);
-        } else {
-          throw error;
-        }
-      }
-    }
-
-    // Setup test data
-    console.log('\n📁 Setting up test data...');
-    testData = await setupTestData();
-
-    // Configure backup
-    console.log(`\n⚙️  Configuring ${options.type} backup...`);
-    await configureBackup(options.type);
-
-    // Run tests based on backup type
-    await runTest('Initial Full Backup', performBackup);
-
-    if (options.type === 's3') {
-      await runTest('Verify S3 Backup Contents', async () => {
-        const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
-        await verifyS3Backup(lastRun);
-      });
-    }
-
-    await runTest('Incremental Backup', () => testIncrementalBackup(testData));
-
-    await runTest('Manifest Validation', async () => {
-      const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
-      await testManifestValidation(lastRun);
-    });
-
-    await runTest('Backup Status Check', testBackupStatus);
-
-    // Performance test with larger files
-    if (options.type === 's3') {
-      await runTest('Large File Backup (10MB)', async () => {
-        const largeFile = path.join(testData.storagePath, 'events/active/large.jpg');
-        await fs.writeFile(largeFile, crypto.randomBytes(10 * 1024 * 1024));
-        await performBackup();
-      });
-    }
-
-    // Test backup service lifecycle
-    await runTest('Backup Service Start/Stop', async () => {
-      await backupService.startBackupService();
-      console.log('   ✓ Service started');
-      
-      backupService.stopBackupService();
-      console.log('   ✓ Service stopped');
-    });
-
-    // Print results summary
-    console.log('\n📊 Test Results Summary');
-    console.log('======================');
-    console.log(`✅ Passed: ${results.passed}`);
-    console.log(`❌ Failed: ${results.failed}`);
-    console.log(`⏭️  Skipped: ${results.skipped}`);
-    console.log(`📋 Total: ${results.tests.length}`);
-
-    if (results.failed > 0) {
-      console.log('\nFailed Tests:');
-      results.tests
-        .filter(t => t.status === 'failed')
-        .forEach(t => console.log(`  - ${t.name}: ${t.error}`));
-    }
-
-  } catch (error) {
-    console.error('\n💥 Fatal error:', error.message);
-    if (options.verbose) {
-      console.error(error.stack);
-    }
-    results.failed++;
-  } finally {
-    // Cleanup
-    await cleanupTestData();
-
-    // Close database
-    await db.destroy();
-
-    // Exit with appropriate code
-    process.exit(results.failed > 0 ? 1 : 0);
-  }
-}
-
-// Run if called directly
-if (require.main === module) {
-  main().catch(error => {
-    console.error('Unhandled error:', error);
-    process.exit(1);
-  });
-}
-
-module.exports = { runTest, skipTest };

backend/scripts/test-backup-service.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-
-require('dotenv').config();
-const { initializeDatabase } = require('../src/database/db');
-const { runBackup, getBackupStatus } = require('../src/services/backupService');
-const logger = require('../src/utils/logger');
-
-async function testBackupService() {
-  try {
-    console.log('Testing backup service...\n');
-    
-    // Initialize database
-    await initializeDatabase();
-    
-    // Get current backup status
-    console.log('Getting backup status...');
-    const statusBefore = await getBackupStatus();
-    console.log('Last run:', statusBefore.lastRun ? statusBefore.lastRun.started_at : 'Never');
-    console.log('Is healthy:', statusBefore.isHealthy);
-    console.log('');
-    
-    // Run backup
-    console.log('Running backup...');
-    await runBackup();
-    
-    // Get status after backup
-    console.log('\nGetting status after backup...');
-    const statusAfter = await getBackupStatus();
-    console.log('Last run:', statusAfter.lastRun ? statusAfter.lastRun.started_at : 'Never');
-    console.log('Status:', statusAfter.lastRun ? statusAfter.lastRun.status : 'Unknown');
-    console.log('Files backed up:', statusAfter.lastRun ? statusAfter.lastRun.files_backed_up : 0);
-    console.log('Total size:', statusAfter.lastRun ? `${(statusAfter.lastRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB` : '0 MB');
-    
-    if (statusAfter.lastRun && statusAfter.lastRun.error_message) {
-      console.log('Error:', statusAfter.lastRun.error_message);
-    }
-    
-    console.log('\nBackup test completed!');
-    process.exit(0);
-  } catch (error) {
-    console.error('Test failed:', error);
-    process.exit(1);
-  }
-}
-
-testBackupService();

backend/scripts/test-restore-service.js

@@ -1,325 +0,0 @@
-/**
- * Test script for the restore service
- * 
- * This script demonstrates the restore service functionality with safety checks
- * 
- * Usage:
- *   node scripts/test-restore-service.js [options]
- * 
- * Options:
- *   --dry-run    Perform validation only without actual restore
- *   --force      Force restore even with warnings
- *   --type       Restore type: full, database, files, selective (default: full)
- *   --source     Backup source path or S3 URL
- *   --manifest   Path to backup manifest
- */
-
-require('dotenv').config();
-const { restoreService } = require('../src/services/restoreService');
-const { db } = require('../src/database/db');
-const logger = require('../src/utils/logger');
-const path = require('path');
-const fs = require('fs').promises;
-
-// Parse command line arguments
-const args = process.argv.slice(2);
-const options = {
-  dryRun: args.includes('--dry-run'),
-  force: args.includes('--force'),
-  restoreType: 'full',
-  source: null,
-  manifestPath: null
-};
-
-// Parse restore type
-const typeIndex = args.indexOf('--type');
-if (typeIndex !== -1 && args[typeIndex + 1]) {
-  options.restoreType = args[typeIndex + 1];
-}
-
-// Parse source
-const sourceIndex = args.indexOf('--source');
-if (sourceIndex !== -1 && args[sourceIndex + 1]) {
-  options.source = args[sourceIndex + 1];
-}
-
-// Parse manifest
-const manifestIndex = args.indexOf('--manifest');
-if (manifestIndex !== -1 && args[manifestIndex + 1]) {
-  options.manifestPath = args[manifestIndex + 1];
-}
-
-async function testRestore() {
-  console.log('=== PicPeak Restore Service Test ===\n');
-  
-  try {
-    // If no source/manifest provided, try to find a recent backup
-    if (!options.source || !options.manifestPath) {
-      console.log('No backup source specified. Looking for recent backups...\n');
-      
-      const recentBackup = await db('backup_runs')
-        .where('status', 'completed')
-        .whereNotNull('manifest_path')
-        .orderBy('completed_at', 'desc')
-        .first();
-      
-      if (!recentBackup) {
-        console.error('❌ No completed backups found in the database');
-        console.log('\nPlease run a backup first or specify --source and --manifest');
-        process.exit(1);
-      }
-      
-      console.log(`Found recent backup from ${recentBackup.completed_at}`);
-      console.log(`Backup ID: ${recentBackup.manifest_id}`);
-      console.log(`Files backed up: ${recentBackup.files_backed_up}`);
-      console.log(`Total size: ${(recentBackup.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
-      console.log(`Manifest: ${recentBackup.manifest_path}\n`);
-      
-      // For this test, we'll create a mock scenario
-      console.log('⚠️  This is a TEST MODE - using mock data for safety\n');
-      
-      // Create test backup directory
-      const testBackupDir = path.join(__dirname, '../temp/test-backup');
-      await fs.mkdir(testBackupDir, { recursive: true });
-      
-      // Create test manifest
-      const testManifest = {
-        manifest: {
-          version: '2.0',
-          created: new Date().toISOString(),
-          generator: 'Test Script',
-          format: 'json'
-        },
-        backup: {
-          id: 'test-backup-' + Date.now(),
-          type: 'full',
-          timestamp: new Date().toISOString(),
-          path: testBackupDir,
-          parent_backup_id: null,
-          retention_days: 30
-        },
-        system: {
-          hostname: require('os').hostname(),
-          platform: process.platform,
-          os_release: require('os').release(),
-          architecture: require('os').arch()
-        },
-        application: {
-          name: 'PicPeak',
-          version: require('../package.json').version,
-          node_version: process.version,
-          environment: 'test'
-        },
-        files: {
-          count: 0,
-          total_size: 0,
-          checksums: {},
-          manifest: []
-        },
-        database: {
-          type: process.env.DB_TYPE === 'postgresql' ? 'postgresql' : 'sqlite',
-          backup_file: null,
-          size: 0,
-          checksum: null,
-          tables: {},
-          row_counts: {}
-        },
-        verification: {
-          total_checksum: null,
-          file_count_check: 0,
-          size_check: 0,
-          integrity_timestamp: new Date().toISOString()
-        },
-        metadata: {
-          test_mode: true
-        }
-      };
-      
-      // Calculate checksum
-      const crypto = require('crypto');
-      const manifestCopy = JSON.parse(JSON.stringify(testManifest));
-      delete manifestCopy.verification.total_checksum;
-      testManifest.verification.total_checksum = crypto
-        .createHash('sha256')
-        .update(JSON.stringify(manifestCopy, Object.keys(manifestCopy).sort()))
-        .digest('hex');
-      
-      // Save test manifest
-      const testManifestPath = path.join(testBackupDir, 'test-manifest.json');
-      await fs.writeFile(testManifestPath, JSON.stringify(testManifest, null, 2));
-      
-      options.source = testBackupDir;
-      options.manifestPath = testManifestPath;
-    }
-    
-    // Display restore options
-    console.log('Restore Options:');
-    console.log(`- Type: ${options.restoreType}`);
-    console.log(`- Source: ${options.source}`);
-    console.log(`- Manifest: ${options.manifestPath}`);
-    console.log(`- Dry Run: ${options.dryRun ? 'Yes' : 'No'}`);
-    console.log(`- Force: ${options.force ? 'Yes' : 'No'}`);
-    console.log('');
-    
-    // Add S3 config if source is S3
-    if (options.source.startsWith('s3://')) {
-      options.s3Config = {
-        accessKeyId: process.env.BACKUP_S3_ACCESS_KEY,
-        secretAccessKey: process.env.BACKUP_S3_SECRET_KEY,
-        region: process.env.BACKUP_S3_REGION || 'us-east-1',
-        endpoint: process.env.BACKUP_S3_ENDPOINT
-      };
-      
-      if (!options.s3Config.accessKeyId || !options.s3Config.secretAccessKey) {
-        console.error('❌ S3 credentials not configured in environment');
-        process.exit(1);
-      }
-    }
-    
-    // Confirm before proceeding (unless dry run)
-    if (!options.dryRun) {
-      console.log('⚠️  WARNING: This will restore data from the backup!');
-      console.log('⚠️  Current data may be overwritten!');
-      console.log('');
-      console.log('Press Ctrl+C to cancel, or wait 5 seconds to continue...');
-      await new Promise(resolve => setTimeout(resolve, 5000));
-    }
-    
-    console.log('\nStarting restore operation...\n');
-    
-    // Perform restore
-    const result = await restoreService.restore(options);
-    
-    if (options.dryRun) {
-      console.log('\n=== DRY RUN RESULTS ===\n');
-      
-      console.log('Validation:');
-      console.log(`- Valid: ${result.validation.isValid ? '✅ Yes' : '❌ No'}`);
-      
-      if (result.validation.errors.length > 0) {
-        console.log('- Errors:');
-        result.validation.errors.forEach(err => console.log(`  ❌ ${err}`));
-      }
-      
-      if (result.validation.warnings.length > 0) {
-        console.log('- Warnings:');
-        result.validation.warnings.forEach(warn => console.log(`  ⚠️  ${warn}`));
-      }
-      
-      console.log('\nDisk Space:');
-      console.log(`- Required: ${result.spaceCheck.requiredFormatted}`);
-      console.log(`- Available: ${result.spaceCheck.availableFormatted}`);
-      console.log(`- Sufficient: ${result.spaceCheck.hasEnoughSpace ? '✅ Yes' : '❌ No'}`);
-      
-    } else {
-      console.log('\n=== RESTORE RESULTS ===\n');
-      
-      console.log(`Status: ${result.success ? '✅ SUCCESS' : '❌ FAILED'}`);
-      console.log(`Duration: ${result.duration}s`);
-      
-      if (result.result) {
-        console.log('\nItems Restored:');
-        if (result.result.databaseRestored !== undefined) {
-          console.log(`- Database: ${result.result.databaseRestored ? '✅' : '❌'}`);
-        }
-        if (result.result.filesRestored !== undefined) {
-          console.log(`- Files: ${result.result.filesRestored}`);
-        }
-        if (result.result.errors && result.result.errors.length > 0) {
-          console.log('- Errors:');
-          result.result.errors.forEach(err => console.log(`  ❌ ${err}`));
-        }
-      }
-      
-      if (result.verification) {
-        console.log('\nVerification:');
-        console.log(`- Valid: ${result.verification.isValid ? '✅ Yes' : '❌ No'}`);
-        if (result.verification.errors.length > 0) {
-          console.log('- Errors:');
-          result.verification.errors.forEach(err => console.log(`  ❌ ${err}`));
-        }
-      }
-      
-      if (result.preRestoreBackup) {
-        console.log('\nSafety Backup:');
-        console.log(`- Location: ${result.preRestoreBackup}`);
-        console.log('- This backup can be used to rollback if needed');
-      }
-    }
-    
-    // Show recent log entries
-    console.log('\nRecent Log Entries:');
-    result.logs.slice(-10).forEach(log => {
-      const icon = log.level === 'error' ? '❌' : log.level === 'warn' ? '⚠️ ' : 'ℹ️ ';
-      console.log(`${icon} [${log.timestamp}] ${log.message}`);
-    });
-    
-    // Clean up test files
-    if (options.source && options.source.includes('test-backup')) {
-      await fs.rmdir(path.dirname(options.source), { recursive: true }).catch(() => {});
-    }
-    
-  } catch (error) {
-    console.error('\n❌ Restore operation failed:', error.message);
-    
-    // Show logs if available
-    if (restoreService.restoreLog && restoreService.restoreLog.length > 0) {
-      console.log('\nError Log:');
-      restoreService.restoreLog.slice(-10).forEach(log => {
-        if (log.level === 'error' || log.level === 'warn') {
-          console.log(`[${log.timestamp}] ${log.level.toUpperCase()}: ${log.message}`);
-        }
-      });
-    }
-    
-    process.exit(1);
-  }
-  
-  // Cleanup
-  await db.destroy();
-  process.exit(0);
-}
-
-// Show help if requested
-if (args.includes('--help') || args.includes('-h')) {
-  console.log(`
-PicPeak Restore Service Test
-
-This script tests the restore service functionality with safety checks.
-
-Usage:
-  node scripts/test-restore-service.js [options]
-
-Options:
-  --dry-run    Perform validation only without actual restore
-  --force      Force restore even with warnings
-  --type       Restore type: full, database, files, selective (default: full)
-  --source     Backup source path or S3 URL
-  --manifest   Path to backup manifest
-  --help       Show this help message
-
-Examples:
-  # Dry run with automatic backup selection
-  node scripts/test-restore-service.js --dry-run
-
-  # Full restore from specific backup
-  node scripts/test-restore-service.js --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
-
-  # Database-only restore with force
-  node scripts/test-restore-service.js --type database --force --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
-
-  # Restore from S3
-  node scripts/test-restore-service.js --source s3://my-bucket/backups/2024-01-20 --manifest s3://my-bucket/backups/2024-01-20/manifest.json
-
-Safety Features:
-- Pre-restore validation checks compatibility and warns about potential issues
-- Automatic pre-restore backup is created (unless skipped)
-- Post-restore verification ensures data integrity
-- Rollback capability if restore fails
-- Detailed logging of all operations
-`);
-  process.exit(0);
-}
-
-// Run the test
-testRestore();

backend/server.js

@@ -12,6 +12,7 @@ logger.info('Server starting up', {
   timestamp: new Date().toISOString()
 });
 
+const fs = require('fs');
 const express = require('express');
 const helmet = require('helmet');
 const cors = require('cors');
@@ -25,6 +26,12 @@ const { startScheduledBackups } = require('./src/services/databaseBackup');
 const { maintenanceMiddleware } = require('./src/middleware/maintenance');
 const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
 const { createRateLimiter, createAuthRateLimiter } = require('./src/services/rateLimitService');
+const { getPublicSitePayload } = require('./src/services/publicSiteService');
+const cookieParser = require('cookie-parser');
+const {
+  getAdminTokenFromRequest,
+  getGalleryTokenFromRequest,
+} = require('./src/utils/tokenUtils');
 
 // Import routes
 const authRoutes = require('./src/routes/auth-enhanced');
@@ -32,6 +39,7 @@ const eventRoutes = require('./src/routes/events');
 const galleryRoutes = require('./src/routes/gallery');
 const adminRoutes = require('./src/routes/admin');
 const adminAuthRoutes = require('./src/routes/adminAuth');
+const secureImagesRoutes = require('./src/routes/secureImages');
 
 const app = express();
 const PORT = process.env.PORT || 3000;
@@ -41,25 +49,79 @@ const PORT = process.env.PORT || 3000;
 app.set('trust proxy', 'loopback, linklocal, uniquelocal');
 
 // Security middleware with custom CSP
+// In native HTTP installs, do NOT force HTTPS for subresources.
+const enableHsts = process.env.ENABLE_HSTS === 'true';
+const cspDirectives = {
+  defaultSrc: ["'self'"],
+  scriptSrc: [
+    "'self'",
+    'https://www.google.com',
+    'https://www.gstatic.com'
+  ],
+  styleSrc: ["'self'", "'unsafe-inline'", "https:"], // Required for styled components
+  imgSrc: ["'self'", "data:", "https:", "blob:"], // Allow data URLs and external images
+  connectSrc: ["'self'", 'https://www.google.com', 'https://www.gstatic.com'], // API connections
+  fontSrc: ["'self'", "https:", "data:"], // Web fonts
+  objectSrc: ["'none'"], // Disable plugins
+  mediaSrc: ["'self'"], // Audio/video
+  frameSrc: ["'self'", 'https://www.google.com'],
+};
+// Only upgrade insecure requests when HSTS explicitly enabled (HTTPS deployment)
+if (enableHsts) {
+  // In helmet, an empty array enables the directive
+  cspDirectives.upgradeInsecureRequests = [];
+}
+
+app.use(cookieParser());
+
+app.use((req, res, next) => {
+  if (req.headers.authorization) {
+    return next();
+  }
+
+  const path = req.path || '';
+  const slugMatch = path.match(/\/api\/(?:gallery|secure-images)\/([^\/]+)/);
+  const slug = slugMatch ? slugMatch[1] : req.requestedSlug;
+  const adminToken = getAdminTokenFromRequest(req);
+  const galleryToken = getGalleryTokenFromRequest(req, slug);
+
+  const isAdminRequest = path.startsWith('/api/admin') || path.startsWith('/admin');
+  const isGalleryRequest = Boolean(slugMatch)
+    || path.startsWith('/api/gallery')
+    || path.startsWith('/gallery')
+    || path.startsWith('/api/secure-images');
+
+  // Prefer admin credentials on admin routes so gallery sessions cannot override them.
+  if (isAdminRequest) {
+    if (adminToken) {
+      req.headers.authorization = `Bearer ${adminToken}`;
+    }
+  } else if (isGalleryRequest) {
+    if (galleryToken) {
+      req.headers.authorization = `Bearer ${galleryToken}`;
+    } else if (adminToken) {
+      req.headers.authorization = `Bearer ${adminToken}`;
+    }
+  } else if (adminToken) {
+    req.headers.authorization = `Bearer ${adminToken}`;
+  } else if (galleryToken) {
+    req.headers.authorization = `Bearer ${galleryToken}`;
+  }
+
+  next();
+});
+
 app.use(helmet({
   contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'"], // Required for React
-      styleSrc: ["'self'", "'unsafe-inline'", "https:"], // Required for styled components
-      imgSrc: ["'self'", "data:", "https:", "blob:"], // Allow data URLs and external images
-      connectSrc: ["'self'"], // API connections
-      fontSrc: ["'self'", "https:", "data:"], // Web fonts
-      objectSrc: ["'none'"], // Disable plugins
-      mediaSrc: ["'self'"], // Audio/video
-      frameSrc: ["'none'"], // Disable iframes
-    },
+    // Avoid helmet adding defaults like upgrade-insecure-requests when not desired
+    useDefaults: false,
+    directives: cspDirectives,
   },
-  hsts: {
+  hsts: enableHsts ? {
     maxAge: 31536000, // 1 year
     includeSubDomains: true,
     preload: true
-  },
+  } : false,
   permittedCrossDomainPolicies: false,
   referrerPolicy: { policy: "strict-origin-when-cross-origin" }
 }));
@@ -71,14 +133,14 @@ app.use((req, res, next) => {
   next();
 });
 
-// CORS configuration
+// CORS configuration (apply only to API routes)
 const corsOptions = {
   origin: function (origin, callback) {
     const allowedOrigins = [
       process.env.FRONTEND_URL || 'http://localhost:3005',
       process.env.ADMIN_URL || 'http://localhost:3005'
     ];
-    
+
     // In development, also allow localhost origins
     if (process.env.NODE_ENV === 'development') {
       allowedOrigins.push(
@@ -88,23 +150,166 @@ const corsOptions = {
         'http://localhost:3000'  // Direct backend access
       );
     }
-    
-    // Allow requests with no origin (like mobile apps or curl)
+
+    // Allow requests with no origin (like curl) and allow-listed origins
     if (!origin || allowedOrigins.indexOf(origin) !== -1) {
       callback(null, true);
     } else {
-      callback(new Error('Not allowed by CORS'));
+      // Do not error globally; just omit CORS headers on disallowed origins
+      callback(null, false);
     }
   },
   credentials: true
 };
 
-app.use(cors(corsOptions));
+// Only attach CORS to API endpoints, not static assets
+app.use('/api', cors(corsOptions));
+// Handle preflight explicitly for API paths
+app.options('/api/*', cors(corsOptions));
 
 // Initialize rate limiters (they will be created dynamically)
 let generalRateLimiter;
 let authRateLimiter;
 
+function composeInlineStyles(payload) {
+  const { branding } = payload;
+  const cssSegments = [];
+
+  cssSegments.push(`:root {
+  --brand-primary: ${branding.colors.primary};
+  --brand-accent: ${branding.colors.accent};
+  --brand-background: ${branding.colors.background};
+  --brand-text: ${branding.colors.text};
+}`);
+
+  if (payload.baseCss) {
+    cssSegments.push(payload.baseCss);
+  }
+
+  if (payload.css) {
+    cssSegments.push(`/* Custom styles */\n${payload.css}`);
+  }
+
+  return cssSegments.join('\n\n');
+}
+
+function renderBrandHeader(branding) {
+  const displayName = branding.companyName || 'PicPeak';
+  const logoSrc = branding.logoUrl || '/picpeak-logo-transparent.png';
+  const logo = `<img src="${logoSrc}" alt="${displayName}" class="brand-logo" loading="lazy" decoding="async" />`;
+
+  const tagline = branding.companyTagline
+    ? `<p class="brand-tagline">${branding.companyTagline}</p>`
+    : '';
+
+  return `<header class="site-header">
+  <div class="header-inner">
+    <div class="brand">
+      ${logo}
+      <div class="brand-copy">
+        <p class="brand-label">${displayName}</p>
+        ${tagline}
+      </div>
+    </div>
+    <nav class="site-nav">
+      <a href="#features">${'Features'}</a>
+      <a href="#workflow">${'Workflow'}</a>
+      <a href="#collections">${'Collections'}</a>
+      <a href="#stories">${'Stories'}</a>
+      <a href="#contact">${'Contact'}</a>
+    </nav>
+  </div>
+</header>`;
+}
+
+function renderBrandFooter(branding) {
+  const displayName = branding.companyName || 'PicPeak';
+  const footerNote = branding.footerText
+    ? `<p>${branding.footerText}</p>`
+    : '<p>Powered by PicPeak to keep every celebration beautifully organised.</p>';
+
+  const supportLink = branding.supportEmail
+    ? `<a href="mailto:${branding.supportEmail}">Support</a>`
+    : '';
+
+  const legalLinks = `
+    <a href="/datenschutz">Privacy Policy</a>
+    <a href="/impressum">Impressum</a>
+    ${supportLink}
+  `;
+
+  return `<footer class="site-footer" id="contact">
+  <div class="footer-inner">
+    <div>
+      <h2>${displayName}</h2>
+      ${footerNote}
+    </div>
+    <div class="footer-links">
+      ${legalLinks}
+    </div>
+  </div>
+</footer>`;
+}
+
+function buildPublicSiteDocument(payload) {
+  const inlineStyles = composeInlineStyles(payload);
+  const header = renderBrandHeader(payload.branding);
+  const footer = renderBrandFooter(payload.branding);
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${payload.title}</title>
+  <meta name="description" content="Curated photo galleries and stories from unforgettable celebrations." />
+  <link rel="preconnect" href="https://fonts.googleapis.com" />
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
+  <style>${inlineStyles}</style>
+</head>
+<body>
+  <div class="site-shell">
+    ${header}
+    <main class="site-main">
+      ${payload.html}
+    </main>
+    ${footer}
+  </div>
+</body>
+</html>`;
+}
+
+async function handlePublicSiteRequest(req, res, next) {
+  try {
+    const payload = await getPublicSitePayload();
+
+    if (!payload.enabled) {
+      res.redirect(302, '/admin/login');
+      return;
+    }
+
+    if (payload.etag && req.headers['if-none-match'] === payload.etag) {
+      res.status(304).end();
+      return;
+    }
+
+    const document = buildPublicSiteDocument(payload);
+
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Cache-Control', 'public, max-age=30, must-revalidate');
+    res.setHeader('ETag', payload.etag);
+    res.setHeader('Vary', 'Accept-Encoding');
+    res.setHeader('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https: data:; object-src 'none'; script-src 'self'; form-action 'self'");
+
+    res.status(200).send(document);
+  } catch (error) {
+    logger.error('Failed to render public site', { error: error.message });
+    next();
+  }
+}
+
 // Function to initialize rate limiters
 async function initializeRateLimiters() {
   generalRateLimiter = await createRateLimiter();
@@ -123,6 +328,22 @@ async function initializeRateLimiters() {
 app.use(express.json({ limit: '100mb' }));
 app.use(express.urlencoded({ extended: true, limit: '100mb' }));
 
+// Request logging for API routes (with timestamps)
+const apiRequestLogger = (req, res, next) => {
+  try {
+    const started = Date.now();
+    const ts = new Date().toISOString();
+    logger.info(`[${ts}] ${req.method} ${req.originalUrl}`);
+    res.on('finish', () => {
+      const ms = Date.now() - started;
+      const tsDone = new Date().toISOString();
+      logger.info(`[${tsDone}] ${req.method} ${req.originalUrl} -> ${res.statusCode} (${ms}ms)`);
+    });
+  } catch (_) {}
+  next();
+};
+app.use('/api', apiRequestLogger);
+
 // Maintenance mode middleware - add after body parsing but before routes
 app.use(maintenanceMiddleware);
 
@@ -142,6 +363,7 @@ const secureStatic = require('./src/middleware/secureStatic');
 
 // Get storage path from environment or use default
 const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
+process.env.EXTERNAL_MEDIA_ROOT = process.env.EXTERNAL_MEDIA_ROOT || '/external-media';
 
 // Static file serving for photos (protected)
 app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'events/active')));
@@ -198,23 +420,69 @@ app.get('/health', async (req, res) => {
 
 // Routes
 app.use('/api/auth', authRoutes);
-app.use('/api/events', eventRoutes);
+  app.use('/api/events', eventRoutes);
+  app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
+// Gallery routes - main routes first, then feedback routes
 app.use('/api/gallery', galleryRoutes);
+app.use('/api/gallery', require('./src/routes/galleryFeedback'));
 app.use('/api/admin', adminRoutes);
 app.use('/api/admin/auth', adminAuthRoutes);
 app.use('/api/admin/system', require('./src/routes/adminSystem'));
 app.use('/api/admin/backup', require('./src/routes/adminBackup'));
 app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
 app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
-app.use('/api/gallery', require('./src/routes/galleryFeedback'));
+app.use('/api/admin/image-security', require('./src/routes/adminImageSecurity'));
+app.use('/api/admin/thumbnails', require('./src/routes/adminThumbnails'));
+app.use('/api/admin/photos', require('./src/routes/adminPhotos'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));
+app.use('/api/secure-images', secureImagesRoutes);
+
+// Optional: Serve built frontend (native installs)
+try {
+  const serveFrontendEnv = process.env.SERVE_FRONTEND; // 'true' | 'false' | undefined
+  const frontendDir = process.env.FRONTEND_DIR || path.join(__dirname, '../frontend/dist');
+  const indexPath = path.join(frontendDir, 'index.html');
+  // Auto-serve when dist exists unless explicitly disabled
+  const shouldServe = (serveFrontendEnv === 'true') || ((serveFrontendEnv === undefined || serveFrontendEnv === 'auto') && fs.existsSync(indexPath));
+  if (shouldServe) {
+    logger.info(`Serving frontend from ${frontendDir}`);
+    // Serve pre-built assets
+    app.use(express.static(frontendDir));
+
+    // Landing page handler or SPA fallback
+    app.get('/', handlePublicSiteRequest, (req, res) => {
+      res.sendFile(indexPath);
+    });
+
+    // SPA fallback for admin + gallery routes
+    app.get(['/admin', '/admin/*', '/gallery/*'], (req, res) => {
+      res.sendFile(indexPath);
+    });
+  } else {
+    logger.info('Frontend static serving disabled or dist not found', { serveFrontendEnv, frontendDir });
+    app.get('/', handlePublicSiteRequest, (req, res) => {
+      res.status(503).send('Frontend bundle not available. Build frontend or enable public site.');
+    });
+  }
+} catch (e) {
+  logger.warn('Failed to enable frontend static serving', { error: e.message });
+}
 
 // Error handling middleware
 app.use((err, req, res, next) => {
-  logger.error(err.stack);
-  res.status(500).json({ error: 'Something went wrong!' });
+  console.error('EXPRESS ERROR HANDLER:', err);
+  console.error('Error stack:', err.stack);
+  console.error('Request URL:', req.url);
+  console.error('Request method:', req.method);
+  logger.error('Express error handler:', {
+    message: err.message,
+    stack: err.stack,
+    url: req.url,
+    method: req.method
+  });
+  res.status(500).json({ error: 'Something went wrong!', details: err.message });
 });
 
 // Initialize services

backend/src/__tests__/publicSiteService.test.js

@@ -0,0 +1,107 @@
+jest.mock('../database/db', () => {
+  const mockDb = jest.fn();
+  return {
+    db: mockDb,
+    logActivity: jest.fn(),
+  };
+});
+
+jest.mock('../utils/logger', () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+}));
+
+const { db } = require('../database/db');
+const { getPublicSitePayload, clearPublicSiteCache } = require('../services/publicSiteService');
+const { sanitizeCss } = require('../utils/cssSanitizer');
+
+const buildPublicSiteRows = (overrides = {}) => ([
+  { setting_key: 'general_public_site_enabled', setting_value: JSON.stringify(overrides.enabled ?? true) },
+  { setting_key: 'general_public_site_html', setting_value: JSON.stringify(overrides.html ?? '<h1>{{company_name}}</h1>') },
+  { setting_key: 'general_public_site_custom_css', setting_value: JSON.stringify(overrides.css ?? "body { color: red; }") }
+]);
+
+const buildBrandingRows = (overrides = {}) => ([
+  { setting_key: 'branding_company_name', setting_value: JSON.stringify(overrides.companyName ?? 'Willow & Pine Studio') },
+  { setting_key: 'branding_company_tagline', setting_value: JSON.stringify(overrides.companyTagline ?? 'Stories told in colour and light.') },
+  { setting_key: 'branding_support_email', setting_value: JSON.stringify(overrides.supportEmail ?? 'hello@example.com') },
+  { setting_key: 'branding_logo_url', setting_value: JSON.stringify(overrides.logoUrl ?? '/uploads/logos/logo.png') },
+  { setting_key: 'branding_footer_text', setting_value: JSON.stringify(overrides.footerText ?? 'Crafted with care for every celebration.') },
+  { setting_key: 'theme_config', setting_value: JSON.stringify(overrides.themeConfig ?? {
+    primaryColor: '#2563eb',
+    accentColor: '#1d4ed8',
+    backgroundColor: '#f8fafc',
+    textColor: '#0f172a'
+  }) }
+]);
+
+describe('publicSiteService', () => {
+  beforeEach(() => {
+    clearPublicSiteCache();
+    jest.clearAllMocks();
+  });
+
+  it('sanitizes stored HTML by stripping script tags', async () => {
+    const publicSiteRows = buildPublicSiteRows({ html: '<h1>{{company_name}}</h1><script>alert(1)</script>' });
+    const brandingRows = buildBrandingRows();
+
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(publicSiteRows) }));
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(brandingRows) }));
+
+    const payload = await getPublicSitePayload({ bypassCache: true });
+
+    expect(payload.enabled).toBe(true);
+    expect(payload.html).toContain('<h1>Willow & Pine Studio</h1>');
+    expect(payload.html).not.toContain('<script');
+    expect(payload.baseCss.length).toBeGreaterThan(0);
+    expect(payload.branding.companyName).toBe('Willow & Pine Studio');
+  });
+
+  it('sanitizes custom CSS and removes dangerous patterns', async () => {
+    const publicSiteRows = buildPublicSiteRows({
+      css: "body { color: blue; } @import url('https://malicious.example/style.css'); div { background: url(\"javascript:alert(1)\"); }"
+    });
+    const brandingRows = buildBrandingRows();
+
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(publicSiteRows) }));
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(brandingRows) }));
+
+    const payload = await getPublicSitePayload({ bypassCache: true });
+
+    expect(payload.css).toContain('body { color: blue; }');
+    expect(payload.css).not.toContain('@import');
+    expect(payload.css).not.toContain('javascript:');
+    // Client-side util should match server sanitization expectations
+    const clientSanitized = sanitizeCss(publicSiteRows[2].setting_value ? JSON.parse(publicSiteRows[2].setting_value) : '');
+    expect(clientSanitized).not.toContain('@import');
+    expect(clientSanitized).not.toContain('javascript:');
+  });
+
+  it('injects branding tokens into the rendered payload', async () => {
+    const publicSiteRows = buildPublicSiteRows({ html: '<section><h1>{{company_name}}</h1><p>{{company_tagline}}</p><a href="mailto:{{support_email}}">Get in touch</a></section>' });
+    const brandingRows = buildBrandingRows({
+      companyName: 'Aurora Collective',
+      companyTagline: 'Modern photography for timeless celebrations.',
+      supportEmail: 'studio@aurora.co',
+      logoUrl: '/uploads/logos/aurora.png',
+      themeConfig: {
+        primaryColor: '#5C8762',
+        accentColor: '#1d4ed8',
+        backgroundColor: '#fafafa',
+        textColor: '#171717'
+      }
+    });
+
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(publicSiteRows) }));
+    db.mockImplementationOnce(() => ({ whereIn: () => Promise.resolve(brandingRows) }));
+
+    const payload = await getPublicSitePayload({ bypassCache: true });
+
+    expect(payload.html).toContain('Aurora Collective');
+    expect(payload.html).toContain('Modern photography for timeless celebrations.');
+    expect(payload.html).toContain('studio@aurora.co');
+    expect(payload.branding.logoUrl).toBe('/uploads/logos/aurora.png');
+    expect(payload.branding.colors.primary).toBe('#5C8762');
+  });
+});

backend/src/constants/publicSiteDefaults.js

@@ -0,0 +1,690 @@
+const DEFAULT_PUBLIC_SITE_TITLE = 'PicPeak — Curated Galleries, Effortless Sharing';
+
+const DEFAULT_PUBLIC_SITE_HTML = `
+<section class="hero" id="welcome">
+  <div class="hero__inner">
+    <span class="hero__badge">PicPeak Showcase</span>
+    <h1>Share the story of {{company_name}}</h1>
+    <p class="hero__lead">{{company_tagline}}</p>
+    <div class="hero__cta">
+      <a href="#features" class="button button--primary">Explore Features</a>
+      <a href="#collections" class="button button--ghost">View Sample Galleries</a>
+    </div>
+    <dl class="hero__stats">
+      <div>
+        <dt>Private invites</dt>
+        <dd>Secure links for every guest</dd>
+      </div>
+      <div>
+        <dt>Curated delivery</dt>
+        <dd>Highlight every favourite instantly</dd>
+      </div>
+      <div>
+        <dt>Fully branded</dt>
+        <dd>Colours, typography, and logo that match you</dd>
+      </div>
+    </dl>
+  </div>
+  <div class="hero__visual">
+    <article class="deck deck--primary">
+      <header class="deck__header">
+        <img src="{{brand_logo_url}}" alt="{{company_name}} logo" class="deck__logo" loading="lazy" decoding="async" />
+        <span class="deck__title">PicPeak Gallery</span>
+      </header>
+      <ul class="deck__list">
+        <li>Guided cover stories</li>
+        <li>Guest uploads with approvals</li>
+        <li>Protected high-res downloads</li>
+      </ul>
+    </article>
+    <article class="deck deck--secondary">
+      <p class="deck__quote">“PicPeak makes delivery feel like part of the celebration. Our couples relive the day the moment they open the link.”</p>
+      <p class="deck__author">— Studio Miraval</p>
+    </article>
+  </div>
+</section>
+
+<section class="features" id="features">
+  <div class="section-head">
+    <span class="section-badge">Why teams pick PicPeak</span>
+    <h2>Design-first galleries with the workflow you already love</h2>
+    <p>Bring the PicPeak admin experience to your clients with branded, secure, and responsive public pages.</p>
+  </div>
+  <div class="feature-grid">
+    <article>
+      <h3>Beautiful by default</h3>
+      <p>Every gallery inherits your PicPeak theme, typography, and colour palette automatically.</p>
+    </article>
+    <article>
+      <h3>Guided storytelling</h3>
+      <p>Create anchored sections, spotlight favourite collections, and embed testimonials that build trust.</p>
+    </article>
+    <article>
+      <h3>Secure sharing</h3>
+      <p>Password gates, expiring links, and download protection keep every celebration personal.</p>
+    </article>
+  </div>
+</section>
+
+<section class="workflow" id="workflow">
+  <div class="workflow__content">
+    <h2>Launch in minutes</h2>
+    <ol class="workflow__steps">
+      <li>
+        <h4>Brand it once</h4>
+        <p>PicPeak automatically applies your logo, colours, and support details.</p>
+      </li>
+      <li>
+        <h4>Curate sections</h4>
+        <p>Highlight hero stories, featured galleries, and timeline moments with simple HTML blocks.</p>
+      </li>
+      <li>
+        <h4>Share confidently</h4>
+        <p>Send a single link that greets guests before they enter their private gallery.</p>
+      </li>
+    </ol>
+  </div>
+  <div class="workflow__media">
+    <figure class="workflow__browser">
+      <img src="/picpeak-logo-transparent.png" alt="PicPeak interface" loading="lazy" decoding="async" />
+      <figcaption>PicPeak dashboard &mdash; trusted by studios worldwide.</figcaption>
+    </figure>
+  </div>
+</section>
+
+<section class="collections" id="collections">
+  <div class="section-head">
+    <span class="section-badge">Showcase highlights</span>
+    <h2>Curated sample galleries that mirror your client experience</h2>
+    <p>Drop in featured stories, welcome messages, and callouts that prepare guests for what comes next.</p>
+  </div>
+  <div class="collection-showcase">
+    <article>
+      <h3>Signature Galleries</h3>
+      <p>Use responsive cards to preview your most loved collections or vendor partnerships.</p>
+    </article>
+    <article>
+      <h3>Welcome timelines</h3>
+      <p>Guide guests from arrival to download with steps that feel effortless and on-brand.</p>
+    </article>
+  </div>
+</section>
+
+<section class="stories" id="stories">
+  <div class="section-head section-head--center">
+    <span class="section-badge">Client notes</span>
+    <h2>Experiences that keep guests coming back</h2>
+  </div>
+  <div class="story-grid">
+    <figure>
+      <blockquote>“From the welcome page to the final download, everything felt like us. PicPeak turned our gallery into part of the celebration.”</blockquote>
+      <figcaption>— Harper &amp; Elias</figcaption>
+    </figure>
+    <figure>
+      <blockquote>“The public landing page gives every collection a narrative. Our couples feel the care we put into every image.”</blockquote>
+      <figcaption>— Jordan Rivera, Photographer</figcaption>
+    </figure>
+  </div>
+</section>
+
+<section class="cta" id="contact">
+  <div class="cta__inner">
+    <div>
+      <h2>Ready to welcome your guests?</h2>
+      <p>Create a PicPeak landing page that matches your studio and introduces every celebration with confidence.</p>
+    </div>
+    <div class="cta__actions">
+      <a href="mailto:{{support_email}}" class="button button--primary">Contact us</a>
+      <a href="#features" class="button button--ghost">Review features</a>
+    </div>
+  </div>
+</section>
+
+<footer class="site-footer" id="legal">
+  <div class="footer-inner">
+    <div>
+      <h2>{{company_name}}</h2>
+      <p>Powered by PicPeak to keep every celebration beautifully organised.</p>
+    </div>
+    <div class="footer-links">
+      <a href="/datenschutz">Privacy Policy</a>
+      <a href="/impressum">Impressum</a>
+      <a href="mailto:{{support_email}}">Support</a>
+    </div>
+  </div>
+</footer>
+`;
+
+const DEFAULT_PUBLIC_SITE_CSS = `
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family: 'Inter', 'Segoe UI', system-ui, -apple-system, BlinkMacSystemFont, sans-serif;
+  background: linear-gradient(180deg, var(--brand-background), #ffffff 55%);
+  color: var(--brand-text);
+  -webkit-font-smoothing: antialiased;
+}
+
+a {
+  color: inherit;
+  text-decoration: none;
+}
+
+img {
+  max-width: 100%;
+  display: block;
+}
+
+.site-shell {
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+  background: linear-gradient(180deg, rgba(15, 23, 42, 0.03), transparent 65%);
+}
+
+.site-header {
+  position: sticky;
+  top: 0;
+  z-index: 30;
+  background: rgba(255, 255, 255, 0.92);
+  backdrop-filter: blur(18px);
+  border-bottom: 1px solid rgba(15, 23, 42, 0.08);
+}
+
+.header-inner {
+  max-width: 1100px;
+  margin: 0 auto;
+  padding: 1rem 1.5rem;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1.5rem;
+}
+
+.brand {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+.brand-logo {
+  width: 48px;
+  height: 48px;
+  border-radius: 12px;
+  object-fit: contain;
+  background: rgba(148, 163, 184, 0.12);
+  padding: 6px;
+}
+
+.brand-copy {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.brand-label {
+  margin: 0;
+  font-weight: 600;
+  font-size: 1rem;
+  letter-spacing: -0.01em;
+  color: var(--brand-text);
+}
+
+.brand-tagline {
+  margin: 0;
+  font-size: 0.85rem;
+  color: rgba(15, 23, 42, 0.65);
+}
+
+.site-nav {
+  display: flex;
+  gap: 1rem;
+  font-size: 0.95rem;
+  color: rgba(15, 23, 42, 0.65);
+}
+
+.site-nav a {
+  position: relative;
+  padding: 0.25rem 0;
+}
+
+.site-nav a::after {
+  content: '';
+  position: absolute;
+  left: 0;
+  bottom: -6px;
+  width: 100%;
+  height: 2px;
+  background: transparent;
+  transition: background 0.2s ease;
+}
+
+.site-nav a:hover::after {
+  background: var(--brand-primary);
+}
+
+.site-main {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 4rem;
+  padding: 2.5rem 1.5rem 4rem;
+}
+
+@media (min-width: 960px) {
+  .site-main {
+    padding: 3rem 0 5rem;
+    gap: 5rem;
+  }
+
+  .hero,
+  .features,
+  .workflow,
+  .collections,
+  .stories,
+  .cta {
+    max-width: 1100px;
+    margin: 0 auto;
+  }
+}
+
+.hero {
+  display: grid;
+  gap: 2.5rem;
+  align-items: center;
+}
+
+@media (min-width: 960px) {
+  .hero {
+    grid-template-columns: minmax(0, 1.1fr) minmax(0, 0.9fr);
+  }
+}
+
+.hero__inner {
+  display: flex;
+  flex-direction: column;
+  gap: 1.75rem;
+}
+
+.hero__badge {
+  display: inline-flex;
+  align-items: center;
+  padding: 0.55rem 0.9rem;
+  border-radius: 999px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  background: rgba(34, 197, 94, 0.18);
+  color: var(--brand-primary);
+}
+
+.hero h1 {
+  margin: 0;
+  font-size: clamp(2.65rem, 4.8vw, 3.6rem);
+  letter-spacing: -0.02em;
+  line-height: 1.08;
+}
+
+.hero__lead {
+  margin: 0;
+  max-width: 32rem;
+  color: rgba(15, 23, 42, 0.72);
+  font-size: 1.05rem;
+  line-height: 1.6;
+}
+
+.hero__cta {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.85rem;
+}
+
+.hero__stats {
+  display: grid;
+  gap: 1rem;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  margin: 0;
+  padding: 0;
+}
+
+.hero__stats dt {
+  font-weight: 600;
+  color: var(--brand-text);
+}
+
+.hero__stats dd {
+  margin: 0.35rem 0 0;
+  color: rgba(15, 23, 42, 0.6);
+  font-size: 0.95rem;
+}
+
+.hero__visual {
+  display: grid;
+  gap: 1.5rem;
+}
+
+.deck {
+  border-radius: 20px;
+  padding: 1.75rem;
+  background: #fff;
+  box-shadow: 0 35px 60px -35px rgba(15, 23, 42, 0.35);
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  display: grid;
+  gap: 1.35rem;
+}
+
+.deck--primary {
+  border-color: rgba(34, 197, 94, 0.2);
+}
+
+.deck--secondary {
+  background: linear-gradient(135deg, rgba(34, 197, 94, 0.08), rgba(15, 23, 42, 0.03));
+}
+
+.deck__header {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+.deck__logo {
+  width: 44px;
+  height: 44px;
+  border-radius: 12px;
+  background: rgba(34, 197, 94, 0.12);
+  padding: 6px;
+}
+
+.deck__title {
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.deck__list {
+  margin: 0;
+  padding-left: 1.1rem;
+  display: grid;
+  gap: 0.65rem;
+  color: rgba(15, 23, 42, 0.68);
+}
+
+.deck__quote {
+  margin: 0;
+  font-size: 1.05rem;
+  line-height: 1.7;
+  color: rgba(15, 23, 42, 0.78);
+}
+
+.deck__author {
+  margin: 0;
+  font-weight: 600;
+  color: var(--brand-text);
+}
+
+.section-head {
+  display: grid;
+  gap: 1rem;
+  max-width: 640px;
+}
+
+.section-head--center {
+  text-align: center;
+  margin: 0 auto;
+}
+
+.section-badge {
+  display: inline-flex;
+  padding: 0.45rem 0.9rem;
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  background: rgba(34, 197, 94, 0.14);
+  color: var(--brand-primary);
+}
+
+.section-head h2 {
+  margin: 0;
+  font-size: clamp(2rem, 3vw, 2.6rem);
+  letter-spacing: -0.018em;
+}
+
+.section-head p {
+  margin: 0;
+  color: rgba(15, 23, 42, 0.65);
+}
+
+.feature-grid {
+  display: grid;
+  gap: 1.5rem;
+  margin-top: 2.5rem;
+  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+}
+
+.feature-grid article {
+  background: rgba(255, 255, 255, 0.9);
+  border-radius: 16px;
+  padding: 1.75rem;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  box-shadow: 0 18px 40px -30px rgba(15, 23, 42, 0.28);
+}
+
+.workflow {
+  display: grid;
+  gap: 2rem;
+  align-items: center;
+}
+
+@media (min-width: 960px) {
+  .workflow {
+    grid-template-columns: minmax(0, 0.9fr) minmax(0, 1.1fr);
+  }
+}
+
+.workflow__steps {
+  margin: 1.75rem 0 0;
+  padding: 0;
+  list-style: none;
+  display: grid;
+  gap: 1.5rem;
+}
+
+.workflow__steps h4 {
+  margin: 0 0 0.35rem;
+  font-size: 1.05rem;
+  color: var(--brand-text);
+}
+
+.workflow__steps p {
+  margin: 0;
+  color: rgba(15, 23, 42, 0.65);
+}
+
+.workflow__browser {
+  margin: 0;
+  background: rgba(15, 23, 42, 0.05);
+  border-radius: 20px;
+  border: 1px solid rgba(15, 23, 42, 0.1);
+  padding: 2rem;
+  text-align: center;
+  color: rgba(15, 23, 42, 0.55);
+  font-size: 0.85rem;
+}
+
+.collection-showcase {
+  margin-top: 2.5rem;
+  display: grid;
+  gap: 1.5rem;
+  grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+}
+
+.collection-showcase article {
+  background: rgba(255, 255, 255, 0.92);
+  border-radius: 18px;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  padding: 1.5rem;
+  box-shadow: 0 18px 45px -32px rgba(15, 23, 42, 0.3);
+}
+
+.story-grid {
+  margin-top: 2.5rem;
+  display: grid;
+  gap: 1.5rem;
+  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+}
+
+.story-grid figure {
+  margin: 0;
+  padding: 1.75rem;
+  background: rgba(255, 255, 255, 0.95);
+  border-radius: 20px;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  box-shadow: 0 18px 42px -32px rgba(15, 23, 42, 0.28);
+}
+
+.story-grid blockquote {
+  margin: 0 0 1.2rem;
+  font-size: 1.05rem;
+  line-height: 1.7;
+  color: rgba(15, 23, 42, 0.8);
+}
+
+.story-grid figcaption {
+  font-weight: 600;
+  color: rgba(15, 23, 42, 0.7);
+}
+
+.cta {
+  background: linear-gradient(135deg, var(--brand-primary), var(--brand-accent));
+  color: #fff;
+  border-radius: 28px;
+  padding: clamp(2.5rem, 5vw, 3.5rem);
+}
+
+.cta__inner {
+  display: flex;
+  flex-direction: column;
+  gap: 1.75rem;
+  max-width: 720px;
+}
+
+.cta__inner h2 {
+  margin: 0;
+  font-size: clamp(2rem, 3vw, 2.5rem);
+}
+
+.cta__inner p {
+  margin: 0;
+  font-size: 1.05rem;
+  opacity: 0.95;
+}
+
+.cta__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1rem;
+}
+
+.button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.85rem 1.75rem;
+  border-radius: 999px;
+  font-weight: 600;
+  transition: transform 160ms ease, box-shadow 200ms ease, background 200ms ease, color 200ms ease;
+  border: 1px solid transparent;
+}
+
+.button:hover {
+  transform: translateY(-2px);
+}
+
+.button--primary {
+  background: var(--brand-primary);
+  color: #fff;
+  box-shadow: 0 25px 45px -25px rgba(15, 23, 42, 0.55);
+}
+
+.button--primary:hover {
+  background: var(--brand-accent);
+}
+
+.button--ghost {
+  background: rgba(255, 255, 255, 0.08);
+  border-color: rgba(255, 255, 255, 0.45);
+  color: inherit;
+}
+
+.site-footer {
+  padding: 3rem 1.5rem;
+  background: rgba(15, 23, 42, 0.05);
+  border-top: 1px solid rgba(15, 23, 42, 0.08);
+}
+
+.footer-inner {
+  max-width: 1100px;
+  margin: 0 auto;
+  display: grid;
+  gap: 1.5rem;
+  grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+}
+
+.footer-inner h2 {
+  margin: 0 0 0.5rem;
+  font-size: 1.1rem;
+}
+
+.footer-inner p {
+  margin: 0;
+  color: rgba(15, 23, 42, 0.65);
+  line-height: 1.6;
+}
+
+.footer-links {
+  display: flex;
+  flex-direction: column;
+  gap: 0.65rem;
+  font-weight: 600;
+  color: var(--brand-primary);
+}
+
+.footer-links a {
+  color: inherit;
+}
+
+.footer-links a:hover {
+  text-decoration: underline;
+}
+
+@media (max-width: 960px) {
+  .site-nav {
+    display: none;
+  }
+
+  .hero__visual {
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .workflow {
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .cta__inner {
+    gap: 1.5rem;
+  }
+}
+`;
+
+module.exports = {
+  DEFAULT_PUBLIC_SITE_TITLE,
+  DEFAULT_PUBLIC_SITE_HTML,
+  DEFAULT_PUBLIC_SITE_CSS,
+};

backend/src/database/db.js

@@ -1,5 +1,27 @@
+const fs = require('fs');
+const path = require('path');
 const knex = require('knex');
 const knexConfig = require('../../knexfile');
+const logger = require('../utils/logger');
+
+// Ensure SQLite directory exists when using file-based DB (native installs)
+try {
+  const isPostgres = knexConfig && knexConfig.client === 'pg';
+  if (!isPostgres && knexConfig && knexConfig.connection) {
+    const filename = typeof knexConfig.connection === 'object'
+      ? knexConfig.connection.filename
+      : (typeof knexConfig.connection === 'string' ? knexConfig.connection : null);
+    if (filename && typeof filename === 'string') {
+      const dir = path.dirname(filename);
+      if (dir && dir !== '.') {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+    }
+  }
+} catch (e) {
+  // Non-fatal: log and continue; SQLite will fail later if still missing
+  try { logger.warn('SQLite directory ensure failed', { error: e.message }); } catch (_) {}
+}
 
 // Create database connection with built-in retry logic
 const db = knex(knexConfig);
@@ -22,7 +44,7 @@ async function withRetry(queryFn, retries = MAX_RETRIES) {
       );
       
       if (isConnectionError && i < retries - 1) {
-        console.log(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        logger.info(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
         await new Promise(resolve => setTimeout(resolve, RETRY_DELAY * (i + 1)));
         continue;
       }
@@ -53,6 +75,14 @@ async function initializeDatabase() {
       table.boolean('is_archived').defaultTo(false);
       table.string('archive_path');
       table.datetime('archived_at');
+      table.boolean('allow_user_uploads').defaultTo(false);
+      table.integer('upload_category_id');
+      table.boolean('allow_downloads').defaultTo(true);
+      table.boolean('disable_right_click').defaultTo(false);
+      table.boolean('watermark_downloads').defaultTo(false);
+      table.text('watermark_text');
+      table.integer('hero_photo_id').references('id').inTable('photos').onDelete('SET NULL');
+      table.boolean('require_password').defaultTo(true);
     });
   } else {
     // Check if color_theme needs to be updated to TEXT type
@@ -82,16 +112,47 @@ async function initializeDatabase() {
             archive_path TEXT,
             archived_at DATETIME,
             allow_user_uploads BOOLEAN DEFAULT 0,
-            upload_category_id INTEGER
+            upload_category_id INTEGER,
+            allow_downloads BOOLEAN DEFAULT 1,
+            disable_right_click BOOLEAN DEFAULT 0,
+            watermark_downloads BOOLEAN DEFAULT 0,
+            watermark_text TEXT,
+            hero_photo_id INTEGER,
+            require_password BOOLEAN DEFAULT 1
           )
         `);
         
-        await db.raw('INSERT INTO events_new SELECT * FROM events');
+        const pragmaRows = await db.raw("PRAGMA table_info('events')");
+        const existingColumns = pragmaRows.map(row => row.name);
+        const selectColumns = existingColumns.map((col) => {
+          switch (col) {
+            case 'allow_user_uploads':
+              return "COALESCE(allow_user_uploads, 0) as allow_user_uploads";
+            case 'upload_category_id':
+              return "upload_category_id";
+            case 'allow_downloads':
+              return "COALESCE(allow_downloads, 1) as allow_downloads";
+            case 'disable_right_click':
+              return "COALESCE(disable_right_click, 0) as disable_right_click";
+            case 'watermark_downloads':
+              return "COALESCE(watermark_downloads, 0) as watermark_downloads";
+            case 'watermark_text':
+              return 'watermark_text';
+            case 'hero_photo_id':
+              return 'hero_photo_id';
+            case 'require_password':
+              return 'COALESCE(require_password, 1) as require_password';
+            default:
+              return col;
+          }
+        });
+
+        await db.raw(`INSERT INTO events_new (${existingColumns.join(', ')}) SELECT ${selectColumns.join(', ')} FROM events`);
         await db.raw('DROP TABLE events');
         await db.raw('ALTER TABLE events_new RENAME TO events');
       } catch (error) {
         // If the migration fails, it might already have been applied
-        console.log('Color theme migration may have already been applied');
+        logger.debug('Color theme migration may have already been applied');
       }
     }
   }
@@ -107,6 +168,7 @@ async function initializeDatabase() {
       table.string('thumbnail_path');
       table.string('type').notNullable(); // 'collage' or 'individual'
       table.integer('size_bytes');
+      table.string('uploaded_by').defaultTo('admin');
       table.datetime('uploaded_at').defaultTo(db.fn.now());
       table.integer('view_count').defaultTo(0);
       table.integer('download_count').defaultTo(0);
@@ -137,11 +199,24 @@ async function initializeDatabase() {
       table.string('email_type').notNullable(); // 'creation', 'warning', 'expiration', 'archive_complete'
       table.json('email_data');
       table.string('status').defaultTo('pending'); // 'pending', 'sent', 'failed'
+      table.datetime('created_at').defaultTo(db.fn.now());
       table.datetime('scheduled_at').defaultTo(db.fn.now());
       table.datetime('sent_at');
       table.text('error_message');
       table.integer('retry_count').defaultTo(0);
     });
+  } else {
+    const hasCreatedAt = await db.schema.hasColumn('email_queue', 'created_at');
+    if (!hasCreatedAt) {
+      await db.schema.alterTable('email_queue', (table) => {
+        table.datetime('created_at').defaultTo(db.fn.now());
+      });
+      try {
+        await db('email_queue').whereNull('created_at').update({ created_at: db.fn.now() });
+      } catch (updateError) {
+        logger.debug('Email queue created_at backfill skipped', { error: updateError.message });
+      }
+    }
   }
 
   // Admin users table
@@ -153,9 +228,13 @@ async function initializeDatabase() {
       table.string('email').unique().notNullable();
       table.string('password_hash').notNullable();
       table.boolean('is_active').defaultTo(true);
+      table.boolean('must_change_password').defaultTo(false);
+      table.datetime('password_changed_at');
       table.datetime('created_at').defaultTo(db.fn.now());
       table.datetime('updated_at').defaultTo(db.fn.now());
       table.datetime('last_login');
+      table.string('last_login_ip');
+      table.string('language', 2).defaultTo('en');
     });
   } else {
     // Check if updated_at column exists
@@ -167,6 +246,69 @@ async function initializeDatabase() {
       // Set default value for existing rows
       await db('admin_users').update({ updated_at: new Date() });
     }
+    
+    // Check if must_change_password column exists
+    const hasMustChangePassword = await db.schema.hasColumn('admin_users', 'must_change_password');
+    if (!hasMustChangePassword) {
+      await db.schema.table('admin_users', (table) => {
+        table.boolean('must_change_password').defaultTo(false);
+      });
+    }
+    
+    // Check if password_changed_at column exists
+    const hasPasswordChangedAt = await db.schema.hasColumn('admin_users', 'password_changed_at');
+    if (!hasPasswordChangedAt) {
+      await db.schema.table('admin_users', (table) => {
+        table.datetime('password_changed_at');
+      });
+    }
+    
+    // Check if last_login_ip column exists
+    const hasLastLoginIp = await db.schema.hasColumn('admin_users', 'last_login_ip');
+    if (!hasLastLoginIp) {
+      await db.schema.table('admin_users', (table) => {
+        table.string('last_login_ip');
+      });
+    }
+
+    const hasLanguage = await db.schema.hasColumn('admin_users', 'language');
+    if (!hasLanguage) {
+      await db.schema.table('admin_users', (table) => {
+        table.string('language', 2).defaultTo('en');
+      });
+    }
+  }
+
+  // Token revocation tables
+  const hasRevokedTokensTable = await db.schema.hasTable('revoked_tokens');
+  if (!hasRevokedTokensTable) {
+    await db.schema.createTable('revoked_tokens', (table) => {
+      table.increments('id').primary();
+      table.string('token_id').notNullable().unique(); // JWT ID or generated ID
+      table.integer('user_id').nullable(); // User who owned the token
+      table.string('token_type', 20); // admin, gallery, etc.
+      table.timestamp('revoked_at').defaultTo(db.fn.now());
+      table.timestamp('expires_at').notNullable(); // When token would have expired
+      table.string('reason', 100); // password_change, logout, compromised, etc.
+      table.text('metadata'); // Additional JSON data
+      
+      // Indexes for performance
+      table.index('token_id');
+      table.index('user_id');
+      table.index('expires_at'); // For cleanup
+    });
+  }
+
+  const hasUserTokenRevocationsTable = await db.schema.hasTable('user_token_revocations');
+  if (!hasUserTokenRevocationsTable) {
+    await db.schema.createTable('user_token_revocations', (table) => {
+      table.integer('user_id').primary();
+      table.timestamp('revoked_at').notNullable();
+      table.string('reason', 100);
+      
+      // Index for quick lookups
+      table.index('revoked_at');
+    });
   }
 
   // Email configuration table
@@ -210,6 +352,18 @@ async function initializeDatabase() {
       table.datetime('updated_at').defaultTo(db.fn.now());
     });
   }
+  
+  const defaultLanguageSetting = await db('app_settings')
+    .where('setting_key', 'default_language')
+    .first();
+  if (!defaultLanguageSetting) {
+    await db('app_settings').insert({
+      setting_key: 'default_language',
+      setting_value: JSON.stringify('en'),
+      setting_type: 'general',
+      updated_at: new Date(),
+    });
+  }
 
   // Activity logs table
   const hasActivityLogsTable = await db.schema.hasTable('activity_logs');
@@ -234,6 +388,86 @@ async function initializeDatabase() {
       });
     }
   }
+
+  await ensureGlobalCategories();
+}
+
+// Ensure photo categories exist for new deployments
+async function ensureGlobalCategories() {
+  const hasPhotoCategoriesTable = await db.schema.hasTable('photo_categories');
+  if (!hasPhotoCategoriesTable) {
+    await db.schema.createTable('photo_categories', (table) => {
+      table.increments('id').primary();
+      table.string('name', 100).notNullable();
+      table.string('slug', 100).notNullable();
+      table.boolean('is_global').defaultTo(true);
+      table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+      table.timestamp('created_at').defaultTo(db.fn.now());
+      table.unique(['slug', 'event_id']);
+    });
+  }
+
+  const hasCategoryIdColumn = await db.schema.hasColumn('photos', 'category_id');
+  if (!hasCategoryIdColumn) {
+    await db.schema.alterTable('photos', (table) => {
+      table.integer('category_id').references('id').inTable('photo_categories');
+    });
+  }
+
+  const hasCmsPagesTable = await db.schema.hasTable('cms_pages');
+  if (!hasCmsPagesTable) {
+    await db.schema.createTable('cms_pages', (table) => {
+      table.increments('id').primary();
+      table.string('slug', 100).unique().notNullable();
+      table.text('title_en');
+      table.text('title_de');
+      table.text('content_en');
+      table.text('content_de');
+      table.timestamp('updated_at').defaultTo(db.fn.now());
+    });
+  }
+
+  const categoryCountRow = await db('photo_categories').count({ count: 'id' }).first();
+  const categoryCount = categoryCountRow ? Number(categoryCountRow.count) : 0;
+  if (categoryCount === 0) {
+    const defaultCategories = [
+      { name: 'Ceremony', slug: 'ceremony', is_global: true },
+      { name: 'Reception', slug: 'reception', is_global: true },
+      { name: 'Portraits', slug: 'portraits', is_global: true },
+      { name: 'Group Photos', slug: 'group-photos', is_global: true },
+      { name: 'Details', slug: 'details', is_global: true },
+      { name: 'Party', slug: 'party', is_global: true },
+    ];
+
+    await db('photo_categories').insert(defaultCategories);
+  }
+
+  const cmsPages = await db('cms_pages').select('slug');
+  const existingSlugs = cmsPages.map((page) => page.slug);
+  const defaultPages = [
+    {
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: '<h2>Legal Notice</h2><p>Please edit this content in the admin panel.</p>',
+      content_de: '<h2>Impressum</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+      updated_at: new Date(),
+    },
+    {
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: '<h2>Privacy Policy</h2><p>Please edit this content in the admin panel.</p>',
+      content_de: '<h2>Datenschutzerklärung</h2><p>Bitte bearbeiten Sie diesen Inhalt im Admin-Panel.</p>',
+      updated_at: new Date(),
+    },
+  ];
+
+  for (const page of defaultPages) {
+    if (!existingSlugs.includes(page.slug)) {
+      await db('cms_pages').insert(page);
+    }
+  }
 }
 
 // Helper function to log activities
@@ -248,8 +482,8 @@ async function logActivity(activityType, metadata = {}, eventId = null, actor =
       event_id: eventId
     });
   } catch (error) {
-    console.error('Failed to log activity:', error);
+    logger.error('Failed to log activity:', { error: error.message });
   }
 }
 
-module.exports = { db, initializeDatabase, logActivity, withRetry };
+module.exports = { db, initializeDatabase, logActivity, withRetry };

backend/src/middleware/auth-enhanced-v2.js

@@ -3,13 +3,14 @@ const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
+const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
 
 /**
  * Enhanced admin authentication middleware with revocation checking
  */
 async function adminAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const token = getAdminTokenFromRequest(req);
     if (!token) {
       return res.status(401).json({ error: 'No token provided' });
     }
@@ -97,7 +98,8 @@ async function adminAuth(req, res, next) {
  */
 async function galleryAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const slug = req.params?.slug || req.requestedSlug;
+    const token = getGalleryTokenFromRequest(req, slug);
     if (!token) {
       return res.status(401).json({ error: 'No token provided' });
     }
@@ -164,4 +166,4 @@ module.exports = {
   adminAuth, 
   galleryAuth,
   // ... other exports
-};
+};

backend/src/middleware/auth-enhanced.js

@@ -2,6 +2,7 @@ const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const logger = require('../utils/logger');
+const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
 
 /**
  * Enhanced admin authentication middleware
@@ -9,7 +10,7 @@ const logger = require('../utils/logger');
  */
 async function adminAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const token = getAdminTokenFromRequest(req);
     if (!token) {
       return res.status(401).json({ error: 'No token provided' });
     }
@@ -89,7 +90,8 @@ async function adminAuth(req, res, next) {
  */
 async function galleryAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const slug = req.params?.slug || req.requestedSlug;
+    const token = getGalleryTokenFromRequest(req, slug);
     if (!token) {
       return res.status(401).json({ error: 'No token provided' });
     }
@@ -151,7 +153,8 @@ async function galleryAuth(req, res, next) {
  */
 async function photoAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const slug = req.params?.slug || req.requestedSlug;
+    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
     if (!token) {
       return res.status(401).json({ error: 'Authentication required' });
     }
@@ -235,4 +238,4 @@ module.exports = {
   galleryAuth,
   photoAuth,
   verifyGalleryAccess
-};
+};

backend/src/middleware/auth.js

@@ -2,10 +2,11 @@ const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const logger = require('../utils/logger');
+const { getAdminTokenFromRequest } = require('../utils/tokenUtils');
 
 async function adminAuth(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const token = getAdminTokenFromRequest(req);
     if (!token) {
       const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
                      req.headers['x-real-ip'] || 
@@ -22,7 +23,19 @@ async function adminAuth(req, res, next) {
     
     let decoded;
     try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET);
+      // Try to verify with issuer first, fallback to no issuer for backward compatibility
+      try {
+        decoded = jwt.verify(token, process.env.JWT_SECRET, {
+          issuer: 'picpeak-auth'
+        });
+      } catch (issuerError) {
+        // If verification fails with issuer, try without issuer (backward compatibility)
+        if (issuerError.name === 'JsonWebTokenError' && issuerError.message.includes('jwt issuer invalid')) {
+          decoded = jwt.verify(token, process.env.JWT_SECRET);
+        } else {
+          throw issuerError;
+        }
+      }
     } catch (jwtError) {
       const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
                      req.headers['x-real-ip'] || 

backend/src/middleware/feedbackRateLimit.js

@@ -24,7 +24,10 @@ async function getRateLimitSettings() {
       .first();
     
     if (settings && settings.setting_value) {
-      return JSON.parse(settings.setting_value);
+      // setting_value is already a JSON object in PostgreSQL
+      return typeof settings.setting_value === 'string' 
+        ? JSON.parse(settings.setting_value)
+        : settings.setting_value;
     }
     
     // Default settings
@@ -120,8 +123,8 @@ async function recordAction(identifier, eventId, actionType) {
 function feedbackRateLimit(actionType) {
   return async (req, res, next) => {
     try {
-      // Extract event ID from params or body
-      const eventId = req.params.eventId || req.body?.event_id;
+      // Extract event ID from params, body or event object (set by verifyGalleryAccess)
+      const eventId = req.params.eventId || req.body?.event_id || req.event?.id;
       if (!eventId) {
         return res.status(400).json({ error: 'Event ID required' });
       }

backend/src/middleware/gallery.js

@@ -1,38 +1,125 @@
 const jwt = require('jsonwebtoken');
 const { db, withRetry } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
+const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
+const logger = require('../utils/logger');
 
 // Middleware to verify gallery access
 async function verifyGalleryAccess(req, res, next) {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const requestedSlug = req.params.slug || req.requestedSlug;
+    const token = getGalleryTokenFromRequest(req, requestedSlug);
+    let event;
+
     if (!token) {
+      if (!requestedSlug) {
+        return res.status(401).json({ error: 'No token provided' });
+      }
+
+      event = await withRetry(async () => {
+        return await db('events')
+          .where({ 
+            slug: requestedSlug,
+            is_active: formatBoolean(true),
+            is_archived: formatBoolean(false)
+          })
+          .select('*')
+          .first();
+      });
+
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found or expired' });
+      }
+
+      const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+      if (!requiresPassword) {
+        req.event = event;
+        req.sessionID = `gallery_public_${event.id}_${Date.now()}`;
+        req.clientInfo = {
+          ip: req.ip || req.connection.remoteAddress || 'unknown',
+          userAgent: req.get('User-Agent') || 'unknown',
+          fingerprint: `${req.ip}-${req.get('User-Agent')}`.substring(0, 32),
+          timestamp: Date.now()
+        };
+        return next();
+      }
+
       return res.status(401).json({ error: 'No token provided' });
     }
     
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const event = await withRetry(async () => {
-      return await db('events')
-        .where({ 
-          id: decoded.eventId, 
-          is_active: formatBoolean(true),
-          is_archived: formatBoolean(false)
-        })
-        .first();
-    });
+    // Try to verify with issuer first, fallback to no issuer for backward compatibility
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth'
+      });
+    } catch (error) {
+      // If verification fails with issuer, try without issuer (backward compatibility)
+      if (error.name === 'JsonWebTokenError' && error.message.includes('jwt issuer invalid')) {
+        decoded = jwt.verify(token, process.env.JWT_SECRET);
+      } else {
+        throw error;
+      }
+    }
+    logger.debug('[verifyGalleryAccess] Token decoded successfully', { eventId: decoded.eventId, slug: requestedSlug });
+    
+    // If we have a slug in the URL params or from pre-middleware, verify it matches
+    if (requestedSlug) {
+      // Verify by slug and ensure it matches the token's event
+      event = await withRetry(async () => {
+        return await db('events')
+          .where({ 
+            slug: requestedSlug,
+            is_active: formatBoolean(true),
+            is_archived: formatBoolean(false)
+          })
+          .select('*')
+          .first();
+      });
+      
+      // Verify the token's eventId matches
+      if (event && event.id !== decoded.eventId) {
+        return res.status(403).json({ error: 'Token does not match requested gallery' });
+      }
+    } else {
+      // Fallback to using eventId from token
+      event = await withRetry(async () => {
+        return await db('events')
+          .where({ 
+            id: decoded.eventId, 
+            is_active: formatBoolean(true),
+            is_archived: formatBoolean(false)
+          })
+          .select('*')
+          .first();
+      });
+    }
     
     if (!event) {
+      logger.warn('[verifyGalleryAccess] Event not found for slug', { slug: requestedSlug || 'no-slug', tokenEventId: decoded.eventId });
       return res.status(404).json({ error: 'Gallery not found or expired' });
     }
     
+    logger.debug('[verifyGalleryAccess] Event located', { eventId: event.id, slug: event.slug });
     req.event = event;
+    req.sessionID = decoded.sessionId || `gallery_${event.id}_${Date.now()}`;
+    
+    // Create client info for logging (similar to secureImageMiddleware but simpler)
+    req.clientInfo = {
+      ip: req.ip || req.connection.remoteAddress || 'unknown',
+      userAgent: req.get('User-Agent') || 'unknown',
+      fingerprint: `${req.ip}-${req.get('User-Agent')}`.substring(0, 32), // Limit to 32 chars for DB column
+      timestamp: Date.now()
+    };
+    
+    logger.debug('[verifyGalleryAccess] Access granted', { eventId: event.id, slug: event.slug });
     next();
   } catch (error) {
-    console.error('Error verifying gallery access:', error);
-    res.status(401).json({ error: 'Invalid token', details: error.message });
+    logger.error('Error verifying gallery access', { error: error.message, stack: error.stack });
+    res.status(401).json({ error: 'Invalid token' });
   }
 }
 
 module.exports = {
   verifyGalleryAccess
-};
+};

backend/src/middleware/photoAuth.js

@@ -2,14 +2,14 @@ const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
+const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
+const logger = require('../utils/logger');
 
 async function photoAuth(req, res, next) {
   try {
     // Extract event slug from the path
     let eventSlug;
     
-    console.log('PhotoAuth middleware - path:', req.path);
-    
     // For thumbnails, we need to parse the filename to get the event info
     if (req.path.startsWith('/thumb_')) {
       // For now, we'll rely on JWT token for thumbnail access
@@ -20,11 +20,24 @@ async function photoAuth(req, res, next) {
     }
     
     // First check for JWT token (from gallery access)
-    const authHeader = req.headers.authorization;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
-      const token = authHeader.replace('Bearer ', '');
+    const tokenFromRequest = getGalleryTokenFromRequest(req, eventSlug);
+    if (tokenFromRequest) {
+      const token = tokenFromRequest;
       try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        // Try to verify with issuer first, fallback to no issuer for backward compatibility
+        let decoded;
+        try {
+          decoded = jwt.verify(token, process.env.JWT_SECRET, {
+            issuer: 'picpeak-auth'
+          });
+        } catch (issuerError) {
+          // If verification fails with issuer, try without issuer (backward compatibility)
+          if (issuerError.name === 'JsonWebTokenError' && issuerError.message.includes('jwt issuer invalid')) {
+            decoded = jwt.verify(token, process.env.JWT_SECRET);
+          } else {
+            throw issuerError;
+          }
+        }
         
         // Check if it's a gallery token
         if (decoded.type === 'gallery') {
@@ -66,29 +79,36 @@ async function photoAuth(req, res, next) {
           // For both thumbnails and photos with admin token, allow access
           return next();
         }
-      } catch (err) {
-        // Token invalid, fall through to password check
-        console.error('JWT verification failed:', err.message);
+    } catch (err) {
+      // Token invalid, fall through to password check
+      logger.warn('JWT verification failed in photoAuth', { error: err.message });
       }
     }
     
     // Check for password header (legacy support)
     const password = req.headers['x-gallery-password'];
     
-    if (!password && !authHeader) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-    
     // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
-    if (!eventSlug && !password) {
+    if (!eventSlug && !password && !tokenFromRequest) {
       return res.status(401).json({ error: 'Authentication required for thumbnails' });
     }
-    
+
     const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found' });
     }
+
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
+    if (!requiresPassword) {
+      req.event = event;
+      return next();
+    }
     
+    if (!password && !tokenFromRequest) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
     if (password) {
       const validPassword = await bcrypt.compare(password, event.password_hash);
       if (!validPassword) {
@@ -108,7 +128,7 @@ async function photoAuth(req, res, next) {
     req.event = event;
     next();
   } catch (error) {
-    console.error('Photo auth error:', error);
+    logger.error('Photo auth error', { error: error.message, stack: error.stack });
     res.status(500).json({ error: 'Authentication error' });
   }
 }

backend/src/middleware/secureImageMiddleware.js

@@ -0,0 +1,409 @@
+const { db } = require('../database/db');
+const secureImageService = require('../services/secureImageService');
+const logger = require('../utils/logger');
+const { formatBoolean } = require('../utils/dbCompat');
+
+/**
+ * Enhanced secure image middleware with comprehensive protection
+ */
+class SecureImageMiddleware {
+  constructor() {
+    this.suspiciousIPs = new Set();
+    this.blockedFingerprints = new Set();
+    this.rateLimitViolations = new Map();
+  }
+
+  /**
+   * Main security middleware for image access
+   */
+  secureImageAccess = async (req, res, next) => {
+    try {
+      const startTime = Date.now();
+      const clientIP = this.getClientIP(req);
+      const userAgent = req.get('User-Agent') || '';
+      const clientFingerprint = secureImageService.createClientFingerprint(req);
+
+      // Create client info object
+      req.clientInfo = {
+        ip: clientIP,
+        userAgent,
+        fingerprint: clientFingerprint,
+        timestamp: startTime
+      };
+
+      // Security checks
+      const securityCheck = await this.performSecurityChecks(req, res);
+      if (!securityCheck.passed) {
+        return res.status(securityCheck.status).json({ 
+          error: securityCheck.message 
+        });
+      }
+
+      // Set security headers
+      this.setSecurityHeaders(res);
+
+      // Log successful security check
+      logger.info('Secure image access granted', {
+        ip: clientIP,
+        fingerprint: clientFingerprint,
+        photoId: req.params.photoId,
+        eventId: req.params.slug,
+        userAgent: userAgent.substring(0, 100)
+      });
+
+      next();
+    } catch (error) {
+      logger.error('Secure image middleware error', {
+        error: error.message,
+        stack: error.stack,
+        ip: req.ip,
+        path: req.path
+      });
+      
+      res.status(500).json({ 
+        error: 'Security validation failed' 
+      });
+    }
+  };
+
+  /**
+   * Perform comprehensive security checks
+   */
+  async performSecurityChecks(req, res) {
+    const { clientInfo } = req;
+    const { photoId } = req.params;
+
+    // 1. Check if IP is blocked
+    if (this.suspiciousIPs.has(clientInfo.ip)) {
+      await this.logSecurityEvent('blocked_ip_access', req, { reason: 'IP on block list' });
+      return { passed: false, status: 403, message: 'Access denied' };
+    }
+
+    // 2. Check if fingerprint is blocked
+    if (this.blockedFingerprints.has(clientInfo.fingerprint)) {
+      await this.logSecurityEvent('blocked_fingerprint_access', req, { reason: 'Fingerprint blocked' });
+      return { passed: false, status: 403, message: 'Access denied' };
+    }
+
+    // 3. Rate limiting check
+    const rateLimit = await this.checkRateLimit(req);
+    if (!rateLimit.passed) {
+      await this.logSecurityEvent('rate_limit_exceeded', req, rateLimit);
+      return { passed: false, status: 429, message: 'Too many requests' };
+    }
+
+    // 4. Check for suspicious patterns
+    if (photoId) {
+      const suspiciousActivity = await secureImageService.detectSuspiciousActivity(
+        clientInfo.fingerprint, 
+        photoId
+      );
+      
+      if (suspiciousActivity) {
+        await this.logSecurityEvent('suspicious_activity', req, { 
+          photoId, 
+          reason: 'Multiple rapid accesses' 
+        });
+        
+        // Add to monitoring but don't block yet
+        this.flagSuspiciousActivity(clientInfo);
+      }
+    }
+
+    // 5. User-Agent validation
+    const userAgentValid = this.validateUserAgent(clientInfo.userAgent);
+    if (!userAgentValid.valid) {
+      await this.logSecurityEvent('invalid_user_agent', req, userAgentValid);
+      return { passed: false, status: 400, message: 'Invalid client' };
+    }
+
+    // 6. Check request headers for automation signs
+    const automationCheck = this.detectAutomation(req);
+    if (automationCheck.detected) {
+      await this.logSecurityEvent('automation_detected', req, automationCheck);
+      return { passed: false, status: 403, message: 'Automated access not allowed' };
+    }
+
+    return { passed: true };
+  }
+
+  /**
+   * Advanced rate limiting with multiple windows
+   */
+  async checkRateLimit(req) {
+    const { clientInfo } = req;
+    const now = Date.now();
+
+    // Get rate limit settings from database
+    const settings = await this.getRateLimitSettings();
+    
+    // Check different time windows
+    const windows = [
+      { duration: 60000, limit: settings.perMinute || 30 }, // 1 minute
+      { duration: 300000, limit: settings.per5Minutes || 100 }, // 5 minutes
+      { duration: 3600000, limit: settings.perHour || 500 } // 1 hour
+    ];
+
+    for (const window of windows) {
+      const allowed = secureImageService.checkRateLimit(
+        `${clientInfo.fingerprint}_${window.duration}`,
+        window.limit,
+        window.duration
+      );
+
+      if (!allowed) {
+        // Track violations
+        const violationKey = `${clientInfo.fingerprint}_violations`;
+        const violations = this.rateLimitViolations.get(violationKey) || 0;
+        this.rateLimitViolations.set(violationKey, violations + 1);
+
+        // Block after multiple violations
+        if (violations >= 5) {
+          this.blockedFingerprints.add(clientInfo.fingerprint);
+          logger.warn('Client fingerprint blocked due to repeated violations', {
+            fingerprint: clientInfo.fingerprint,
+            violations: violations + 1
+          });
+        }
+
+        return {
+          passed: false,
+          window: window.duration / 1000,
+          limit: window.limit,
+          violations: violations + 1
+        };
+      }
+    }
+
+    return { passed: true };
+  }
+
+  /**
+   * Validate User-Agent for legitimacy
+   */
+  validateUserAgent(userAgent) {
+    if (!userAgent || userAgent.length < 10) {
+      return { valid: false, reason: 'Missing or too short User-Agent' };
+    }
+
+    // Check for common bot patterns
+    const botPatterns = [
+      /curl/i, /wget/i, /scrapy/i, /python/i, /requests/i,
+      /bot/i, /crawler/i, /spider/i, /scraper/i
+    ];
+
+    for (const pattern of botPatterns) {
+      if (pattern.test(userAgent)) {
+        return { valid: false, reason: 'Bot User-Agent detected' };
+      }
+    }
+
+    // Check for valid browser patterns
+    const browserPatterns = [
+      /mozilla/i, /chrome/i, /safari/i, /firefox/i, /edge/i, /opera/i
+    ];
+
+    const hasValidBrowser = browserPatterns.some(pattern => pattern.test(userAgent));
+    if (!hasValidBrowser) {
+      return { valid: false, reason: 'Invalid browser User-Agent' };
+    }
+
+    return { valid: true };
+  }
+
+  /**
+   * Detect automation and scripting attempts
+   */
+  detectAutomation(req) {
+    const headers = req.headers;
+    const suspiciousHeaders = [];
+
+    // Check for automation indicators
+    if (!headers.accept) {
+      suspiciousHeaders.push('missing_accept_header');
+    }
+
+    if (!headers['accept-language']) {
+      suspiciousHeaders.push('missing_accept_language');
+    }
+
+    if (!headers['accept-encoding']) {
+      suspiciousHeaders.push('missing_accept_encoding');
+    }
+
+    // Check for scripting headers
+    if (headers['x-requested-with'] === 'XMLHttpRequest' && !headers.referer) {
+      suspiciousHeaders.push('ajax_without_referer');
+    }
+
+    // Check for headless browser indicators
+    if (headers['user-agent'] && headers['user-agent'].includes('HeadlessChrome')) {
+      suspiciousHeaders.push('headless_browser');
+    }
+
+    const detected = suspiciousHeaders.length >= 2;
+
+    return {
+      detected,
+      suspiciousHeaders,
+      score: suspiciousHeaders.length
+    };
+  }
+
+  /**
+   * Set comprehensive security headers
+   */
+  setSecurityHeaders(res) {
+    res.set({
+      // Prevent caching
+      'Cache-Control': 'no-store, no-cache, must-revalidate, private',
+      'Pragma': 'no-cache',
+      'Expires': '0',
+      
+      // Security headers
+      'X-Content-Type-Options': 'nosniff',
+      'X-Frame-Options': 'DENY',
+      'X-XSS-Protection': '1; mode=block',
+      'Referrer-Policy': 'strict-origin-when-cross-origin',
+      'Content-Security-Policy': "default-src 'none'; img-src 'self'",
+      
+      // Custom security headers
+      'X-Protected-Content': 'true',
+      'X-Download-Policy': 'restricted',
+      
+      // CORS restrictions
+      'Access-Control-Allow-Origin': process.env.FRONTEND_URL || '*',
+      'Access-Control-Allow-Methods': 'GET',
+      'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+      'Access-Control-Max-Age': '3600'
+    });
+  }
+
+  /**
+   * Get client IP address with proxy support
+   */
+  getClientIP(req) {
+    return req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
+           req.headers['x-real-ip'] ||
+           req.connection.remoteAddress ||
+           req.socket.remoteAddress ||
+           req.ip;
+  }
+
+  /**
+   * Flag suspicious activity for monitoring
+   */
+  flagSuspiciousActivity(clientInfo) {
+    const key = `suspicious_${clientInfo.fingerprint}`;
+    const existing = this.rateLimitViolations.get(key) || 0;
+    
+    this.rateLimitViolations.set(key, existing + 1);
+    
+    // Add to suspicious IPs after multiple flags
+    if (existing >= 3) {
+      this.suspiciousIPs.add(clientInfo.ip);
+      logger.warn('IP added to suspicious list', {
+        ip: clientInfo.ip,
+        fingerprint: clientInfo.fingerprint,
+        flags: existing + 1
+      });
+    }
+  }
+
+  /**
+   * Log security events
+   */
+  async logSecurityEvent(eventType, req, details = {}) {
+    try {
+      const logData = {
+        event_type: eventType,
+        client_ip: req.clientInfo?.ip || req.ip,
+        client_fingerprint: req.clientInfo?.fingerprint,
+        user_agent: req.get('User-Agent')?.substring(0, 255),
+        request_path: req.path,
+        request_method: req.method,
+        details: JSON.stringify(details),
+        timestamp: new Date().toISOString()
+      };
+
+      logger.warn(`Security event: ${eventType}`, logData);
+
+      // Store in database if needed
+      if (process.env.LOG_SECURITY_EVENTS === 'true') {
+        await db('security_logs').insert(logData).catch(console.error);
+      }
+    } catch (error) {
+      console.error('Error logging security event:', error);
+    }
+  }
+
+  /**
+   * Get rate limit settings from database
+   */
+  async getRateLimitSettings() {
+    try {
+      const settings = await db('app_settings')
+        .whereIn('setting_key', [
+          'max_image_requests_per_minute',
+          'max_image_requests_per_5_minutes',
+          'max_image_requests_per_hour'
+        ])
+        .select('setting_key', 'setting_value');
+
+      const config = {};
+      settings.forEach(setting => {
+        const key = setting.setting_key.replace('max_image_requests_per_', '');
+        config[key === 'minute' ? 'perMinute' : key === '5_minutes' ? 'per5Minutes' : 'perHour'] = 
+          JSON.parse(setting.setting_value);
+      });
+
+      return {
+        perMinute: config.perMinute || 30,
+        per5Minutes: config.per5Minutes || 100,
+        perHour: config.perHour || 500
+      };
+    } catch (error) {
+      console.error('Error getting rate limit settings:', error);
+      return { perMinute: 30, per5Minutes: 100, perHour: 500 };
+    }
+  }
+
+  /**
+   * Clean up old security data
+   */
+  cleanup() {
+    const now = Date.now();
+    
+    // Clear old rate limit violations (older than 1 hour)
+    for (const [key, timestamp] of this.rateLimitViolations.entries()) {
+      if (typeof timestamp === 'number' && now - timestamp > 3600000) {
+        this.rateLimitViolations.delete(key);
+      }
+    }
+
+    // Clean up the secure image service
+    secureImageService.cleanup();
+  }
+
+  /**
+   * Get security status
+   */
+  getSecurityStatus() {
+    return {
+      suspiciousIPsCount: this.suspiciousIPs.size,
+      blockedFingerprintsCount: this.blockedFingerprints.size,
+      activeViolations: this.rateLimitViolations.size,
+      timestamp: new Date().toISOString()
+    };
+  }
+}
+
+// Create singleton instance
+const secureImageMiddleware = new SecureImageMiddleware();
+
+// Setup cleanup interval
+setInterval(() => {
+  secureImageMiddleware.cleanup();
+}, 300000); // Every 5 minutes
+
+module.exports = secureImageMiddleware;

backend/src/middleware/sessionTimeout.js

@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { getAdminTokenFromRequest } = require('../utils/tokenUtils');
 
 // In-memory session tracking (in production, use Redis)
 const sessions = new Map();
@@ -67,11 +68,7 @@ async function getSessionTimeout() {
 
 async function sessionTimeoutMiddleware(req, res, next) {
   // Skip for non-authenticated routes
-  if (!req.headers.authorization) {
-    return next();
-  }
-  
-  const token = req.headers.authorization.split(' ')[1];
+  const token = getAdminTokenFromRequest(req);
   if (!token) {
     return next();
   }
@@ -150,4 +147,4 @@ module.exports = {
   sessionTimeoutMiddleware, 
   endSession,
   getActiveSessions 
-};
+};

backend/src/routes/__tests__/adminAuth.test.js

@@ -0,0 +1,99 @@
+const request = require('supertest');
+const express = require('express');
+
+const buildChain = ({ firstResult, updateResult } = {}) => {
+  const chain = {
+    where: jest.fn().mockReturnThis(),
+    whereNot: jest.fn().mockReturnThis(),
+    select: jest.fn().mockReturnThis(),
+    update: jest.fn().mockResolvedValue(updateResult ?? 1),
+    first: jest.fn().mockResolvedValue(firstResult),
+  };
+  return chain;
+};
+
+jest.mock('../../database/db', () => {
+  const dbMock = jest.fn();
+  dbMock.raw = jest.fn();
+  dbMock.__setImplementations = (...chains) => {
+    dbMock.mockReset();
+    chains.forEach((chain) => {
+      dbMock.mockImplementationOnce(() => chain);
+    });
+  };
+  return {
+    db: dbMock,
+    logActivity: jest.fn().mockResolvedValue(undefined),
+  };
+});
+
+jest.mock('../../middleware/auth-enhanced-v2', () => ({
+  adminAuth: (_req, _res, next) => {
+    _req.admin = { id: 1, username: 'admin' };
+    next();
+  },
+}));
+
+const { db, logActivity } = require('../../database/db');
+const adminAuthRouter = require('../adminAuth');
+
+describe('adminAuth profile updates', () => {
+  const app = express();
+  app.use(express.json());
+  app.use('/auth/admin', adminAuthRouter);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('updates the admin profile', async () => {
+    const updatedUser = {
+      id: 1,
+      username: 'newadmin',
+      email: 'newadmin@example.com',
+      must_change_password: false,
+    };
+
+    db.__setImplementations(
+      buildChain({ firstResult: null }),          // email check
+      buildChain({ firstResult: null }),          // username check
+      buildChain({ updateResult: 1 }),            // update
+      buildChain({ firstResult: updatedUser }),   // fetch updated user
+    );
+
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: updatedUser.username, email: updatedUser.email })
+      .expect(200);
+
+    expect(response.body).toEqual({ user: updatedUser });
+    expect(logActivity).toHaveBeenCalledWith(
+      'admin_profile_updated',
+      { admin_id: 1, updated_fields: ['username', 'email'] },
+      null,
+      { type: 'admin', id: 1, name: updatedUser.username }
+    );
+  });
+
+  it('rejects email conflicts', async () => {
+    db.__setImplementations(
+      buildChain({ firstResult: { id: 2 } })
+    );
+
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: 'newadmin', email: 'taken@example.com' })
+      .expect(409);
+
+    expect(response.body).toEqual({ error: 'Email is already in use by another admin' });
+  });
+
+  it('validates input', async () => {
+    const response = await request(app)
+      .put('/auth/admin/profile')
+      .send({ username: '', email: 'not-an-email' })
+      .expect(400);
+
+    expect(response.body.errors).toBeDefined();
+  });
+});

backend/src/routes/__tests__/adminNotifications.test.js

@@ -0,0 +1,67 @@
+const request = require('supertest');
+const express = require('express');
+
+jest.mock('../../database/db', () => {
+  const deleteMock = jest.fn().mockResolvedValue(5);
+  const chain = {
+    select: jest.fn().mockReturnThis(),
+    leftJoin: jest.fn().mockReturnThis(),
+    orderBy: jest.fn().mockReturnThis(),
+    limit: jest.fn().mockReturnThis(),
+    whereNull: jest.fn().mockReturnThis(),
+    whereNotNull: jest.fn().mockReturnThis(),
+    where: jest.fn().mockReturnThis(),
+    update: jest.fn().mockReturnThis(),
+    delete: deleteMock,
+    count: jest.fn().mockReturnThis(),
+    first: jest.fn().mockResolvedValue({ count: 0 }),
+  };
+
+  const dbMock = jest.fn(() => chain);
+  dbMock.raw = jest.fn();
+  dbMock.__chain = chain;
+  dbMock.__deleteMock = deleteMock;
+  return { db: dbMock };
+});
+
+jest.mock('../../middleware/auth-enhanced-v2', () => ({
+  adminAuth: (_req, _res, next) => next(),
+}));
+
+const { db } = require('../../database/db');
+const notificationsRouter = require('../adminNotifications');
+
+describe('adminNotifications routes', () => {
+  const app = express();
+  app.use(express.json());
+  app.use('/admin/notifications', notificationsRouter);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('clears all notifications', async () => {
+    db.__deleteMock.mockResolvedValueOnce(8);
+
+    const response = await request(app)
+      .delete('/admin/notifications/clear-all')
+      .expect(200);
+
+    expect(db).toHaveBeenCalledWith('activity_logs');
+    expect(db.__deleteMock).toHaveBeenCalledTimes(1);
+    expect(response.body).toEqual({
+      message: 'All notifications cleared',
+      deletedCount: 8,
+    });
+  });
+
+  it('handles database errors when clearing notifications', async () => {
+    db.__deleteMock.mockRejectedValueOnce(new Error('boom'));
+
+    const response = await request(app)
+      .delete('/admin/notifications/clear-all')
+      .expect(500);
+
+    expect(response.body).toEqual({ error: 'Failed to clear notifications' });
+  });
+});

backend/src/routes/adminAuth.js

@@ -72,6 +72,68 @@ router.post('/change-password', [
   }
 });
 
+// Update admin profile
+router.put('/profile', [
+  adminAuth,
+  body('username').trim().notEmpty().withMessage('Username is required'),
+  body('email').trim().isEmail().withMessage('Valid email is required')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { username, email } = req.body;
+    const userId = req.admin.id;
+
+    // Check for email conflicts
+    const existingEmail = await db('admin_users')
+      .where('email', email)
+      .whereNot('id', userId)
+      .first();
+
+    if (existingEmail) {
+      return res.status(409).json({ error: 'Email is already in use by another admin' });
+    }
+
+    // Check username conflict (if multiple admins are supported)
+    const existingUsername = await db('admin_users')
+      .where('username', username)
+      .whereNot('id', userId)
+      .first();
+
+    if (existingUsername) {
+      return res.status(409).json({ error: 'Username is already in use by another admin' });
+    }
+
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        username,
+        email,
+        updated_at: new Date()
+      });
+
+    const updatedUser = await db('admin_users')
+      .select('id', 'username', 'email', 'must_change_password')
+      .where('id', userId)
+      .first();
+
+    await logActivity(
+      'admin_profile_updated',
+      { admin_id: userId, updated_fields: ['username', 'email'] },
+      null,
+      { type: 'admin', id: userId, name: username }
+    );
+
+    res.json({ user: updatedUser });
+  } catch (error) {
+    console.error('Admin profile update error:', error);
+    res.status(500).json({ error: 'Failed to update admin profile' });
+  }
+});
+
 // Logout
 router.post('/logout', adminAuth, async (req, res) => {
   try {
@@ -96,4 +158,4 @@ router.post('/logout', adminAuth, async (req, res) => {
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminBackup.js

@@ -221,7 +221,11 @@ router.post('/test-connection', adminAuth, async (req, res) => {
           await fs.access(config.path, fs.constants.W_OK);
           res.json({ success: true, message: 'Local path is writable' });
         } catch (error) {
-          res.json({ success: false, message: 'Cannot write to local path: ' + error.message });
+          logger.warn('Local backup path not writable', {
+            path: config.path,
+            error: error.message
+          });
+          res.json({ success: false, message: 'Cannot write to local path. Check server logs for details.' });
         }
         break;
         
@@ -243,7 +247,11 @@ router.post('/test-connection', adminAuth, async (req, res) => {
           const { stdout } = await execAsync(testCommand);
           res.json({ success: true, message: 'Rsync connection successful' });
         } catch (error) {
-          res.json({ success: false, message: 'Rsync connection failed: ' + error.message });
+          logger.warn('Rsync connection test failed', {
+            destination: config.host || config.destination,
+            error: error.message
+          });
+          res.json({ success: false, message: 'Rsync connection failed. Check server logs for details.' });
         }
         break;
         
@@ -274,7 +282,7 @@ router.get('/manifest/:backupRunId', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to get backup manifest:', error);
-    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+    res.status(404).json({ error: 'Backup manifest not found' });
   }
 });
 
@@ -327,7 +335,7 @@ router.get('/manifest/:backupRunId/download', adminAuth, async (req, res) => {
     }
   } catch (error) {
     logger.error('Failed to download backup manifest:', error);
-    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+    res.status(404).json({ error: 'Backup manifest not found' });
   }
 });
 
@@ -344,7 +352,7 @@ router.get('/manifests/:backupId', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to get backup manifest:', error);
-    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+    res.status(404).json({ error: 'Backup manifest not found' });
   }
 });
 
@@ -375,7 +383,7 @@ router.get('/manifests/:backupId/download', adminAuth, async (req, res) => {
     }
   } catch (error) {
     logger.error('Failed to download backup manifest:', error);
-    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+    res.status(404).json({ error: 'Backup manifest not found' });
   }
 });
 
@@ -436,7 +444,7 @@ router.get('/s3/buckets', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to list S3 buckets:', error);
-    res.status(500).json({ error: 'Failed to list S3 buckets: ' + error.message });
+    res.status(500).json({ error: 'Failed to list S3 buckets' });
   }
 });
 
@@ -473,7 +481,7 @@ router.get('/s3/files', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to list S3 files:', error);
-    res.status(500).json({ error: 'Failed to list S3 files: ' + error.message });
+    res.status(500).json({ error: 'Failed to list S3 files' });
   }
 });
 
@@ -535,7 +543,7 @@ router.delete('/s3/cleanup', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to cleanup S3 backups:', error);
-    res.status(500).json({ error: 'Failed to cleanup S3 backups: ' + error.message });
+    res.status(500).json({ error: 'Failed to cleanup S3 backups' });
   }
 });
 
@@ -587,7 +595,7 @@ router.post('/s3/test-upload', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('S3 upload test failed:', error);
-    res.status(500).json({ error: 'S3 upload test failed: ' + error.message });
+    res.status(500).json({ error: 'S3 upload test failed' });
   }
 });
 
@@ -675,7 +683,7 @@ router.get('/download/:backupId', adminAuth, async (req, res) => {
     }
   } catch (error) {
     logger.error('Failed to download backup:', error);
-    res.status(500).json({ error: 'Failed to download backup: ' + error.message });
+    res.status(500).json({ error: 'Failed to download backup' });
   }
 });
 
@@ -744,7 +752,7 @@ router.get('/checksums', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to get file checksums:', error);
-    res.status(500).json({ error: 'Failed to get file checksums: ' + error.message });
+    res.status(500).json({ error: 'Failed to get file checksums' });
   }
 });
 
@@ -847,7 +855,7 @@ router.post('/estimate', adminAuth, async (req, res) => {
     });
   } catch (error) {
     logger.error('Failed to estimate backup size:', error);
-    res.status(500).json({ error: 'Failed to estimate backup size: ' + error.message });
+    res.status(500).json({ error: 'Failed to estimate backup size' });
   }
 });
 
@@ -945,12 +953,13 @@ async function validateManifestData(manifestData) {
       }
     };
   } catch (error) {
+    logger.error('Manifest validation error', { error: error.message });
     return {
       valid: false,
-      error: `Validation error: ${error.message}`,
-      details: { error: error.message }
+      error: 'Validation error encountered while processing manifest',
+      details: { hint: 'See server logs for diagnostic details.' }
     };
   }
 }
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminDashboard.js

@@ -166,7 +166,7 @@ router.get('/health', adminAuth, async (req, res) => {
     
     const [failedEmails] = await db('email_queue')
       .where('status', 'failed')
-      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
+      .where('scheduled_at', '>=', twentyFourHoursAgo.toISOString())
       .count('* as count');
 
     const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';

backend/src/routes/adminEvents.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { body, query, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 const bcrypt = require('bcrypt');
@@ -12,7 +13,29 @@ const { queueEmail } = require('../services/emailProcessor');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 // formatDate import removed - dates are formatted by email processor
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
+
+const parseBooleanInput = (value, defaultValue = true) => {
+  if (value === undefined || value === null) {
+    return defaultValue;
+  }
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  if (typeof value === 'number') {
+    return value !== 0;
+  }
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (['false', '0', 'no', 'off'].includes(normalized)) {
+      return false;
+    }
+    if (['true', '1', 'yes', 'on'].includes(normalized)) {
+      return true;
+    }
+  }
+  return defaultValue;
+};
 
 // Create new event
 router.post('/', adminAuth, [
@@ -21,16 +44,43 @@ router.post('/', adminAuth, [
   body('event_date').isDate(),
   body('host_email').isEmail().normalizeEmail(),
   body('admin_email').isEmail().normalizeEmail(),
-  body('password').isLength({ min: 6 }),
+  body('require_password').optional().isBoolean(),
+  body('password').optional().isString().custom((value, { req }) => {
+    const input = req.body.require_password;
+    const normalizeBoolean = (val, defaultValue = true) => {
+      if (val === undefined || val === null) return defaultValue;
+      if (typeof val === 'boolean') return val;
+      if (typeof val === 'number') return val !== 0;
+      if (typeof val === 'string') {
+        const normalized = val.trim().toLowerCase();
+        if (['false', '0', 'no', 'off'].includes(normalized)) return false;
+        if (['true', '1', 'yes', 'on'].includes(normalized)) return true;
+      }
+      return defaultValue;
+    };
+
+    const requirePassword = normalizeBoolean(input, true);
+    if (!requirePassword) {
+      return true;
+    }
+    if (typeof value !== 'string' || value.trim().length < 6) {
+      throw new Error('Password must be at least 6 characters long');
+    }
+    return true;
+  }),
   body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
   body('welcome_message').optional().trim(),
   body('color_theme').optional().trim(),
   body('allow_user_uploads').optional().isBoolean().toBoolean(),
   body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim()
+  body('host_name').notEmpty().trim(),
+  body('allow_downloads').optional().isBoolean(),
+  body('disable_right_click').optional().isBoolean(),
+  body('watermark_downloads').optional().isBoolean(),
+  body('watermark_text').optional().trim()
 ], async (req, res) => {
   try {
-    console.log('Create event request body:', req.body);
+    logger.debug('Create event request body', { body: req.body });
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
       console.error('Validation errors:', errors.array());
@@ -49,21 +99,57 @@ router.post('/', adminAuth, [
       color_theme = null,
       expiration_days = 30,
       allow_user_uploads = false,
-      upload_category_id = null
+      upload_category_id = null,
+      allow_downloads = true,
+      disable_right_click = false,
+      watermark_downloads = false,
+      watermark_text = null,
+      require_password: requirePasswordInput = true,
+      // Feedback settings
+      feedback_enabled = false,
+      allow_ratings = true,
+      allow_likes = true,
+      allow_comments = true,
+      allow_favorites = true,
+      require_name_email = false,
+      moderate_comments = true,
+      show_feedback_to_guests = true
     } = req.body;
     
-    // Validate password strength
-    const passwordValidation = await validatePasswordInContext(password, 'gallery', {
-      eventName: event_name
+    const requirePassword = parseBooleanInput(requirePasswordInput, true);
+
+    // Debug logging
+    logger.debug('Download control values', {
+      allow_downloads,
+      disable_right_click,
+      watermark_downloads,
+      watermark_text,
+      require_password: requirePassword,
+      types: {
+        allow_downloads: typeof allow_downloads,
+        disable_right_click: typeof disable_right_click,
+        watermark_downloads: typeof watermark_downloads
+      }
     });
     
-    if (!passwordValidation.valid) {
-      return res.status(400).json({ 
-        error: 'Password does not meet security requirements',
-        details: passwordValidation.errors,
-        score: passwordValidation.score,
-        feedback: passwordValidation.feedback
+    let passwordValidation = null;
+    let galleryPassword = password;
+
+    if (requirePassword) {
+      passwordValidation = await validatePasswordInContext(password, 'gallery', {
+        eventName: event_name
       });
+
+      if (!passwordValidation.valid) {
+        return res.status(400).json({ 
+          error: 'Password does not meet security requirements',
+          details: passwordValidation.errors,
+          score: passwordValidation.score,
+          feedback: passwordValidation.feedback
+        });
+      }
+    } else {
+      galleryPassword = '';
     }
     
     // Generate unique slug
@@ -83,10 +169,14 @@ router.post('/', adminAuth, [
     
     // Generate share link
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
+    const shareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
     
-    // Hash password with configurable rounds
-    const password_hash = await bcrypt.hash(password, getBcryptRounds());
+    // Hash password with configurable rounds (random placeholder when not required)
+    const password_hash = requirePassword
+      ? await bcrypt.hash(password, getBcryptRounds())
+      : await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
     
     // Calculate expiration date (days after event date)
     // Parse YYYY-MM-DD format as local date to avoid timezone issues
@@ -121,15 +211,37 @@ router.post('/', adminAuth, [
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString(),
       allow_user_uploads,
-      upload_category_id
+      upload_category_id,
+      allow_downloads: formatBoolean(allow_downloads !== undefined ? allow_downloads : true),
+      disable_right_click: formatBoolean(disable_right_click !== undefined ? disable_right_click : false),
+      watermark_downloads: formatBoolean(watermark_downloads !== undefined ? watermark_downloads : false),
+      watermark_text,
+      require_password: formatBoolean(requirePassword)
     }).returning('id');
     
     // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
     const eventId = insertResult[0]?.id || insertResult[0];
     
+    // Insert feedback settings if feedback is enabled
+    if (feedback_enabled) {
+      await db('event_feedback_settings').insert({
+        event_id: eventId,
+        feedback_enabled: formatBoolean(feedback_enabled),
+        allow_ratings: formatBoolean(allow_ratings),
+        allow_likes: formatBoolean(allow_likes),
+        allow_comments: formatBoolean(allow_comments),
+        allow_favorites: formatBoolean(allow_favorites),
+        require_name_email: formatBoolean(require_name_email),
+        moderate_comments: formatBoolean(moderate_comments),
+        show_feedback_to_guests: formatBoolean(show_feedback_to_guests),
+        created_at: new Date().toISOString(),
+        updated_at: new Date().toISOString()
+      });
+    }
+    
     // Log activity
     await logActivity('event_created', 
-      { event_type, expires_at }, 
+      { event_type, expires_at, require_password: requirePassword, password_strength: passwordValidation?.score }, 
       eventId, 
       { type: 'admin', id: req.admin.id, name: req.admin.username }
     );
@@ -146,7 +258,7 @@ router.post('/', adminAuth, [
         event_name,
         event_date: event_date,  // Pass raw date - will be formatted by email processor
         gallery_link: shareLink,
-        gallery_password: password,
+        gallery_password: requirePassword ? password : 'No password required',
         expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
         welcome_message: welcome_message || ''
       }),
@@ -160,6 +272,7 @@ router.post('/', adminAuth, [
       slug,
       event_name,
       event_type,
+      require_password: requirePassword,
       share_link: shareLink,
       expires_at: expires_at.toISOString(),
       created_at: new Date().toISOString()
@@ -341,21 +454,70 @@ router.put('/:id', adminAuth, [
     // Check if it's a number or can be converted to a valid integer
     const num = Number(value);
     return !isNaN(num) && Number.isInteger(num);
-  }).withMessage('hero_photo_id must be an integer or null')
+  }).withMessage('hero_photo_id must be an integer or null'),
+  body('allow_downloads').optional().isBoolean(),
+  body('disable_right_click').optional().isBoolean(),
+  body('watermark_downloads').optional().isBoolean(),
+  body('watermark_text').optional().trim(),
+  body('source_mode').optional().isIn(['managed', 'reference']),
+  body('external_path').optional({ nullable: true }).isString().trim(),
+  body('require_password').optional().isBoolean(),
+  body('password').optional().isString().custom((value, { req }) => {
+    if (value === undefined || value === null || value === '') {
+      return true;
+    }
+    if (typeof value !== 'string' || value.trim().length < 6) {
+      throw new Error('Password must be at least 6 characters long');
+    }
+    return true;
+  })
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      console.log('Update event validation errors:', JSON.stringify(errors.array(), null, 2));
-      console.log('Request body:', req.body);
+      logger.debug('Update event validation errors', { errors: errors.array(), body: req.body });
       return res.status(400).json({ errors: errors.array() });
     }
 
     const { id } = req.params;
-    const updates = req.body;
+    const updates = { ...req.body };
+
+    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
+    let requirePasswordUpdate;
+    if (hasRequirePasswordUpdate) {
+      requirePasswordUpdate = parseBooleanInput(updates.require_password, true);
+      updates.require_password = formatBoolean(requirePasswordUpdate);
+    }
+
+    let newPasswordPlain;
+    if (Object.prototype.hasOwnProperty.call(updates, 'password')) {
+      if (updates.password === undefined || updates.password === null || updates.password === '') {
+        delete updates.password;
+      } else {
+        newPasswordPlain = updates.password;
+        delete updates.password;
+      }
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'source_mode')) {
+      updates.source_mode = updates.source_mode === 'reference' ? 'reference' : 'managed';
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'external_path')) {
+      const trimmedPath = updates.external_path ? String(updates.external_path).trim() : '';
+      updates.external_path = trimmedPath || null;
+    }
+
+    if (updates.source_mode === 'managed') {
+      updates.external_path = null;
+    }
+
+    if (updates.source_mode === 'reference' && (updates.external_path === null || updates.external_path === undefined)) {
+      return res.status(400).json({ error: 'external_path is required when source_mode is reference' });
+    }
 
     // Log the update request for debugging
-    console.log('Update event request:', {
+    logger.debug('Update event request', {
       id,
       updates,
       color_theme_length: updates.color_theme ? updates.color_theme.length : 0,
@@ -370,6 +532,18 @@ router.put('/:id', adminAuth, [
       return res.status(404).json({ error: 'Event not found' });
     }
 
+    const currentRequirePassword = parseBooleanInput(event.require_password, true);
+
+    if (hasRequirePasswordUpdate && requirePasswordUpdate === true && !currentRequirePassword && !newPasswordPlain) {
+      return res.status(400).json({ error: 'Password must be provided when enabling password requirement.' });
+    }
+
+    if (newPasswordPlain) {
+      updates.password_hash = await bcrypt.hash(newPasswordPlain, getBcryptRounds());
+    } else if (hasRequirePasswordUpdate && requirePasswordUpdate === false && currentRequirePassword) {
+      updates.password_hash = await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
+    }
+
     // Update event
     await db('events')
       .where('id', id)
@@ -414,10 +588,7 @@ router.delete('/:id', adminAuth, async (req, res) => {
       // 4. Delete photos (this will also handle hero_photo_id foreign key)
       await trx('photos').where('event_id', id).del();
 
-      // 5. Delete categories (photo_categories has CASCADE delete for event_id)
-      await trx('photo_categories').where('event_id', id).del();
-
-      // 6. Finally delete the event
+      // 5. Finally delete the event
       await trx('events').where('id', id).del();
 
       // Delete event folder from storage if it exists
@@ -463,13 +634,11 @@ router.delete('/:id', adminAuth, async (req, res) => {
     // Provide more specific error messages
     if (error.message && error.message.includes('foreign key constraint')) {
       res.status(500).json({ 
-        error: 'Cannot delete event due to existing references. Please contact support.',
-        details: error.message 
+        error: 'Cannot delete event due to existing references. Please contact support.'
       });
     } else {
       res.status(500).json({ 
-        error: 'Failed to delete event',
-        details: process.env.NODE_ENV === 'development' ? error.message : undefined
+        error: 'Failed to delete event'
       });
     }
   }
@@ -526,16 +695,15 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
     }
 
     // Generate new password
-    const { generatePassword } = require('../utils/passwordGenerator');
-    const newPassword = generatePassword();
+    const { generateReadablePassword } = require('../utils/passwordGenerator');
+    const newPassword = generateReadablePassword();
     const passwordHash = await bcrypt.hash(newPassword, 10);
 
     // Update event with new password
     await db('events')
       .where('id', id)
       .update({
-        password_hash: passwordHash,
-        updated_at: new Date()
+        password_hash: passwordHash
       });
 
     // Log activity
@@ -729,7 +897,7 @@ router.post('/bulk-archive', adminAuth, [
         results.failed.push({
           id: event.id,
           name: event.event_name,
-          error: error.message
+          error: 'Failed to archive event. Check server logs for details.'
         });
       }
     }
@@ -755,4 +923,4 @@ router.post('/bulk-archive', adminAuth, [
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminExternalMedia.js

@@ -0,0 +1,147 @@
+const express = require('express');
+const path = require('path');
+const fs = require('fs').promises;
+const { adminAuth } = require('../middleware/auth');
+const { list, resolveExternalPath, getExternalMediaRoot } = require('../services/externalMediaService');
+const { db, logActivity } = require('../database/db');
+const logger = require('../utils/logger');
+
+const router = express.Router();
+
+// GET /api/admin/external-media/list?path=relative/dir
+router.get('/list', adminAuth, async (req, res) => {
+  try {
+    const relPath = (req.query.path || '').replace(/^\/+/, '');
+    const result = await list(relPath);
+    res.json(result);
+  } catch (error) {
+    logger.warn('Invalid external media path requested', {
+      path: req.query.path,
+      error: error.message
+    });
+    res.status(400).json({ error: 'Invalid external media path' });
+  }
+});
+
+// Helper to recursively collect files under a directory, filtered by image extensions
+async function walkDir(dir, baseDir) {
+  const results = [];
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  for (const e of entries) {
+    if (e.name.startsWith('.')) continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      results.push(...await walkDir(full, baseDir));
+    } else if (e.isFile()) {
+      const ext = path.extname(e.name).toLowerCase();
+      if (['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) {
+        const rel = path.relative(baseDir, full);
+        results.push({ full, rel, name: e.name });
+      }
+    }
+  }
+  return results;
+}
+
+// POST /api/admin/events/:id/import-external
+// Body: { external_path: string, recursive?: boolean, map?: { individual?: string, collages?: string } }
+router.post('/events/:id/import-external', adminAuth, async (req, res) => {
+  try {
+    const eventId = parseInt(req.params.id);
+    const { external_path, recursive = true, map = { individual: 'individual', collages: 'collages' } } = req.body || {};
+    if (!external_path) return res.status(400).json({ error: 'external_path is required' });
+
+    // Load event
+    const event = await db('events').where('id', eventId).first();
+    if (!event) return res.status(404).json({ error: 'Event not found' });
+
+    const baseAbs = resolveExternalPath({ external_path }, '');
+    // Collect files
+    const files = recursive ? await walkDir(baseAbs, baseAbs) : (await fs.readdir(baseAbs, { withFileTypes: true }))
+      .filter(e => e.isFile())
+      .map(e => ({ full: path.join(baseAbs, e.name), rel: e.name, name: e.name }))
+      .filter(f => ['.jpg', '.jpeg', '.png', '.webp'].includes(path.extname(f.name).toLowerCase()));
+
+    // Prepare file metadata and deduplicate by filename within type (keep largest)
+    let skipped = 0;
+    const preparedFiles = [];
+    for (const f of files) {
+      try {
+        const stats = await fs.stat(f.full);
+        const segs = f.rel.split(path.sep);
+        let type = 'individual';
+        if (segs[0] === map.collages) type = 'collage';
+        if (segs[0] === map.individual) type = 'individual';
+        preparedFiles.push({ ...f, type, size: stats.size });
+      } catch (err) {
+        skipped++;
+      }
+    }
+
+    const dedupeMap = new Map();
+    for (const file of preparedFiles) {
+      const dedupeKey = `${file.type}:${path.basename(file.rel).toLowerCase()}`;
+      const existing = dedupeMap.get(dedupeKey);
+      if (!existing || file.size > existing.size) {
+        if (existing) skipped++;
+        dedupeMap.set(dedupeKey, file);
+      } else {
+        skipped++;
+      }
+    }
+
+    let imported = 0;
+
+    // Insert photos
+    for (const f of dedupeMap.values()) {
+      // Infer type by subfolder names
+      const segs = f.rel.split(path.sep);
+      let type = 'individual';
+      if (segs[0] === map.collages) type = 'collage';
+      if (segs[0] === map.individual) type = 'individual';
+
+      try {
+        // Check if already exists (by external_relpath)
+        const exists = await db('photos')
+          .where({ event_id: eventId, external_relpath: f.rel })
+          .first();
+        if (exists) { skipped++; continue; }
+        const stats = await fs.stat(f.full);
+        const inserted = await db('photos')
+          .insert({
+            event_id: eventId,
+            filename: f.name,
+            // Keep path as a hint for legacy code but not used for resolution in external mode
+            path: path.join(event.slug, f.name),
+            thumbnail_path: null,
+            type,
+            size_bytes: stats.size,
+            source_origin: 'external',
+            external_relpath: f.rel
+          })
+          .returning('id');
+
+        imported += (inserted?.length ? 1 : 0);
+      } catch (e) {
+        skipped++;
+      }
+    }
+
+    // Update event fields
+    await db('events').where('id', eventId).update({ source_mode: 'reference', external_path });
+
+    // Queue thumbnail generation lazily by reading thumbnails via ensure endpoint as needed
+    await logActivity('external_import_completed', { event_id: eventId, imported, skipped, external_path }, eventId, { type: 'admin' });
+
+    res.json({ imported, skipped, thumbnailsQueued: 0 });
+  } catch (error) {
+    logger.error('External media import failed', {
+      eventId: req.params.id,
+      externalPath: req.body?.external_path,
+      error: error.message
+    });
+    res.status(500).json({ error: 'Failed to import external media' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminFeedback.js

@@ -60,8 +60,8 @@ router.put('/events/:eventId/feedback-settings',
         settings: updatedSettings
       }, eventId, {
         type: 'admin',
-        id: req.user.id,
-        name: req.user.username
+        id: req.admin.id,
+        name: req.admin.username
       });
       
       res.json(updatedSettings);
@@ -111,7 +111,29 @@ router.get('/events/:eventId/feedback',
       
       // Pagination
       const offset = (page - 1) * limit;
-      const totalCount = await query.clone().count('photo_feedback.id as count').first();
+      
+      // Create a separate count query
+      let countQuery = db('photo_feedback')
+        .where('photo_feedback.event_id', eventId);
+      
+      if (type) {
+        countQuery = countQuery.where('photo_feedback.feedback_type', type);
+      }
+      
+      if (status === 'pending') {
+        countQuery = countQuery.where('photo_feedback.is_approved', false)
+                               .where('photo_feedback.is_hidden', false);
+      } else if (status === 'approved') {
+        countQuery = countQuery.where('photo_feedback.is_approved', true);
+      } else if (status === 'hidden') {
+        countQuery = countQuery.where('photo_feedback.is_hidden', true);
+      }
+      
+      if (photoId) {
+        countQuery = countQuery.where('photo_feedback.photo_id', photoId);
+      }
+      
+      const totalCount = await countQuery.count('photo_feedback.id as count').first();
       
       const feedback = await query
         .orderBy('photo_feedback.created_at', 'desc')
@@ -145,7 +167,7 @@ router.put('/feedback/:feedbackId/:action',
         return res.status(400).json({ error: 'Invalid action' });
       }
       
-      await feedbackService.moderateFeedback(feedbackId, action, req.user.id);
+      await feedbackService.moderateFeedback(feedbackId, action, req.admin.id);
       
       res.json({ success: true });
     } catch (error) {
@@ -162,7 +184,7 @@ router.delete('/feedback/:feedbackId',
     try {
       const { feedbackId } = req.params;
       
-      await feedbackService.deleteFeedback(feedbackId, req.user.id);
+      await feedbackService.deleteFeedback(feedbackId, req.admin.id);
       
       res.json({ success: true });
     } catch (error) {
@@ -314,7 +336,7 @@ router.get('/feedback/pending-moderation',
 );
 
 // Word filter management
-router.get('/feedback/word-filters',
+router.get('/word-filters',
   adminAuth,
   async (req, res) => {
     try {
@@ -327,7 +349,7 @@ router.get('/feedback/word-filters',
   }
 );
 
-router.post('/feedback/word-filters',
+router.post('/word-filters',
   adminAuth,
   validateWordFilter,
   checkValidation,
@@ -339,14 +361,14 @@ router.post('/feedback/word-filters',
       
       await logActivity('word_filter_added', { word, severity }, null, {
         type: 'admin',
-        id: req.user.id,
-        name: req.user.username
+        id: req.user?.id || req.admin?.id,
+        name: req.user?.username || req.admin?.username
       });
       
       res.json({ success: true });
     } catch (error) {
       if (error.message === 'Word filter already exists') {
-        return res.status(409).json({ error: error.message });
+        return res.status(409).json({ error: 'Word filter already exists' });
       }
       logger.error('Error adding word filter:', error);
       res.status(500).json({ error: 'Failed to add word filter' });
@@ -354,7 +376,7 @@ router.post('/feedback/word-filters',
   }
 );
 
-router.put('/feedback/word-filters/:id',
+router.put('/word-filters/:id',
   adminAuth,
   async (req, res) => {
     try {
@@ -371,7 +393,7 @@ router.put('/feedback/word-filters/:id',
   }
 );
 
-router.delete('/feedback/word-filters/:id',
+router.delete('/word-filters/:id',
   adminAuth,
   async (req, res) => {
     try {
@@ -408,4 +430,4 @@ function convertToCSV(data) {
   return [csvHeaders, ...csvRows].join('\n');
 }
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminImageSecurity.js

@@ -0,0 +1,515 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const secureImageMiddleware = require('../middleware/secureImageMiddleware');
+const logger = require('../utils/logger');
+
+const router = express.Router();
+
+/**
+ * Get image security settings
+ */
+router.get('/settings', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings')
+      .whereIn('setting_key', [
+        'default_protection_level',
+        'default_image_quality',
+        'enable_devtools_protection',
+        'max_image_requests_per_minute',
+        'max_image_requests_per_5_minutes',
+        'max_image_requests_per_hour',
+        'suspicious_activity_threshold',
+        'enable_canvas_rendering',
+        'default_fragmentation_level',
+        'security_monitoring_enabled',
+        'block_suspicious_ips',
+        'log_security_events_to_db',
+        'auto_block_threshold'
+      ])
+      .select('setting_key', 'setting_value');
+
+    const config = {};
+    settings.forEach(setting => {
+      config[setting.setting_key] = JSON.parse(setting.setting_value);
+    });
+
+    res.json(config);
+  } catch (error) {
+    logger.error('Error getting image security settings', { error: error.message });
+    res.status(500).json({ error: 'Failed to get security settings' });
+  }
+});
+
+/**
+ * Update image security settings
+ */
+router.put('/settings', adminAuth, async (req, res) => {
+  try {
+    const updates = req.body;
+    
+    // Validate settings
+    const validSettings = [
+      'default_protection_level',
+      'default_image_quality',
+      'enable_devtools_protection',
+      'max_image_requests_per_minute',
+      'max_image_requests_per_5_minutes',
+      'max_image_requests_per_hour',
+      'suspicious_activity_threshold',
+      'enable_canvas_rendering',
+      'default_fragmentation_level',
+      'security_monitoring_enabled',
+      'block_suspicious_ips',
+      'log_security_events_to_db',
+      'auto_block_threshold'
+    ];
+
+    // Update each setting
+    for (const [key, value] of Object.entries(updates)) {
+      if (validSettings.includes(key)) {
+        await db('app_settings')
+          .where('setting_key', key)
+          .update({
+            setting_value: JSON.stringify(value),
+            updated_at: new Date()
+          });
+      }
+    }
+
+    logger.info('Image security settings updated', {
+      adminId: req.admin.id,
+      updates: Object.keys(updates)
+    });
+
+    res.json({ message: 'Settings updated successfully' });
+  } catch (error) {
+    logger.error('Error updating image security settings', { 
+      error: error.message,
+      adminId: req.admin.id 
+    });
+    res.status(500).json({ error: 'Failed to update security settings' });
+  }
+});
+
+/**
+ * Get security monitoring dashboard data
+ */
+router.get('/dashboard', adminAuth, async (req, res) => {
+  try {
+    const { timeframe = '24h' } = req.query;
+    
+    let timeFilter;
+    switch (timeframe) {
+      case '1h':
+        timeFilter = new Date(Date.now() - 3600000);
+        break;
+      case '24h':
+        timeFilter = new Date(Date.now() - 86400000);
+        break;
+      case '7d':
+        timeFilter = new Date(Date.now() - 604800000);
+        break;
+      default:
+        timeFilter = new Date(Date.now() - 86400000);
+    }
+
+    // Get image access statistics
+    const accessStats = await db('image_access_logs')
+      .where('accessed_at', '>', timeFilter.toISOString())
+      .select('access_type')
+      .count('* as count')
+      .groupBy('access_type');
+
+    // Get security events
+    const securityEvents = await db('security_logs')
+      .where('timestamp', '>', timeFilter.toISOString())
+      .select('event_type')
+      .count('* as count')
+      .groupBy('event_type');
+
+    // Get top suspicious IPs
+    const suspiciousIPs = await db('security_logs')
+      .where('timestamp', '>', timeFilter.toISOString())
+      .where('event_type', 'like', '%suspicious%')
+      .select('client_ip')
+      .count('* as count')
+      .groupBy('client_ip')
+      .orderBy('count', 'desc')
+      .limit(10);
+
+    // Get most accessed photos
+    const topPhotos = await db('image_access_logs')
+      .join('photos', 'image_access_logs.photo_id', 'photos.id')
+      .join('events', 'photos.event_id', 'events.id')
+      .where('image_access_logs.accessed_at', '>', timeFilter.toISOString())
+      .select('photos.filename', 'events.event_name', 'photos.id')
+      .count('* as access_count')
+      .groupBy('photos.id', 'photos.filename', 'events.event_name')
+      .orderBy('access_count', 'desc')
+      .limit(10);
+
+    // Get middleware status
+    const middlewareStatus = secureImageMiddleware.getSecurityStatus();
+
+    // Calculate totals
+    const totalAccess = accessStats.reduce((sum, stat) => sum + parseInt(stat.count), 0);
+    const totalSecurityEvents = securityEvents.reduce((sum, stat) => sum + parseInt(stat.count), 0);
+
+    // Get unique visitors
+    const uniqueVisitors = await db('image_access_logs')
+      .where('accessed_at', '>', timeFilter.toISOString())
+      .countDistinct('client_fingerprint as count')
+      .first();
+
+    res.json({
+      timeframe,
+      summary: {
+        totalAccess,
+        totalSecurityEvents,
+        uniqueVisitors: parseInt(uniqueVisitors.count),
+        suspiciousIPsCount: suspiciousIPs.length
+      },
+      accessStats: accessStats.reduce((acc, stat) => {
+        acc[stat.access_type] = parseInt(stat.count);
+        return acc;
+      }, {}),
+      securityEvents: securityEvents.reduce((acc, stat) => {
+        acc[stat.event_type] = parseInt(stat.count);
+        return acc;
+      }, {}),
+      suspiciousIPs: suspiciousIPs.map(ip => ({
+        ip: ip.client_ip,
+        incidents: parseInt(ip.count)
+      })),
+      topPhotos: topPhotos.map(photo => ({
+        id: photo.id,
+        filename: photo.filename,
+        eventName: photo.event_name,
+        accessCount: parseInt(photo.access_count)
+      })),
+      middlewareStatus
+    });
+
+  } catch (error) {
+    logger.error('Error getting security dashboard data', { error: error.message });
+    res.status(500).json({ error: 'Failed to get dashboard data' });
+  }
+});
+
+/**
+ * Get detailed security logs
+ */
+router.get('/logs', adminAuth, async (req, res) => {
+  try {
+    const { 
+      page = 1, 
+      limit = 50, 
+      eventType = null, 
+      timeframe = '24h' 
+    } = req.query;
+
+    let timeFilter;
+    switch (timeframe) {
+      case '1h':
+        timeFilter = new Date(Date.now() - 3600000);
+        break;
+      case '24h':
+        timeFilter = new Date(Date.now() - 86400000);
+        break;
+      case '7d':
+        timeFilter = new Date(Date.now() - 604800000);
+        break;
+      default:
+        timeFilter = new Date(Date.now() - 86400000);
+    }
+
+    let query = db('security_logs')
+      .where('timestamp', '>', timeFilter.toISOString())
+      .orderBy('timestamp', 'desc');
+
+    if (eventType) {
+      query = query.where('event_type', eventType);
+    }
+
+    const offset = (parseInt(page) - 1) * parseInt(limit);
+    const logs = await query.limit(parseInt(limit)).offset(offset);
+
+    // Get total count for pagination
+    let countQuery = db('security_logs')
+      .where('timestamp', '>', timeFilter.toISOString())
+      .count('* as total');
+
+    if (eventType) {
+      countQuery = countQuery.where('event_type', eventType);
+    }
+
+    const totalResult = await countQuery.first();
+    const total = parseInt(totalResult.total);
+
+    res.json({
+      logs: logs.map(log => ({
+        ...log,
+        details: log.details ? JSON.parse(log.details) : null
+      })),
+      pagination: {
+        page: parseInt(page),
+        limit: parseInt(limit),
+        total,
+        pages: Math.ceil(total / parseInt(limit))
+      }
+    });
+
+  } catch (error) {
+    logger.error('Error getting security logs', { error: error.message });
+    res.status(500).json({ error: 'Failed to get security logs' });
+  }
+});
+
+/**
+ * Get image access logs for a specific event
+ */
+router.get('/events/:eventId/access-logs', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { page = 1, limit = 50 } = req.query;
+
+    const offset = (parseInt(page) - 1) * parseInt(limit);
+
+    const logs = await db('image_access_logs')
+      .join('photos', 'image_access_logs.photo_id', 'photos.id')
+      .where('image_access_logs.event_id', eventId)
+      .select(
+        'image_access_logs.*',
+        'photos.filename'
+      )
+      .orderBy('image_access_logs.accessed_at', 'desc')
+      .limit(parseInt(limit))
+      .offset(offset);
+
+    const totalResult = await db('image_access_logs')
+      .where('event_id', eventId)
+      .count('* as total')
+      .first();
+
+    const total = parseInt(totalResult.total);
+
+    res.json({
+      logs: logs.map(log => ({
+        ...log,
+        metadata: log.metadata ? JSON.parse(log.metadata) : null
+      })),
+      pagination: {
+        page: parseInt(page),
+        limit: parseInt(limit),
+        total,
+        pages: Math.ceil(total / parseInt(limit))
+      }
+    });
+
+  } catch (error) {
+    logger.error('Error getting event access logs', { 
+      error: error.message, 
+      eventId: req.params.eventId 
+    });
+    res.status(500).json({ error: 'Failed to get access logs' });
+  }
+});
+
+/**
+ * Block/unblock suspicious IPs
+ */
+router.post('/block-ip', adminAuth, async (req, res) => {
+  try {
+    const { ip, action = 'block' } = req.body;
+    
+    if (!ip) {
+      return res.status(400).json({ error: 'IP address required' });
+    }
+
+    if (action === 'block') {
+      // Add to blocked IPs in middleware
+      secureImageMiddleware.suspiciousIPs.add(ip);
+      
+      logger.warn('IP manually blocked by admin', {
+        ip,
+        adminId: req.admin.id,
+        adminUsername: req.admin.username
+      });
+    } else if (action === 'unblock') {
+      // Remove from blocked IPs
+      secureImageMiddleware.suspiciousIPs.delete(ip);
+      
+      logger.info('IP manually unblocked by admin', {
+        ip,
+        adminId: req.admin.id,
+        adminUsername: req.admin.username
+      });
+    }
+
+    res.json({ 
+      message: `IP ${ip} ${action}ed successfully`,
+      action,
+      ip
+    });
+
+  } catch (error) {
+    logger.error('Error blocking/unblocking IP', { 
+      error: error.message,
+      adminId: req.admin.id 
+    });
+    res.status(500).json({ error: 'Failed to update IP status' });
+  }
+});
+
+/**
+ * Clear security logs older than specified time
+ */
+router.delete('/logs/cleanup', adminAuth, async (req, res) => {
+  try {
+    const { olderThan = '30d' } = req.body;
+    
+    let cutoffDate;
+    switch (olderThan) {
+      case '7d':
+        cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+        break;
+      case '30d':
+        cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+        break;
+      case '90d':
+        cutoffDate = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+        break;
+      default:
+        cutoffDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+    }
+
+    // Delete old security logs
+    const securityDeleted = await db('security_logs')
+      .where('timestamp', '<', cutoffDate.toISOString())
+      .del();
+
+    // Delete old image access logs
+    const accessDeleted = await db('image_access_logs')
+      .where('accessed_at', '<', cutoffDate.toISOString())
+      .del();
+
+    logger.info('Security logs cleanup completed', {
+      adminId: req.admin.id,
+      securityLogsDeleted: securityDeleted,
+      accessLogsDeleted: accessDeleted,
+      cutoffDate: cutoffDate.toISOString()
+    });
+
+    res.json({
+      message: 'Cleanup completed successfully',
+      deleted: {
+        securityLogs: securityDeleted,
+        accessLogs: accessDeleted
+      },
+      cutoffDate: cutoffDate.toISOString()
+    });
+
+  } catch (error) {
+    logger.error('Error cleaning up security logs', { 
+      error: error.message,
+      adminId: req.admin.id 
+    });
+    res.status(500).json({ error: 'Failed to cleanup logs' });
+  }
+});
+
+/**
+ * Export security data for analysis
+ */
+router.get('/export', adminAuth, async (req, res) => {
+  try {
+    const { format = 'json', timeframe = '7d' } = req.query;
+    
+    let timeFilter;
+    switch (timeframe) {
+      case '24h':
+        timeFilter = new Date(Date.now() - 86400000);
+        break;
+      case '7d':
+        timeFilter = new Date(Date.now() - 604800000);
+        break;
+      case '30d':
+        timeFilter = new Date(Date.now() - 2592000000);
+        break;
+      default:
+        timeFilter = new Date(Date.now() - 604800000);
+    }
+
+    // Get security logs
+    const securityLogs = await db('security_logs')
+      .where('timestamp', '>', timeFilter.toISOString())
+      .orderBy('timestamp', 'desc');
+
+    // Get image access logs
+    const accessLogs = await db('image_access_logs')
+      .where('accessed_at', '>', timeFilter.toISOString())
+      .orderBy('accessed_at', 'desc');
+
+    const exportData = {
+      exportDate: new Date().toISOString(),
+      timeframe,
+      securityLogs: securityLogs.map(log => ({
+        ...log,
+        details: log.details ? JSON.parse(log.details) : null
+      })),
+      accessLogs: accessLogs.map(log => ({
+        ...log,
+        metadata: log.metadata ? JSON.parse(log.metadata) : null
+      }))
+    };
+
+    if (format === 'csv') {
+      // Convert to CSV format (simplified)
+      const csv = convertToCSV(exportData);
+      res.set({
+        'Content-Type': 'text/csv',
+        'Content-Disposition': `attachment; filename="security-export-${timeframe}.csv"`
+      });
+      res.send(csv);
+    } else {
+      res.set({
+        'Content-Type': 'application/json',
+        'Content-Disposition': `attachment; filename="security-export-${timeframe}.json"`
+      });
+      res.json(exportData);
+    }
+
+    logger.info('Security data exported', {
+      adminId: req.admin.id,
+      format,
+      timeframe,
+      recordCount: exportData.securityLogs.length + exportData.accessLogs.length
+    });
+
+  } catch (error) {
+    logger.error('Error exporting security data', { 
+      error: error.message,
+      adminId: req.admin.id 
+    });
+    res.status(500).json({ error: 'Failed to export security data' });
+  }
+});
+
+/**
+ * Helper function to convert data to CSV
+ */
+function convertToCSV(data) {
+  // Simplified CSV conversion for security logs
+  const headers = ['timestamp', 'event_type', 'client_ip', 'details'];
+  const rows = data.securityLogs.map(log => [
+    log.timestamp,
+    log.event_type,
+    log.client_ip,
+    JSON.stringify(log.details || {})
+  ]);
+  
+  return [headers.join(','), ...rows.map(row => row.join(','))].join('\n');
+}
+
+module.exports = router;

backend/src/routes/adminNotifications.js

@@ -119,4 +119,18 @@ router.delete('/clear-old', adminAuth, async (req, res) => {
   }
 });
 
-module.exports = router;
+// Delete all notifications
+router.delete('/clear-all', adminAuth, async (req, res) => {
+  try {
+    const deletedCount = await db('activity_logs').delete();
+    res.json({
+      message: 'All notifications cleared',
+      deletedCount
+    });
+  } catch (error) {
+    console.error('Clear all notifications error:', error);
+    res.status(500).json({ error: 'Failed to clear notifications' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminPhotos.js

@@ -13,6 +13,24 @@ const router = express.Router();
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
+const parseCategoryId = (value) => {
+  if (value === undefined || value === null) return null;
+  if (typeof value === 'number' && Number.isInteger(value)) {
+    return value === 0 ? null : value;
+  }
+  if (typeof value === 'string') {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === 'null') return null;
+    if (/^\d+$/.test(trimmed)) {
+      const parsed = parseInt(trimmed, 10);
+      if (!Number.isNaN(parsed)) {
+        return parsed === 0 ? null : parsed;
+      }
+    }
+  }
+  return null;
+};
+
 // Configure multer for file uploads
 // IMPORTANT: Using synchronous functions to prevent file corruption
 const storage = multer.diskStorage({
@@ -158,23 +176,24 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
     }
     
     // Parse category_id to number if provided
-    const parsedCategoryId = category_id ? parseInt(category_id, 10) : null;
+    const numericCategoryId = parseCategoryId(category_id);
     
-    // Get category details if provided
-    let category = null;
-    if (parsedCategoryId) {
-      category = await db('photo_categories').where({ id: parsedCategoryId }).first();
-      if (!category) {
-        // Clean up temp files
-        if (req.tempUploadPath) {
-          try {
-            await fs.rm(req.tempUploadPath, { recursive: true, force: true });
-          } catch (e) {
-            console.error('Failed to clean up temp path:', e);
-          }
-        }
-        return res.status(400).json({ error: 'Invalid category' });
-      }
+    // Determine photo type from category_id parameter (for backwards compatibility)
+    let photoType = 'individual'; // default
+    let categoryName = 'individual';
+    
+    if (numericCategoryId === 1 || category_id === 'collage') {
+      photoType = 'collage';
+      categoryName = 'collages';
+    } else if (numericCategoryId === 2 || category_id === 'individual') {
+      photoType = 'individual';
+      categoryName = 'individual';
+    }
+    
+    // For backwards compatibility, accept string values
+    if (category_id === 'collage') {
+      photoType = 'collage';
+      categoryName = 'collages';
     }
     
     // Create final destination directory
@@ -194,22 +213,12 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
       const trx = await db.transaction();
       
       try {
-        // Get initial counter for this batch
-        let batchCounter = 1;
-        if (category) {
-          const categoryData = await trx('photo_categories')
-            .where({ id: parsedCategoryId })
-            .forUpdate()
-            .first();
-          batchCounter = (categoryData.photo_counter || 0) + 1;
-        } else {
-          const uncategorizedCount = await trx('photos')
-            .where({ event_id: eventId })
-            .whereNull('category_id')
-            .count('id as count')
-            .first();
-          batchCounter = (parseInt(uncategorizedCount.count) || 0) + 1;
-        }
+        // Get initial counter for this batch based on photo type
+        const existingCount = await trx('photos')
+          .where({ event_id: eventId, type: photoType })
+          .count('id as count')
+          .first();
+        let batchCounter = (parseInt(existingCount.count) || 0) + 1;
         
         const batchPhotos = [];
         const fileRenameOperations = []; // Store rename operations to do after commit
@@ -231,7 +240,7 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
             const extension = path.extname(file.originalname);
             const newFilename = generatePhotoFilename(
               event.event_name,
-              category ? category.name : 'uncategorized',
+              categoryName,
               counter,
               extension
             );
@@ -247,9 +256,10 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
               filename: newFilename,
               path: relativePath,
               thumbnail_path: null, // Will generate after successful commit
-              category_id: parsedCategoryId ? parseInt(parsedCategoryId) : null,
-              type: 'individual',
-              size_bytes: tempStats.size // Use actual file size from stat
+              type: photoType,
+              size_bytes: tempStats.size, // Use actual file size from stat
+              category_id: numericCategoryId,
+              source_origin: 'managed'
             };
             
             batchPhotos.push(photoData);
@@ -269,18 +279,11 @@ router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, nex
         
         // Insert all photos in this batch
         if (batchPhotos.length > 0) {
-          console.log(`Inserting batch of ${batchPhotos.length} photos with category_id: ${parsedCategoryId}`);
+          console.log(`Inserting batch of ${batchPhotos.length} photos with type: ${photoType}`);
           
           const insertedIds = await trx('photos').insert(batchPhotos).returning('id');
           
-          // Update category counter if needed
-          if (category && parsedCategoryId) {
-            const newCounter = batchCounter + batchPhotos.length - 1;
-            await trx('photo_categories')
-              .where({ id: parsedCategoryId })
-              .update({ photo_counter: newCounter });
-            console.log(`Updated category ${parsedCategoryId} counter to ${newCounter}`);
-          }
+          // No need to update counter as we calculate it dynamically
           
           // Commit the transaction first
           await trx.commit();
@@ -492,9 +495,11 @@ router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
     }
     
     // Update photo
+    const normalizedCategoryId = parseCategoryId(category_id);
+
     await db('photos')
       .where({ id: photoId })
-      .update({ category_id: category_id || null });
+      .update({ category_id: normalizedCategoryId });
     
     res.json({ message: 'Photo updated successfully' });
   } catch (error) {
@@ -595,7 +600,7 @@ router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
     // Update photos
     const updateData = {};
     if (updates.category_id !== undefined) {
-      updateData.category_id = updates.category_id || null;
+      updateData.category_id = parseCategoryId(updates.category_id);
     }
     
     await db('photos')
@@ -623,8 +628,9 @@ router.get('/:eventId/photos/:photoId/download', adminAuth, async (req, res) =>
       return res.status(404).json({ error: 'Photo not found' });
     }
     
-    const storagePath = getStoragePath();
-    const filePath = path.join(storagePath, 'events/active', photo.path);
+    const { resolvePhotoFilePath } = require('../services/photoResolver');
+    const event = await db('events').where('id', eventId).first();
+    const filePath = resolvePhotoFilePath(event, photo);
     
     // Check if file exists
     try {
@@ -648,20 +654,24 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     const { category_id, type, search, sort = 'date', order = 'desc' } = req.query;
     
     let query = db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .leftJoin('photo_categories as pc', 'pc.id', 'photos.category_id')
       .where({ 'photos.event_id': eventId })
       .select(
         'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
+        'pc.name as category_display_name',
+        'pc.slug as category_display_slug'
       );
     
-    // Filter by category (including uncategorized)
+    // Filter by type (individual/collage) - category_id maps to type
     if (category_id !== undefined) {
-      if (category_id === '' || category_id === '0') {
+      if (category_id === '') {
+        // No filter when empty string is provided
+      } else if (category_id === '0') {
         query = query.whereNull('photos.category_id');
-      } else {
-        query = query.where({ 'photos.category_id': category_id });
+      } else if (/^\d+$/.test(category_id)) {
+        query = query.where('photos.category_id', parseInt(category_id, 10));
+      } else if (category_id === 'individual' || category_id === 'collage') {
+        query = query.where({ 'photos.type': category_id });
       }
     }
     
@@ -685,19 +695,48 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     }
     
     const photos = await query.orderBy(orderByColumn, order);
+
+    if (photos.length === 0) {
+      return res.json({ photos: [] });
+    }
+
+    // Get comment counts separately
+    const commentCounts = await db('photo_feedback')
+      .whereIn('photo_id', photos.map(p => p.id))
+      .where('feedback_type', 'comment')
+      .where('is_approved', true)
+      .where('is_hidden', false)
+      .groupBy('photo_id')
+      .select('photo_id', db.raw('COUNT(*) as comment_count'));
+    
+    // Create a map for quick lookup
+    const commentMap = {};
+    commentCounts.forEach(c => {
+      commentMap[c.photo_id] = parseInt(c.comment_count);
+    });
     
     res.json({
       photos: photos.map(photo => ({
         id: photo.id,
         filename: photo.filename,
-        url: `/admin/events/${eventId}/photo/${photo.id}`,
-        thumbnail_url: photo.thumbnail_path ? `/admin/events/${eventId}/thumbnail/${photo.id}` : null,
+        // Use the correct admin photos router base for serving images
+        url: `/admin/photos/${eventId}/photo/${photo.id}`,
+        // Always expose a thumbnail URL; backend will generate on demand if missing
+        thumbnail_url: `/admin/photos/${eventId}/thumbnail/${photo.id}`,
         type: photo.type,
-        category_id: photo.category_id,
-        category_name: photo.category_name,
-        category_slug: photo.category_slug,
+        category_id: photo.category_id !== null && photo.category_id !== undefined
+          ? Number(photo.category_id)
+          : null,
+        category_name: photo.category_display_name || (photo.type === 'individual' ? 'Individual Photos' : 'Collages'),
+        category_slug: photo.category_display_slug || photo.type,
         size: photo.size_bytes,
-        uploaded_at: photo.uploaded_at
+        uploaded_at: photo.uploaded_at,
+        // Feedback data
+        has_feedback: (commentMap[photo.id] > 0 || photo.average_rating > 0 || photo.like_count > 0),
+        average_rating: photo.average_rating || 0,
+        comment_count: commentMap[photo.id] || 0,
+        like_count: photo.like_count || 0,
+        favorite_count: photo.favorite_count || 0
       }))
     });
   } catch (error) {
@@ -719,8 +758,9 @@ router.get('/:eventId/photo/:photoId', adminAuth, async (req, res) => {
       return res.status(404).json({ error: 'Photo not found' });
     }
     
-    const storagePath = getStoragePath();
-    const filePath = path.join(storagePath, 'events/active', photo.path);
+    const { resolvePhotoFilePath } = require('../services/photoResolver');
+    const event = await db('events').where('id', eventId).first();
+    const filePath = resolvePhotoFilePath(event, photo);
     
     // Check if file exists
     try {
@@ -798,8 +838,9 @@ router.get('/:eventId/debug', adminAuth, async (req, res) => {
       storagePath: getStoragePath()
     });
   } catch (error) {
-    res.status(500).json({ error: error.message });
+    console.error('Error fetching admin photo debug data:', error);
+    res.status(500).json({ error: 'Failed to fetch photo debug data' });
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminRestore.js

@@ -82,7 +82,7 @@ router.post('/validate', [
     logger.error('Restore validation failed:', error);
     res.status(400).json({
       success: false,
-      error: error.message,
+      error: 'Restore validation failed',
       logs: restoreService.restoreLog
     });
   }
@@ -162,7 +162,7 @@ router.post('/start', [
     logger.error('Failed to start restore:', error);
     res.status(500).json({
       success: false,
-      error: error.message
+      error: 'Failed to start restore operation'
     });
   }
 });
@@ -458,4 +458,4 @@ async function getBackupConfig() {
   return config;
 }
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminSettings.js

@@ -8,12 +8,24 @@ const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth');
 const { clearMaintenanceCache } = require('../middleware/maintenance');
 const { clearSettingsCache } = require('../services/rateLimitService');
+const {
+  DEFAULT_PUBLIC_SITE_HTML,
+  DEFAULT_PUBLIC_SITE_CSS,
+} = require('../constants/publicSiteDefaults');
+const {
+  clearPublicSiteCache,
+  getDefaultPublicSitePayload,
+  getRawPublicSiteSettings,
+} = require('../services/publicSiteService');
+const { sanitizeCss } = require('../utils/cssSanitizer');
 const router = express.Router();
 
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
 // Configure multer for logo uploads
 const storage = multer.diskStorage({
   destination: async (req, file, cb) => {
-    const uploadDir = path.join(__dirname, '../../storage/uploads/logos');
+    const uploadDir = path.join(getStoragePath(), 'uploads/logos');
     await fs.mkdir(uploadDir, { recursive: true });
     cb(null, uploadDir);
   },
@@ -43,7 +55,7 @@ const upload = multer({
 // Configure multer for favicon uploads
 const faviconStorage = multer.diskStorage({
   destination: async (req, file, cb) => {
-    const uploadDir = path.join(__dirname, '../../storage/uploads/favicons');
+    const uploadDir = path.join(getStoragePath(), 'uploads/favicons');
     await fs.mkdir(uploadDir, { recursive: true });
     cb(null, uploadDir);
   },
@@ -135,6 +147,27 @@ router.get('/:type', adminAuth, async (req, res) => {
   }
 });
 
+// Get password complexity settings for frontend
+router.get('/password/complexity', adminAuth, async (req, res) => {
+  try {
+    const { getPasswordComplexitySettings, getPasswordConfigForComplexity } = require('../utils/passwordValidation');
+    
+    // Get current complexity level from database
+    const complexityLevel = await getPasswordComplexitySettings();
+    
+    // Get configuration for the complexity level
+    const config = getPasswordConfigForComplexity(complexityLevel);
+    
+    res.json({
+      complexityLevel,
+      config
+    });
+  } catch (error) {
+    console.error('Password complexity settings fetch error:', error);
+    res.status(500).json({ error: 'Failed to fetch password complexity settings' });
+  }
+});
+
 // Update branding settings
 router.put('/branding', adminAuth, async (req, res) => {
   try {
@@ -149,7 +182,13 @@ router.put('/branding', adminAuth, async (req, res) => {
       watermark_size,
       favicon_url,
       logo_url,
-      watermark_logo_url
+      watermark_logo_url,
+      logo_size,
+      logo_max_height,
+      logo_position,
+      logo_display_header,
+      logo_display_hero,
+      logo_display_mode
     } = req.body;
 
     const brandingSettings = {
@@ -163,7 +202,13 @@ router.put('/branding', adminAuth, async (req, res) => {
       watermark_size,
       favicon_url,
       logo_url,
-      watermark_logo_url
+      watermark_logo_url,
+      logo_size,
+      logo_max_height,
+      logo_position,
+      logo_display_header,
+      logo_display_hero,
+      logo_display_mode
     };
 
     // Handle favicon deletion if empty string or null is provided
@@ -185,7 +230,8 @@ router.put('/branding', adminAuth, async (req, res) => {
         
         if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
           // Delete the file from filesystem
-          const faviconPath = path.join(__dirname, '..', '..', 'storage', currentFaviconUrl.replace('/uploads/', ''));
+          const relativePath = currentFaviconUrl.replace(/^\//, '');
+          const faviconPath = path.join(getStoragePath(), relativePath);
           try {
             await fs.unlink(faviconPath);
             console.log('Deleted favicon file:', faviconPath);
@@ -215,7 +261,8 @@ router.put('/branding', adminAuth, async (req, res) => {
         
         if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
           // Delete the file from filesystem
-          const logoPath = path.join(__dirname, '..', '..', 'storage', currentLogoUrl.replace('/uploads/', ''));
+          const relativePath = currentLogoUrl.replace(/^\//, '');
+          const logoPath = path.join(getStoragePath(), relativePath);
           try {
             await fs.unlink(logoPath);
             console.log('Deleted logo file:', logoPath);
@@ -251,6 +298,8 @@ router.put('/branding', adminAuth, async (req, res) => {
       metadata: JSON.stringify({ company_name })
     });
 
+    clearPublicSiteCache();
+
     res.json({ message: 'Branding settings updated successfully' });
   } catch (error) {
     console.error('Branding update error:', error);
@@ -410,6 +459,8 @@ router.put('/theme', adminAuth, async (req, res) => {
       metadata: JSON.stringify({ theme_name: themeSettings.name || 'custom' })
     });
 
+    clearPublicSiteCache();
+
     res.json({ message: 'Theme settings updated successfully' });
   } catch (error) {
     console.error('Theme update error:', error);
@@ -420,7 +471,39 @@ router.put('/theme', adminAuth, async (req, res) => {
 // Update general settings
 router.put('/general', adminAuth, async (req, res) => {
   try {
-    const settings = req.body;
+    const settings = { ...req.body };
+
+    const publicSiteKeysTouched = Object.keys(settings).some((key) => key.startsWith('general_public_site_'));
+
+    if (publicSiteKeysTouched) {
+      if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_custom_css')) {
+        settings.general_public_site_custom_css = sanitizeCss(settings.general_public_site_custom_css || '');
+      }
+
+      if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_html') && typeof settings.general_public_site_html === 'string') {
+        settings.general_public_site_html = settings.general_public_site_html.trim();
+      }
+
+      if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_enabled')) {
+        settings.general_public_site_enabled = formatBoolean(settings.general_public_site_enabled);
+      }
+
+      const enableToggle = settings.general_public_site_enabled;
+      if (enableToggle === true) {
+        let htmlValue = settings.general_public_site_html;
+
+        if (htmlValue === undefined) {
+          const currentSettings = await getRawPublicSiteSettings();
+          htmlValue = currentSettings.general_public_site_html;
+        }
+
+        if (!htmlValue || !String(htmlValue).trim()) {
+          return res.status(400).json({
+            error: 'Public site HTML must be provided before enabling the public landing page.'
+          });
+        }
+      }
+    }
 
     // Update or insert each setting
     for (const [key, value] of Object.entries(settings)) {
@@ -443,6 +526,10 @@ router.put('/general', adminAuth, async (req, res) => {
       clearMaintenanceCache();
     }
 
+    if (publicSiteKeysTouched) {
+      clearPublicSiteCache();
+    }
+
     // Log activity
     await db('activity_logs').insert({
       activity_type: 'general_settings_updated',
@@ -560,7 +647,7 @@ router.get('/storage/info', adminAuth, async (req, res) => {
     for (const archive of archives) {
       if (archive.archive_path) {
         try {
-          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+          const storagePath = getStoragePath();
           const fullArchivePath = path.join(storagePath, archive.archive_path);
           const stats = await fs.stat(fullArchivePath);
           archiveStorage += stats.size;
@@ -570,11 +657,190 @@ router.get('/storage/info', adminAuth, async (req, res) => {
       }
     }
 
+    const DEFAULT_SOFT_LIMIT_BYTES = 10 * 1024 * 1024 * 1024; // 10GB fallback
+    const storagePath = getStoragePath();
+
+    let diskStats = null;
+    let rawDiskTotal = null;
+    let rawDiskFree = null;
+    let rawDiskAvailable = null;
+    try {
+      diskStats = await fs.statfs(storagePath);
+      rawDiskTotal = Number(diskStats.bsize) * Number(diskStats.blocks);
+      rawDiskFree = Number(diskStats.bsize) * Number(diskStats.bfree);
+      rawDiskAvailable = Number(diskStats.bsize) * Number(diskStats.bavail);
+    } catch (diskError) {
+      console.error('Disk stats error:', diskError.message);
+    }
+
+    const clampDiskValue = (value) => {
+      if (!Number.isFinite(value) || value <= 0) {
+        return null;
+      }
+
+      // Treat unusually large virtualised values as unreliable (>50TB)
+      const MAX_REASONABLE_BYTES = 50 * 1024 * 1024 * 1024 * 1024;
+      if (value > MAX_REASONABLE_BYTES) {
+        return null;
+      }
+
+      return value;
+    };
+
+    let diskTotal = null;
+    let diskFree = null;
+    let diskAvailable = null;
+
+    if (diskStats) {
+      diskTotal = clampDiskValue(rawDiskTotal);
+      diskFree = clampDiskValue(rawDiskFree);
+      diskAvailable = clampDiskValue(rawDiskAvailable);
+
+      if (diskTotal && diskAvailable && diskAvailable > diskTotal) {
+        diskAvailable = null;
+      }
+      if (diskTotal && diskFree && diskFree > diskTotal) {
+        diskFree = null;
+      }
+    }
+
+    const totalUsed = totalStorage?.total || 0;
+
+    const parseBytesValue = (value) => {
+      const numeric = Number(value);
+      if (!Number.isFinite(numeric) || numeric <= 0) {
+        return null;
+      }
+      return Math.floor(numeric);
+    };
+
+    const parseEnvOverride = (bytesVar, gbVar) => {
+      if (process.env[bytesVar]) {
+        return parseBytesValue(process.env[bytesVar]);
+      }
+      if (process.env[gbVar]) {
+        const value = parseBytesValue(process.env[gbVar]);
+        return value ? value * 1024 * 1024 * 1024 : null;
+      }
+      return null;
+    };
+
+    let configuredSoftLimit = null;
+    let capacityOverrideDb = null;
+    let availableOverrideDb = null;
+
+    try {
+      const storageSettings = await db('app_settings')
+        .whereIn('setting_key', [
+          'general_storage_soft_limit_bytes',
+          'general_storage_capacity_override_bytes',
+          'general_storage_available_override_bytes'
+        ])
+        .select('setting_key', 'setting_value');
+
+      storageSettings.forEach((setting) => {
+        let parsedValue = null;
+        if (setting.setting_value) {
+          try {
+            parsedValue = JSON.parse(setting.setting_value);
+          } catch (error) {
+            parsedValue = setting.setting_value;
+          }
+        }
+
+        switch (setting.setting_key) {
+          case 'general_storage_soft_limit_bytes':
+            if (typeof parsedValue === 'number' && !Number.isNaN(parsedValue)) {
+              configuredSoftLimit = parsedValue;
+            }
+            break;
+          case 'general_storage_capacity_override_bytes':
+            if (typeof parsedValue === 'number' && !Number.isNaN(parsedValue)) {
+              capacityOverrideDb = parsedValue;
+            }
+            break;
+          case 'general_storage_available_override_bytes':
+            if (typeof parsedValue === 'number' && !Number.isNaN(parsedValue)) {
+              availableOverrideDb = parsedValue;
+            }
+            break;
+          default:
+            break;
+        }
+      });
+    } catch (error) {
+      console.error('Storage settings read error:', error.message);
+    }
+
+    const capacityOverrideEnv = parseEnvOverride('STORAGE_CAPACITY_OVERRIDE_BYTES', 'STORAGE_CAPACITY_OVERRIDE_GB');
+    const availableOverrideEnv = parseEnvOverride('STORAGE_AVAILABLE_OVERRIDE_BYTES', 'STORAGE_AVAILABLE_OVERRIDE_GB');
+
+    let capacityOverrideBytes = null;
+    let availableOverrideBytes = null;
+    let overrideSource = null;
+
+    if (capacityOverrideEnv != null || availableOverrideEnv != null) {
+      capacityOverrideBytes = capacityOverrideEnv;
+      availableOverrideBytes = availableOverrideEnv;
+      overrideSource = 'env';
+    } else if (capacityOverrideDb != null || availableOverrideDb != null) {
+      capacityOverrideBytes = capacityOverrideDb;
+      availableOverrideBytes = availableOverrideDb;
+      overrideSource = 'settings';
+    }
+
+    if (capacityOverrideBytes != null) {
+      diskTotal = capacityOverrideBytes;
+      if (availableOverrideBytes == null) {
+        diskAvailable = Math.max(capacityOverrideBytes - totalUsed, 0);
+      } else {
+        diskAvailable = Math.min(Math.max(availableOverrideBytes, 0), capacityOverrideBytes);
+      }
+      diskFree = diskAvailable;
+    } else if (availableOverrideBytes != null) {
+      diskAvailable = Math.max(availableOverrideBytes, 0);
+      diskFree = diskAvailable;
+    }
+
+    let recommendedSoftLimit = null;
+    if (diskTotal && diskAvailable) {
+      const projected = totalUsed + Math.floor(diskAvailable * 0.8);
+      recommendedSoftLimit = Math.min(diskTotal, Math.max(projected, Math.floor(diskTotal * 0.5)));
+    } else if (diskTotal) {
+      recommendedSoftLimit = Math.floor(diskTotal * 0.8);
+    } else if (diskAvailable) {
+      recommendedSoftLimit = Math.max(totalUsed, totalUsed + Math.floor(diskAvailable * 0.8));
+    }
+
+    if (recommendedSoftLimit && totalUsed > 0 && recommendedSoftLimit < totalUsed) {
+      recommendedSoftLimit = totalUsed;
+    }
+
+    const fallbackSoftLimit = recommendedSoftLimit || diskTotal || DEFAULT_SOFT_LIMIT_BYTES;
+    if (!recommendedSoftLimit && fallbackSoftLimit) {
+      recommendedSoftLimit = fallbackSoftLimit;
+    }
+    const effectiveSoftLimit = configuredSoftLimit || fallbackSoftLimit || DEFAULT_SOFT_LIMIT_BYTES;
+
+    const diskMetricsReliable = Boolean(diskTotal);
+
     res.json({
-      total_used: totalStorage.total || 0,
+      total_used: totalUsed,
       archive_storage: archiveStorage,
       storage_by_event: storageByEvent,
-      storage_limit: 10 * 1024 * 1024 * 1024 // 10GB default
+      storage_limit: effectiveSoftLimit,
+      storage_soft_limit: effectiveSoftLimit,
+      configured_soft_limit: configuredSoftLimit,
+      recommended_soft_limit: recommendedSoftLimit,
+      soft_limit_configured: Boolean(configuredSoftLimit),
+      disk_total: diskTotal,
+      disk_free: diskFree,
+      disk_available: diskAvailable,
+      disk_total_raw: rawDiskTotal,
+      disk_free_raw: rawDiskFree,
+      disk_available_raw: rawDiskAvailable,
+      disk_metrics_reliable: diskMetricsReliable,
+      disk_override_source: overrideSource
     });
   } catch (error) {
     console.error('Storage info error:', error);
@@ -684,4 +950,79 @@ router.put('/security/rate-limit', adminAuth, [
   }
 });
 
-module.exports = router;
+// Get default public site template
+router.get('/public-site/default', adminAuth, async (req, res) => {
+  try {
+    const defaults = await getDefaultPublicSitePayload();
+
+    res.json({
+      enabled: false,
+      html: DEFAULT_PUBLIC_SITE_HTML.trim(),
+      css: '',
+      baseCss: DEFAULT_PUBLIC_SITE_CSS.trim(),
+      branding: defaults.branding,
+      meta: {
+        title: defaults.title,
+      }
+    });
+  } catch (error) {
+    console.error('Failed to load public site defaults:', error);
+    res.status(500).json({ error: 'Failed to load defaults' });
+  }
+});
+
+// Reset public site template to defaults
+router.post('/public-site/reset', adminAuth, async (req, res) => {
+  try {
+    const entries = [
+      {
+        key: 'general_public_site_html',
+        value: DEFAULT_PUBLIC_SITE_HTML.trim()
+      },
+      {
+        key: 'general_public_site_custom_css',
+        value: ''
+      }
+    ];
+
+    for (const { key, value } of entries) {
+      await db('app_settings')
+        .insert({
+          setting_key: key,
+          setting_value: JSON.stringify(value),
+          setting_type: 'general',
+          updated_at: new Date()
+        })
+        .onConflict('setting_key')
+        .merge({
+          setting_value: JSON.stringify(value),
+          updated_at: new Date()
+        });
+    }
+
+    clearPublicSiteCache();
+
+    const defaults = await getDefaultPublicSitePayload();
+
+    await logActivity('public_site_reset_to_default',
+      {
+        template_length: DEFAULT_PUBLIC_SITE_HTML.length,
+      },
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+
+    res.json({
+      message: 'Public site template reset to defaults',
+      html: DEFAULT_PUBLIC_SITE_HTML.trim(),
+      css: '',
+      baseCss: DEFAULT_PUBLIC_SITE_CSS.trim(),
+      branding: defaults.branding
+    });
+  } catch (error) {
+    console.error('Failed to reset public site template:', error);
+    res.status(500).json({ error: 'Failed to reset template' });
+  }
+});
+
+module.exports = router;

backend/src/routes/adminSystem.js

@@ -5,6 +5,7 @@ const fs = require('fs').promises;
 const path = require('path');
 const os = require('os');
 const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');
 const router = express.Router();
 
 // Get system version
@@ -208,10 +209,14 @@ router.get('/database', adminAuth, async (req, res) => {
         });
       } catch (error) {
         // Table might not exist
+        logger.warn('Failed to retrieve table info', {
+          table,
+          error: error.message
+        });
         tableInfo.push({
           name: table,
           rows: 0,
-          error: error.message
+          error: 'Unable to retrieve table details'
         });
       }
     }
@@ -226,4 +231,4 @@ router.get('/database', adminAuth, async (req, res) => {
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/adminThumbnails.js

@@ -0,0 +1,188 @@
+const express = require('express');
+const router = express.Router();
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const { generateThumbnail } = require('../services/imageProcessor');
+const path = require('path');
+const fs = require('fs').promises;
+const logger = require('../utils/logger');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+// Get thumbnail settings
+router.get('/settings', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings')
+      .whereIn('key', [
+        'thumbnail_width',
+        'thumbnail_height',
+        'thumbnail_fit',
+        'thumbnail_quality',
+        'thumbnail_format'
+      ])
+      .select('key', 'value', 'description');
+    
+    const settingsMap = {};
+    settings.forEach(s => {
+      settingsMap[s.key] = {
+        value: s.value,
+        description: s.description
+      };
+    });
+    
+    res.json({
+      settings: settingsMap,
+      fitOptions: ['cover', 'contain', 'fill', 'inside', 'outside'],
+      formatOptions: ['jpeg', 'png', 'webp']
+    });
+  } catch (error) {
+    logger.error('Error fetching thumbnail settings:', error);
+    res.status(500).json({ error: 'Failed to fetch thumbnail settings' });
+  }
+});
+
+// Update thumbnail settings
+router.put('/settings', adminAuth, async (req, res) => {
+  try {
+    const { width, height, fit, quality, format } = req.body;
+    
+    // Validate inputs
+    if (width && (width < 50 || width > 1000)) {
+      return res.status(400).json({ error: 'Width must be between 50 and 1000 pixels' });
+    }
+    if (height && (height < 50 || height > 1000)) {
+      return res.status(400).json({ error: 'Height must be between 50 and 1000 pixels' });
+    }
+    if (quality && (quality < 1 || quality > 100)) {
+      return res.status(400).json({ error: 'Quality must be between 1 and 100' });
+    }
+    if (fit && !['cover', 'contain', 'fill', 'inside', 'outside'].includes(fit)) {
+      return res.status(400).json({ error: 'Invalid fit option' });
+    }
+    if (format && !['jpeg', 'png', 'webp'].includes(format)) {
+      return res.status(400).json({ error: 'Invalid format option' });
+    }
+    
+    // Update settings
+    const updates = [];
+    if (width) updates.push({ key: 'thumbnail_width', value: width.toString() });
+    if (height) updates.push({ key: 'thumbnail_height', value: height.toString() });
+    if (fit) updates.push({ key: 'thumbnail_fit', value: fit });
+    if (quality) updates.push({ key: 'thumbnail_quality', value: quality.toString() });
+    if (format) updates.push({ key: 'thumbnail_format', value: format });
+    
+    for (const update of updates) {
+      await db('app_settings')
+        .where('key', update.key)
+        .update({
+          value: update.value,
+          updated_at: db.fn.now()
+        });
+    }
+    
+    res.json({ 
+      message: 'Thumbnail settings updated successfully',
+      regenerateRequired: true 
+    });
+  } catch (error) {
+    logger.error('Error updating thumbnail settings:', error);
+    res.status(500).json({ error: 'Failed to update thumbnail settings' });
+  }
+});
+
+// Regenerate all thumbnails with new settings
+router.post('/regenerate', adminAuth, async (req, res) => {
+  try {
+    const { eventId } = req.body; // Optional: regenerate for specific event only
+    
+    let query = db('photos').select('id', 'event_id', 'path');
+    if (eventId) {
+      query = query.where('event_id', eventId);
+    }
+    
+    const photos = await query;
+    
+    if (photos.length === 0) {
+      return res.json({ message: 'No photos to regenerate' });
+    }
+    
+    // Start regeneration in background
+    res.json({ 
+      message: `Started regenerating ${photos.length} thumbnails`,
+      count: photos.length 
+    });
+    
+    // Process thumbnails in background
+    setImmediate(async () => {
+      let successCount = 0;
+      let errorCount = 0;
+      
+      for (const photo of photos) {
+        try {
+          const storagePath = getStoragePath();
+          const originalPath = path.join(storagePath, 'events/active', photo.path);
+          
+          // Check if original file exists
+          try {
+            await fs.access(originalPath);
+          } catch (err) {
+            logger.warn(`Original file not found for photo ${photo.id}: ${originalPath}`);
+            errorCount++;
+            continue;
+          }
+          
+          // Regenerate thumbnail
+          const thumbnailPath = await generateThumbnail(originalPath, { regenerate: true });
+          
+          if (thumbnailPath) {
+            // Update database with new thumbnail path
+            await db('photos')
+              .where({ id: photo.id })
+              .update({ 
+                thumbnail_path: thumbnailPath,
+                updated_at: db.fn.now()
+              });
+            
+            successCount++;
+            logger.info(`Regenerated thumbnail for photo ${photo.id}`);
+          } else {
+            errorCount++;
+          }
+        } catch (error) {
+          logger.error(`Error regenerating thumbnail for photo ${photo.id}:`, error);
+          errorCount++;
+        }
+      }
+      
+      logger.info(`Thumbnail regeneration complete: ${successCount} success, ${errorCount} errors`);
+    });
+    
+  } catch (error) {
+    logger.error('Error starting thumbnail regeneration:', error);
+    res.status(500).json({ error: 'Failed to start thumbnail regeneration' });
+  }
+});
+
+// Get regeneration status
+router.get('/regenerate/status', adminAuth, async (req, res) => {
+  try {
+    // Count photos with and without thumbnails
+    const totalPhotos = await db('photos').count('id as count').first();
+    const photosWithThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .count('id as count')
+      .first();
+    
+    res.json({
+      total: totalPhotos.count,
+      withThumbnails: photosWithThumbnails.count,
+      withoutThumbnails: totalPhotos.count - photosWithThumbnails.count,
+      percentage: Math.round((photosWithThumbnails.count / totalPhotos.count) * 100)
+    });
+  } catch (error) {
+    logger.error('Error fetching regeneration status:', error);
+    res.status(500).json({ error: 'Failed to fetch regeneration status' });
+  }
+});
+
+module.exports = router;

backend/src/routes/auth-enhanced-v2.js

@@ -220,7 +220,7 @@ router.post('/logout', async (req, res) => {
 // Gallery password verification with enhanced security
 router.post('/gallery/verify', [
   body('slug').notEmpty().trim(),
-  body('password').notEmpty()
+  body('password').optional().isString()
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
@@ -232,53 +232,69 @@ router.post('/gallery/verify', [
     const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
     
-    // Check gallery-specific lockout
-    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
-      return res.status(423).json({ 
-        error: 'Too many failed attempts. Please try again later.',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
     const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    const requiresPassword = !(event && (event.require_password === false || event.require_password === 0 || event.require_password === '0'));
+
+    if (requiresPassword) {
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      if (lockoutStatus.isLocked) {
+        logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+        return res.status(423).json({ 
+          error: 'Too many failed attempts. Please try again later.',
+          retryAfter: lockoutStatus.remainingTime
+        });
+      }
+
+      const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+      if (!recaptchaValid) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+      }
+    }
+
     if (!event) {
       // Don't reveal if gallery exists
       await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
       return res.status(401).json({ error: 'Invalid gallery or password' });
     }
-    
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+
+    if (requiresPassword) {
+      if (!password) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        return res.status(401).json({ error: 'Invalid gallery or password' });
+      }
+
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: ipAddress,
+          user_agent: userAgent,
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid gallery or password' });
+      }
+
+      await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+
       await db('access_logs').insert({
         event_id: event.id,
         ip_address: ipAddress,
         user_agent: userAgent,
-        action: 'login_fail'
+        action: 'login_success'
+      });
+    } else {
+      logger.info('Public gallery access granted without password', { slug, ipAddress });
+      await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_success'
       });
-      return res.status(401).json({ error: 'Invalid gallery or password' });
     }
     
-    // Successful access
-    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
-    
-    // Log successful access
-    await db('access_logs').insert({
-      event_id: event.id,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      action: 'login_success'
-    });
-    
     // Generate session token with additional security info
     const token = jwt.sign({ 
       eventId: event.id, 
@@ -302,7 +318,8 @@ router.post('/gallery/verify', [
         color_theme: event.color_theme,
         expires_at: event.expires_at,
         allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id
+        upload_category_id: event.upload_category_id,
+        require_password: requiresPassword
       }
     });
   } catch (error) {
@@ -372,4 +389,4 @@ router.post('/password-strength', [
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/auth-enhanced.js

@@ -14,6 +14,14 @@ const {
 } = require('../utils/authSecurity');
 const { endSession } = require('../middleware/sessionTimeout');
 const logger = require('../utils/logger');
+const {
+  setAdminAuthCookie,
+  clearAdminAuthCookie,
+  setGalleryAuthCookies,
+  clearGalleryAuthCookies,
+  getAdminTokenFromRequest,
+  getGalleryTokenFromRequest,
+} = require('../utils/tokenUtils');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -91,6 +99,8 @@ router.post('/admin/login', [
       expiresIn: '24h',
       issuer: 'picpeak-auth'
     });
+
+    setAdminAuthCookie(res, token);
     
     res.json({
       token,
@@ -110,13 +120,14 @@ router.post('/admin/login', [
 // Logout endpoint
 router.post('/logout', async (req, res) => {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
-    
+    const adminToken = getAdminTokenFromRequest(req);
+    const galleryToken = getGalleryTokenFromRequest(req);
+    const token = adminToken || galleryToken;
+
     if (token) {
       // End the session
       endSession(token);
-      
-      // Log the logout
+
       try {
         const decoded = jwt.verify(token, process.env.JWT_SECRET);
         logger.info('User logged out', { 
@@ -124,11 +135,23 @@ router.post('/logout', async (req, res) => {
           username: decoded.username,
           type: decoded.type
         });
+
+        if (decoded.type === 'admin') {
+          clearAdminAuthCookie(res);
+        } else if (decoded.type === 'gallery') {
+          clearGalleryAuthCookies(res, decoded.eventSlug);
+        }
       } catch (err) {
-        // Token might be invalid, but still process logout
+        // Token might be invalid, but still process logout and clear cookies
+        clearAdminAuthCookie(res);
+        clearGalleryAuthCookies(res);
       }
+    } else {
+      // No token found, but ensure cookies are cleared
+      clearAdminAuthCookie(res);
+      clearGalleryAuthCookies(res);
     }
-    
+
     res.json({ message: 'Logged out successfully' });
   } catch (error) {
     logger.error('Logout error:', error);
@@ -139,7 +162,7 @@ router.post('/logout', async (req, res) => {
 // Gallery password verification with enhanced security
 router.post('/gallery/verify', [
   body('slug').notEmpty().trim(),
-  body('password').notEmpty()
+  body('password').optional().isString()
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
@@ -150,55 +173,68 @@ router.post('/gallery/verify', [
     const { slug, password, recaptchaToken } = req.body;
     const ipAddress = req.ip || req.connection.remoteAddress;
     const userAgent = req.headers['user-agent'] || '';
-    
-    // Check gallery-specific lockout
-    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
-    if (lockoutStatus.isLocked) {
-      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
-      return res.status(423).json({ 
-        error: 'Too many failed attempts. Please try again later.',
-        retryAfter: lockoutStatus.remainingTime
-      });
-    }
-    
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
-    
-    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    const event = await db('events')
+      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
+      .first();
+
     if (!event) {
-      // Don't reveal if gallery exists
       await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
       return res.status(401).json({ error: 'Invalid gallery or password' });
     }
-    
-    const validPassword = await bcrypt.compare(password, event.password_hash);
-    if (!validPassword) {
-      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
+    if (requiresPassword) {
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      if (lockoutStatus.isLocked) {
+        logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+        return res.status(423).json({ 
+          error: 'Too many failed attempts. Please try again later.',
+          retryAfter: lockoutStatus.remainingTime
+        });
+      }
+
+      const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+      if (!recaptchaValid) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+      }
+
+      if (!password) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        return res.status(401).json({ error: 'Invalid gallery or password' });
+      }
+
+      const validPassword = await bcrypt.compare(password, event.password_hash);
+      if (!validPassword) {
+        await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+        await db('access_logs').insert({
+          event_id: event.id,
+          ip_address: ipAddress,
+          user_agent: userAgent,
+          action: 'login_fail'
+        });
+        return res.status(401).json({ error: 'Invalid gallery or password' });
+      }
+
+      await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
       await db('access_logs').insert({
         event_id: event.id,
         ip_address: ipAddress,
         user_agent: userAgent,
-        action: 'login_fail'
+        action: 'login_success'
+      });
+    } else {
+      logger.info('Public gallery access granted without password', { slug, ipAddress });
+      await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_success'
       });
-      return res.status(401).json({ error: 'Invalid gallery or password' });
     }
-    
-    // Successful access
-    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
-    
-    // Log successful access
-    await db('access_logs').insert({
-      event_id: event.id,
-      ip_address: ipAddress,
-      user_agent: userAgent,
-      action: 'login_success'
-    });
-    
-    // Generate session token with additional security info
+
     const token = jwt.sign({ 
       eventId: event.id, 
       eventSlug: event.slug,
@@ -209,6 +245,8 @@ router.post('/gallery/verify', [
       expiresIn: '24h',
       issuer: 'picpeak-auth'
     });
+
+    setGalleryAuthCookies(res, token, event.slug);
     
     res.json({
       token,
@@ -221,7 +259,8 @@ router.post('/gallery/verify', [
         color_theme: event.color_theme,
         expires_at: event.expires_at,
         allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id
+        upload_category_id: event.upload_category_id,
+        require_password: requiresPassword
       }
     });
   } catch (error) {
@@ -230,15 +269,97 @@ router.post('/gallery/verify', [
   }
 });
 
+// Share link authentication (token-based)
+router.post('/gallery/share-login', [
+  body('slug').notEmpty().trim(),
+  body('token').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { slug, token } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+
+    const event = await db('events')
+      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
+      .first();
+
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+
+    let expectedToken = event.share_link;
+    if (expectedToken && expectedToken.includes('/')) {
+      expectedToken = expectedToken.split('/').pop();
+    }
+
+    if (!expectedToken || token !== expectedToken) {
+      return res.status(401).json({ error: 'Invalid or expired share link' });
+    }
+
+    const jwtToken = jwt.sign({
+      eventId: event.id,
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, {
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+
+    await trackSuccessfulLogin(`gallery:${slug}:share`, ipAddress, userAgent);
+    setGalleryAuthCookies(res, jwtToken, event.slug);
+
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
+    res.json({
+      token: jwtToken,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id,
+        require_password: requiresPassword
+      }
+    });
+  } catch (error) {
+    logger.error('Share link authentication error:', error);
+    res.status(500).json({ error: 'Share link login failed' });
+  }
+});
+
+// Gallery logout to clear cookies
+router.post('/gallery/logout', async (req, res) => {
+  try {
+    const { slug } = req.body || {};
+    clearGalleryAuthCookies(res, slug);
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Gallery logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
 // Get current session info
 router.get('/session', async (req, res) => {
   try {
-    const token = req.headers.authorization?.split(' ')[1];
+    const { slug } = req.query;
+    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
     
     if (!token) {
       return res.status(401).json({ error: 'No token provided' });
     }
-    
+
     try {
       const decoded = jwt.verify(token, process.env.JWT_SECRET);
       
@@ -250,7 +371,9 @@ router.get('/session', async (req, res) => {
         valid: true,
         type: decoded.type,
         expiresIn: Math.floor(remainingTime),
-        user: decoded.username || decoded.eventSlug
+        user: decoded.username || decoded.eventSlug,
+        eventSlug: decoded.eventSlug,
+        adminUsername: decoded.username
       });
     } catch (err) {
       res.json({
@@ -263,4 +386,4 @@ router.get('/session', async (req, res) => {
   }
 });
 
-module.exports = router;
+module.exports = router;

backend/src/routes/auth.js

@@ -71,13 +71,13 @@ router.post('/gallery/verify', [
     
     const { slug, password, recaptchaToken } = req.body;
     
-    // Verify reCAPTCHA
-    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
-    if (!recaptchaValid) {
-      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
-    }
+    // Verify reCAPTCHA - temporarily disabled for testing
+    // const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    // if (!recaptchaValid) {
+    //   return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    // }
     
-    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
+    const event = await db('events').where({ slug: slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).select('*').first();
     if (!event) {
       return res.status(404).json({ error: 'Gallery not found or expired' });
     }
@@ -108,20 +108,25 @@ router.post('/gallery/verify', [
       type: 'gallery' 
     }, process.env.JWT_SECRET, { expiresIn: '24h' });
     
+    const responseEvent = {
+      id: event.id,
+      event_name: event.event_name,
+      event_type: event.event_type,
+      event_date: event.event_date,
+      welcome_message: event.welcome_message,
+      color_theme: event.color_theme,
+      expires_at: event.expires_at,
+      allow_user_uploads: event.allow_user_uploads,
+      upload_category_id: event.upload_category_id,
+      hero_photo_id: event.hero_photo_id,
+      allow_downloads: event.allow_downloads
+    };
+    
+    console.log('Auth response event:', JSON.stringify(responseEvent, null, 2));
+    
     res.json({
       token,
-      event: {
-        id: event.id,
-        event_name: event.event_name,
-        event_type: event.event_type,
-        event_date: event.event_date,
-        welcome_message: event.welcome_message,
-        color_theme: event.color_theme,
-        expires_at: event.expires_at,
-        allow_user_uploads: event.allow_user_uploads,
-        upload_category_id: event.upload_category_id,
-        hero_photo_id: event.hero_photo_id
-      }
+      event: responseEvent
     });
   } catch (error) {
     res.status(500).json({ error: 'Verification failed' });

backend/src/routes/events.js

@@ -4,11 +4,34 @@ const bcrypt = require('bcrypt');
 const crypto = require('crypto');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const router = express.Router();
 
+const parseBooleanInput = (value, defaultValue = true) => {
+  if (value === undefined || value === null) {
+    return defaultValue;
+  }
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  if (typeof value === 'number') {
+    return value !== 0;
+  }
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (['false', '0', 'no', 'off'].includes(normalized)) {
+      return false;
+    }
+    if (['true', '1', 'yes', 'on'].includes(normalized)) {
+      return true;
+    }
+  }
+  return defaultValue;
+};
+
 // Create new event
 router.post('/', adminAuth, [
   body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
@@ -16,7 +39,17 @@ router.post('/', adminAuth, [
   body('event_date').isDate(),
   body('host_email').isEmail(),
   body('admin_email').isEmail(),
-  body('password').isLength({ min: 6 }),
+  body('require_password').optional().isBoolean(),
+  body('password').optional().isString().custom((value, { req }) => {
+    const requirePassword = parseBooleanInput(req.body.require_password, true);
+    if (!requirePassword) {
+      return true;
+    }
+    if (typeof value !== 'string' || value.trim().length < 6) {
+      throw new Error('Password must be at least 6 characters long');
+    }
+    return true;
+  }),
   body('expiration_days').isInt({ min: 1, max: 365 }).optional()
 ], async (req, res) => {
   try {
@@ -32,10 +65,28 @@ router.post('/', adminAuth, [
       host_email,
       admin_email,
       password,
+      require_password: requirePasswordInput = true,
       welcome_message,
       color_theme,
       expiration_days = 30
     } = req.body;
+
+    const requirePassword = parseBooleanInput(requirePasswordInput, true);
+
+    if (requirePassword) {
+      const passwordValidation = await validatePasswordInContext(password, 'gallery', {
+        eventName: event_name
+      });
+
+      if (!passwordValidation.valid) {
+        return res.status(400).json({ 
+          error: 'Password does not meet security requirements',
+          details: passwordValidation.errors,
+          score: passwordValidation.score,
+          feedback: passwordValidation.feedback
+        });
+      }
+    }
     
     // Generate unique slug
     const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
@@ -47,12 +98,17 @@ router.post('/', adminAuth, [
       counter++;
     }
     
-    // Generate share link
+    // Generate share link (just slug/token, not full URL)
     const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
+    const fullShareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
+    const shareLinkSlug = `${slug}/${shareToken}`;
     
-    // Hash password
-    const password_hash = await bcrypt.hash(password, 10);
+    // Hash password (or placeholder when not required)
+    const password_hash = requirePassword
+      ? await bcrypt.hash(password, getBcryptRounds())
+      : await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
     
     // Calculate expiration date (days after event date)
     const expires_at = new Date(event_date);
@@ -75,8 +131,9 @@ router.post('/', adminAuth, [
       password_hash,
       welcome_message,
       color_theme,
-      share_link: shareLink,
-      expires_at
+      share_link: shareLinkSlug,
+      expires_at,
+      require_password: formatBoolean(requirePassword)
     }).returning('id');
     
     // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
@@ -88,17 +145,18 @@ router.post('/', adminAuth, [
       host_name: host_email.split('@')[0], // Extract name from email
       event_name,
       event_date: event_date,  // Pass raw date - will be formatted by email processor
-      gallery_link: shareLink,
-      gallery_password: password,
+      gallery_link: fullShareLink,
+      gallery_password: requirePassword ? password : 'No password required',
       expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
       welcome_message: welcome_message || ''
     });
-    
+
     res.json({
       id: eventId,
       slug,
-      share_link: shareLink,
-      expires_at
+      share_link: fullShareLink,
+      expires_at,
+      require_password: requirePassword
     });
   } catch (error) {
     console.error(error);
@@ -137,17 +195,46 @@ router.get('/', adminAuth, async (req, res) => {
 router.put('/:id', adminAuth, async (req, res) => {
   try {
     const { id } = req.params;
-    const updates = req.body;
+    const updates = { ...req.body };
     
     // Don't allow updating certain fields
     delete updates.id;
     delete updates.slug;
     delete updates.created_at;
-    
-    // If updating password, hash it
-    if (updates.password) {
-      updates.password_hash = await bcrypt.hash(updates.password, 10);
-      delete updates.password;
+    delete updates.password_confirmation;
+
+    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
+    let requirePasswordUpdate;
+    if (hasRequirePasswordUpdate) {
+      requirePasswordUpdate = parseBooleanInput(updates.require_password, true);
+      updates.require_password = formatBoolean(requirePasswordUpdate);
+    }
+
+    let newPasswordPlain;
+    if (Object.prototype.hasOwnProperty.call(updates, 'password')) {
+      if (updates.password === undefined || updates.password === null || updates.password === '') {
+        delete updates.password;
+      } else {
+        newPasswordPlain = updates.password;
+        delete updates.password;
+      }
+    }
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    const currentRequirePassword = parseBooleanInput(event.require_password, true);
+
+    if (hasRequirePasswordUpdate && requirePasswordUpdate === true && !currentRequirePassword && !newPasswordPlain) {
+      return res.status(400).json({ error: 'Password must be provided when enabling password requirement.' });
+    }
+
+    if (newPasswordPlain) {
+      updates.password_hash = await bcrypt.hash(newPasswordPlain, getBcryptRounds());
+    } else if (hasRequirePasswordUpdate && requirePasswordUpdate === false && currentRequirePassword) {
+      updates.password_hash = await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
     }
     
     await db('events').where('id', id).update(updates);

backend/src/routes/gallery.js

@@ -1,5 +1,4 @@
 const express = require('express');
-const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const archiver = require('archiver');
@@ -7,9 +6,12 @@ const path = require('path');
 const router = express.Router();
 const watermarkService = require('../services/watermarkService');
 const { verifyGalleryAccess } = require('../middleware/gallery');
+const secureImageService = require('../services/secureImageService');
+const logger = require('../utils/logger');
+const { resolvePhotoFilePath } = require('../services/photoResolver');
 
 // Get storage path from environment or default
-const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
 
 // Verify share token
 router.get('/:slug/verify-token/:token', async (req, res) => {
@@ -34,7 +36,7 @@ router.get('/:slug/verify-token/:token', async (req, res) => {
     res.json({ valid: true });
   } catch (error) {
     console.error('Error verifying token:', error);
-    res.status(500).json({ error: 'Failed to verify token', details: error.message });
+    res.status(500).json({ error: 'Failed to verify token' });
   }
 });
 
@@ -46,7 +48,21 @@ router.get('/:slug/info', async (req, res) => {
     
     const event = await db('events')
       .where({ slug })
-      .select('event_name', 'event_type', 'event_date', 'expires_at', 'is_active', 'is_archived', 'share_link')
+      .select(
+        'event_name',
+        'event_type',
+        'event_date',
+        'expires_at',
+        'is_active',
+        'is_archived',
+        'share_link',
+        'allow_downloads',
+        'disable_right_click',
+        'watermark_downloads',
+        'watermark_text',
+        'require_password',
+        'color_theme'
+      )
       .first();
     
     if (!event) {
@@ -70,6 +86,8 @@ router.get('/:slug/info', async (req, res) => {
       }
     }
     
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
     res.json({
       event_name: event.event_name,
       event_type: event.event_type,
@@ -77,36 +95,139 @@ router.get('/:slug/info', async (req, res) => {
       expires_at: event.expires_at,
       is_active: event.is_active,
       is_expired: !event.is_active || new Date(event.expires_at) < new Date(),
-      requires_password: true,
-      color_theme: event.color_theme
+      requires_password: requiresPassword,
+      color_theme: event.color_theme,
+      allow_downloads: !(event.allow_downloads === false || event.allow_downloads === 0 || event.allow_downloads === '0'),
+      disable_right_click: event.disable_right_click === true || event.disable_right_click === 1 || event.disable_right_click === '1',
+      watermark_downloads: event.watermark_downloads === true || event.watermark_downloads === 1 || event.watermark_downloads === '1',
+      watermark_text: event.watermark_text
     });
   } catch (error) {
     console.error('Error fetching gallery info:', error);
-    res.status(500).json({ error: 'Failed to fetch gallery info', details: error.message });
+    res.status(500).json({ error: 'Failed to fetch gallery info' });
   }
 });
 
 // Get all photos
 router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
   try {
-    const photos = await db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+    // Get filter parameters from query
+    const { filter, guest_id } = req.query;
+    
+    // First get all photos
+    let photos = await db('photos')
       .where('photos.event_id', req.event.id)
-      .select(
-        'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
-      )
+      .select('photos.*')
       .orderBy('photos.uploaded_at', 'desc');
     
-    // Get all categories for this event
-    const categories = await db('photo_categories')
-      .where(function() {
-        this.where('is_global', formatBoolean(true))
-          .orWhere('event_id', req.event.id);
-      })
-      .orderBy('is_global', 'desc')
-      .orderBy('name', 'asc');
+    // Apply filtering if requested (supports global stats + per-guest interactions)
+    if (filter) {
+      const filterTokens = new Set(
+        String(filter)
+          .toLowerCase()
+          .split(',')
+          .map(token => token.trim())
+          .filter(Boolean)
+      );
+
+      if (filterTokens.size > 0) {
+        // Treat "saved" / "favorite" synonyms as favorites
+        if (filterTokens.has('saved')) {
+          filterTokens.add('favorited');
+        }
+        if (filterTokens.has('favorite')) {
+          filterTokens.add('favorited');
+        }
+
+        const include = new Set();
+
+        const includeBy = (predicate) => {
+          photos.forEach(photo => {
+            if (predicate(photo)) {
+              include.add(photo.id);
+            }
+          });
+        };
+
+        let guestFeedbackByType = null;
+        if (guest_id) {
+          const guestFeedbackRows = await db('photo_feedback')
+            .where({ event_id: req.event.id, guest_identifier: guest_id })
+            .select('photo_id', 'feedback_type');
+
+          guestFeedbackByType = guestFeedbackRows.reduce((acc, row) => {
+            if (!acc[row.feedback_type]) {
+              acc[row.feedback_type] = new Set();
+            }
+            acc[row.feedback_type].add(row.photo_id);
+            return acc;
+          }, {});
+        }
+
+        const includeGuestMatches = (type) => {
+          const ids = guestFeedbackByType?.[type];
+          if (ids && ids.size > 0) {
+            ids.forEach(id => include.add(id));
+          }
+        };
+
+        if (filterTokens.has('liked')) {
+          includeGuestMatches('like');
+          includeBy(photo => (photo.like_count || 0) > 0);
+        }
+
+        if (filterTokens.has('favorited')) {
+          includeGuestMatches('favorite');
+          includeBy(photo => (photo.favorite_count || 0) > 0);
+        }
+
+        if (filterTokens.has('rated')) {
+          includeGuestMatches('rating');
+          includeBy(photo => (photo.average_rating || 0) > 0);
+        }
+
+        if (filterTokens.has('commented')) {
+          includeGuestMatches('comment');
+          const commentedRows = await db('photo_feedback')
+            .where({ event_id: req.event.id, feedback_type: 'comment', is_approved: true, is_hidden: false })
+            .groupBy('photo_id')
+            .select('photo_id');
+          commentedRows.forEach(row => include.add(row.photo_id));
+        }
+
+        photos = photos.filter(photo => include.has(photo.id));
+      }
+    }
+    
+    // Then get comment counts separately
+    const commentCounts = await db('photo_feedback')
+      .whereIn('photo_id', photos.map(p => p.id))
+      .where('feedback_type', 'comment')
+      .where('is_approved', true)
+      .where('is_hidden', false)
+      .groupBy('photo_id')
+      .select('photo_id', db.raw('COUNT(*) as comment_count'));
+    
+    // Create a map for quick lookup
+    const commentMap = {};
+    commentCounts.forEach(c => {
+      commentMap[c.photo_id] = parseInt(c.comment_count);
+    });
+    
+    // Get distinct photo types for this event
+    const categoryResults = await db('photos')
+      .where('event_id', req.event.id)
+      .select('type')
+      .distinct('type')
+      .orderBy('type', 'asc');
+    
+    // Convert types to category-like objects
+    const categories = categoryResults.map(result => ({
+      id: result.type,
+      name: result.type === 'individual' ? 'Individual Photos' : 'Collages',
+      slug: result.type,
+      is_global: false
+    }));
     
     // Log view
     await db('access_logs').insert({
@@ -116,6 +237,16 @@ router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
       action: 'view'
     });
     
+    // Include protection settings in response
+    const protectionSettings = {
+      protection_level: req.event.protection_level || 'standard',
+      image_quality: req.event.image_quality || 85,
+      use_canvas_rendering: req.event.use_canvas_rendering === true,
+      fragmentation_level: req.event.fragmentation_level || 3,
+      overlay_protection: req.event.overlay_protection !== false
+    };
+    
+
     res.json({
       event: {
         id: req.event.id,
@@ -125,30 +256,47 @@ router.get('/:slug/photos', verifyGalleryAccess, async (req, res) => {
         welcome_message: req.event.welcome_message,
         color_theme: req.event.color_theme,
         expires_at: req.event.expires_at,
-        hero_photo_id: req.event.hero_photo_id
+        hero_photo_id: req.event.hero_photo_id,
+        allow_downloads: req.event.allow_downloads !== false,
+        disable_right_click: req.event.disable_right_click === true,
+        watermark_downloads: req.event.watermark_downloads === true,
+        watermark_text: req.event.watermark_text,
+        ...protectionSettings
       },
-      categories: categories.map(cat => ({
-        id: cat.id,
-        name: cat.name,
-        slug: cat.slug,
-        is_global: cat.is_global
-      })),
-      photos: photos.map(photo => ({
-        id: photo.id,
-        filename: photo.filename,
-        url: `/api/gallery/${req.params.slug}/photo/${photo.id}`,
-        thumbnail_url: photo.thumbnail_path ? `/api/gallery/${req.params.slug}/thumbnail/${photo.id}` : null,
-        type: photo.type,
-        category_id: photo.category_id,
-        category_name: photo.category_name,
-        category_slug: photo.category_slug,
-        size: photo.size_bytes,
-        uploaded_at: photo.uploaded_at
-      }))
+      categories: categories,
+      photos: photos.map(photo => {
+        const useJwtUrl = (protectionSettings.protection_level === 'basic' || protectionSettings.protection_level === 'standard');
+        const photoUrl = useJwtUrl ? 
+          `/api/gallery/${req.params.slug}/photo/${photo.id}` : 
+          `/api/secure-images/${req.params.slug}/secure/${photo.id}/{{token}}`;
+        
+        return {
+          id: photo.id,
+          filename: photo.filename,
+          url: photoUrl,
+          thumbnail_url: photo.thumbnail_path ? `/api/gallery/${req.params.slug}/thumbnail/${photo.id}` : null,
+          secure_url_template: `/api/secure-images/${req.params.slug}/secure/${photo.id}/{{token}}`,
+          download_url_template: `/api/secure-images/${req.params.slug}/secure-download/${photo.id}/{{token}}`,
+          type: photo.type,
+          category_id: photo.type,
+          category_name: photo.type === 'individual' ? 'Individual Photos' : 'Collages',
+          category_slug: photo.type,
+          size: photo.size_bytes,
+          uploaded_at: photo.uploaded_at,
+          // Fixed: Use the calculated useJwtUrl variable instead of recalculating
+          requires_token: !useJwtUrl,
+          // Feedback data
+          has_feedback: (commentMap[photo.id] > 0 || photo.average_rating > 0 || photo.like_count > 0),
+          average_rating: photo.average_rating || 0,
+          comment_count: commentMap[photo.id] || 0,
+          like_count: photo.like_count || 0,
+          favorite_count: photo.favorite_count || 0
+        };
+      })
     });
   } catch (error) {
     console.error('Error fetching photos:', error);
-    res.status(500).json({ error: 'Failed to fetch photos', details: error.message });
+    res.status(500).json({ error: 'Failed to fetch photos' });
   }
 });
 
@@ -157,6 +305,11 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) =>
   try {
     const { photoId } = req.params;
     
+    // Check if downloads are allowed for this event
+    if (req.event.allow_downloads === false) {
+      return res.status(403).json({ error: 'Downloads are disabled for this gallery' });
+    }
+    
     const photo = await db('photos')
       .where({ id: photoId, event_id: req.event.id })
       .first();
@@ -177,7 +330,18 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) =>
       photo_id: photoId
     });
     
-    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+    let filePath;
+    try {
+      filePath = resolvePhotoFilePath(req.event, photo);
+    } catch (resolveError) {
+      logger.error('Failed to resolve photo path for download', {
+        slug: req.params.slug,
+        photoId,
+        eventId: req.event.id,
+        error: resolveError.message,
+      });
+      return res.status(404).json({ error: 'Photo file not found' });
+    }
     
     // Get watermark settings
     const watermarkSettings = await watermarkService.getWatermarkSettings();
@@ -195,9 +359,24 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) =>
       res.send(watermarkedBuffer);
     } else {
       // Send original file
-      res.download(filePath, photo.filename);
+      res.download(filePath, photo.filename, (downloadError) => {
+        if (downloadError) {
+          logger.error('Error streaming gallery download', {
+            slug: req.params.slug,
+            photoId,
+            eventId: req.event.id,
+            error: downloadError.message,
+          });
+        }
+      });
     }
   } catch (error) {
+    logger.error('Unexpected error processing gallery download', {
+      slug: req.params.slug,
+      photoId: req.params.photoId,
+      eventId: req.event?.id,
+      error: error.message,
+    });
     res.status(500).json({ error: 'Failed to download photo' });
   }
 });
@@ -205,25 +384,25 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, async (req, res) =>
 // Download all photos as ZIP
 router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
   try {
-    // Fetch photos with category information
+    // Check if downloads are allowed for this event
+    if (req.event.allow_downloads === false) {
+      return res.status(403).json({ error: 'Downloads are disabled for this gallery' });
+    }
+    
+    // Fetch photos
     const photos = await db('photos')
-      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
       .where('photos.event_id', req.event.id)
-      .select(
-        'photos.*',
-        'photo_categories.name as category_name',
-        'photo_categories.slug as category_slug'
-      )
-      .orderBy('photo_categories.name', 'asc')
+      .select('photos.*')
+      .orderBy('photos.type', 'asc')
       .orderBy('photos.uploaded_at', 'desc');
     
     if (photos.length === 0) {
       return res.status(404).json({ error: 'No photos found' });
     }
     
-    // Count unique categories (excluding null)
-    const uniqueCategories = new Set(photos.filter(p => p.category_id).map(p => p.category_id)).size;
-    const hasMultipleCategories = uniqueCategories > 1;
+    // Count unique types
+    const uniqueTypes = new Set(photos.map(p => p.type)).size;
+    const hasMultipleTypes = uniqueTypes > 1;
     
     res.setHeader('Content-Type', 'application/zip');
     res.setHeader('Content-Disposition', `attachment; filename="${req.event.slug}.zip"`);
@@ -240,30 +419,43 @@ router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
     
     // Add photos to archive
     for (const photo of photos) {
-      const filePath = path.join(getStoragePath(), 'events/active', photo.path);
+      let filePath;
+      try {
+        filePath = resolvePhotoFilePath(req.event, photo);
+      } catch (resolveError) {
+        logger.warn('Skipping photo in bulk download due to unresolved path', {
+          slug: req.params.slug,
+          photoId: photo.id,
+          eventId: req.event.id,
+          error: resolveError.message,
+        });
+        continue;
+      }
       
       // Determine the file name in the archive
       let archiveName;
-      if (hasMultipleCategories) {
-        if (photo.category_name) {
-          // Use category name as folder (sanitize for filesystem)
-          const folderName = photo.category_name.replace(/[^a-zA-Z0-9-_ ]/g, '').trim();
-          archiveName = path.join(folderName, photo.filename);
-        } else {
-          // Put uncategorized photos in 'Uncategorized' folder
-          archiveName = path.join('Uncategorized', photo.filename);
-        }
+      if (hasMultipleTypes) {
+        // Use photo type as folder
+        const folderName = photo.type === 'individual' ? 'Individual Photos' : 'Collages';
+        archiveName = path.join(folderName, photo.filename);
       } else {
         // No folders, just the filename
         archiveName = photo.filename;
       }
       
       if (watermarkSettings && watermarkSettings.enabled) {
-        // Apply watermark
-        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-        archive.append(watermarkedBuffer, { name: archiveName });
+        try {
+          const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+          archive.append(watermarkedBuffer, { name: archiveName });
+        } catch (watermarkError) {
+          logger.warn('Failed to watermark photo for bulk download, skipping original to avoid leak', {
+            slug: req.params.slug,
+            photoId: photo.id,
+            eventId: req.event.id,
+            error: watermarkError.message,
+          });
+        }
       } else {
-        // Add original file
         archive.file(filePath, { name: archiveName });
       }
     }
@@ -278,81 +470,267 @@ router.get('/:slug/download-all', verifyGalleryAccess, async (req, res) => {
       action: 'download_all'
     });
   } catch (error) {
+    logger.error('Error creating bulk gallery download', {
+      slug: req.params.slug,
+      eventId: req.event?.id,
+      error: error.message,
+    });
     res.status(500).json({ error: 'Failed to create download archive' });
   }
 });
 
-// View single photo (with watermark if enabled)
-router.get('/:slug/photo/:photoId', verifyGalleryAccess, async (req, res) => {
+// Download selected photos as ZIP
+router.post('/:slug/download-selected', verifyGalleryAccess, async (req, res) => {
   try {
-    const { photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: req.event.id })
-      .first();
-    
-    if (!photo) {
-      return res.status(404).json({ error: 'Photo not found' });
+    // Check if downloads are allowed for this event
+    if (req.event.allow_downloads === false) {
+      return res.status(403).json({ error: 'Downloads are disabled for this gallery' });
     }
-    
-    const filePath = path.join(getStoragePath(), 'events/active', photo.path);
-    
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
-    
-    if (watermarkSettings && watermarkSettings.enabled) {
-      // Apply watermark and send
-      const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-      
-      res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
-        'Cache-Control': 'public, max-age=3600' // Cache for 1 hour
+
+    const ids = Array.isArray(req.body?.photo_ids) ? req.body.photo_ids : [];
+    if (!ids.length) {
+      return res.status(400).json({ error: 'photo_ids is required (non-empty array)' });
+    }
+
+    // Clean IDs
+    const photoIds = ids
+      .map((v) => parseInt(v, 10))
+      .filter((v) => Number.isInteger(v))
+      .slice(0, 500);
+
+    if (photoIds.length === 0) {
+      return res.status(400).json({ error: 'No valid photo IDs provided' });
+    }
+
+    // Fetch photos
+    const photos = await db('photos')
+      .where('photos.event_id', req.event.id)
+      .whereIn('photos.id', photoIds)
+      .select('photos.*')
+      .orderBy('photos.uploaded_at', 'desc');
+
+    if (photos.length === 0) {
+      return res.status(404).json({ error: 'No photos found for selected IDs' });
+    }
+
+    const archiveName = `${req.event.slug}-selected.zip`;
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${archiveName}"`);
+
+    const archive = archiver('zip', { zlib: { level: 5 } });
+    archive.on('error', (err) => {
+      logger.error('Zip error generating selected download', {
+        slug: req.params.slug,
+        eventId: req.event?.id,
+        error: err.message,
       });
-      
-      res.send(watermarkedBuffer);
-    } else {
-      // Send original file
-      res.sendFile(filePath);
+      try {
+        res.status(500).end();
+      } catch (_) {
+        // ignore double-send errors
+      }
+    });
+    archive.pipe(res);
+
+    // Check watermark settings similar to download-all
+    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    for (const photo of photos) {
+      try {
+        const filePath = resolvePhotoFilePath(req.event, photo);
+        const name = photo.filename || `photo-${photo.id}.jpg`;
+        if (watermarkSettings && watermarkSettings.enabled) {
+          try {
+            const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+            archive.append(watermarkedBuffer, { name });
+          } catch (watermarkError) {
+            logger.warn('Failed to watermark selected photo, skipping original to avoid leak', {
+              slug: req.params.slug,
+              photoId: photo.id,
+              eventId: req.event.id,
+              error: watermarkError.message,
+            });
+          }
+        } else {
+          archive.file(filePath, { name });
+        }
+      } catch (resolveError) {
+        logger.warn('Skipping selected photo due to unresolved path', {
+          slug: req.params.slug,
+          photoId: photo.id,
+          eventId: req.event.id,
+          error: resolveError.message,
+        });
+      }
     }
+
+    await archive.finalize();
+
+    await db('access_logs').insert({
+      event_id: req.event.id,
+      ip_address: req.ip,
+      user_agent: req.headers['user-agent'],
+      action: 'download_selected'
+    });
   } catch (error) {
-    console.error('Error serving photo:', error);
-    res.status(500).json({ error: 'Failed to serve photo' });
+    logger.error('Error in download-selected:', {
+      slug: req.params.slug,
+      eventId: req.event?.id,
+      error: error.message,
+    });
+    res.status(500).json({ error: 'Failed to download selected photos' });
   }
 });
 
-// Serve thumbnail
-router.get('/:slug/thumbnail/:photoId', verifyGalleryAccess, async (req, res) => {
-  try {
-    const { photoId } = req.params;
-    
-    const photo = await db('photos')
-      .where({ id: photoId, event_id: req.event.id })
-      .first();
-    
-    if (!photo || !photo.thumbnail_path) {
-      return res.status(404).json({ error: 'Thumbnail not found' });
-    }
-    
-    const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
-    
-    // Check if file exists
-    const fs = require('fs').promises;
+
+// View single photo (with watermark if enabled)
+router.get('/:slug/photo/:photoId', 
+  verifyGalleryAccess, 
+  async (req, res) => {
     try {
-      await fs.access(thumbPath);
+      const { photoId } = req.params;
+      
+      const photo = await db('photos')
+        .where({ id: photoId, event_id: req.event.id })
+        .first();
+      
+      
+      if (!photo) {
+        return res.status(404).json({ error: 'Photo not found' });
+      }
+
+      // Check protection level - basic and standard protection allow direct JWT access
+      const protectionLevel = req.event.protection_level || 'standard';
+      
+      if (protectionLevel === 'enhanced' || protectionLevel === 'maximum') {
+        // For enhanced/maximum protection, redirect to secure endpoint
+        return res.status(302).json({ 
+          error: 'Secure access required',
+          secureEndpoint: `/api/secure-images/${req.params.slug}/generate-token`,
+          photoId: photoId
+        });
+      }
+      
+      // Resolve the absolute file path for this photo, supporting both managed and external reference modes
+      const { resolvePhotoFilePath } = require('../services/photoResolver');
+      const filePath = resolvePhotoFilePath(req.event, photo);
+      
+      
+      // Log access - temporarily disabled for debugging
+      // await secureImageService.logImageAccess(
+      //   photoId,
+      //   req.event.id,
+      //   req.clientInfo,
+      //   'view_basic'
+      // );
+      
+      // Get watermark settings
+      const watermarkSettings = await watermarkService.getWatermarkSettings();
+      
+      if (watermarkSettings && watermarkSettings.enabled) {
+        // Apply watermark and send
+        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+        
+        res.set({
+          'Content-Type': photo.mime_type || 'image/jpeg',
+          'Cache-Control': 'private, max-age=1800', // Cache for 30 minutes
+          'X-Protection-Level': 'basic'
+        });
+        
+        res.send(watermarkedBuffer);
+      } else {
+        // Send original file with basic protection headers
+        res.set({
+          'Cache-Control': 'private, max-age=1800',
+          'X-Protection-Level': 'basic'
+        });
+        // Ensure absolute path for res.sendFile
+        const absolutePath = path.isAbsolute(filePath) ? filePath : path.resolve(filePath);
+        res.sendFile(absolutePath);
+      }
     } catch (error) {
-      return res.status(404).json({ error: 'Thumbnail file not found' });
+      logger.error('Error serving photo:', {
+        error: error.message,
+        stack: error.stack,
+        photoId: req.params.photoId,
+        eventId: req.event?.id
+      });
+      res.status(500).json({ error: 'Failed to serve photo' });
     }
+  }
+);
+
+// Serve thumbnail
+router.get('/:slug/thumbnail/:photoId', 
+  verifyGalleryAccess, 
+  async (req, res) => {
+    try {
+      const { photoId } = req.params;
+      
+      const photo = await db('photos')
+        .where({ id: photoId, event_id: req.event.id })
+        .first();
+      
+      if (!photo || !photo.thumbnail_path) {
+        return res.status(404).json({ error: 'Thumbnail not found' });
+      }
+      
+      const thumbPath = path.join(getStoragePath(), photo.thumbnail_path);
+      
+      // Check if file exists
+      const fs = require('fs').promises;
+      try {
+        await fs.access(thumbPath);
+      } catch (error) {
+        return res.status(404).json({ error: 'Thumbnail file not found' });
+      }
+
+      // Log thumbnail access
+      await secureImageService.logImageAccess(
+        photoId,
+        req.event.id,
+        req.clientInfo,
+        'thumbnail'
+      );
+      
+      // Set appropriate headers with enhanced security
+      res.set({
+        'Content-Type': 'image/jpeg',
+        'Cache-Control': 'private, max-age=1800', // Reduced cache time
+        'Cross-Origin-Resource-Policy': 'cross-origin',
+        'X-Content-Type-Options': 'nosniff',
+        'X-Protected-Thumbnail': 'true'
+      });
+      
+      // Send file
+      res.sendFile(path.resolve(thumbPath));
+    } catch (error) {
+      logger.error('Error serving thumbnail:', {
+        error: error.message,
+        photoId: req.params.photoId,
+        eventId: req.event?.id
+      });
+      res.status(500).json({ error: 'Failed to serve thumbnail' });
+    }
+  }
+);
+
+// Get feedback settings for gallery
+router.get('/:slug/feedback-settings', verifyGalleryAccess, async (req, res) => {
+  try {
+    const feedbackService = require('../services/feedbackService');
+    const settings = await feedbackService.getEventFeedbackSettings(req.event.id);
     
-    // Set appropriate headers
-    res.setHeader('Content-Type', 'image/jpeg');
-    res.setHeader('Cache-Control', 'private, max-age=3600');
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    
-    // Send file
-    res.sendFile(path.resolve(thumbPath));
+    res.json({
+      feedback_enabled: settings.feedback_enabled || false,
+      allow_ratings: settings.allow_ratings,
+      allow_likes: settings.allow_likes, 
+      allow_comments: settings.allow_comments,
+      allow_favorites: settings.allow_favorites,
+      show_feedback_to_guests: settings.show_feedback_to_guests
+    });
   } catch (error) {
-    console.error('Error serving thumbnail:', error);
-    res.status(500).json({ error: 'Failed to serve thumbnail' });
+    console.error('Error fetching feedback settings:', error);
+    res.status(500).json({ error: 'Failed to fetch feedback settings' });
   }
 });
 
@@ -442,12 +820,6 @@ router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
         // Process uploaded photos
         const results = await processUploadedPhotos(req.files, eventId, 'user', categoryId);
         
-        // Clean up temp files
-        const fs = require('fs').promises;
-        for (const file of req.files) {
-          await fs.unlink(file.path).catch(console.error);
-        }
-        
         res.json({ 
           message: 'Photos uploaded successfully',
           count: results.length,

backend/src/routes/galleryFeedback.js

@@ -24,14 +24,15 @@ router.get('/:slug/feedback-settings',
       const settings = await feedbackService.getEventFeedbackSettings(event.id);
       
       // Only send relevant settings to guests
+      // Convert SQLite boolean values (0/1) to proper booleans
       const guestSettings = {
-        feedback_enabled: settings.feedback_enabled,
-        allow_ratings: settings.allow_ratings,
-        allow_likes: settings.allow_likes,
-        allow_comments: settings.allow_comments,
-        allow_favorites: settings.allow_favorites,
-        require_name_email: settings.require_name_email,
-        show_feedback_to_guests: settings.show_feedback_to_guests
+        feedback_enabled: Boolean(settings.feedback_enabled),
+        allow_ratings: Boolean(settings.allow_ratings),
+        allow_likes: Boolean(settings.allow_likes),
+        allow_comments: Boolean(settings.allow_comments),
+        allow_favorites: Boolean(settings.allow_favorites),
+        require_name_email: Boolean(settings.require_name_email),
+        show_feedback_to_guests: Boolean(settings.show_feedback_to_guests)
       };
       
       res.json(guestSettings);

backend/src/routes/protectedImages.js

@@ -4,6 +4,7 @@ const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { verifyGalleryAccess } = require('../middleware/gallery');
 const watermarkService = require('../services/watermarkService');
+const secureImageService = require('../services/secureImageService');
 const { getStoragePath } = require('../config/storage');
 const crypto = require('crypto');
 
@@ -48,11 +49,20 @@ function verifyImageToken(token) {
 }
 
 /**
- * Serve watermarked image
+ * Serve protected image with enhanced security
  */
 router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) => {
   try {
     const { photoId } = req.params;
+    const { protectionLevel = 'standard', token } = req.query;
+    
+    // Create client fingerprint
+    const clientFingerprint = secureImageService.createClientFingerprint(req);
+    
+    // Check rate limiting
+    if (!secureImageService.checkRateLimit(clientFingerprint, 30, 60000)) {
+      return res.status(429).json({ error: 'Rate limit exceeded' });
+    }
     
     // Get photo details
     const photo = await db('photos')
@@ -65,35 +75,123 @@ router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) =
     if (!photo) {
       return res.status(404).json({ error: 'Photo not found' });
     }
+
+    // Check for suspicious activity
+    const isSuspicious = await secureImageService.detectSuspiciousActivity(clientFingerprint, photoId);
+    if (isSuspicious) {
+      return res.status(429).json({ error: 'Suspicious activity detected' });
+    }
     
-    // Get watermark settings
-    const watermarkSettings = await watermarkService.getWatermarkSettings();
+    // Log access
+    await secureImageService.logImageAccess(photoId, req.event.id, {
+      ip: req.ip,
+      userAgent: req.get('User-Agent'),
+      fingerprint: clientFingerprint
+    }, 'view');
+    
+    // Get protection settings from event
+    const protectionSettings = {
+      protectionLevel: req.event.protection_level || protectionLevel,
+      quality: req.event.image_quality || 85,
+      addFingerprint: req.event.add_fingerprint !== false,
+      fragmentImage: protectionLevel === 'maximum'
+    };
     
     // Build full path to photo
     const photoPath = path.join(getStoragePath(), 'events/active', req.event.slug, photo.path);
     
-    // Apply watermark if enabled
-    const imageBuffer = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    // Process image with protection
+    const processedImage = await secureImageService.processProtectedImage(photoPath, protectionSettings);
     
-    // Set appropriate headers
+    // Apply watermark if enabled
+    let finalImage;
+    if (processedImage.type === 'fragmented') {
+      // Return fragmented image data for canvas reconstruction
+      return res.json({
+        type: 'fragmented',
+        fragments: processedImage.fragments.map(f => ({
+          index: f.index,
+          row: f.row,
+          col: f.col,
+          data: f.buffer.toString('base64'),
+          position: f.position
+        })),
+        dimensions: processedImage.originalDimensions,
+        fragmentDimensions: processedImage.fragmentDimensions
+      });
+    } else {
+      const watermarkSettings = await watermarkService.getWatermarkSettings();
+      finalImage = await watermarkService.applyWatermark(photoPath, watermarkSettings);
+    }
+    
+    // Set security headers
     res.set({
       'Content-Type': photo.mime_type || 'image/jpeg',
-      'Content-Length': imageBuffer.length,
-      'Cache-Control': 'private, max-age=3600',
-      'X-Content-Type-Options': 'nosniff'
+      'Content-Length': finalImage.length,
+      'Cache-Control': 'private, no-cache, no-store, must-revalidate',
+      'Pragma': 'no-cache',
+      'Expires': '0',
+      'X-Content-Type-Options': 'nosniff',
+      'X-Frame-Options': 'DENY',
+      'X-Download-Options': 'noopen',
+      'Content-Disposition': 'inline; filename="protected-image.jpg"'
     });
     
-    // Send the watermarked image
-    res.send(imageBuffer);
+    // Send the protected image
+    res.send(finalImage);
     
   } catch (error) {
-    console.error('Error serving watermarked image:', error);
+    console.error('Error serving protected image:', error);
     res.status(500).json({ error: 'Failed to serve image' });
   }
 });
 
 /**
- * Generate signed URL for image access
+ * Generate secure token for enhanced image access
+ */
+router.post('/:slug/photo/:photoId/generate-secure-token', verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId } = req.params;
+    const { protectionLevel = 'standard', expiresIn = 300 } = req.body;
+    
+    // Verify photo belongs to this event
+    const photo = await db('photos')
+      .where({
+        id: photoId,
+        event_id: req.event.id
+      })
+      .first();
+    
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+
+    // Create client fingerprint
+    const clientFingerprint = secureImageService.createClientFingerprint(req);
+    
+    // Generate secure token
+    const token = secureImageService.generateSecureToken(photoId, req.sessionID || 'anonymous', {
+      expiresIn,
+      maxUses: protectionLevel === 'maximum' ? 1 : 3,
+      clientFingerprint,
+      protectionLevel
+    });
+    
+    res.json({ 
+      token,
+      expiresIn,
+      protectionLevel,
+      maxUses: protectionLevel === 'maximum' ? 1 : 3
+    });
+    
+  } catch (error) {
+    console.error('Error generating secure token:', error);
+    res.status(500).json({ error: 'Failed to generate token' });
+  }
+});
+
+/**
+ * Generate signed URL for image access (legacy support)
  */
 router.post('/:slug/photo/:photoId/generate-url', verifyGalleryAccess, async (req, res) => {
   try {

backend/src/routes/publicSettings.js

@@ -42,6 +42,12 @@ router.get('/', async (req, res) => {
       branding_watermark_size: settingsObject.branding_watermark_size || 15,
       branding_favicon_url: settingsObject.branding_favicon_url || '',
       branding_logo_url: settingsObject.branding_logo_url || '',
+      branding_logo_size: settingsObject.branding_logo_size || 'medium',
+      branding_logo_max_height: settingsObject.branding_logo_max_height || 48,
+      branding_logo_position: settingsObject.branding_logo_position || 'left',
+      branding_logo_display_header: settingsObject.branding_logo_display_header !== false,
+      branding_logo_display_hero: settingsObject.branding_logo_display_hero !== false,
+      branding_logo_display_mode: settingsObject.branding_logo_display_mode || 'logo_and_text',
       theme_config: settingsObject.theme_config || null,
       default_language: settingsObject.general_default_language || 'en',
       enable_analytics: settingsObject.general_enable_analytics !== false,

backend/src/routes/secureImages.js

@@ -0,0 +1,448 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { verifyGalleryAccess } = require('../middleware/gallery');
+const secureImageService = require('../services/secureImageService');
+const secureImageMiddleware = require('../middleware/secureImageMiddleware');
+const logger = require('../utils/logger');
+const { formatBoolean } = require('../utils/dbCompat');
+const { resolvePhotoFilePath } = require('../services/photoResolver');
+
+const router = express.Router();
+
+/**
+ * Generate secure token for image access
+ */
+router.post('/:slug/generate-token', async (req, res, next) => {
+  // Add slug to request for verifyGalleryAccess
+  req.requestedSlug = req.params.slug;
+  next();
+}, verifyGalleryAccess, async (req, res) => {
+  try {
+    const { photoId, accessType = 'view' } = req.body;
+    
+    if (!photoId) {
+      return res.status(400).json({ error: 'Photo ID required' });
+    }
+
+    // Verify photo exists and belongs to event
+    const photo = await db('photos')
+      .where({ id: photoId, event_id: req.event.id })
+      .first();
+
+    if (!photo) {
+      return res.status(404).json({ error: 'Photo not found' });
+    }
+
+    // Create client fingerprint
+    const clientFingerprint = secureImageService.createClientFingerprint(req);
+    
+    // Get protection level from event settings
+    const protectionLevel = req.event.protection_level || 'standard';
+    
+    // Generate secure token with appropriate settings
+    const tokenOptions = {
+      expiresIn: protectionLevel === 'maximum' ? 180 : 300, // 3-5 minutes
+      maxUses: accessType === 'download' ? 1 : 3,
+      clientFingerprint,
+      protectionLevel
+    };
+
+    const token = secureImageService.generateSecureToken(
+      photoId,
+      req.sessionID || 'anonymous',
+      tokenOptions
+    );
+
+    // Log token generation
+    await secureImageService.logImageAccess(
+      photoId,
+      req.event.id,
+      { 
+        ip: req.ip, 
+        userAgent: req.get('User-Agent'), 
+        fingerprint: clientFingerprint 
+      },
+      'token_generated'
+    );
+
+    res.json({
+      token,
+      expiresIn: tokenOptions.expiresIn,
+      maxUses: tokenOptions.maxUses,
+      protectionLevel
+    });
+
+  } catch (error) {
+    logger.error('Error generating secure token', {
+      error: error.message,
+      photoId: req.body.photoId,
+      eventId: req.event?.id
+    });
+    res.status(500).json({ error: 'Failed to generate secure token' });
+  }
+});
+
+/**
+ * Serve protected image with security measures
+ */
+router.get('/:slug/secure/:photoId/:token', 
+  secureImageMiddleware.secureImageAccess,
+  async (req, res) => {
+    const { slug, photoId, token } = req.params; // Move outside try block for error handler access
+    
+    try {
+      logger.debug('Secure image route hit', {
+        slug,
+        photoId,
+        tokenLength: token?.length,
+        hasAuthHeader: Boolean(req.headers.authorization),
+      });
+      const { fragment } = req.query;
+
+      // Verify secure token
+      const tokenValidation = secureImageService.verifySecureToken(
+        token,
+        req.clientInfo.fingerprint
+      );
+
+      if (!tokenValidation.valid) {
+        // Get event for logging (best effort)
+        const event = await db('events').where({ slug }).first();
+        await secureImageService.logImageAccess(
+          photoId,
+          event?.id || 0,
+          req.clientInfo,
+          'token_invalid'
+        );
+        return res.status(403).json({ error: 'Invalid or expired token' });
+      }
+
+      // Get event from slug
+      const event = await db('events')
+        .where({ 
+          slug,
+          is_active: formatBoolean(true),
+          is_archived: formatBoolean(false)
+        })
+        .first();
+
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+
+      // Verify photo exists and belongs to event  
+      const photo = await db('photos')
+        .where({ id: photoId, event_id: event.id })
+        .first();
+
+      if (!photo) {
+        return res.status(404).json({ error: 'Photo not found' });
+      }
+
+      let filePath;
+      try {
+        filePath = resolvePhotoFilePath(req.event, photo);
+      } catch (resolveError) {
+        logger.error('Failed to resolve photo path for secure token generation', {
+          slug: req.params.slug,
+          photoId,
+          eventId: req.event.id,
+          error: resolveError.message,
+        });
+        return res.status(404).json({ error: 'Photo file not found' });
+      }
+
+      // Get protection settings for this event
+      const protectionSettings = {
+        protectionLevel: event.protection_level || 'standard',
+        quality: event.image_quality || 85,
+        addFingerprint: event.add_fingerprint !== false,
+        fragmentImage: event.use_canvas_rendering === true && fragment !== undefined
+      };
+
+      // Process image with protection measures
+      const processedImage = await secureImageService.processProtectedImage(
+        filePath,
+        protectionSettings
+      );
+
+      // Handle fragmented images
+      if (processedImage.type === 'fragmented') {
+        return await handleFragmentedImage(req, res, processedImage, fragment);
+      }
+
+      // Log successful access
+      await secureImageService.logImageAccess(
+        photoId,
+        event.id,
+        req.clientInfo,
+        'view'
+      );
+
+      // Set content type and security headers
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Length': processedImage.length,
+        'X-Protection-Level': protectionSettings.protectionLevel,
+        'X-Remaining-Uses': tokenValidation.remaining
+      });
+
+      res.send(processedImage);
+
+    } catch (error) {
+      logger.error('Error serving secure image', {
+        error: error.message,
+        photoId,
+        slug,
+        clientFingerprint: req.clientInfo?.fingerprint
+      });
+      res.status(500).json({ error: 'Failed to serve image' });
+    }
+  }
+);
+
+/**
+ * Handle fragmented image delivery
+ */
+async function handleFragmentedImage(req, res, fragmentedImage, fragmentIndex) {
+  const { photoId } = req.params;
+  
+  try {
+    if (fragmentIndex === undefined) {
+      // Return fragment metadata
+      res.json({
+        type: 'fragmented',
+        fragments: fragmentedImage.fragments.length,
+        dimensions: fragmentedImage.originalDimensions,
+        fragmentDimensions: fragmentedImage.fragmentDimensions
+      });
+      return;
+    }
+
+    const index = parseInt(fragmentIndex);
+    if (isNaN(index) || index < 0 || index >= fragmentedImage.fragments.length) {
+      return res.status(400).json({ error: 'Invalid fragment index' });
+    }
+
+    const fragment = fragmentedImage.fragments[index];
+    
+    // Log fragment access
+    await secureImageService.logImageAccess(
+      photoId,
+      req.event.id,
+      req.clientInfo,
+      `fragment_${index}`
+    );
+
+    res.set({
+      'Content-Type': 'image/jpeg',
+      'Content-Length': fragment.buffer.length,
+      'X-Fragment-Index': index,
+      'X-Fragment-Position': JSON.stringify(fragment.position)
+    });
+
+    res.send(fragment.buffer);
+
+  } catch (error) {
+    logger.error('Error serving image fragment', {
+      error: error.message,
+      fragmentIndex,
+      photoId
+    });
+    res.status(500).json({ error: 'Failed to serve image fragment' });
+  }
+}
+
+/**
+ * Download protected image with watermark
+ */
+router.get('/:slug/secure-download/:photoId/:token',
+  secureImageMiddleware.secureImageAccess,
+  async (req, res, next) => {
+    // Add slug to request for verifyGalleryAccess
+    req.requestedSlug = req.params.slug;
+    next();
+  },
+  verifyGalleryAccess,
+  async (req, res) => {
+    try {
+      const { photoId, token } = req.params;
+
+      // Check if downloads are allowed
+      if (req.event.allow_downloads === false) {
+        return res.status(403).json({ error: 'Downloads are disabled for this gallery' });
+      }
+
+      // Verify secure token
+      const tokenValidation = secureImageService.verifySecureToken(
+        token,
+        req.clientInfo.fingerprint
+      );
+
+      if (!tokenValidation.valid) {
+        return res.status(403).json({ error: 'Invalid or expired token' });
+      }
+
+      // Verify photo exists
+      const photo = await db('photos')
+        .where({ id: photoId, event_id: req.event.id })
+        .first();
+
+      if (!photo) {
+        return res.status(404).json({ error: 'Photo not found' });
+      }
+
+      let filePath;
+      try {
+        filePath = resolvePhotoFilePath(req.event, photo);
+      } catch (resolveError) {
+        logger.error('Failed to resolve photo path for secure download', {
+          slug: req.params.slug,
+          photoId,
+          eventId: req.event.id,
+          error: resolveError.message,
+        });
+        return res.status(404).json({ error: 'Photo file not found' });
+      }
+
+      // Apply watermark if enabled
+      const watermarkService = require('../services/watermarkService');
+      const watermarkSettings = await watermarkService.getWatermarkSettings();
+      
+      let fileBuffer;
+      if (watermarkSettings && watermarkSettings.enabled) {
+        fileBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
+      } else {
+        const fs = require('fs').promises;
+        fileBuffer = await fs.readFile(filePath);
+      }
+
+      // Update download count
+      await db('photos').where('id', photoId).increment('download_count', 1);
+
+      // Log download
+      await secureImageService.logImageAccess(
+        photoId,
+        req.event.id,
+        req.clientInfo,
+        'download'
+      );
+
+      res.set({
+        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Disposition': `attachment; filename="${photo.filename}"`,
+        'Content-Length': fileBuffer.length,
+        'X-Download-Protected': 'true'
+      });
+
+      res.send(fileBuffer);
+
+    } catch (error) {
+      logger.error('Error serving secure download', {
+        error: error.message,
+        photoId: req.params.photoId
+      });
+      res.status(500).json({ error: 'Failed to download image' });
+    }
+  }
+);
+
+/**
+ * Get security statistics for monitoring
+ */
+router.get('/security/stats', async (req, res) => {
+  try {
+    // Only allow admin access
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+
+    const jwt = require('jsonwebtoken');
+    // Try to verify with issuer first, fallback to no issuer for backward compatibility
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth'
+      });
+    } catch (issuerError) {
+      // If verification fails with issuer, try without issuer (backward compatibility)
+      if (issuerError.name === 'JsonWebTokenError' && issuerError.message.includes('jwt issuer invalid')) {
+        decoded = jwt.verify(token, process.env.JWT_SECRET);
+      } else {
+        throw issuerError;
+      }
+    }
+    const admin = await db('admin_users').where({ id: decoded.id }).first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+
+    // Get security statistics
+    const stats = {
+      middleware: secureImageMiddleware.getSecurityStatus(),
+      recentAccess: await getRecentAccessStats(),
+      suspiciousActivity: await getSuspiciousActivityStats()
+    };
+
+    res.json(stats);
+
+  } catch (error) {
+    logger.error('Error getting security stats', { error: error.message });
+    res.status(500).json({ error: 'Failed to get security stats' });
+  }
+});
+
+/**
+ * Get recent access statistics
+ */
+async function getRecentAccessStats() {
+  try {
+    const hourAgo = new Date(Date.now() - 3600000).toISOString();
+    
+    const stats = await db('image_access_logs')
+      .where('accessed_at', '>', hourAgo)
+      .select('access_type')
+      .count('* as count')
+      .groupBy('access_type');
+
+    return stats.reduce((acc, stat) => {
+      acc[stat.access_type] = parseInt(stat.count);
+      return acc;
+    }, {});
+  } catch (error) {
+    console.error('Error getting recent access stats:', error);
+    return {};
+  }
+}
+
+/**
+ * Get suspicious activity statistics
+ */
+async function getSuspiciousActivityStats() {
+  try {
+    const hourAgo = new Date(Date.now() - 3600000).toISOString();
+    
+    const suspiciousCount = await db('image_access_logs')
+      .where('accessed_at', '>', hourAgo)
+      .where('access_type', 'like', '%suspicious%')
+      .count('* as count')
+      .first();
+
+    const uniqueIPs = await db('image_access_logs')
+      .where('accessed_at', '>', hourAgo)
+      .countDistinct('client_ip as count')
+      .first();
+
+    return {
+      suspiciousEvents: parseInt(suspiciousCount.count),
+      uniqueIPs: parseInt(uniqueIPs.count)
+    };
+  } catch (error) {
+    console.error('Error getting suspicious activity stats:', error);
+    return { suspiciousEvents: 0, uniqueIPs: 0 };
+  }
+}
+
+module.exports = router;

backend/src/services/emailProcessor.js

@@ -132,6 +132,12 @@ async function processTemplate(template, variables, language = 'en') {
       ? '(Aus Sicherheitsgründen nicht angezeigt)' 
       : '(Not shown for security reasons)';
   }
+
+  if (processedVariables.gallery_password === 'No password required') {
+    processedVariables.gallery_password = language === 'de'
+      ? 'Kein Passwort erforderlich'
+      : 'No password required';
+  }
   
   // Format dates if they exist
   if (processedVariables.event_date) {
@@ -546,4 +552,4 @@ module.exports = {
   queueEmail,
   stopEmailQueueProcessor,
   testEmailConnection
-};
+};

backend/src/services/externalMediaService.js

@@ -0,0 +1,109 @@
+const fs = require('fs').promises;
+const fsSync = require('fs');
+const path = require('path');
+const { safePathJoin } = require('../utils/fileSecurityUtils');
+
+let cachedRoot = null;
+
+function resolveDefaultRoot() {
+  const containerDefault = '/external-media';
+  try {
+    if (fsSync.existsSync(containerDefault)) {
+      return containerDefault;
+    }
+  } catch (error) {
+    // ignore lookup errors, fallback below
+  }
+
+  const localFallback = path.resolve(__dirname, '../../..', 'storage/external-media');
+  try {
+    if (fsSync.existsSync(localFallback)) {
+      return localFallback;
+    }
+  } catch (error) {
+    // ignore and return container default
+  }
+
+  return containerDefault;
+}
+
+function getExternalMediaRoot() {
+  if (cachedRoot) {
+    return cachedRoot;
+  }
+
+  const configured = process.env.EXTERNAL_MEDIA_ROOT;
+  if (configured && configured.trim()) {
+    const resolvedConfigured = path.resolve(configured.trim());
+    try {
+      if (fsSync.existsSync(resolvedConfigured)) {
+        cachedRoot = resolvedConfigured;
+        return cachedRoot;
+      }
+    } catch (error) {
+      // ignore lookup errors and fall back to defaults
+    }
+  }
+
+  cachedRoot = resolveDefaultRoot();
+  return cachedRoot;
+}
+
+function isUnderRoot(p) {
+  const root = path.resolve(getExternalMediaRoot());
+  const resolved = path.resolve(p);
+  return resolved === root || resolved.startsWith(root + path.sep);
+}
+
+async function list(relativePath = '') {
+  const root = getExternalMediaRoot();
+  // Normalize and ensure safe join under root
+  const targetDir = safePathJoin(root, relativePath || '.');
+
+  const entries = [];
+  try {
+    const dirents = await fs.readdir(targetDir, { withFileTypes: true });
+    for (const d of dirents) {
+      // Skip hidden files and directories
+      if (d.name.startsWith('.')) continue;
+      const full = path.join(targetDir, d.name);
+      const stat = await fs.stat(full).catch(() => null);
+      if (!stat) continue;
+
+      if (d.isDirectory()) {
+        entries.push({ name: d.name, type: 'dir' });
+      } else if (d.isFile()) {
+        const ext = path.extname(d.name).toLowerCase();
+        if (['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) {
+          entries.push({ name: d.name, type: 'file', size: stat.size, mtime: stat.mtime });
+        }
+      }
+    }
+  } catch (e) {
+    // Propagate errors for caller to handle (e.g., invalid path)
+    throw e;
+  }
+
+  const rootResolved = path.resolve(root);
+  const currentResolved = path.resolve(targetDir);
+  const canNavigateUp = currentResolved !== rootResolved;
+
+  // Return normalized relative path from root
+  const relFromRoot = path.relative(rootResolved, currentResolved);
+
+  return { path: relFromRoot, entries, canNavigateUp };
+}
+
+function resolveExternalPath(event, relpath) {
+  const root = getExternalMediaRoot();
+  const base = event?.external_path ? path.join(event.external_path) : '';
+  const combined = base ? path.join(base, relpath || '') : (relpath || '');
+  return safePathJoin(root, combined);
+}
+
+module.exports = {
+  getExternalMediaRoot,
+  isUnderRoot,
+  list,
+  resolveExternalPath,
+};

backend/src/services/feedbackService.js

@@ -120,7 +120,7 @@ class FeedbackService {
       }
       
       // Insert new feedback
-      const [id] = await db('photo_feedback').insert({
+      const result = await db('photo_feedback').insert({
         photo_id: photoId,
         event_id: eventId,
         feedback_type,
@@ -134,7 +134,9 @@ class FeedbackService {
         is_approved: feedback_type !== 'comment' || !feedbackData.moderate_comments,
         created_at: new Date(),
         updated_at: new Date()
-      });
+      }).returning('id');
+      
+      const id = result[0]?.id || result[0];
       
       // Update photo stats
       await this.updatePhotoFeedbackStats(photoId);
@@ -175,7 +177,7 @@ class FeedbackService {
       
       const feedback = await query
         .orderBy('created_at', 'desc')
-        .select('id', 'feedback_type', 'rating', 'comment_text', 'guest_name', 'created_at');
+        .select('id', 'feedback_type', 'rating', 'comment_text', 'guest_name', 'created_at', 'is_approved', 'is_hidden');
       
       return feedback;
     } catch (error) {
@@ -388,6 +390,76 @@ class FeedbackService {
       throw error;
     }
   }
+
+  /**
+   * Get filtered photos based on feedback criteria
+   * @param {number} eventId - Event ID
+   * @param {string} guestIdentifier - Guest identifier
+   * @param {object} filters - Filter criteria
+   * @param {boolean} filters.liked - Include liked photos
+   * @param {boolean} filters.favorited - Include favorited photos
+   * @param {string} filters.operator - 'AND' or 'OR' for multiple filters
+   * @returns {Promise<number[]>} Array of photo IDs that match criteria
+   */
+  async getFilteredPhotos(eventId, guestIdentifier, filters = {}) {
+    try {
+      const { liked, favorited, operator = 'OR' } = filters;
+      
+      // If no filters specified, return all photos
+      if (!liked && !favorited) {
+        const allPhotos = await db('photos')
+          .where('event_id', eventId)
+          .select('id');
+        return allPhotos.map(p => p.id);
+      }
+      
+      // Build query based on filters
+      let query = db('photo_feedback')
+        .where('event_id', eventId)
+        .where('guest_identifier', guestIdentifier)
+        .where('is_hidden', false);
+      
+      // Apply filter logic
+      if (operator === 'AND' && liked && favorited) {
+        // For AND operation, we need photos that have both types of feedback
+        const likedPhotos = await db('photo_feedback')
+          .where('event_id', eventId)
+          .where('guest_identifier', guestIdentifier)
+          .where('feedback_type', 'like')
+          .where('is_hidden', false)
+          .select('photo_id');
+        
+        const favoritedPhotos = await db('photo_feedback')
+          .where('event_id', eventId)
+          .where('guest_identifier', guestIdentifier)
+          .where('feedback_type', 'favorite')
+          .where('is_hidden', false)
+          .select('photo_id');
+        
+        const likedIds = new Set(likedPhotos.map(p => p.photo_id));
+        const favoritedIds = new Set(favoritedPhotos.map(p => p.photo_id));
+        
+        // Return intersection of both sets
+        return Array.from(likedIds).filter(id => favoritedIds.has(id));
+      } else {
+        // OR operation or single filter
+        const feedbackTypes = [];
+        if (liked) feedbackTypes.push('like');
+        if (favorited) feedbackTypes.push('favorite');
+        
+        query.whereIn('feedback_type', feedbackTypes);
+      }
+      
+      const filteredPhotos = await query
+        .distinct('photo_id')
+        .select('photo_id');
+      
+      return filteredPhotos.map(p => p.photo_id);
+    } catch (error) {
+      logger.error('Error getting filtered photos:', error);
+      throw error;
+    }
+  }
 }
 
 module.exports = new FeedbackService();

backend/src/services/imageProcessor.js

@@ -2,21 +2,69 @@ const sharp = require('sharp');
 const path = require('path');
 const fs = require('fs').promises;
 const logger = require('../utils/logger');
+const { db } = require('../database/db');
 
 // Configure sharp for better memory management with large batches
 sharp.cache(false); // Disable cache to prevent memory buildup
 sharp.concurrency(2); // Limit concurrent operations
 
-const THUMBNAIL_WIDTH = 300;
+// Default thumbnail settings
+const DEFAULT_THUMBNAIL_WIDTH = 300;
+const DEFAULT_THUMBNAIL_HEIGHT = 300;
+const DEFAULT_THUMBNAIL_FIT = 'cover'; // 'cover' for square crops
+const DEFAULT_THUMBNAIL_QUALITY = 85;
+const DEFAULT_THUMBNAIL_FORMAT = 'jpeg';
+
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const getThumbnailPath = () => path.join(getStoragePath(), 'thumbnails');
 
+// Get thumbnail settings from database
+async function getThumbnailSettings() {
+  try {
+    const settings = await db('app_settings')
+      .whereIn('setting_key', [
+        'thumbnail_width',
+        'thumbnail_height',
+        'thumbnail_fit',
+        'thumbnail_quality',
+        'thumbnail_format'
+      ])
+      .select('setting_key', 'setting_value');
+    
+    const settingsMap = {};
+    settings.forEach(s => {
+      settingsMap[s.setting_key] = s.setting_value;
+    });
+    
+    return {
+      width: parseInt(settingsMap.thumbnail_width) || DEFAULT_THUMBNAIL_WIDTH,
+      height: parseInt(settingsMap.thumbnail_height) || DEFAULT_THUMBNAIL_HEIGHT,
+      fit: settingsMap.thumbnail_fit || DEFAULT_THUMBNAIL_FIT,
+      quality: parseInt(settingsMap.thumbnail_quality) || DEFAULT_THUMBNAIL_QUALITY,
+      format: settingsMap.thumbnail_format || DEFAULT_THUMBNAIL_FORMAT
+    };
+  } catch (error) {
+    // If database is not ready or settings don't exist, use defaults
+    logger.warn('Could not fetch thumbnail settings, using defaults:', error.message);
+    return {
+      width: DEFAULT_THUMBNAIL_WIDTH,
+      height: DEFAULT_THUMBNAIL_HEIGHT,
+      fit: DEFAULT_THUMBNAIL_FIT,
+      quality: DEFAULT_THUMBNAIL_QUALITY,
+      format: DEFAULT_THUMBNAIL_FORMAT
+    };
+  }
+}
+
 async function generateThumbnail(imagePath, options = {}) {
   const filename = path.basename(imagePath);
   const thumbnailFilename = `thumb_${filename}`;
   const thumbnailDir = getThumbnailPath();
   const thumbnailPath = path.join(thumbnailDir, thumbnailFilename);
   
+  // Get thumbnail settings
+  const settings = await getThumbnailSettings();
+  
   // Ensure thumbnail directory exists
   await fs.mkdir(thumbnailDir, { recursive: true });
   
@@ -38,22 +86,43 @@ async function generateThumbnail(imagePath, options = {}) {
       throw new Error('Invalid image metadata - file may be incomplete');
     }
     
-    // Generate thumbnail with memory-efficient settings and error handling
-    await sharp(imagePath, { 
+    // Create sharp instance with memory-efficient settings
+    let sharpInstance = sharp(imagePath, { 
       limitInputPixels: 268402689, // ~16k x 16k max
       sequentialRead: true, // More memory efficient for large images
       failOnError: false // Don't fail on minor issues
-    })
-      .resize(THUMBNAIL_WIDTH, null, {
-        withoutEnlargement: true,
-        fit: 'inside'
-      })
-      .jpeg({ 
-        quality: 80,
+    });
+    
+    // Apply resize with configured settings
+    // For square thumbnails with 'cover' fit, we crop to center
+    sharpInstance = sharpInstance.resize(settings.width, settings.height, {
+      withoutEnlargement: true,
+      fit: settings.fit, // 'cover' will crop to fill the exact dimensions
+      position: 'center' // Center the crop for better composition
+    });
+    
+    // Apply format-specific options
+    if (settings.format === 'jpeg') {
+      sharpInstance = sharpInstance.jpeg({ 
+        quality: settings.quality,
         progressive: true, // Progressive JPEG for better loading
         mozjpeg: true // Better compression
-      })
-      .toFile(thumbnailPath);
+      });
+    } else if (settings.format === 'png') {
+      sharpInstance = sharpInstance.png({
+        quality: settings.quality,
+        compressionLevel: 9,
+        progressive: true
+      });
+    } else if (settings.format === 'webp') {
+      sharpInstance = sharpInstance.webp({
+        quality: settings.quality,
+        effort: 4 // Balance between speed and compression
+      });
+    }
+    
+    // Save the thumbnail
+    await sharpInstance.toFile(thumbnailPath);
     
     // Verify the thumbnail was created successfully
     const stats = await fs.stat(thumbnailPath);
@@ -63,7 +132,8 @@ async function generateThumbnail(imagePath, options = {}) {
     
     return path.relative(getStoragePath(), thumbnailPath);
   } catch (error) {
-    logger.error(`Failed to generate thumbnail for ${filename}:`, error.message);
+    const msg = (error && error.message) ? error.message : String(error);
+    logger.error(`Failed to generate thumbnail for ${filename}: ${msg}`);
     
     // Clean up any partially created file
     try {
@@ -102,8 +172,18 @@ async function isThumbnailValid(thumbnailPath) {
  * Regenerate thumbnail if it's broken or missing
  */
 async function ensureThumbnail(photo) {
-  const storagePath = getStoragePath();
-  const originalPath = path.join(storagePath, 'events/active', photo.path);
+  const { db } = require('../database/db');
+  const { resolvePhotoFilePath } = require('./photoResolver');
+  let originalPath;
+  try {
+    const event = await db('events').where('id', photo.event_id).first();
+    originalPath = resolvePhotoFilePath(event, photo);
+    logger.info(`Ensuring thumbnail for photo ${photo.id} from source: ${originalPath}`);
+  } catch (e) {
+    const msg = (e && e.message) ? e.message : String(e);
+    logger.error(`Failed to resolve original path for thumbnail (photo ${photo.id}): ${msg}`);
+    return null;
+  }
   
   // Check if thumbnail exists and is valid
   if (photo.thumbnail_path) {

backend/src/services/photoProcessor.js

@@ -7,9 +7,32 @@ const { generatePhotoFilename } = require('../utils/filenameSanitizer');
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 
+function normalizeFiles(files) {
+  if (!files) return [];
+  if (Array.isArray(files)) return files.filter(Boolean);
+
+  // Multer may expose files as an iterable object
+  if (typeof files[Symbol.iterator] === 'function') {
+    return Array.from(files).filter(Boolean);
+  }
+
+  if (typeof files === 'object') {
+    return Object.values(files)
+      .flatMap((value) => (Array.isArray(value) ? value : [value]))
+      .filter(Boolean);
+  }
+
+  return [];
+}
+
 async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categoryId = null) {
   const uploadedPhotos = [];
-  
+  const fileList = normalizeFiles(files);
+
+  if (fileList.length === 0) {
+    return uploadedPhotos;
+  }
+
   // Get event details
   const event = await db('events').where({ id: eventId }).first();
   if (!event) {
@@ -17,43 +40,34 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
   }
   
   // Process each file
-  for (const file of files) {
+  for (const file of fileList) {
     const trx = await db.transaction();
     
     try {
-      // Get category info if provided
-      let category = null;
+      // Count existing photos to generate sequence number
       let counter = 1;
-      const parsedCategoryId = categoryId ? parseInt(categoryId) : null;
+      let photoType = 'individual'; // default type
       
-      if (parsedCategoryId) {
-        // Get category and update counter
-        category = await trx('photo_categories')
-          .where({ id: parsedCategoryId })
-          .first();
-        
-        if (category) {
-          counter = (category.photo_counter || 0) + 1;
-          await trx('photo_categories')
-            .where({ id: parsedCategoryId })
-            .update({ photo_counter: counter });
-        }
-      } else {
-        // For uncategorized photos, count existing uncategorized photos
-        const uncategorizedCount = await trx('photos')
-          .where({ event_id: eventId })
-          .whereNull('category_id')
-          .count('id as count')
-          .first();
-        
-        counter = (uncategorizedCount.count || 0) + 1;
+      // If categoryId is provided and matches photo types, use it as type
+      if (categoryId === 'collage') {
+        photoType = 'collage';
       }
       
+      // Count existing photos of the same type for numbering
+      const existingCount = await trx('photos')
+        .where({ event_id: eventId, type: photoType })
+        .count('id as count')
+        .first();
+
+      const existingCountValue = Number(existingCount?.count ?? 0);
+      counter = existingCountValue + 1;
+      
       // Generate new filename
       const extension = path.extname(file.originalname);
+      const categoryName = photoType === 'collage' ? 'collages' : 'individual';
       const newFilename = generatePhotoFilename(
         event.event_name,
-        category ? category.name : 'uncategorized',
+        categoryName,
         counter,
         extension
       );
@@ -63,9 +77,24 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
       await fs.mkdir(destPath, { recursive: true });
       
       const newPath = path.join(destPath, newFilename);
+      const tempPath = file?.path || file?.filepath || file?.tempFilePath;
+
+      if (!tempPath) {
+        throw new Error('Uploaded file is missing a temporary path');
+      }
+
       // Use copyFile and unlink instead of rename to avoid cross-device issues
-      await fs.copyFile(file.path, newPath);
-      await fs.unlink(file.path);
+      try {
+        await fs.copyFile(tempPath, newPath);
+      } finally {
+        try {
+          await fs.unlink(tempPath);
+        } catch (unlinkErr) {
+          if (unlinkErr?.code !== 'ENOENT') {
+            console.warn(`Failed to clean up temp upload ${tempPath}:`, unlinkErr);
+          }
+        }
+      }
       
       // Generate thumbnail
       const thumbnailPath = await generateThumbnail(newPath);
@@ -76,17 +105,46 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
       const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
       
       // Add to database with uploaded_by field
-      const [photoId] = await trx('photos').insert({
-        event_id: eventId,
-        filename: newFilename,
-        path: relativePath,
-        thumbnail_path: relativeThumbPath,
-        category_id: parsedCategoryId || null,
-        type: 'individual',
-        size_bytes: file.size,
-        uploaded_by: uploadedBy
-      });
-      
+      let insertResult;
+      const clientName = trx?.client?.config?.client;
+      const supportsReturning = ['pg', 'postgres', 'postgresql'].includes(clientName);
+
+      if (supportsReturning) {
+        insertResult = await trx('photos')
+          .insert({
+            event_id: eventId,
+            filename: newFilename,
+            path: relativePath,
+            thumbnail_path: relativeThumbPath,
+            type: photoType,
+            size_bytes: file.size,
+            uploaded_by: uploadedBy,
+            source_origin: 'managed'
+          })
+          .returning('id');
+      } else {
+        insertResult = await trx('photos').insert({
+          event_id: eventId,
+          filename: newFilename,
+          path: relativePath,
+          thumbnail_path: relativeThumbPath,
+          type: photoType,
+          size_bytes: file.size,
+          uploaded_by: uploadedBy,
+          source_origin: 'managed'
+        });
+      }
+
+      const insertedId = Array.isArray(insertResult)
+        ? (insertResult[0]?.id ?? insertResult[0])
+        : insertResult;
+
+      const photoId = typeof insertedId === 'object' ? insertedId.id : insertedId;
+
+      if (photoId === undefined || photoId === null) {
+        throw new Error('Failed to determine inserted photo ID');
+      }
+
       // Commit transaction
       await trx.commit();
       
@@ -94,8 +152,7 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
         id: photoId,
         filename: newFilename,
         size: file.size,
-        category_id: parsedCategoryId || null,
-        uploaded_by: uploadedBy
+        type: photoType
       });
     } catch (error) {
       console.error(`Error processing file ${file.originalname}:`, error);
@@ -109,4 +166,4 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
 
 module.exports = {
   processUploadedPhotos
-};
+};

backend/src/services/photoResolver.js

@@ -0,0 +1,52 @@
+const path = require('path');
+const { resolveExternalPath } = require('./externalMediaService');
+const { safePathJoin } = require('../utils/fileSecurityUtils');
+
+const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+
+/**
+ * Resolve absolute photo file path based on event + photo origin
+ * Managed: storage/events/active + photo.path (legacy variants supported)
+ * External reference: EXTERNAL_MEDIA_ROOT + event.external_path + photo.external_relpath
+ */
+function resolvePhotoFilePath(event, photo) {
+  if (!event || !photo) throw new Error('resolvePhotoFilePath requires event and photo');
+
+  const isExternal = photo.source_origin === 'external' ||
+    (!!photo.external_relpath && (event.source_mode === 'reference' || event.source_mode === 'external'));
+
+  if (isExternal) {
+    if (!photo.external_relpath) {
+      throw new Error('Missing external_relpath for external photo');
+    }
+    // Normalize duplicate leaf segments (e.g., event.external_path ends with 'individual'
+    // and external_relpath starts with 'individual/') to avoid double segment like
+    // '/external-media/.../individual/individual/file.jpg'
+    let rel = photo.external_relpath;
+    try {
+      const lastSeg = path.basename(event.external_path || '');
+      const firstSeg = rel.split(path.sep)[0];
+      if (lastSeg && firstSeg && lastSeg === firstSeg) {
+        rel = rel.split(path.sep).slice(1).join(path.sep) || '';
+      }
+    } catch (_) {
+      // ignore normalization errors
+    }
+    return resolveExternalPath(event, rel);
+  }
+
+  const storagePath = getStoragePath();
+  const eventsRoot = path.join(storagePath, 'events/active');
+
+  if (photo.path && photo.path.startsWith('events/active/')) {
+    // Legacy paths already include prefix; normalize via safe join
+    return safePathJoin(storagePath, photo.path.replace(/^events\/active\/?/, 'events/active/'));
+  }
+
+  const relativeSegment = photo.path ? photo.path.replace(/^\/+/, '') : '';
+  return safePathJoin(eventsRoot, relativeSegment);
+}
+
+module.exports = {
+  resolvePhotoFilePath,
+};

backend/src/services/publicSiteService.js

@@ -0,0 +1,262 @@
+const crypto = require('crypto');
+const sanitizeHtml = require('sanitize-html');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+const { sanitizeCss } = require('../utils/cssSanitizer');
+const {
+  DEFAULT_PUBLIC_SITE_TITLE,
+  DEFAULT_PUBLIC_SITE_HTML,
+  DEFAULT_PUBLIC_SITE_CSS,
+} = require('../constants/publicSiteDefaults');
+
+const CACHE_TTL_MS = Number(process.env.PUBLIC_SITE_CACHE_TTL_MS || 60_000);
+
+let cachedPayload = null;
+let cacheExpiresAt = 0;
+
+const ALLOWED_HTML_TAGS = [
+  'a', 'article', 'aside', 'blockquote', 'br', 'button', 'caption', 'div',
+  'em', 'figure', 'figcaption', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+  'header', 'hr', 'img', 'li', 'main', 'nav', 'ol', 'p', 'section', 'span',
+  'strong', 'sup', 'sub', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr',
+  'ul'
+];
+
+const COMMON_ATTRIBUTES = ['class', 'id', 'role', 'aria-label', 'aria-hidden'];
+
+function parseSettingValue(value) {
+  if (value === null || value === undefined) {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    return value;
+  }
+}
+
+async function fetchPublicSiteSettings() {
+  const rows = await db('app_settings')
+    .whereIn('setting_key', [
+      'general_public_site_enabled',
+      'general_public_site_html',
+      'general_public_site_custom_css'
+    ]);
+
+  const map = {
+    general_public_site_enabled: false,
+    general_public_site_html: DEFAULT_PUBLIC_SITE_HTML,
+    general_public_site_custom_css: ''
+  };
+
+  rows.forEach((row) => {
+    const parsed = parseSettingValue(row.setting_value);
+    map[row.setting_key] = parsed == null ? map[row.setting_key] : parsed;
+  });
+
+  return map;
+}
+
+function sanitizeBrandUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) {
+    return null;
+  }
+
+  const trimmed = url.trim();
+  if (trimmed.startsWith('javascript:')) {
+    return null;
+  }
+
+  return trimmed;
+}
+
+async function fetchBrandingContext() {
+  const rows = await db('app_settings')
+    .whereIn('setting_key', [
+      'branding_company_name',
+      'branding_company_tagline',
+      'branding_support_email',
+      'branding_logo_url',
+      'branding_footer_text',
+      'theme_config'
+    ]);
+
+  const context = {
+    companyName: null,
+    companyTagline: null,
+    supportEmail: null,
+    logoUrl: null,
+    footerText: null,
+    colors: {
+      primary: '#16a34a',
+      accent: '#0f766e',
+      background: '#f4fbf6',
+      text: '#0f172a'
+    }
+  };
+
+  rows.forEach((row) => {
+    const parsed = parseSettingValue(row.setting_value);
+    switch (row.setting_key) {
+    case 'branding_company_name':
+      context.companyName = parsed || context.companyName;
+      break;
+    case 'branding_company_tagline':
+      context.companyTagline = parsed || context.companyTagline;
+      break;
+    case 'branding_support_email':
+      context.supportEmail = parsed || context.supportEmail;
+      break;
+    case 'branding_logo_url':
+      context.logoUrl = sanitizeBrandUrl(parsed);
+      break;
+    case 'branding_footer_text':
+      context.footerText = parsed || context.footerText;
+      break;
+    case 'theme_config': {
+      try {
+        const themeConfig = typeof parsed === 'string' ? JSON.parse(parsed) : parsed;
+        if (themeConfig && typeof themeConfig === 'object') {
+          context.colors.primary = themeConfig.primaryColor || context.colors.primary;
+          context.colors.accent = themeConfig.accentColor || context.colors.accent;
+          context.colors.background = themeConfig.backgroundColor || context.colors.background;
+          context.colors.text = themeConfig.textColor || context.colors.text;
+        }
+      } catch (error) {
+        logger.warn('Failed to parse theme configuration for public site', { error: error.message });
+      }
+      break;
+    }
+    default:
+      break;
+    }
+  });
+
+  return context;
+}
+
+function sanitizeHtmlPayload(html) {
+  const sanitized = sanitizeHtml(html || '', {
+    allowedTags: ALLOWED_HTML_TAGS,
+    allowedAttributes: {
+      '*': COMMON_ATTRIBUTES,
+      a: ['href', 'target', 'rel', ...COMMON_ATTRIBUTES],
+      img: ['src', 'alt', 'title', 'width', 'height', 'loading', 'decoding', ...COMMON_ATTRIBUTES],
+      button: ['type', ...COMMON_ATTRIBUTES]
+    },
+    allowedSchemes: ['http', 'https', 'mailto', 'tel'],
+    allowedSchemesByTag: { img: ['http', 'https', 'data'] },
+    transformTags: {
+      a: (tagName, attribs) => {
+        const transformed = { ...attribs };
+        if (transformed.href && !/^https?:|^mailto:|^tel:/i.test(transformed.href)) {
+          // sanitize-html will remove disallowed schemes, but we guard as well
+          delete transformed.href;
+        }
+
+        if (transformed.target === '_blank') {
+          transformed.rel = transformed.rel ? `${transformed.rel} noopener noreferrer`.trim() : 'noopener noreferrer';
+        }
+
+        return { tagName, attribs: transformed };
+      }
+    },
+    nonBooleanAttributes: ['target'],
+    parser: {
+      lowerCaseAttributeNames: true
+    }
+  });
+
+  return sanitized;
+}
+
+function buildCachedPayload(raw) {
+  const sanitizedHtml = sanitizeHtmlPayload(raw.publicSite.general_public_site_html || DEFAULT_PUBLIC_SITE_HTML);
+  const sanitizedCss = sanitizeCss(raw.publicSite.general_public_site_custom_css || '');
+  const enabled = Boolean(raw.publicSite.general_public_site_enabled);
+  const title = raw.branding.companyName || DEFAULT_PUBLIC_SITE_TITLE;
+  const baseCss = sanitizeCss(DEFAULT_PUBLIC_SITE_CSS);
+
+  const substitutedHtml = applyBrandTokens(sanitizedHtml, raw.branding);
+
+  const hash = crypto
+    .createHash('sha1')
+    .update(`${enabled}|${substitutedHtml}|${sanitizedCss}|${baseCss}|${JSON.stringify(raw.branding)}`)
+    .digest('hex');
+
+  return {
+    enabled,
+    html: substitutedHtml,
+    css: sanitizedCss,
+    baseCss,
+    title,
+    branding: raw.branding,
+    etag: `W/"${hash}"`
+  };
+}
+
+async function getPublicSitePayload({ bypassCache = false } = {}) {
+  if (!bypassCache && cachedPayload && Date.now() < cacheExpiresAt) {
+    return cachedPayload;
+  }
+
+  const [publicSite, branding] = await Promise.all([
+    fetchPublicSiteSettings(),
+    fetchBrandingContext()
+  ]);
+
+  const payload = buildCachedPayload({ publicSite, branding });
+
+  cachedPayload = payload;
+  cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+
+  return payload;
+}
+
+function clearPublicSiteCache() {
+  cachedPayload = null;
+  cacheExpiresAt = 0;
+}
+
+async function getDefaultPublicSitePayload() {
+  const branding = await fetchBrandingContext();
+  return buildCachedPayload({
+    publicSite: {
+      general_public_site_enabled: false,
+      general_public_site_html: DEFAULT_PUBLIC_SITE_HTML,
+      general_public_site_custom_css: ''
+    },
+    branding
+  });
+}
+
+async function getRawPublicSiteSettings() {
+  return fetchPublicSiteSettings();
+}
+
+function applyBrandTokens(html, branding) {
+  if (!html) {
+    return html;
+  }
+
+  const tokens = {
+    company_name: branding.companyName || '',
+    company_tagline: branding.companyTagline || '',
+    support_email: branding.supportEmail || '',
+    brand_logo_url: branding.logoUrl || '/picpeak-logo-transparent.png',
+    brand_primary_hex: branding.colors?.primary || '#2563eb',
+    brand_accent_hex: branding.colors?.accent || '#1d4ed8',
+    brand_background_hex: branding.colors?.background || '#f8fafc',
+    brand_text_hex: branding.colors?.text || '#0f172a'
+  };
+
+  return html.replace(/\{\{\s*(company_name|company_tagline|support_email|brand_logo_url|brand_primary_hex|brand_accent_hex|brand_background_hex|brand_text_hex)\s*\}\}/gi,
+    (_, key) => tokens[key] || '');
+}
+
+module.exports = {
+  getPublicSitePayload,
+  clearPublicSiteCache,
+  getDefaultPublicSitePayload,
+  getRawPublicSiteSettings
+};

backend/src/services/rateLimitService.js

@@ -2,6 +2,7 @@ const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const logger = require('../utils/logger');
+const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
 
 // Cache for rate limit settings
 let settingsCache = null;
@@ -95,12 +96,9 @@ function clearSettingsCache() {
  */
 function isAuthenticated(req) {
   try {
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      return false;
-    }
-
-    const token = authHeader.substring(7);
+    const slugMatch = req.path.match(/\/api\/(?:gallery|secure-images)\/([^\/]+)/);
+    const slug = slugMatch ? slugMatch[1] : req.requestedSlug;
+    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
     const decoded = jwt.verify(token, process.env.JWT_SECRET);
     
     // Check if token is valid
@@ -280,4 +278,4 @@ module.exports = {
   createAuthRateLimiter,
   isAuthenticated,
   shouldSkipRateLimit
-};
+};

backend/src/services/secureImageService.js

@@ -0,0 +1,431 @@
+const crypto = require('crypto');
+const sharp = require('sharp');
+const { db } = require('../database/db');
+const watermarkService = require('./watermarkService');
+const path = require('path');
+const fs = require('fs').promises;
+
+class SecureImageService {
+  constructor() {
+    this.tokenCache = new Map();
+    this.sessionTokens = new Map();
+    this.rateLimitCache = new Map();
+  }
+
+  /**
+   * Generate a secure, time-limited, single-use token for image access
+   */
+  generateSecureToken(photoId, sessionId, options = {}) {
+    const {
+      expiresIn = 300, // 5 minutes default
+      maxUses = 1,
+      clientFingerprint = '',
+      protectionLevel = 'standard'
+    } = options;
+
+    const tokenData = {
+      photoId: parseInt(photoId),
+      sessionId,
+      clientFingerprint,
+      expiresAt: Date.now() + (expiresIn * 1000),
+      maxUses,
+      usedCount: 0,
+      protectionLevel,
+      createdAt: Date.now()
+    };
+
+    // Create tamper-proof token
+    const tokenPayload = Buffer.from(JSON.stringify(tokenData)).toString('base64');
+    const imageSecret = process.env.IMAGE_SECRET || process.env.JWT_SECRET + '_IMAGE_PROTECTION';
+    const signature = crypto
+      .createHmac('sha256', process.env.JWT_SECRET + imageSecret)
+      .update(tokenPayload)
+      .digest('hex');
+    
+    const token = `${tokenPayload}.${signature}`;
+    
+    // Cache token with metadata
+    this.tokenCache.set(token, tokenData);
+    
+    // Set cleanup timer
+    setTimeout(() => {
+      this.tokenCache.delete(token);
+    }, expiresIn * 1000 + 60000); // Add 1 minute buffer
+
+    return token;
+  }
+
+  /**
+   * Verify and consume secure token
+   */
+  verifySecureToken(token, clientFingerprint = '') {
+    try {
+      const cached = this.tokenCache.get(token);
+      if (!cached) {
+        return { valid: false, reason: 'Token not found or expired' };
+      }
+
+      // Verify token integrity
+      const [payload, signature] = token.split('.');
+      const imageSecret = process.env.IMAGE_SECRET || process.env.JWT_SECRET + '_IMAGE_PROTECTION';
+      const expectedSignature = crypto
+        .createHmac('sha256', process.env.JWT_SECRET + imageSecret)
+        .update(payload)
+        .digest('hex');
+
+      if (signature !== expectedSignature) {
+        return { valid: false, reason: 'Token tampered' };
+      }
+
+      // Check expiration
+      if (Date.now() > cached.expiresAt) {
+        this.tokenCache.delete(token);
+        return { valid: false, reason: 'Token expired' };
+      }
+
+      // Check usage count
+      if (cached.usedCount >= cached.maxUses) {
+        return { valid: false, reason: 'Token max uses exceeded' };
+      }
+
+      // Verify client fingerprint for enhanced security
+      if (cached.protectionLevel === 'enhanced' && cached.clientFingerprint !== clientFingerprint) {
+        return { valid: false, reason: 'Client fingerprint mismatch' };
+      }
+
+      // Consume usage
+      cached.usedCount++;
+      
+      // Remove token if max uses reached
+      if (cached.usedCount >= cached.maxUses) {
+        this.tokenCache.delete(token);
+      }
+
+      return { 
+        valid: true, 
+        data: cached,
+        remaining: cached.maxUses - cached.usedCount
+      };
+    } catch (error) {
+      return { valid: false, reason: 'Token verification failed' };
+    }
+  }
+
+  /**
+   * Create client fingerprint from request
+   */
+  createClientFingerprint(req) {
+    const components = [
+      req.ip,
+      req.get('User-Agent') || '',
+      req.get('Accept-Language') || '',
+      req.get('Accept-Encoding') || ''
+    ];
+    
+    return crypto
+      .createHash('sha256')
+      .update(components.join('|'))
+      .digest('hex')
+      .substring(0, 16);
+  }
+
+  /**
+   * Rate limiting for image requests
+   */
+  checkRateLimit(clientId, limit = 50, windowMs = 60000) {
+    const now = Date.now();
+    const windowStart = now - windowMs;
+    
+    if (!this.rateLimitCache.has(clientId)) {
+      this.rateLimitCache.set(clientId, []);
+    }
+    
+    const requests = this.rateLimitCache.get(clientId);
+    
+    // Remove old requests outside the window
+    const recentRequests = requests.filter(timestamp => timestamp > windowStart);
+    this.rateLimitCache.set(clientId, recentRequests);
+    
+    if (recentRequests.length >= limit) {
+      return false;
+    }
+    
+    // Add current request
+    recentRequests.push(now);
+    return true;
+  }
+
+  /**
+   * Process image with protection measures
+   */
+  async processProtectedImage(imagePath, options = {}) {
+    const {
+      protectionLevel = 'standard',
+      quality = 85,
+      maxWidth = 1920,
+      maxHeight = 1080,
+      addFingerprint = true,
+      fragmentImage = false
+    } = options;
+
+    try {
+      let image = sharp(imagePath);
+      const metadata = await image.metadata();
+
+      // Resize if too large
+      if (metadata.width > maxWidth || metadata.height > maxHeight) {
+        image = image.resize(maxWidth, maxHeight, {
+          fit: 'inside',
+          withoutEnlargement: true
+        });
+      }
+
+      // Apply quality reduction for protection
+      if (protectionLevel === 'enhanced') {
+        quality = Math.min(quality, 70);
+      } else if (protectionLevel === 'maximum') {
+        quality = Math.min(quality, 60);
+      }
+
+      // Convert to appropriate format
+      image = image.jpeg({ quality, progressive: true });
+
+      // Add invisible watermark/fingerprint
+      if (addFingerprint) {
+        const fingerprint = crypto.randomBytes(16).toString('hex');
+        
+        // Embed fingerprint in metadata
+        image = image.withMetadata({
+          exif: {
+            [sharp.EXIF.IFD0.ImageDescription]: `Protected:${fingerprint}`
+          }
+        });
+      }
+
+      const buffer = await image.toBuffer();
+
+      // Fragment image if requested (for canvas reconstruction)
+      if (fragmentImage && protectionLevel === 'maximum') {
+        return await this.fragmentImageBuffer(buffer, metadata);
+      }
+
+      return buffer;
+    } catch (error) {
+      console.error('Error processing protected image:', error);
+      // Return original on error
+      return await fs.readFile(imagePath);
+    }
+  }
+
+  /**
+   * Fragment image into multiple pieces for canvas reconstruction
+   */
+  async fragmentImageBuffer(buffer, metadata) {
+    const { width, height } = metadata;
+    const fragments = [];
+    
+    // Create 3x3 grid of fragments
+    const cols = 3;
+    const rows = 3;
+    const fragmentWidth = Math.floor(width / cols);
+    const fragmentHeight = Math.floor(height / rows);
+
+    for (let row = 0; row < rows; row++) {
+      for (let col = 0; col < cols; col++) {
+        const left = col * fragmentWidth;
+        const top = row * fragmentHeight;
+        
+        const fragment = await sharp(buffer)
+          .extract({ 
+            left, 
+            top, 
+            width: fragmentWidth, 
+            height: fragmentHeight 
+          })
+          .toBuffer();
+          
+        fragments.push({
+          index: row * cols + col,
+          row,
+          col,
+          buffer: fragment,
+          position: { left, top, width: fragmentWidth, height: fragmentHeight }
+        });
+      }
+    }
+
+    return {
+      type: 'fragmented',
+      fragments,
+      originalDimensions: { width, height },
+      fragmentDimensions: { width: fragmentWidth, height: fragmentHeight, cols, rows }
+    };
+  }
+
+  /**
+   * Log image access for security monitoring
+   */
+  async logImageAccess(photoId, eventId, clientInfo, accessType = 'view', metadata = {}) {
+    try {
+      const logEntry = {
+        photo_id: photoId,
+        event_id: eventId,
+        client_ip: clientInfo.ip,
+        user_agent: clientInfo.userAgent?.substring(0, 500), // Limit length
+        access_type: accessType,
+        client_fingerprint: clientInfo.fingerprint?.substring(0, 32) || 'unknown',
+        accessed_at: new Date().toISOString(),
+        metadata: JSON.stringify({
+          timestamp: clientInfo.timestamp || Date.now(),
+          ...metadata
+        })
+      };
+
+      await db('image_access_logs').insert(logEntry);
+
+      // Check for rapid successive access (potential scraping)
+      if (accessType === 'view' || accessType === 'download') {
+        await this.checkForRapidAccess(clientInfo.fingerprint, photoId, eventId);
+      }
+
+    } catch (error) {
+      console.error('Error logging image access:', error);
+    }
+  }
+
+  /**
+   * Enhanced suspicious activity detection
+   */
+  async checkForRapidAccess(clientFingerprint, photoId, eventId = null) {
+    try {
+      const fiveMinutesAgo = new Date(Date.now() - 300000).toISOString();
+      
+      // Check accesses to same photo
+      const samePhotoAccess = await db('image_access_logs')
+        .where('client_fingerprint', clientFingerprint)
+        .where('photo_id', photoId)
+        .where('accessed_at', '>', fiveMinutesAgo)
+        .count('* as count')
+        .first();
+
+      // Check total accesses across all photos
+      const totalAccess = await db('image_access_logs')
+        .where('client_fingerprint', clientFingerprint)
+        .where('accessed_at', '>', fiveMinutesAgo)
+        .count('* as count')
+        .first();
+
+      const samePhotoCount = parseInt(samePhotoAccess.count);
+      const totalCount = parseInt(totalAccess.count);
+
+      // Flag if suspicious patterns detected
+      if (samePhotoCount > 5 || totalCount > 30) {
+        await this.flagSuspiciousActivity(
+          clientFingerprint, 
+          photoId, 
+          'rapid_access',
+          { samePhotoCount, totalCount, eventId }
+        );
+      }
+
+    } catch (error) {
+      console.error('Error checking for rapid access:', error);
+    }
+  }
+
+  /**
+   * Flag suspicious activity and take action
+   */
+  async flagSuspiciousActivity(clientFingerprint, photoId, reason, details = {}) {
+    try {
+      // Try to get event_id from photo
+      let eventId = details.eventId;
+      if (!eventId && photoId) {
+        const photo = await db('photos').where({ id: photoId }).first();
+        eventId = photo?.event_id;
+      }
+      
+      // Log the suspicious activity
+      await db('image_access_logs').insert({
+        photo_id: photoId,
+        event_id: eventId || 0, // Use 0 as a fallback for suspicious activity without event context
+        client_ip: details.clientIp || 'unknown',
+        client_fingerprint: clientFingerprint,
+        access_type: 'suspicious',
+        accessed_at: new Date().toISOString(),
+        metadata: JSON.stringify({
+          reason,
+          ...details,
+          flaggedAt: Date.now()
+        })
+      });
+
+      console.warn(`Suspicious activity flagged: ${reason}`, {
+        clientFingerprint,
+        photoId,
+        details
+      });
+
+      // If multiple suspicious activities, consider blocking
+      const recentSuspicious = await db('image_access_logs')
+        .where('client_fingerprint', clientFingerprint)
+        .where('access_type', 'suspicious')
+        .where('accessed_at', '>', new Date(Date.now() - 3600000).toISOString()) // Last hour
+        .count('* as count')
+        .first();
+
+      if (parseInt(recentSuspicious.count) >= 3) {
+        console.warn(`Client fingerprint flagged for blocking: ${clientFingerprint}`);
+        // This would be handled by the middleware's blocking system
+      }
+
+    } catch (error) {
+      console.error('Error flagging suspicious activity:', error);
+    }
+  }
+
+  /**
+   * Detect suspicious access patterns
+   */
+  async detectSuspiciousActivity(clientFingerprint, photoId) {
+    try {
+      const recentAccess = await db('image_access_logs')
+        .where('client_fingerprint', clientFingerprint)
+        .where('photo_id', photoId)
+        .where('accessed_at', '>', new Date(Date.now() - 300000).toISOString()) // Last 5 minutes
+        .count('* as count')
+        .first();
+
+      const accessCount = parseInt(recentAccess.count);
+      
+      // Flag if more than 10 accesses to same photo in 5 minutes
+      if (accessCount > 10) {
+        console.warn(`Suspicious activity detected: ${accessCount} accesses to photo ${photoId} from ${clientFingerprint}`);
+        return true;
+      }
+
+      return false;
+    } catch (error) {
+      console.error('Error detecting suspicious activity:', error);
+      return false;
+    }
+  }
+
+  /**
+   * Clean up expired tokens and logs
+   */
+  cleanup() {
+    // Clear expired rate limit entries
+    const now = Date.now();
+    for (const [clientId, requests] of this.rateLimitCache.entries()) {
+      const recent = requests.filter(timestamp => timestamp > now - 60000);
+      if (recent.length === 0) {
+        this.rateLimitCache.delete(clientId);
+      } else {
+        this.rateLimitCache.set(clientId, recent);
+      }
+    }
+  }
+}
+
+module.exports = new SecureImageService();

backend/src/services/storage/__tests__/s3Storage.test.js

@@ -1,5 +1,5 @@
 const S3StorageAdapter = require('../s3Storage');
-const { S3Client } = require('@aws-sdk/client-s3');
+const { S3Client, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command } = require('@aws-sdk/client-s3');
 const { Upload } = require('@aws-sdk/lib-storage');
 const fs = require('fs');
 const stream = require('stream');
@@ -24,6 +24,10 @@ describe('S3StorageAdapter', () => {
       send: mockSend
     };
     S3Client.mockImplementation(() => mockS3Client);
+
+    HeadBucketCommand.mockImplementation((input) => ({ input }));
+    HeadObjectCommand.mockImplementation((input) => ({ input }));
+    ListObjectsV2Command.mockImplementation((input) => ({ input }));
     
     // Create adapter instance
     s3Storage = new S3StorageAdapter({
@@ -70,11 +74,7 @@ describe('S3StorageAdapter', () => {
       const result = await s3Storage.testConnection();
       
       expect(result).toBe(true);
-      expect(mockSend).toHaveBeenCalledWith(
-        expect.objectContaining({
-          input: { Bucket: 'test-bucket' }
-        })
-      );
+      expect(HeadBucketCommand).toHaveBeenCalledWith({ Bucket: 'test-bucket' });
     });
     
     it('should throw error on connection failure', async () => {
@@ -132,24 +132,25 @@ describe('S3StorageAdapter', () => {
     
     it('should track upload progress', async () => {
       const onProgress = jest.fn();
-      let progressCallback;
-      
-      mockUpload.on.mockImplementation((event, callback) => {
-        if (event === 'httpUploadProgress') {
-          progressCallback = callback;
-        }
-        return mockUpload;
+      Upload.mockImplementation(() => {
+        const uploadInstance = {
+          on: jest.fn((event, handler) => {
+            if (event === 'httpUploadProgress') {
+              handler({ loaded: 512, total: 1024 });
+            }
+            return uploadInstance;
+          }),
+          done: mockDone
+        };
+        return uploadInstance;
       });
-      
+
       const uploadPromise = s3Storage.upload('/path/to/file.jpg', 'test-key', {
         onProgress
       });
-      
-      // Simulate progress
-      progressCallback({ loaded: 512, total: 1024 });
-      
+
       await uploadPromise;
-      
+
       expect(onProgress).toHaveBeenCalledWith(512, 1024);
     });
     
@@ -177,11 +178,10 @@ describe('S3StorageAdapter', () => {
       const result = await s3Storage.exists('test-key');
       
       expect(result).toBe(true);
-      expect(mockSend).toHaveBeenCalledWith(
-        expect.objectContaining({
-          input: { Bucket: 'test-bucket', Key: 'test-key' }
-        })
-      );
+      expect(HeadObjectCommand).toHaveBeenCalledWith({
+        Bucket: 'test-bucket',
+        Key: 'test-key'
+      });
     });
     
     it('should return false if object does not exist', async () => {
@@ -220,58 +220,51 @@ describe('S3StorageAdapter', () => {
     it('should retry on retryable errors', async () => {
       const retryableError = new Error('Connection reset');
       retryableError.code = 'ECONNRESET';
-      
-      // First attempt fails, second succeeds
-      mockSend
+
+      const operation = jest.fn()
         .mockRejectedValueOnce(retryableError)
-        .mockResolvedValueOnce({});
-      
-      // Mock setTimeout to speed up test
-      jest.useFakeTimers();
-      
-      const promise = s3Storage.exists('test-key');
-      
-      // Advance timers
-      jest.runAllTimers();
-      
-      const result = await promise;
-      
-      expect(result).toBe(true);
-      expect(mockSend).toHaveBeenCalledTimes(2);
-      
-      jest.useRealTimers();
+        .mockResolvedValueOnce('success');
+
+      const originalRandom = Math.random;
+      const originalDelay = s3Storage.config.retryDelay;
+      Math.random = jest.fn(() => 0);
+      s3Storage.config.retryDelay = 0;
+
+      const result = await s3Storage._retryOperation(operation);
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(2);
+
+      Math.random = originalRandom;
+      s3Storage.config.retryDelay = originalDelay;
     });
     
     it('should not retry on non-retryable errors', async () => {
       const nonRetryableError = new Error('Invalid credentials');
       nonRetryableError.code = 'InvalidCredentials';
       
-      mockSend.mockRejectedValueOnce(nonRetryableError);
-      
-      await expect(s3Storage.exists('test-key')).rejects.toThrow('Invalid credentials');
-      expect(mockSend).toHaveBeenCalledTimes(1);
+      const operation = jest.fn().mockRejectedValueOnce(nonRetryableError);
+
+      await expect(s3Storage._retryOperation(operation)).rejects.toThrow('Invalid credentials');
+      expect(operation).toHaveBeenCalledTimes(1);
     });
     
     it('should stop retrying after max attempts', async () => {
       const retryableError = new Error('Service unavailable');
       retryableError.code = 'ServiceUnavailable';
       
-      mockSend.mockRejectedValue(retryableError);
-      
-      // Mock setTimeout to speed up test
-      jest.useFakeTimers();
-      
-      const promise = s3Storage.exists('test-key');
-      
-      // Advance timers for all retries
-      for (let i = 0; i < 4; i++) {
-        jest.runAllTimers();
-      }
-      
-      await expect(promise).rejects.toThrow('Service unavailable');
-      expect(mockSend).toHaveBeenCalledTimes(4); // Initial + 3 retries
-      
-      jest.useRealTimers();
+      const operation = jest.fn().mockRejectedValue(retryableError);
+
+      const originalRandom = Math.random;
+      const originalDelay = s3Storage.config.retryDelay;
+      Math.random = jest.fn(() => 0);
+      s3Storage.config.retryDelay = 0;
+
+      await expect(s3Storage._retryOperation(operation)).rejects.toThrow('Service unavailable');
+      expect(operation).toHaveBeenCalledTimes(4); // initial + 3 retries
+
+      Math.random = originalRandom;
+      s3Storage.config.retryDelay = originalDelay;
     });
   });
   
@@ -308,4 +301,4 @@ describe('S3StorageAdapter', () => {
       expect(s3Storage._formatBytes(1536, 1)).toBe('1.5 KB');
     });
   });
-});
+});