Regenerate frontend package-lock to match package.json

Fetch patched libpng from edge for frontend runtime
Update frontend package-lock.json for npm compatibility
2025-11-28 18:44:38 +01:00 · 2025-11-28 17:54:56 +01:00 · 2025-11-28 17:54:56 +01:00 · 2025-11-28 17:54:36 +01:00 · 2025-11-28 17:54:36 +01:00 · 2025-11-28 17:54:36 +01:00
150 changed files with 10309 additions and 5956 deletions
@@ -1,114 +0,0 @@
 kind: pipeline
 type: docker
 name: default
 steps:
  # Build Backend Docker Image
  - name: build-backend
    image: plugins/docker
    settings:
      repo: registry.local.nothaft.cloud/picpeak-backend
      tags: 
        - latest
        - ${DRONE_COMMIT_SHA:0:8}
        - ${DRONE_BRANCH}-latest
      dockerfile: backend/Dockerfile
      context: backend/
      registry: registry.local.nothaft.cloud
      build_args:
        - VERSION=${DRONE_TAG:-dev}
  # Build Frontend Docker Image
  - name: build-frontend
    image: plugins/docker
    settings:
      repo: registry.local.nothaft.cloud/picpeak-frontend
      tags: 
        - latest
        - ${DRONE_COMMIT_SHA:0:8}
        - ${DRONE_BRANCH}-latest
      dockerfile: frontend/Dockerfile
      context: frontend/
      registry: registry.local.nothaft.cloud
      build_args:
        - VERSION=${DRONE_TAG:-dev}
        - VITE_API_URL=${VITE_API_URL:-/api}
 trigger:
  branch:
    - main
    - develop
  event:
    - push
    - pull_request
 ---
 kind: pipeline
 type: docker
 name: release
 steps:
  # Build Backend Release
  - name: build-backend-release
    image: plugins/docker
    settings:
      repo: registry.local.nothaft.cloud/picpeak-backend
      tags:
        - ${DRONE_TAG}
        - latest
      dockerfile: backend/Dockerfile
      context: backend/
      registry: registry.local.nothaft.cloud
  # Build Frontend Release
  - name: build-frontend-release
    image: plugins/docker
    settings:
      repo: registry.local.nothaft.cloud/picpeak-frontend
      tags:
        - ${DRONE_TAG}
        - latest
      dockerfile: frontend/Dockerfile
      context: frontend/
      registry: registry.local.nothaft.cloud
  # -------- NEW: Publish Docker images to GitHub Container Registry --------
  - name: push-backend-ghcr
    image: plugins/docker
    settings:
      repo: ghcr.io/the-luap/picpeak-backend
      tags:
        - ${DRONE_TAG}
        - latest
      dockerfile: backend/Dockerfile
      context: backend/
      registry: ghcr.io
      username:
        from_secret: GITHUB_USERNAME
      password:
        from_secret: GITHUB_TOKEN
      build_args:
        - VERSION=${DRONE_TAG}
  - name: push-frontend-ghcr
    image: plugins/docker
    settings:
      repo: ghcr.io/the-luap/picpeak-frontend
      tags:
        - ${DRONE_TAG}
        - latest
      dockerfile: frontend/Dockerfile
      context: frontend/
      registry: ghcr.io
      username:
        from_secret: GITHUB_USERNAME
      password:
        from_secret: GITHUB_TOKEN
      build_args:
        - VERSION=${DRONE_TAG}
        - VITE_API_URL=${VITE_API_URL:-/api}
 trigger:
  event:
    - tag
@@ -1,132 +0,0 @@
 name: Mirror to GitHub
 on:
  workflow_dispatch:  # Allow manual triggering only
 jobs:
  mirror:
    runs-on: ubuntu-latest
    # Note: For GitHub fine-grained tokens, ensure the token has:
    # - Repository access to the-luap/picpeak
    # - Repository permissions: Contents (Read and Write), Metadata (Read)
    # For classic tokens: repo scope is sufficient
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Full history for proper mirroring
      - name: Setup Git
        run: |
          git config --global user.name "the-luap"
          git config --global user.email "paul-nothaft@hotmail.de"
      - name: Remove sensitive files and directories
        run: |
          echo "Current files before cleanup:"
          ls -la | head -10 || true
          echo "..."
          # Remove sensitive files/directories if they exist
          echo "Removing sensitive files..."
          rm -rf .gitea/ || true
          rm -rf scripts/install-gitea-runner.sh || true
          rm -rf .drone* || true
          rm -rf photo-sharing-prd.md || true
          rm -rf CLAUDE.md || true
          rm -rf storage/ || true
          rm -rf events/ || true
          rm -rf .playwright-mcp/
          rm -rf .swarm || true
          rm -rf .claude-flow || true
          echo "Sensitive files removal completed"
          # Add and commit the cleanup if there are changes
          git add -A
          if ! git diff --cached --quiet; then
            git commit -m "chore: remove sensitive files for GitHub mirror"
            echo "✅ Committed cleanup of sensitive files"
          else
            echo "✅ No sensitive files to remove"
          fi
          echo "Final file structure (top level):"
          ls -la | head -10 || true
      - name: Check GitHub token
        env:
          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
        run: |
          if [ -z "$GITHUBTOKEN" ]; then
            echo "ERROR: GITHUBTOKEN secret is not set!"
            echo "Please add a GitHub Personal Access Token as a secret named GITHUBTOKEN"
            echo ""
            echo "For fine-grained tokens:"
            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens"
            echo "  - Create token with repository access to the-luap/picpeak"
            echo "  - Grant permissions: Contents (Read and Write), Metadata (Read)"
            echo ""
            echo "For classic tokens:"
            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic)"
            echo "  - Create token with 'repo' scope"
            exit 1
          else
            echo "✅ GitHub token is available (length: ${#GITHUBTOKEN})"
            # Try to detect token type (fine-grained tokens are typically longer)
            if [ ${#GITHUBTOKEN} -gt 80 ]; then
              echo "📌 Token appears to be a fine-grained personal access token"
            else
              echo "📌 Token appears to be a classic personal access token"
            fi
          fi
      - name: Push to GitHub
        env:
          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
          GIT_TRACE: 1  # Enable Git trace for debugging if needed
        run: |
          # Remove existing github remote if it exists
          git remote remove github || true
          # Configure Git to use the token for authentication
          # This method works for both classic and fine-grained tokens
          git config --global url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf "https://github.com/"
          # Add GitHub remote (clean URL without credentials)
          git remote add github https://github.com/the-luap/picpeak.git
          # Verify remote was added
          echo "GitHub remote configuration:"
          git remote -v
          # Push to GitHub main branch with error handling
          echo "Pushing to GitHub..."
          if git push github main --force 2>&1; then
            echo "✅ Push to GitHub completed successfully!"
          else
            echo "❌ Push to GitHub failed!"
            echo ""
            echo "Common issues and solutions:"
            echo "1. Token permissions: Ensure your token has 'Contents: write' permission"
            echo "2. Token expiration: Check if your token has expired"
            echo "3. Repository access: Verify the token has access to the-luap/picpeak repository"
            echo ""
            echo "For fine-grained tokens, required permissions:"
            echo "  - Repository access: the-luap/picpeak"
            echo "  - Repository permissions: Contents (Read and Write), Metadata (Read)"
            echo ""
            echo "For classic tokens, required scope: 'repo'"
            exit 1
          fi
          # Clean up the git config after push
          git config --global --unset url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf
      - name: Workflow completed
        run: |
          echo "✅ Mirror to GitHub workflow completed successfully!"
          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
          echo "🔒 Sensitive files have been removed from the mirror"
@@ -1,52 +0,0 @@
 name: Test and Lint
 on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
 jobs:
  backend-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
      - name: Install backend dependencies
        working-directory: ./backend
        run: npm ci
      - name: Run backend linting
        working-directory: ./backend
        run: npm run lint || true  # Continue on lint errors for now
      - name: Run backend tests
        working-directory: ./backend
        run: npm test || true  # Continue on test failures for now
  frontend-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
      - name: Install frontend dependencies
        working-directory: ./frontend
        run: npm ci --legacy-peer-deps
      - name: Run frontend linting
        working-directory: ./frontend
        run: npm run lint || true  # Continue on lint errors for now
      - name: Build frontend
        working-directory: ./frontend
        run: npm run build
@@ -1,269 +0,0 @@
 name: Version and Release
 on:
  workflow_dispatch:
 jobs:
  version-bump:
    runs-on: ubuntu-latest
    outputs:
      new_version: ${{ steps.version.outputs.new_version }}
      version_changed: ${{ steps.version.outputs.version_changed }}
      component_changed: ${{ steps.version.outputs.component_changed }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GITEA_TOKEN || github.token }}
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
      - name: Configure Git
        run: |
          git config --global user.name 'Gitea Actions Bot'
          git config --global user.email 'actions@gitea.local'
      - name: Detect changes and bump version
        id: version
        run: |
          set -e  # Exit on error
          echo "=== Debug Info ==="
          echo "GitHub event before: ${{ github.event.before }}"
          echo "GitHub SHA: ${{ github.sha }}"
          echo "Current directory: $(pwd)"
          echo "Git log (last 5): $(git log --oneline -5)"
          # Get the commit range for changed files
          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
            echo "Using commit range: $COMMIT_RANGE"
            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
          else
            # First commit or no previous commit, check against HEAD~1 if it exists
            if git rev-parse HEAD~1 >/dev/null 2>&1; then
              COMMIT_RANGE="HEAD~1..HEAD"
              echo "Using commit range: $COMMIT_RANGE"
              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
            else
              echo "First commit detected, checking all files"
              CHANGED_FILES=$(git ls-files)
            fi
          fi
          echo "Changed files:"
          echo "$CHANGED_FILES"
          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
          echo "Backend files changed: $BACKEND_CHANGED"
          echo "Frontend files changed: $FRONTEND_CHANGED"
          echo "Root files changed: $ROOT_CHANGED"
          # Get current versions
          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.1.0")
          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.1.0")
          echo "Current backend version: $BACKEND_VERSION"
          echo "Current frontend version: $FRONTEND_VERSION"
          # Determine what to update based on changes
          BACKEND_UPDATE=false
          FRONTEND_UPDATE=false
          COMPONENT_CHANGED="none"
          if [ "$ROOT_CHANGED" -gt 0 ]; then
            # Root changes affect both components
            BACKEND_UPDATE=true
            FRONTEND_UPDATE=true
            COMPONENT_CHANGED="both"
            SOURCE_VERSION=$BACKEND_VERSION
            echo "Root changes detected - updating both components"
          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
            # Both components changed
            BACKEND_UPDATE=true
            FRONTEND_UPDATE=true
            COMPONENT_CHANGED="both"
            # Use the higher version as source
            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
              SOURCE_VERSION=$BACKEND_VERSION
            else
              SOURCE_VERSION=$FRONTEND_VERSION
            fi
            echo "Both backend and frontend changed - updating both"
          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
            # Only backend changed
            BACKEND_UPDATE=true
            COMPONENT_CHANGED="backend"
            SOURCE_VERSION=$BACKEND_VERSION
            echo "Only backend changed - updating backend"
          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
            # Only frontend changed
            FRONTEND_UPDATE=true
            COMPONENT_CHANGED="frontend"
            SOURCE_VERSION=$FRONTEND_VERSION
            echo "Only frontend changed - updating frontend"
          else
            echo "No relevant changes detected"
            echo "version_changed=false" >> $GITHUB_OUTPUT
            echo "component_changed=none" >> $GITHUB_OUTPUT
            echo "new_version=" >> $GITHUB_OUTPUT
            exit 0
          fi
          echo "Component changed: $COMPONENT_CHANGED"
          echo "Source version: $SOURCE_VERSION"
          echo "Backend update: $BACKEND_UPDATE"
          echo "Frontend update: $FRONTEND_UPDATE"
          # Calculate new version
          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
          MAJOR="${version_parts[0]}"
          MINOR="${version_parts[1]}"
          PATCH="${version_parts[2]}"
          # Increment patch version and ensure tag uniqueness
          git fetch --tags --quiet || true
          NEW_PATCH=$((PATCH + 1))
          NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
          while git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; do
            echo "Tag v${NEW_VERSION} already exists, bumping patch version again"
            NEW_PATCH=$((NEW_PATCH + 1))
            NEW_VERSION="$MAJOR.$MINOR.$NEW_PATCH"
          done
          echo "New version: $NEW_VERSION"
          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
          # Update versions in package.json files
          if [ "$BACKEND_UPDATE" = true ]; then
            echo "Updating backend version to $NEW_VERSION"
            cd backend && npm version $NEW_VERSION --no-git-tag-version
            cd ..
          fi
          if [ "$FRONTEND_UPDATE" = true ]; then
            echo "Updating frontend version to $NEW_VERSION"
            cd frontend && npm version $NEW_VERSION --no-git-tag-version
            cd ..
          fi
          # Check if there are changes to commit
          if [[ -n $(git status --porcelain) ]]; then
            echo "version_changed=true" >> $GITHUB_OUTPUT
          else
            echo "version_changed=false" >> $GITHUB_OUTPUT
          fi
      - name: Commit version bump
        if: steps.version.outputs.version_changed == 'true'
        run: |
          set -e  # Exit on any error
          # First, ensure we have the latest changes
          echo "Fetching latest changes..."
          git fetch origin main
          # Check if we're behind and need to update
          LOCAL=$(git rev-parse HEAD)
          REMOTE=$(git rev-parse origin/main)
          if [ "$LOCAL" != "$REMOTE" ]; then
            echo "Local is behind remote, pulling changes..."
            git pull origin main --no-rebase
          fi
          COMPONENT="${{ steps.version.outputs.component_changed }}"
          if [ "$COMPONENT" = "both" ]; then
            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
          elif [ "$COMPONENT" = "backend" ]; then
            git add backend/package.json backend/package-lock.json
            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
          elif [ "$COMPONENT" = "frontend" ]; then
            git add frontend/package.json frontend/package-lock.json
            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
          fi
          # Pull latest changes before pushing to avoid conflicts
          echo "Pulling latest changes from origin/main..."
          if ! git pull --rebase origin main; then
            echo "Rebase failed, attempting to resolve..."
            # If rebase fails, abort and try a regular merge
            git rebase --abort || true
            git pull origin main --no-rebase
          fi
          # Push the changes with retry logic
          echo "Pushing version bump..."
          PUSH_SUCCESS=false
          for i in 1 2 3; do
            echo "Push attempt $i of 3..."
            # Try to push
            if git push origin main 2>&1; then
              echo "Successfully pushed version bump on attempt $i"
              PUSH_SUCCESS=true
              break
            else
              echo "Push failed on attempt $i"
              if [ $i -lt 3 ]; then
                echo "Waiting 5 seconds before retry..."
                sleep 5
                echo "Pulling latest changes..."
                git fetch origin main
                # Try rebase first, fall back to merge
                if ! git rebase origin/main; then
                  echo "Rebase failed, trying merge..."
                  git rebase --abort 2>/dev/null || true
                  git pull origin main --no-rebase
                fi
              fi
            fi
          done
          if [ "$PUSH_SUCCESS" = "false" ]; then
            echo "ERROR: Failed to push after 3 attempts"
            exit 1
          fi
      - name: Create Git tag
        if: steps.version.outputs.version_changed == 'true'
        run: |
          COMPONENT="${{ steps.version.outputs.component_changed }}"
          if [ "$COMPONENT" = "both" ]; then
            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
          elif [ "$COMPONENT" = "backend" ]; then
            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
          elif [ "$COMPONENT" = "frontend" ]; then
            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
          fi
          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
          git push origin "v${{ steps.version.outputs.new_version }}"
  trigger-drone:
    needs: version-bump
    if: needs.version-bump.outputs.version_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Drone Build
        run: |
          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
          echo "Drone will automatically trigger on the new tag"
          # Drone CI will automatically trigger on the tag push event
@@ -31,15 +31,26 @@ jobs:
      contents: read
      packages: write
      security-events: write
-    
+
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Determine build platforms
      id: platforms
      run: |
        # For PRs, build only amd64 to avoid QEMU emulation issues with Sharp
        # For main/develop/tags, build multi-arch
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
        else
          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
        fi
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
    - name: Log in to Container Registry
      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -67,7 +78,7 @@ jobs:
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=sha,format=short
          type=raw,value=latest,enable={{is_default_branch}}
    - name: Build and push Backend Docker image
@@ -79,7 +90,7 @@ jobs:
        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
        tags: ${{ steps.meta-backend.outputs.tags }}
        labels: ${{ steps.meta-backend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
        cache-from: type=gha,scope=backend
        cache-to: type=gha,mode=max,scope=backend
        build-args: |
@@ -111,15 +122,26 @@ jobs:
      contents: read
      packages: write
      security-events: write
-    
+
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Determine build platforms
      id: platforms
      run: |
        # For PRs, build only amd64 to avoid QEMU emulation issues
        # For main/develop/tags, build multi-arch
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
        else
          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
        fi
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
    - name: Log in to Container Registry
      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
@@ -147,7 +169,7 @@ jobs:
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
-          type=sha,prefix={{branch}}-,format=short
+          type=sha,format=short
          type=raw,value=latest,enable={{is_default_branch}}
    - name: Build and push Frontend Docker image
@@ -159,7 +181,7 @@ jobs:
        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
        tags: ${{ steps.meta-frontend.outputs.tags }}
        labels: ${{ steps.meta-frontend.outputs.labels }}
-        platforms: linux/amd64,linux/arm64
+        platforms: ${{ steps.platforms.outputs.platforms }}
        cache-from: type=gha,scope=frontend
        cache-to: type=gha,mode=max,scope=frontend
        build-args: |
@@ -75,6 +75,7 @@ certbot/
 # Ignore local contributor guide copy
 AGENTS.md
 CLAUDE.md
 # Local artifacts from browser tooling
 .playwright-mcp/
@@ -1,386 +0,0 @@
 # CLAUDE.md
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 ## Product Overview
 A secure photo sharing platform designed for weddings and events, enabling photographers to share time-limited, password-protected galleries. The platform features automatic expiration, archiving, and a scrappbook.de-inspired modern, minimalist UI.
 ## Architecture Overview
 - **Backend**: Node.js/Express API with SQLite/PostgreSQL, file-based photo storage
 - **Frontend**: React SPA with scrappbook.de-style design (requires implementation)
 - **Storage**: File-based with active/archived separation
 - **Services**: Background workers for email, archiving, file watching, and expiration monitoring
 - **Analytics**: Umami integration for engagement tracking
 ## Essential Commands
 ### Backend Development
 ```bash
 cd backend
 npm install               # Install dependencies
 npm run migrate          # Initialize database schema
 npm run dev              # Start with hot-reload (port 3001)
 npm test                 # Run Jest tests
 npm run lint             # ESLint checks
 ```
 ### Running a Single Test
 ```bash
 cd backend
 npm test -- path/to/test.test.js
 npm test -- --testNamePattern="test name"
 ```
 ### Production Deployment
 See [DEPLOYMENT_GUIDE.md](./DEPLOYMENT_GUIDE.md) for comprehensive deployment instructions including:
 - Docker Compose deployment
 - PM2 deployment
 - Manual installation
 - Non-nginx deployment options
 - SSL/HTTPS setup
 - Troubleshooting guide
 **⚠️ CRITICAL PRODUCTION NOTICE:**
 - Production runs on a SEPARATE SERVER - never assume local changes affect production
 - ALWAYS request production server details before any troubleshooting
 - NO trial-and-error approaches in production - data loss is unacceptable
 - Every change must be thoroughly analyzed and tested locally first
 ## Key Product Requirements (from PRD)
 ### Core Features
 1. **File-Based System**: Drop photos in folders → automatic gallery creation
 2. **Automatic Expiration**: Default 30 days, with 7-day warning emails
 3. **Password Protection**: Secure access with customizable passwords
 4. **Automatic Archiving**: ZIP compression and storage after expiration
 5. **Email Notifications**: Creation, warning, and expiration notifications
 6. **Analytics**: Umami tracking for views, downloads, and engagement
 ### Folder Structure
 ```
 /events/
  ├── active/
  │   ├── wedding-smith-jones-2024-06-15/
  │   │   ├── collages/
  │   │   └── individual/
  │   └── birthday-emma-2024-07-20/
  └── archived/
      └── wedding-smith-jones-2024-06-15.zip
 ```
 ## Frontend Implementation Requirements
 ### Design Style (scrappbook.de-inspired)
 - **Color Palette**: Primary green (#5C8762), neutral backgrounds
 - **Typography**: Clean, modern sans-serif (Noto Sans or similar)
 - **Layout**: Minimalist, modular sections with grid-based photo displays
 - **Aesthetic**: Professional yet approachable, photographer-focused
 ### Key Frontend Components to Build
 1. **Landing Page**: Password entry with event preview
 2. **Gallery View**: 
   - Responsive photo grid with lazy loading
   - Toggle between collages/individual photos
   - Prominent expiration banner
   - Download urgency indicators
 3. **Photo Lightbox**: Full-screen viewing with zoom
 4. **Mobile-First**: Responsive design with touch gestures
 5. **Personalization**: Dynamic theming per event type
 ### User Experience Priorities
 - Clear expiration warnings (sticky banner)
 - One-click "Download All" for urgent galleries
 - Smooth image loading with skeleton screens
 - Intuitive navigation between photo categories
 - Professional presentation matching photographer branding
 ## Key Architecture Patterns
 ### Authentication Flow
 - JWT-based with separate tokens for admin and gallery access
 - Gallery tokens include event-specific claims
 - Auth middleware: `backend/src/middleware/auth.js`
  - `adminAuth` - Admin panel protection
  - `photoAuth` - Protected photo access  
  - `verifyGalleryAccess` - Gallery-specific validation
 ### Database Schema (Knex/SQLite)
 Main tables:
 - `events` - Gallery metadata with expiration, custom messages, themes
 - `photos` - Photo records linked to events
 - `access_logs` - IP-based usage tracking
 - `email_queue` - Async email processing
 - `admin_users` - Admin authentication
 ### Service Architecture
 Background services run as separate processes:
 - **emailService**: Processes email queue with retry logic
 - **archiveService**: Creates ZIP archives of expired events
 - **expirationChecker**: Cron job for expiration warnings
 - **fileWatcher**: Monitors for new photo uploads
 - **backupService**: Scheduled backups with checksum-based change detection
 ### API Structure
 - `/api/admin/*` - Admin panel endpoints (requires adminAuth)
 - `/api/gallery/*` - Public gallery endpoints  
 - `/api/auth/*` - Authentication endpoints
 - Rate limiting: 100 req/15min (general), 5 req/15min (auth)
 ## Critical Implementation Notes
 1. **Security**: All gallery access requires valid JWT with event-specific claims
 2. **Expiration**: Events auto-expire based on `expires_at`, with 7-day email warnings
 3. **Email Queue**: Async processing with retry logic, check `email_queue` table
 4. **File Processing**: Sharp library for thumbnail generation (300x300)
 5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
 6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings
 ## Troubleshooting Guidelines
 ### Before ANY Production Troubleshooting:
 1. **ALWAYS request specific details**:
   - Production server URL/IP
   - Current error messages/logs
   - Recent changes or deployments
   - Affected users/galleries
   - Time of issue occurrence
 2. **Thorough Analysis Required**:
   - Use detailed thinking/analysis for EVERY troubleshooting task
   - Review all related code before suggesting changes
   - Consider all potential side effects
   - Never make assumptions about production environment
 3. **Safe Troubleshooting Steps**:
   - First, reproduce issue in local/dev environment
   - Analyze logs without modifying production
   - Create detailed action plan before any changes
   - Always have rollback strategy ready
   - Document every step taken
 ### Common Issues & Safe Approaches:
 - **Email not sending**: Check email_queue table, SMTP settings, service status
 - **Photos not loading**: Verify file permissions, storage paths, nginx config
 - **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
 - **Performance problems**: Analyze with monitoring tools first, never experiment
 ### Data Safety Rules:
 - NEVER delete or modify production data without explicit backup confirmation
 - ALWAYS verify backups exist before any data operations
 - NO direct database modifications without transaction safety
 - Log all actions for audit trail
 ## Environment Variables
 ### Backend (.env)
 - `JWT_SECRET` - Token signing
 - `ADMIN_URL`, `FRONTEND_URL` - CORS origins
 - `SMTP_*` - Email configuration
 - `DB_*` - PostgreSQL credentials (production)
 - `UMAMI_URL` - Umami instance URL (for server-side tracking)
 - `UMAMI_WEBSITE_ID` - Website ID from Umami
 ### Frontend (.env)
 - `VITE_API_URL` - Backend API URL
 - `VITE_UMAMI_URL` - Umami analytics URL
 - `VITE_UMAMI_WEBSITE_ID` - Website ID from Umami
 - `VITE_UMAMI_SHARE_URL` - (Optional) Public share URL for embedded dashboard
 ## Testing Approach
 - Jest with Supertest for API testing
 - Test files in `__tests__` directories
 - Database migrations run before tests
 - Mock email sending in tests
 ## Umami Analytics Integration
 The frontend includes comprehensive Umami analytics integration for tracking user behavior and gallery performance.
 ### Tracked Events:
 - **Gallery Events**:
  - `gallery_password_entry` - Password attempts (success/failure)
  - `gallery_photo_view` - Individual photo views
  - `gallery_photo_download` - Single photo downloads
  - `gallery_bulk_download` - Bulk/all photo downloads
  - `gallery_expired` - Expired gallery access attempts
 - **Admin Events**:
  - `admin_login` - Admin authentication
  - `admin_event_created` - New event creation
  - `admin_event_archived` - Event archiving
  - `admin_event_deleted` - Event deletion
  - `admin_settings_updated` - Settings changes
 - **User Behavior**:
  - Search queries (with debouncing)
  - Expiration warning views
  - Page views with automatic tracking
 ### Setup:
 1. Install Umami (self-hosted or cloud)
 2. Create a website in Umami dashboard
 3. Set environment variables:
   ```
   VITE_UMAMI_URL=https://your-umami-instance.com
   VITE_UMAMI_WEBSITE_ID=your-website-id
   VITE_UMAMI_SHARE_URL=https://your-umami-instance.com/share/...
   ```
 ### Analytics Dashboard:
 - Admin panel includes analytics page at `/admin/analytics`
 - Summary view with key metrics
 - Option to embed full Umami dashboard
 - Real-time event tracking
 ## Accessibility & Performance Features
 ### Accessibility (WCAG 2.1 AA Compliance)
 - **Error Boundaries**: Graceful error handling with recovery options
 - **Skip Links**: Skip to main content for keyboard navigation
 - **ARIA Labels**: Proper labeling for screen readers
 - **Focus Management**: Focus trap in modals, visible focus indicators
 - **Keyboard Navigation**: Full keyboard support in gallery lightbox (arrows, escape, +/-, d for download)
 - **Loading States**: Skeleton screens instead of spinners for better UX
 - **Offline Support**: Visual indicator when offline
 - **Form Validation**: Accessible error messages with aria-describedby
 ### Performance Optimizations
 - **Lazy Loading**: Images load on scroll with Intersection Observer
 - **Skeleton Screens**: Instant visual feedback during loading
 - **Error Recovery**: Component-level error boundaries prevent full page crashes
 - **Optimistic Updates**: Immediate UI updates with background sync
 - **Debounced Search**: Prevents excessive API calls
 - **Analytics**: Non-blocking Umami integration
 ### Component Library Enhancements
 - `<ErrorBoundary>` - Catches and displays errors gracefully
 - `<PageErrorBoundary>` - Full-page error recovery
 - `<Skeleton>` - Flexible skeleton loader with variants
 - `<OfflineIndicator>` - Network status monitoring
 - `<SkipLink>` - Accessibility navigation
 - `useFocusTrap` - Modal focus management hook
 - `useOnlineStatus` - Network status hook
 ## Theme System & Branding
 ### Theme Features
 - **Dynamic Theming**: CSS variables for runtime theme switching
 - **Preset Themes**: Default, Wedding, Birthday, Corporate, Minimal
 - **Customization Options**:
  - Primary/Accent/Background/Text colors
  - Font family selection
  - Border radius (none, sm, md, lg)
  - Custom logo upload
  - Custom CSS injection
 - **Event-Specific Themes**: Override global theme per gallery
 - **Live Preview**: Real-time theme changes in admin panel
 ### Theme Context API
 ```typescript
 const { theme, setTheme, setThemeByName } = useTheme();
 ```
 ### Branding Settings
 - Company name, tagline, and support email
 - Custom footer text
 - Optional watermarking on downloads
 - Logo upload for gallery header
 ### CSS Variables
 ```css
 --color-primary: #5C8762;
 --color-primary-light: #7aa583;
 --color-primary-dark: #4a6f4f;
 --color-accent: #22c55e;
 --color-background: #fafafa;
 --color-text: #171717;
 --font-family: 'Inter', sans-serif;
 --border-radius: 0.5rem;
 ```
 ## Backup Service
 ### Overview
 The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
 ### Features
 - **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
 - **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
 - **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
 - **Email Notifications**: Alerts on backup failure, optional success notifications
 - **Retention Management**: Automatic cleanup of old backup runs based on retention policy
 - **Progress Tracking**: Database storage of backup history, file states, and statistics
 ### Configuration
 Backup settings are stored in `app_settings` table with `backup_` prefix:
 - `backup_enabled`: Enable/disable the service
 - `backup_schedule`: Cron expression (e.g., '0 2 * * *')
 - `backup_destination_type`: 'local', 'rsync', or 's3'
 - `backup_retention_days`: How long to keep backup history
 - `backup_include_archived`: Whether to backup archived events
 - `backup_exclude_patterns`: File patterns to exclude
 ### API Endpoints
 - `GET /api/admin/backup/config` - Get current configuration
 - `PUT /api/admin/backup/config` - Update configuration
 - `GET /api/admin/backup/status` - Get backup status and history
 - `POST /api/admin/backup/run` - Trigger manual backup
 - `POST /api/admin/backup/test-connection` - Test destination connectivity
 ### Testing
 Run backup service test: `npm run test-backup`
 ### Database Tables
 - `backup_runs`: Tracks each backup execution with statistics
 - `backup_file_states`: Stores file checksums for change detection
 ## Thumbnail Generation
 ### Square Thumbnail Implementation (Issue #12 Fix)
 The system now generates **square 300x300px thumbnails** to prevent blurry/stretched images in the gallery grid:
 - **Problem**: Previously generated 300px width with proportional height (e.g., 300x200 for 3:2 photos), but CSS forced square display causing distortion
 - **Solution**: Thumbnails now use `cover` fit mode to crop to exact 300x300px dimensions with center positioning
 - **Configuration**: Settings stored in `app_settings` table with keys: `thumbnail_width`, `thumbnail_height`, `thumbnail_fit`, `thumbnail_quality`, `thumbnail_format`
 - **Migration**: Run `040_add_thumbnail_settings.js` to add default square thumbnail settings
 - **Regeneration Script**: Use `scripts/regenerate-square-thumbnails.js` to update existing thumbnails
 ### Thumbnail Settings API
 - `GET /api/admin/thumbnails/settings` - Get current thumbnail configuration
 - `PUT /api/admin/thumbnails/settings` - Update thumbnail settings (requires regeneration)
 - `POST /api/admin/thumbnails/regenerate` - Regenerate all thumbnails with new settings
 - `GET /api/admin/thumbnails/regenerate/status` - Check regeneration progress
 ## Success Metrics (from PRD)
 - Time to generate gallery: <2 minutes
 - Guest satisfaction: >90%
 - System uptime: 99.9%
 - Email delivery rate: >98%
 - Successful archiving: 100%
 ## Documentation & Development Practices
 ### Documentation Guidelines:
 - **NEVER create new documentation files for simple tasks**
 - **ALWAYS update existing documentation (like this CLAUDE.md)**
 - Only create new .md files when explicitly requested
 - Avoid creating temporary scripts for one-off tasks
 ### Development Best Practices:
 - Test all changes thoroughly in local environment first
 - Use version control for all changes
 - Keep commits atomic and well-described
 - Review impact on all integrated services
 - Consider backward compatibility
 - Update tests when changing functionality
 ### Production Deployment Checklist:
 - [ ] All tests passing locally
 - [ ] Linting and type checks pass
 - [ ] Database migrations tested with rollback plan
 - [ ] Environment variables documented
 - [ ] Backup strategy confirmed
 - [ ] Monitoring alerts configured
 - [ ] Rollback procedure documented
 - [ ] Stakeholders notified of maintenance window
 - always use docker deployment for testing
@@ -7,9 +7,9 @@ This guide covers multiple deployment options for PicPeak, from simple local set
 For the easiest installation without Docker or complex configurations, use our **unified setup script**:
 ```bash
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
-chmod +x setup.sh && \
+chmod +x picpeak-setup.sh && \
-sudo ./setup.sh
+sudo ./picpeak-setup.sh
 ```
 This automated script handles everything including:
@@ -219,14 +219,17 @@ Update `.env` with:
 - **URL Configuration** (for backend CORS):
  - `FRONTEND_URL` - Frontend origin (use full URL with scheme, no trailing slash)
    - Example (Docker): `http://localhost:3000`
-  - `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
+- `ADMIN_URL` - Admin origin (same as `FRONTEND_URL` for Docker; full URL, no trailing slash)
-    - Example (Docker): `http://localhost:3000`
+  - Example (Docker): `http://localhost:3000`
  Notes:
  - Do not include trailing `/` (e.g., use `http://host:3000`, not `http://host:3000/`).
  - Always include the scheme (`http://` or `https://`).
  - The backend compares origins strictly for CORS; malformed values will cause login requests to fail with 500.
 #### Authentication Security
 - Configure login attempt thresholds from **Admin → Settings → Security**. Defaults are 5 failed attempts per IP within 15 minutes, resulting in a 30 minute lockout.
 #### External Database Example
 To use an external PostgreSQL instead of the bundled container, set the following in `.env` and ensure the `postgres` service is disabled or removed:
@@ -424,10 +427,10 @@ If you lose your admin credentials after the first login, you'll need to manuall
 ```bash
 # Native reinstall example
-sudo ./setup.sh --native --force-admin-password-reset
+sudo ./picpeak-setup.sh --native --force-admin-password-reset
 # Docker reinstall example
-sudo ./setup.sh --docker --force-admin-password-reset
+sudo ./picpeak-setup.sh --docker --force-admin-password-reset
 ```
 The flag calls `scripts/reset-admin-password.js` in non-interactive mode, writes a fresh random password into `data/ADMIN_CREDENTIALS.txt`, and prints the new credentials at the end of the installer run.
@@ -85,6 +85,8 @@ Note on Docker file permissions (PUID/PGID)
 - 📘 [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions
  - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode
 - 📚 [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints
 - 🛠️ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints
 - 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
 - 📜 [**License**](LICENSE) - MIT License
 - 🔒 [**Security**](SECURITY.md) - Security policies
@@ -133,6 +135,31 @@ Perfect for:
 - **Docker**: v20.10.0+
 - **Docker Compose**: v2.0.0+
 ### Video Support Requirements
 When enabling video uploads, consider these additional resources:
 | Resource | Recommendation | Notes |
 |----------|----------------|-------|
 | **RAM** | 4GB+ recommended | FFmpeg processing requires more memory |
 | **Storage** | Plan for 10-100x more | Videos are significantly larger than images |
 | **CPU** | Additional cores help | Video thumbnail extraction is CPU-intensive |
 | **Bandwidth** | Higher throughput | Video streaming requires more bandwidth |
 **Technical Notes:**
 - FFmpeg is bundled via npm (`@ffmpeg-installer/ffmpeg`) - no system installation required
 - Maximum upload size: **10GB per video file**
 - Chunked upload support for files >100MB (resumable uploads)
 - Supported formats: MP4, WebM, MOV, AVI
 - Video thumbnails are automatically generated from the first few seconds
 **For Nginx/Reverse Proxy:**
 If using Nginx, increase the client max body size:
 ```nginx
 client_max_body_size 10G;
 proxy_read_timeout 3600;
 proxy_send_timeout 3600;
 ```
 ## 🤝 Contributing
 We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
@@ -220,7 +247,7 @@ These features are currently in beta testing and may have limited functionality
 | **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
 | **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
 | **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
-| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
+| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | ✅ Implemented |
 | **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
 | **Filtering & Export Options** | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
@@ -8,9 +8,9 @@ This guide provides easy installation instructions for PicPeak on Linux servers
 ```bash
 # Download and run the unified setup script
-curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/setup.sh -o setup.sh && \
+curl -fsSL https://raw.githubusercontent.com/the-luap/picpeak/main/scripts/picpeak-setup.sh -o picpeak-setup.sh && \
-chmod +x setup.sh && \
+chmod +x picpeak-setup.sh && \
-sudo ./setup.sh
+sudo ./picpeak-setup.sh
 ```
 The script will automatically detect your environment and recommend the best installation method.
@@ -21,7 +21,7 @@ The script will automatically detect your environment and recommend the best ins
 Best for: Most users, easy updates, isolated environment
 ```bash
-sudo ./setup.sh --docker
+sudo ./picpeak-setup.sh --docker
 ```
 **Pros:**
@@ -38,7 +38,7 @@ sudo ./setup.sh --docker
 Best for: Resource-constrained systems, Raspberry Pi, direct control
 ```bash
-sudo ./setup.sh --native
+sudo ./picpeak-setup.sh --native
 ```
 **Pros:**
@@ -73,7 +73,7 @@ sudo ./setup.sh --native
 ### Interactive Mode (Default)
 ```bash
-sudo ./setup.sh
+sudo ./picpeak-setup.sh
 ```
 The script will prompt you to choose:
@@ -87,7 +87,7 @@ The script will prompt you to choose:
 #### Docker with full configuration:
 ```bash
-sudo ./setup.sh --docker --unattended \
+sudo ./picpeak-setup.sh --docker --unattended \
  --domain photos.example.com \
  --email admin@example.com \
  --admin-password SecurePass123 \
@@ -100,7 +100,7 @@ sudo ./setup.sh --docker --unattended \
 #### Native with minimal configuration:
 ```bash
-sudo ./setup.sh --native --unattended \
+sudo ./picpeak-setup.sh --native --unattended \
  --email admin@example.com \
  --admin-password SecurePass123
 ```
@@ -293,7 +293,7 @@ sudo systemctl restart picpeak-backend picpeak-workers
 # Update PicPeak
 # (reruns migrations to pick up schema fixes for native installs)
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 ## ⚙️ Configuration
@@ -385,14 +385,14 @@ docker compose pull
 docker compose up -d
 # Native
-sudo ./setup.sh --update
+sudo ./picpeak-setup.sh --update
 ```
 ### Uninstall
 ```bash
 # Will prompt for confirmation and data removal options
-sudo ./setup.sh --uninstall
+sudo ./picpeak-setup.sh --uninstall
 ```
 ## 🐛 Troubleshooting
@@ -508,13 +508,13 @@ sudo systemctl restart picpeak-backend
 ### Home/Office Network
 ```bash
 # Simple local setup without domain
-sudo ./setup.sh --native --email admin@local.com
+sudo ./picpeak-setup.sh --native --email admin@local.com
 ```
 ### Public Website with HTTPS
 ```bash
 # Full production setup
-sudo ./setup.sh --docker \
+sudo ./picpeak-setup.sh --docker \
  --domain photos.company.com \
  --email admin@company.com \
  --enable-ssl
@@ -523,7 +523,7 @@ sudo ./setup.sh --docker \
 ### Raspberry Pi Setup
 ```bash
 # Optimized for ARM devices
-sudo ./setup.sh --native \
+sudo ./picpeak-setup.sh --native \
  --port 8080 \
  --email pi@local.com
 ```
@@ -11,13 +11,16 @@ LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
 LABEL org.opencontainers.image.description="PicPeak Backend Service"
 LABEL org.opencontainers.image.licenses="MIT"
 # Upgrade npm to fix glob CVE-2025-64756 vulnerability
 RUN npm install -g npm@latest
 WORKDIR /app
 # Copy package files
 COPY package*.json ./
-# Install dependencies
+# Install dependencies (--omit=dev replaces deprecated --only=production)
-RUN npm ci --only=production
+RUN npm ci --omit=dev
 # Copy application files
 COPY . .
@@ -27,6 +30,12 @@ FROM node:20-alpine
 WORKDIR /app
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 # Upgrade npm to fix glob CVE-2025-64756 vulnerability
 RUN npm install -g npm@latest
 # Install dumb-init for proper signal handling and postgresql-client for database checks
 RUN apk add --no-cache dumb-init postgresql-client
@@ -1,7 +1,10 @@
-FROM node:18-alpine
+FROM node:20-alpine
 WORKDIR /app
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
@@ -0,0 +1,207 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const express = require('express');
 const request = require('supertest');
 describe('Admin photos in reference mode', () => {
  let tmpDir;
  let storagePath;
  let db;
  let app;
  let categoryId;
  const resetModules = () => {
    jest.resetModules();
    jest.clearAllMocks();
  };
  beforeAll(async () => {
    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'picpeak-admin-photos-'));
    storagePath = path.join(tmpDir, 'storage');
    await fs.promises.mkdir(storagePath, { recursive: true });
    process.env.NODE_ENV = 'test';
    process.env.TEST_DATABASE_PATH = path.join(tmpDir, 'data', 'photo_sharing_test.db');
    await fs.promises.mkdir(path.dirname(process.env.TEST_DATABASE_PATH), { recursive: true });
    try {
      await fs.promises.unlink(process.env.TEST_DATABASE_PATH);
    } catch (_) {
      /* ignore */
    }
    process.env.STORAGE_PATH = storagePath;
    resetModules();
    jest.doMock('../../src/middleware/auth', () => ({
      adminAuth: (req, _res, next) => {
        req.admin = { id: 1, username: 'tester' };
        next();
      }
    }));
    jest.doMock('../../src/services/imageProcessor', () => ({
      generateThumbnail: jest.fn().mockResolvedValue('thumbnails/mock-thumb.jpg'),
      ensureThumbnail: jest.fn()
    }));
    jest.doMock('../../src/middleware/uploadValidation', () => ({
      validateUploadedFiles: (_req, _res, next) => next()
    }));
    jest.doMock('../../src/utils/fileSecurityUtils', () => {
      const actual = jest.requireActual('../../src/utils/fileSecurityUtils');
      return {
        ...actual,
        validateFileType: () => true,
        createFileUploadValidator: () => (_req, _res, next) => next()
      };
    });
    jest.doMock('../../src/utils/logger', () => ({
      debug: jest.fn(),
      info: jest.fn(),
      warn: jest.fn(),
      error: jest.fn()
    }));
    const dbModule = require('../../src/database/db');
    db = dbModule.db;
    await db.schema.dropTableIfExists('photo_feedback');
    await db.schema.dropTableIfExists('photos');
    await db.schema.dropTableIfExists('photo_categories');
    await db.schema.dropTableIfExists('events');
    await db.schema.createTable('events', (table) => {
      table.increments('id').primary();
      table.string('slug').notNullable();
      table.string('event_name').notNullable();
      table.string('source_mode').notNullable();
      table.string('external_path');
    });
    await db.schema.createTable('photo_categories', (table) => {
      table.increments('id').primary();
      table.string('name').notNullable();
      table.string('slug').notNullable();
      table.boolean('is_global').defaultTo(true);
      table.integer('event_id');
    });
    await db.schema.createTable('photos', (table) => {
      table.increments('id').primary();
      table.integer('event_id').notNullable();
      table.string('filename').notNullable();
      table.string('path').notNullable();
      table.string('thumbnail_path');
      table.string('type').notNullable();
      table.integer('size_bytes');
      table.integer('category_id');
      table.string('source_origin');
      table.string('external_relpath');
      table.datetime('uploaded_at').defaultTo(db.fn.now());
      table.float('average_rating').defaultTo(0);
      table.integer('like_count').defaultTo(0);
      table.integer('favorite_count').defaultTo(0);
    });
    await db.schema.createTable('photo_feedback', (table) => {
      table.increments('id');
      table.integer('photo_id');
      table.string('feedback_type');
      table.boolean('is_approved');
      table.boolean('is_hidden');
    });
    await db('events').insert({
      id: 1,
      slug: 'test-event',
      event_name: 'Test Event',
      source_mode: 'reference',
      external_path: 'external/library'
    });
    const insertedCategory = await db('photo_categories').insert({
      name: 'Highlights',
      slug: 'highlights',
      is_global: true
    });
    categoryId = Array.isArray(insertedCategory) ? insertedCategory[0] : insertedCategory;
    const router = require('../../src/routes/adminPhotos');
    app = express();
    app.use(express.json());
    app.use('/api/admin/events', router);
  });
  afterAll(async () => {
    if (db) {
      await db.destroy();
    }
    resetModules();
    delete process.env.TEST_DATABASE_PATH;
    delete process.env.STORAGE_PATH;
    if (tmpDir) {
      await fs.promises.rm(tmpDir, { recursive: true, force: true });
    }
  });
  it('stores managed uploads with category information and managed origin', async () => {
    const uploadResponse = await request(app)
      .post(`/api/admin/events/1/upload`)
      .field('category_id', String(categoryId))
      .attach('photos', Buffer.from('fake image data'), 'photo.jpg');
    expect(uploadResponse.status).toBe(200);
    expect(uploadResponse.body).toHaveProperty('photos');
    expect(Array.isArray(uploadResponse.body.photos)).toBe(true);
    const photo = await db('photos').first();
    expect(photo).toBeTruthy();
    expect(photo.category_id).toBe(categoryId);
    expect(photo.source_origin).toBe('managed');
    expect(photo.external_relpath).toBeNull();
  });
  it('returns numeric category metadata when listing photos', async () => {
    await db('photos').insert({
      event_id: 1,
      filename: 'external.jpg',
      path: 'test-event/external.jpg',
      thumbnail_path: null,
      type: 'individual',
      size_bytes: 123,
      source_origin: 'external',
      external_relpath: 'individual/external.jpg'
    });
    const response = await request(app)
      .get(`/api/admin/events/1/photos`)
      .expect(200);
    expect(Array.isArray(response.body.photos)).toBe(true);
    const managedPhoto = response.body.photos.find((p) => p.category_id === categoryId);
    expect(managedPhoto).toBeTruthy();
    expect(managedPhoto.category_name).toBe('Highlights');
    const filtered = await request(app)
      .get(`/api/admin/events/1/photos`)
      .query({ category_id: String(categoryId) })
      .expect(200);
    expect(filtered.body.photos.every((p) => p.category_id === categoryId)).toBe(true);
  });
  it('normalizes category updates', async () => {
    const photo = await db('photos').first();
    await request(app)
      .patch(`/api/admin/events/1/photos/${photo.id}`)
      .send({ category_id: '0' })
      .expect(200);
    const updated = await db('photos').where({ id: photo.id }).first();
    expect(updated.category_id).toBeNull();
  });
 });
@@ -66,6 +66,16 @@ describe('resolvePhotoFilePath', () => {
    expect(result).toBe(path.join('/mock/external', 'picsum-demo/individual', 'look-02.jpg'));
  });
  it('falls back to managed storage when external metadata is missing', () => {
    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
    const photo = { path: 'fashion-show/new-upload.jpg' };
    const result = resolvePhotoFilePath(event, photo);
    expect(resolveExternalPath).not.toHaveBeenCalled();
    expect(result).toBe(path.join(backendRoot, 'storage', 'events/active', 'fashion-show', 'new-upload.jpg'));
  });
  it('throws when external photo is missing relative path data', () => {
    const event = { slug: 'fashion-show', source_mode: 'reference', external_path: 'picsum-demo' };
    const photo = { source_origin: 'external' };
@@ -1831,8 +1831,8 @@
      }
    },
    "nodemailer": {
-      "version": "6.10.1",
+      "version": "7.0.7",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.7.tgz",
      "overridden": false
    },
    "nodemon": {
@@ -2086,8 +2086,8 @@
              "version": "4.0.1"
            },
            "tar-fs": {
-              "version": "2.1.3",
+              "version": "2.1.4",
-              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+              "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
              "overridden": false
            },
            "tunnel-agent": {
@@ -0,0 +1,48 @@
 const { DEFAULT_MAX_FILES_PER_UPLOAD, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../../src/services/uploadSettings');
 exports.up = async function up(knex) {
  const settingKey = 'general_max_files_per_upload';
  const existing = await knex('app_settings')
    .where({ setting_key: settingKey })
    .first();
  if (existing) {
    // Normalize existing value into allowed bounds
    let parsedValue;
    try {
      parsedValue = existing.setting_value != null ? JSON.parse(existing.setting_value) : null;
    } catch {
      parsedValue = existing.setting_value;
    }
    const numeric = Number(parsedValue);
    let normalized = DEFAULT_MAX_FILES_PER_UPLOAD;
    if (Number.isFinite(numeric) && numeric >= 1) {
      normalized = Math.min(MAX_ALLOWED_FILES_PER_UPLOAD, Math.floor(numeric));
    }
    if (normalized !== numeric) {
      await knex('app_settings')
        .where({ setting_key: settingKey })
        .update({
          setting_value: JSON.stringify(normalized),
          updated_at: new Date()
        });
    }
    return;
  }
  await knex('app_settings').insert({
    setting_key: settingKey,
    setting_value: JSON.stringify(DEFAULT_MAX_FILES_PER_UPLOAD),
    setting_type: 'general',
    updated_at: new Date()
  });
 };
 exports.down = async function down(knex) {
  await knex('app_settings')
    .where({ setting_key: 'general_max_files_per_upload' })
    .del();
 };
@@ -0,0 +1,44 @@
 const { addColumnIfNotExists } = require('../helpers');
 exports.up = async function up(knex) {
  await addColumnIfNotExists(knex, 'events', 'customer_name', (table) => {
    table.string('customer_name');
  });
  await addColumnIfNotExists(knex, 'events', 'customer_email', (table) => {
    table.string('customer_email');
  });
  // Backfill new columns from legacy host_* fields
  const client = knex?.client?.config?.client;
  if (client === 'pg') {
    await knex.raw(`
      UPDATE events
      SET customer_name = COALESCE(customer_name, host_name),
          customer_email = COALESCE(customer_email, host_email)
    `);
  } else {
    // SQLite fallback
    await knex('events').update({
      customer_name: knex.raw('COALESCE(customer_name, host_name)'),
      customer_email: knex.raw('COALESCE(customer_email, host_email)')
    });
  }
 };
 exports.down = async function down(knex) {
  const hasCustomerName = await knex.schema.hasColumn('events', 'customer_name');
  if (hasCustomerName) {
    await knex.schema.alterTable('events', (table) => {
      table.dropColumn('customer_name');
    });
  }
  const hasCustomerEmail = await knex.schema.hasColumn('events', 'customer_email');
  if (hasCustomerEmail) {
    await knex.schema.alterTable('events', (table) => {
      table.dropColumn('customer_email');
    });
  }
 };
@@ -0,0 +1,18 @@
 const { addColumnIfNotExists } = require('../helpers');
 exports.up = async function up(knex) {
  // Add tls_reject_unauthorized column to email_configs table
  // Default is true (validate certificates), false means ignore SSL/TLS certificate errors
  await addColumnIfNotExists(knex, 'email_configs', 'tls_reject_unauthorized', (table) => {
    table.boolean('tls_reject_unauthorized').defaultTo(true);
  });
 };
 exports.down = async function down(knex) {
  const hasColumn = await knex.schema.hasColumn('email_configs', 'tls_reject_unauthorized');
  if (hasColumn) {
    await knex.schema.alterTable('email_configs', (table) => {
      table.dropColumn('tls_reject_unauthorized');
    });
  }
 };
@@ -0,0 +1,109 @@
 const { addColumnIfNotExists } = require('../helpers');
 /**
 * Migration: Add video support to photos table
 * - Adds columns for video metadata (media_type, duration, codecs, dimensions)
 * - Updates existing photos to have media_type 'image'
 */
 exports.up = async function(knex) {
  console.log('Running migration: 042_add_video_support');
  // Add media_type column (image or video)
  await addColumnIfNotExists(knex, 'photos', 'media_type', (table) => {
    table.string('media_type').defaultTo('image');
  });
  // Add mime_type column if not exists
  await addColumnIfNotExists(knex, 'photos', 'mime_type', (table) => {
    table.string('mime_type');
  });
  // Add duration column (for videos, in seconds)
  await addColumnIfNotExists(knex, 'photos', 'duration', (table) => {
    table.integer('duration');
  });
  // Add video codec information
  await addColumnIfNotExists(knex, 'photos', 'video_codec', (table) => {
    table.string('video_codec');
  });
  // Add audio codec information
  await addColumnIfNotExists(knex, 'photos', 'audio_codec', (table) => {
    table.string('audio_codec');
  });
  // Add width dimension
  await addColumnIfNotExists(knex, 'photos', 'width', (table) => {
    table.integer('width');
  });
  // Add height dimension
  await addColumnIfNotExists(knex, 'photos', 'height', (table) => {
    table.integer('height');
  });
  // Update existing photos to have media_type 'image' if not set
  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
  if (hasMediaType) {
    await knex('photos')
      .whereNull('media_type')
      .orWhere('media_type', '')
      .update({ media_type: 'image' });
    console.log('Updated existing photos to have media_type "image"');
  }
  console.log('Migration 042_add_video_support completed');
 };
 exports.down = async function(knex) {
  console.log('Rolling back migration: 042_add_video_support');
  // Remove video support columns
  const hasMediaType = await knex.schema.hasColumn('photos', 'media_type');
  if (hasMediaType) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('media_type');
    });
  }
  const hasDuration = await knex.schema.hasColumn('photos', 'duration');
  if (hasDuration) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('duration');
    });
  }
  const hasVideoCodec = await knex.schema.hasColumn('photos', 'video_codec');
  if (hasVideoCodec) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('video_codec');
    });
  }
  const hasAudioCodec = await knex.schema.hasColumn('photos', 'audio_codec');
  if (hasAudioCodec) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('audio_codec');
    });
  }
  const hasWidth = await knex.schema.hasColumn('photos', 'width');
  if (hasWidth) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('width');
    });
  }
  const hasHeight = await knex.schema.hasColumn('photos', 'height');
  if (hasHeight) {
    await knex.schema.alterTable('photos', (table) => {
      table.dropColumn('height');
    });
  }
  // Note: We don't drop mime_type as it may be used by images as well
  console.log('Rollback of 042_add_video_support completed');
 };
@@ -1,23 +1,56 @@
 exports.up = async function(knex) {
-  // Add user upload settings to events table
+  // Add user upload settings to events table (check if columns exist first)
-  await knex.schema.alterTable('events', function(table) {
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
-    table.boolean('allow_user_uploads').defaultTo(false);
+  if (!hasAllowUserUploads) {
-    table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
+    console.log('Adding allow_user_uploads column to events table...');
-  });
+    await knex.schema.alterTable('events', function(table) {
-  
+      table.boolean('allow_user_uploads').defaultTo(false);
    });
  } else {
    console.log('Column allow_user_uploads already exists in events table, skipping...');
  }
  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
  if (!hasUploadCategoryId) {
    console.log('Adding upload_category_id column to events table...');
    await knex.schema.alterTable('events', function(table) {
      table.integer('upload_category_id').references('id').inTable('photo_categories').onDelete('SET NULL');
    });
  } else {
    console.log('Column upload_category_id already exists in events table, skipping...');
  }
  // Add uploaded_by field to photos table to track who uploaded
-  await knex.schema.alterTable('photos', function(table) {
+  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
-    table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
+  if (!hasUploadedBy) {
-  });
+    console.log('Adding uploaded_by column to photos table...');
    await knex.schema.alterTable('photos', function(table) {
      table.string('uploaded_by').defaultTo('admin'); // 'admin' or guest identifier
    });
  } else {
    console.log('Column uploaded_by already exists in photos table, skipping...');
  }
 };
 exports.down = async function(knex) {
-  await knex.schema.alterTable('events', function(table) {
+  const hasAllowUserUploads = await knex.schema.hasColumn('events', 'allow_user_uploads');
-    table.dropColumn('allow_user_uploads');
+  if (hasAllowUserUploads) {
-    table.dropColumn('upload_category_id');
+    await knex.schema.alterTable('events', function(table) {
-  });
+      table.dropColumn('allow_user_uploads');
-  
+    });
-  await knex.schema.alterTable('photos', function(table) {
+  }
-    table.dropColumn('uploaded_by');
+
-  });
+  const hasUploadCategoryId = await knex.schema.hasColumn('events', 'upload_category_id');
  if (hasUploadCategoryId) {
    await knex.schema.alterTable('events', function(table) {
      table.dropColumn('upload_category_id');
    });
  }
  const hasUploadedBy = await knex.schema.hasColumn('photos', 'uploaded_by');
  if (hasUploadedBy) {
    await knex.schema.alterTable('photos', function(table) {
      table.dropColumn('uploaded_by');
    });
  }
 };
@@ -1,6 +1,6 @@
 {
  "name": "picpeak-backend",
-  "version": "1.1.11",
+  "version": "1.1.15",
  "description": "Backend for PicPeak event photo sharing platform",
  "main": "server.js",
  "scripts": {
@@ -15,6 +15,7 @@
    "@aws-sdk/client-s3": "^3.850.0",
    "@aws-sdk/lib-storage": "^3.850.0",
    "@aws-sdk/s3-request-presigner": "^3.850.0",
    "@ffmpeg-installer/ffmpeg": "^1.1.0",
    "adm-zip": "^0.5.16",
    "archiver": "^5.3.1",
    "axios": "^1.12.2",
@@ -26,6 +27,7 @@
    "express": "^4.18.2",
    "express-rate-limit": "^6.7.0",
    "express-validator": "^7.0.1",
    "fluent-ffmpeg": "^2.1.3",
    "form-data": "^4.0.4",
    "handlebars": "^4.7.8",
    "helmet": "^7.0.0",
@@ -33,13 +35,13 @@
    "i18next-browser-languagedetector": "^8.2.0",
    "i18next-http-backend": "^3.0.2",
    "joi": "^17.9.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
    "jsonwebtoken": "^9.0.0",
    "knex": "^2.4.2",
    "mime-types": "^3.0.1",
    "multer": "^2.0.2",
    "node-cron": "^3.0.2",
-    "nodemailer": "7.0.5",
+    "nodemailer": "^7.0.10",
    "pg": "^8.16.3",
    "react-i18next": "^15.6.0",
    "sanitize-html": "^2.17.0",
@@ -55,5 +57,13 @@
    "mock-fs": "^5.5.0",
    "nodemon": "^3.1.10",
    "supertest": "^6.3.3"
  },
  "overrides": {
    "prebuild-install": {
      "tar-fs": "2.1.4"
    },
    "glob": "^11.1.0",
    "body-parser": "^2.2.1",
    "js-yaml": "^4.1.1"
  }
 }
@@ -324,9 +324,9 @@ async function initializeRateLimiters() {
 // Note: Rate limiters will be initialized after database connection
-// Body parsing middleware with increased limits for large uploads
+<<<<<<< HEAD
-app.use(express.json({ limit: '100mb' }));
+app.use(express.json({ limit: '10gb' }));
-app.use(express.urlencoded({ extended: true, limit: '100mb' }));
+app.use(express.urlencoded({ extended: true, limit: '10gb' }));
 // Request logging for API routes (with timestamps)
 const apiRequestLogger = (req, res, next) => {
@@ -3,6 +3,7 @@ const path = require('path');
 const knex = require('knex');
 const knexConfig = require('../../knexfile');
 const logger = require('../utils/logger');
 const { extractShareToken } = require('../utils/shareLinkUtils');
 // Ensure SQLite directory exists when using file-based DB (native installs)
 try {
@@ -63,12 +64,16 @@ async function initializeDatabase() {
      table.string('event_type').notNullable();
      table.string('event_name').notNullable();
      table.date('event_date').notNullable();
      table.string('customer_name');
      table.string('customer_email');
      table.string('host_email').notNullable();
      table.string('host_name');
      table.string('admin_email').notNullable();
      table.string('password_hash').notNullable();
      table.text('welcome_message');
      table.text('color_theme');
      table.string('share_link').unique().notNullable();
      table.string('share_token').unique();
      table.datetime('created_at').defaultTo(db.fn.now());
      table.datetime('expires_at').notNullable();
      table.boolean('is_active').defaultTo(true);
@@ -99,12 +104,16 @@ async function initializeDatabase() {
            event_type TEXT NOT NULL,
            event_name TEXT NOT NULL,
            event_date DATE NOT NULL,
            customer_name TEXT,
            customer_email TEXT,
            host_name TEXT,
            host_email TEXT NOT NULL,
            admin_email TEXT NOT NULL,
            password_hash TEXT NOT NULL,
            welcome_message TEXT,
            color_theme TEXT,
            share_link TEXT UNIQUE NOT NULL,
            share_token TEXT UNIQUE,
            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
            expires_at DATETIME NOT NULL,
            is_active BOOLEAN DEFAULT 1,
@@ -157,6 +166,37 @@ async function initializeDatabase() {
    }
  }
  const hasShareTokenColumn = await db.schema.hasColumn('events', 'share_token');
  if (!hasShareTokenColumn) {
    await db.schema.table('events', (table) => {
      table.string('share_token').unique();
    });
  }
  const hasHostNameColumn = await db.schema.hasColumn('events', 'host_name');
  if (!hasHostNameColumn) {
    await db.schema.table('events', (table) => {
      table.string('host_name');
    });
  }
  try {
    const eventsWithoutToken = await db('events')
      .whereNull('share_token')
      .select('id', 'share_link');
    for (const event of eventsWithoutToken) {
      const token = extractShareToken(event.share_link);
      if (token) {
        await db('events')
          .where({ id: event.id })
          .update({ share_token: token });
      }
    }
  } catch (error) {
    logger.warn('Share token backfill skipped', { error: error.message });
  }
  // Photo metadata table
  const hasPhotosTable = await db.schema.hasTable('photos');
  if (!hasPhotosTable) {
@@ -0,0 +1,99 @@
 const request = require('supertest');
 const express = require('express');
 const buildChain = ({ firstResult, updateResult } = {}) => {
  const chain = {
    where: jest.fn().mockReturnThis(),
    whereNot: jest.fn().mockReturnThis(),
    select: jest.fn().mockReturnThis(),
    update: jest.fn().mockResolvedValue(updateResult ?? 1),
    first: jest.fn().mockResolvedValue(firstResult),
  };
  return chain;
 };
 jest.mock('../../database/db', () => {
  const dbMock = jest.fn();
  dbMock.raw = jest.fn();
  dbMock.__setImplementations = (...chains) => {
    dbMock.mockReset();
    chains.forEach((chain) => {
      dbMock.mockImplementationOnce(() => chain);
    });
  };
  return {
    db: dbMock,
    logActivity: jest.fn().mockResolvedValue(undefined),
  };
 });
 jest.mock('../../middleware/auth-enhanced-v2', () => ({
  adminAuth: (_req, _res, next) => {
    _req.admin = { id: 1, username: 'admin' };
    next();
  },
 }));
 const { db, logActivity } = require('../../database/db');
 const adminAuthRouter = require('../adminAuth');
 describe('adminAuth profile updates', () => {
  const app = express();
  app.use(express.json());
  app.use('/auth/admin', adminAuthRouter);
  beforeEach(() => {
    jest.clearAllMocks();
  });
  it('updates the admin profile', async () => {
    const updatedUser = {
      id: 1,
      username: 'newadmin',
      email: 'newadmin@example.com',
      must_change_password: false,
    };
    db.__setImplementations(
      buildChain({ firstResult: null }),          // email check
      buildChain({ firstResult: null }),          // username check
      buildChain({ updateResult: 1 }),            // update
      buildChain({ firstResult: updatedUser }),   // fetch updated user
    );
    const response = await request(app)
      .put('/auth/admin/profile')
      .send({ username: updatedUser.username, email: updatedUser.email })
      .expect(200);
    expect(response.body).toEqual({ user: updatedUser });
    expect(logActivity).toHaveBeenCalledWith(
      'admin_profile_updated',
      { admin_id: 1, updated_fields: ['username', 'email'] },
      null,
      { type: 'admin', id: 1, name: updatedUser.username }
    );
  });
  it('rejects email conflicts', async () => {
    db.__setImplementations(
      buildChain({ firstResult: { id: 2 } })
    );
    const response = await request(app)
      .put('/auth/admin/profile')
      .send({ username: 'newadmin', email: 'taken@example.com' })
      .expect(409);
    expect(response.body).toEqual({ error: 'Email is already in use by another admin' });
  });
  it('validates input', async () => {
    const response = await request(app)
      .put('/auth/admin/profile')
      .send({ username: '', email: 'not-an-email' })
      .expect(400);
    expect(response.body.errors).toBeDefined();
  });
 });
@@ -0,0 +1,67 @@
 const request = require('supertest');
 const express = require('express');
 jest.mock('../../database/db', () => {
  const deleteMock = jest.fn().mockResolvedValue(5);
  const chain = {
    select: jest.fn().mockReturnThis(),
    leftJoin: jest.fn().mockReturnThis(),
    orderBy: jest.fn().mockReturnThis(),
    limit: jest.fn().mockReturnThis(),
    whereNull: jest.fn().mockReturnThis(),
    whereNotNull: jest.fn().mockReturnThis(),
    where: jest.fn().mockReturnThis(),
    update: jest.fn().mockReturnThis(),
    delete: deleteMock,
    count: jest.fn().mockReturnThis(),
    first: jest.fn().mockResolvedValue({ count: 0 }),
  };
  const dbMock = jest.fn(() => chain);
  dbMock.raw = jest.fn();
  dbMock.__chain = chain;
  dbMock.__deleteMock = deleteMock;
  return { db: dbMock };
 });
 jest.mock('../../middleware/auth-enhanced-v2', () => ({
  adminAuth: (_req, _res, next) => next(),
 }));
 const { db } = require('../../database/db');
 const notificationsRouter = require('../adminNotifications');
 describe('adminNotifications routes', () => {
  const app = express();
  app.use(express.json());
  app.use('/admin/notifications', notificationsRouter);
  beforeEach(() => {
    jest.clearAllMocks();
  });
  it('clears all notifications', async () => {
    db.__deleteMock.mockResolvedValueOnce(8);
    const response = await request(app)
      .delete('/admin/notifications/clear-all')
      .expect(200);
    expect(db).toHaveBeenCalledWith('activity_logs');
    expect(db.__deleteMock).toHaveBeenCalledTimes(1);
    expect(response.body).toEqual({
      message: 'All notifications cleared',
      deletedCount: 8,
    });
  });
  it('handles database errors when clearing notifications', async () => {
    db.__deleteMock.mockRejectedValueOnce(new Error('boom'));
    const response = await request(app)
      .delete('/admin/notifications/clear-all')
      .expect(500);
    expect(response.body).toEqual({ error: 'Failed to clear notifications' });
  });
 });
@@ -159,6 +159,68 @@ router.post('/change-password', [
  }
 });
 // Update admin profile
 router.put('/profile', [
  adminAuth,
  body('username').trim().notEmpty().withMessage('Username is required'),
  body('email').trim().isEmail().withMessage('Valid email is required')
 ], async (req, res) => {
  try {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    const { username, email } = req.body;
    const userId = req.admin.id;
    // Check for email conflicts
    const existingEmail = await db('admin_users')
      .where('email', email)
      .whereNot('id', userId)
      .first();
    if (existingEmail) {
      return res.status(409).json({ error: 'Email is already in use by another admin' });
    }
    // Check username conflict (if multiple admins are supported)
    const existingUsername = await db('admin_users')
      .where('username', username)
      .whereNot('id', userId)
      .first();
    if (existingUsername) {
      return res.status(409).json({ error: 'Username is already in use by another admin' });
    }
    await db('admin_users')
      .where('id', userId)
      .update({
        username,
        email,
        updated_at: new Date()
      });
    const updatedUser = await db('admin_users')
      .select('id', 'username', 'email', 'must_change_password')
      .where('id', userId)
      .first();
    await logActivity(
      'admin_profile_updated',
      { admin_id: userId, updated_fields: ['username', 'email'] },
      null,
      { type: 'admin', id: userId, name: username }
    );
    res.json({ user: updatedUser });
  } catch (error) {
    console.error('Admin profile update error:', error);
    res.status(500).json({ error: 'Failed to update admin profile' });
  }
 });
 // Logout
 router.post('/logout', adminAuth, async (req, res) => {
  try {
@@ -18,7 +18,8 @@ router.get('/config', adminAuth, async (req, res) => {
        smtp_user: '',
        smtp_pass: '', // Don't send actual password
        from_email: '',
-        from_name: ''
+        from_name: '',
        tls_reject_unauthorized: true
      });
    }
@@ -53,7 +54,8 @@ router.post('/config', [
      smtp_user,
      smtp_pass,
      from_email,
-      from_name
+      from_name,
      tls_reject_unauthorized
    } = req.body;
    // Check if config exists
@@ -66,6 +68,7 @@ router.post('/config', [
      smtp_user: smtp_user || '',
      from_email,
      from_name: from_name || 'Photo Sharing',
      tls_reject_unauthorized: tls_reject_unauthorized !== false, // Default to true
      updated_at: new Date()
    };
@@ -137,6 +140,10 @@ router.post('/test', adminAuth, async (req, res) => {
        user: config.smtp_user,
        pass: config.smtp_pass
      } : undefined,
      tls: {
        // Allow ignoring SSL certificate errors when tls_reject_unauthorized is false
        rejectUnauthorized: config.tls_reject_unauthorized !== false
      },
      logger: process.env.NODE_ENV === 'development',
      debug: process.env.NODE_ENV === 'development'
    };
@@ -173,26 +180,57 @@ router.post('/test', adminAuth, async (req, res) => {
  } catch (error) {
    console.error('Test email error:', error);
    console.error('Error stack:', error.stack);
-    
+
-    // Provide more specific error messages
+    // Provide more specific error messages with translation keys
-    let errorMessage = 'Failed to send test email';
+    let errorMessage = 'Error sending email';
    let errorKey = 'email.errors.sendFailed';
    let details = error.message;
-    
+    let detailsKey = 'email.errors.unknownError';
    if (error.code === 'ECONNREFUSED') {
      errorMessage = 'Failed to connect to SMTP server';
      errorKey = 'email.errors.connectionRefused';
      details = 'Please check your SMTP host and port settings';
      detailsKey = 'email.errors.checkHostPort';
    } else if (error.code === 'EAUTH') {
      errorMessage = 'SMTP authentication failed';
      errorKey = 'email.errors.authFailed';
      details = 'Please check your SMTP username and password';
      detailsKey = 'email.errors.checkCredentials';
    } else if (error.code === 'ESOCKET') {
-      errorMessage = 'Network error';
+      errorMessage = 'Network error connecting to SMTP server';
      errorKey = 'email.errors.networkError';
      details = 'Could not establish connection to SMTP server';
      detailsKey = 'email.errors.connectionFailed';
    } else if (error.code === 'ETIMEDOUT') {
      errorMessage = 'Connection to SMTP server timed out';
      errorKey = 'email.errors.timeout';
      details = 'The server took too long to respond. Please check your network and SMTP settings.';
      detailsKey = 'email.errors.timeoutDetails';
    } else if (error.code === 'ENOTFOUND') {
      errorMessage = 'SMTP server not found';
      errorKey = 'email.errors.serverNotFound';
      details = 'The SMTP host could not be resolved. Please verify the hostname.';
      detailsKey = 'email.errors.checkHostname';
    } else if (error.responseCode >= 500) {
      errorMessage = 'SMTP server error';
      errorKey = 'email.errors.serverError';
      details = `Server returned error code ${error.responseCode}`;
      detailsKey = 'email.errors.serverErrorDetails';
    } else if (error.responseCode >= 400) {
      errorMessage = 'Email rejected by server';
      errorKey = 'email.errors.rejected';
      details = error.response || 'The email was rejected. Check recipient address and settings.';
      detailsKey = 'email.errors.rejectedDetails';
    }
-    
+
-    res.status(500).json({ 
+    res.status(500).json({
      error: errorMessage,
      errorKey: errorKey,
      details: details,
-      code: error.code
+      detailsKey: detailsKey,
      code: error.code,
      responseCode: error.responseCode
    });
  }
 });
@@ -2,13 +2,14 @@
 // Only the relevant parts are shown - merge with existing adminEvents.js
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 const { buildShareLinkVariants } = require('../services/shareLinkService');
 // Enhanced event creation with password validation
 router.post('/', adminAuth, [
  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
  body('event_name').notEmpty().trim(),
  body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
+  body('customer_email').isEmail().normalizeEmail(),
  body('admin_email').isEmail().normalizeEmail(),
  body('password').notEmpty(), // Remove the weak isLength validation
  body('expiration_days').isInt({ min: 1, max: 365 }).optional(),
@@ -16,7 +17,7 @@ router.post('/', adminAuth, [
  body('color_theme').optional().trim(),
  body('allow_user_uploads').optional().isBoolean().toBoolean(),
  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
-  body('host_name').notEmpty().trim()
+  body('customer_name').notEmpty().trim()
 ], async (req, res) => {
  try {
    console.log('Create event request body:', req.body);
@@ -30,8 +31,8 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
-      host_name,
+      customer_name,
-      host_email,
+      customer_email,
      admin_email,
      password,
      welcome_message = '',
@@ -65,9 +66,9 @@ router.post('/', adminAuth, [
      counter++;
    }
-    // Generate share link
+    // Generate share link based on configured style
    const shareToken = crypto.randomBytes(16).toString('hex');
-    const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
+    const { shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
    // Hash password with configurable rounds
    const password_hash = await bcrypt.hash(password, getBcryptRounds());
@@ -88,13 +89,16 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
-      host_name,
+      customer_name,
-      host_email,
+      customer_email,
      host_name: customer_name,
      host_email: customer_email,
      admin_email,
      password_hash,
      welcome_message,
      color_theme,
-      share_link: shareLink,
+      share_link: shareLinkToStore,
      share_token: shareToken,
      expires_at: expires_at.toISOString(),
      created_at: new Date().toISOString(),
      allow_user_uploads,
@@ -121,4 +125,4 @@ router.post('/', adminAuth, [
    console.error('Error creating event:', error);
    res.status(500).json({ error: 'Failed to create event' });
  }
-});
+});
@@ -14,6 +14,7 @@ const { escapeLikePattern } = require('../utils/sqlSecurity');
 // formatDate import removed - dates are formatted by email processor
 const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 const logger = require('../utils/logger');
 const { buildShareLinkVariants } = require('../services/shareLinkService');
 const parseBooleanInput = (value, defaultValue = true) => {
  if (value === undefined || value === null) {
@@ -37,12 +38,67 @@ const parseBooleanInput = (value, defaultValue = true) => {
  return defaultValue;
 };
 const getCustomerNameFromPayload = (payload = {}) => {
  if (typeof payload.customer_name === 'string') {
    const trimmed = payload.customer_name.trim();
    return trimmed || null;
  }
  return null;
 };
 const getCustomerEmailFromPayload = (payload = {}) => {
  if (typeof payload.customer_email === 'string') {
    const trimmed = payload.customer_email.trim();
    return trimmed || null;
  }
  return null;
 };
 const mapEventForApi = (event) => {
  if (!event || typeof event !== 'object') {
    return event;
  }
  const {
    host_name,
    host_email,
    customer_name,
    customer_email,
    ...rest
  } = event;
  return {
    ...rest,
    customer_name: customer_name ?? host_name ?? null,
    customer_email: customer_email ?? host_email ?? null
  };
 };
 let customerColumnCache = null;
 const hasCustomerContactColumns = async () => {
  if (customerColumnCache === true) {
    return true;
  }
  try {
    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
    if (hasColumn) {
      customerColumnCache = true;
    }
    return hasColumn;
  } catch (error) {
    logger.debug('Failed to detect customer_email column', { error: error.message });
    return false;
  }
 };
 // Create new event
 router.post('/', adminAuth, [
  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
  body('event_name').notEmpty().trim(),
  body('event_date').isDate(),
-  body('host_email').isEmail().normalizeEmail(),
+  body('customer_name').notEmpty().trim(),
  body('customer_email').isEmail().normalizeEmail(),
  body('admin_email').isEmail().normalizeEmail(),
  body('require_password').optional().isBoolean(),
  body('password').optional().isString().custom((value, { req }) => {
@@ -73,7 +129,6 @@ router.post('/', adminAuth, [
  body('color_theme').optional().trim(),
  body('allow_user_uploads').optional().isBoolean().toBoolean(),
  body('upload_category_id').optional({ nullable: true, checkFalsy: true }).isInt(),
  body('host_name').notEmpty().trim(),
  body('allow_downloads').optional().isBoolean(),
  body('disable_right_click').optional().isBoolean(),
  body('watermark_downloads').optional().isBoolean(),
@@ -91,8 +146,6 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
      host_name,
      host_email,
      admin_email,
      password,
      welcome_message = '',
@@ -115,7 +168,16 @@ router.post('/', adminAuth, [
      moderate_comments = true,
      show_feedback_to_guests = true
    } = req.body;
-    
+
    const customerName = getCustomerNameFromPayload(req.body);
    const customerEmail = getCustomerEmailFromPayload(req.body);
    const customerColumnsAvailable = await hasCustomerContactColumns();
    if (!customerName || !customerEmail) {
      return res.status(400).json({ error: 'customer_name and customer_email are required' });
    }
    const requirePassword = parseBooleanInput(requirePasswordInput, true);
    // Debug logging
@@ -133,7 +195,6 @@ router.post('/', adminAuth, [
    });
    let passwordValidation = null;
    let galleryPassword = password;
    if (requirePassword) {
      passwordValidation = await validatePasswordInContext(password, 'gallery', {
@@ -148,8 +209,6 @@ router.post('/', adminAuth, [
          feedback: passwordValidation.feedback
        });
      }
    } else {
      galleryPassword = '';
    }
    // Generate unique slug
@@ -167,11 +226,9 @@ router.post('/', adminAuth, [
      counter++;
    }
-    // Generate share link
+    // Generate share link respecting configured format
    const shareToken = crypto.randomBytes(16).toString('hex');
-    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
    const shareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
    // Hash password with configurable rounds (random placeholder when not required)
    const password_hash = requirePassword
@@ -201,13 +258,15 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
-      host_name,
+      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
-      host_email,
+      host_name: customerName,
      host_email: customerEmail,
      admin_email,
      password_hash,
      welcome_message,
      color_theme,
-      share_link: shareLink,
+      share_link: shareLinkToStore,
      share_token: shareToken,
      expires_at: expires_at.toISOString(),
      created_at: new Date().toISOString(),
      allow_user_uploads,
@@ -251,13 +310,15 @@ router.post('/', adminAuth, [
    await db('email_queue').insert({
      event_id: eventId,
-      recipient_email: host_email,
+      recipient_email: customerEmail,
      email_type: 'gallery_created',
      email_data: JSON.stringify({
-        host_name: host_name,
+        customer_name: customerName,
        customer_email: customerEmail,
        host_name: customerName || (customerEmail ? customerEmail.split('@')[0] : null),
        event_name,
        event_date: event_date,  // Pass raw date - will be formatted by email processor
-        gallery_link: shareLink,
+        gallery_link: shareUrl,
        gallery_password: requirePassword ? password : 'No password required',
        expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
        welcome_message: welcome_message || ''
@@ -272,8 +333,10 @@ router.post('/', adminAuth, [
      slug,
      event_name,
      event_type,
      customer_name: customerName,
      customer_email: customerEmail,
      require_password: requirePassword,
-      share_link: shareLink,
+      share_link: shareUrl,
      expires_at: expires_at.toISOString(),
      created_at: new Date().toISOString()
    });
@@ -356,7 +419,7 @@ router.get('/', adminAuth, async (req, res) => {
      created_at: event.created_at ? new Date(event.created_at).toISOString() : null,
      expires_at: event.expires_at ? new Date(event.expires_at).toISOString() : null,
      archived_at: event.archived_at ? new Date(event.archived_at).toISOString() : null
-    }));
+    })).map(mapEventForApi);
    res.json({
      events: eventsWithCounts,
@@ -418,7 +481,7 @@ router.get('/:id', adminAuth, async (req, res) => {
      .where('event_id', id)
      .countDistinct('ip_address as uniqueVisitors');
-    res.json({
+    res.json(mapEventForApi({
      ...event,
      photo_count: parseInt(photoCount) || 0,
      total_size: parseInt(totalSize) || 0,
@@ -426,7 +489,7 @@ router.get('/:id', adminAuth, async (req, res) => {
      total_downloads: parseInt(totalDownloads) || 0,
      unique_visitors: parseInt(uniqueVisitors) || 0,
      recent_photos: recentPhotos
-    });
+    }));
  } catch (error) {
    console.error('Error fetching event:', error);
    res.status(500).json({ error: 'Failed to fetch event details' });
@@ -442,7 +505,8 @@ router.put('/:id', adminAuth, [
  body('welcome_message').optional({ nullable: true, checkFalsy: true }).trim(),
  body('color_theme').optional({ nullable: true }),
  body('allow_user_uploads').optional().isBoolean(),
-  body('host_name').optional().trim().notEmpty(),
+  body('customer_name').optional().trim().notEmpty(),
  body('customer_email').optional().isEmail().normalizeEmail(),
  body('upload_category_id').optional().custom((value) => {
    // Accept null, undefined, or integer values
    if (value === null || value === undefined) return true;
@@ -481,6 +545,39 @@ router.put('/:id', adminAuth, [
    const { id } = req.params;
    const updates = { ...req.body };
    const customerColumnsAvailable = await hasCustomerContactColumns();
    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
    }
    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
      const nextName = getCustomerNameFromPayload(updates);
      if (nextName) {
        if (customerColumnsAvailable) {
          updates.customer_name = nextName;
        } else {
          delete updates.customer_name;
        }
        updates.host_name = nextName;
      } else {
        delete updates.customer_name;
      }
    }
    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
      const nextEmail = getCustomerEmailFromPayload(updates);
      if (nextEmail) {
        if (customerColumnsAvailable) {
          updates.customer_email = nextEmail;
        } else {
          delete updates.customer_email;
        }
        updates.host_email = nextEmail;
      } else {
        delete updates.customer_email;
      }
    }
    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
    let requirePasswordUpdate;
@@ -715,10 +812,13 @@ router.post('/:id/reset-password', adminAuth, async (req, res) => {
    // Queue email notification if requested
    if (sendEmail) {
-      // For password reset, we'll need to create a template or use a different approach
+      const recipientEmail = event.customer_email || event.host_email;
-      // For now, let's use the gallery_created template with updated password
+      const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
-      await queueEmail(id, event.host_email, 'gallery_created', {
+
-        host_name: event.host_email.split('@')[0],
+      await queueEmail(id, recipientEmail, 'gallery_created', {
        customer_name: recipientName,
        customer_email: recipientEmail,
        host_name: recipientName,
        event_name: event.event_name,
        event_date: event.event_date,  // Pass raw date - will be formatted by email processor
        gallery_link: event.share_link,
@@ -773,8 +873,13 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
    // Dates will be formatted by the email processor based on recipient language
    // Queue the email
-    await queueEmail(id, event.host_email, 'gallery_created', {
+    const recipientEmail = event.customer_email || event.host_email;
-      host_name: event.host_name || event.host_email.split('@')[0],
+    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
    await queueEmail(id, recipientEmail, 'gallery_created', {
      customer_name: recipientName,
      customer_email: recipientEmail,
      host_name: recipientName,
      event_name: event.event_name,
      event_date: event.event_date,  // Pass raw date - will be formatted by email processor
      gallery_link: event.share_link,
@@ -789,7 +894,7 @@ router.post('/:id/resend-email', adminAuth, async (req, res) => {
    try {
      await logActivity('email_resent', {
        email_type: 'gallery_created',
-        recipient: event.host_email,
+        recipient: recipientEmail,
        ip_address: req.ip || '0.0.0.0',
        user_agent: req.get('user-agent') || 'Unknown'
      }, id, {
@@ -8,6 +8,9 @@ const { generateThumbnail, ensureThumbnail } = require('../services/imageProcess
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { validateUploadedFiles } = require('../middleware/uploadValidation');
 const { getMaxFilesPerUpload } = require('../services/uploadSettings');
 const { processUploadedPhotos } = require('../services/photoProcessor');
 const chunkedUpload = require('../services/chunkedUploadService');
 const router = express.Router();
 // Get storage path from environment or default
@@ -47,8 +50,8 @@ const { validateFileType } = require('../utils/fileSecurityUtils');
 const upload = multer({
  storage: storage,
  limits: {
-    fileSize: 50 * 1024 * 1024, // 50MB limit per file
+    fileSize: 10 * 1024 * 1024 * 1024, // 10GB limit per file to support large videos
-    files: 500, // Maximum 500 files
+    files: 2000, // Hard safety ceiling; actual limit enforced dynamically
    // Set a reasonable field size limit to prevent memory issues
    fieldSize: 10 * 1024 * 1024, // 10MB for non-file fields
    // Add part size limits to prevent incomplete uploads
@@ -56,13 +59,16 @@ const upload = multer({
    headerPairs: 2000 // Maximum number of header key-value pairs
  },
  fileFilter: (req, file, cb) => {
-    // Accept images only with proper validation
+    // Accept images and videos with proper validation
-    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
+    const allowedMimeTypes = [
-    
+      'image/jpeg', 'image/png', 'image/webp',
      'video/mp4', 'video/webm', 'video/quicktime', 'video/x-msvideo'
    ];
    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
      return cb(null, true);
    } else {
-      cb(new Error('Only JPEG, PNG and WebP images are allowed'));
+      cb(new Error('Only JPEG, PNG, WebP images and MP4, WebM, MOV, AVI videos are allowed'));
    }
  },
  // Add abort on limit to stop processing when limits are exceeded
@@ -73,8 +79,11 @@ const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
 // Create content validator middleware
 const validateUploadContent = createFileUploadValidator({
-  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
+  allowedTypes: [
-  maxFileSize: 50 * 1024 * 1024,
+    'image/jpeg', 'image/png', 'image/webp',
    'video/mp4', 'video/webm', 'video/quicktime', 'video/x-msvideo'
  ],
  maxFileSize: 10 * 1024 * 1024 * 1024, // 10GB to support large videos
  validateContent: true
 });
@@ -99,17 +108,25 @@ const uploadTimeout = (timeout = 300000) => { // 5 minutes default
 };
 // Upload photos for an event
-// Increased limit to 500 files, but recommend chunked uploads for better performance
+// Max file count is configurable via general settings
-router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), (req, res, next) => { // 10 minute timeout
+router.post('/:eventId/upload', adminAuth, uploadTimeout(600000), async (req, res, next) => { // 10 minute timeout
-  upload.array('photos', 500)(req, res, (err) => {
+  let maxFilesPerUpload;
  try {
    maxFilesPerUpload = await getMaxFilesPerUpload();
  } catch (error) {
    console.error('Failed to resolve max files per upload:', error);
    return res.status(500).json({ error: 'Unable to determine upload limits' });
  }
  upload.array('photos', maxFilesPerUpload)(req, res, (err) => {
    if (err) {
      console.error('Multer error:', err);
      if (err instanceof multer.MulterError) {
        if (err.code === 'LIMIT_FILE_SIZE') {
-          return res.status(400).json({ error: 'File too large. Maximum size is 50MB per file.' });
+          return res.status(400).json({ error: 'File too large. Maximum size is 10GB per file.' });
        }
-        if (err.code === 'LIMIT_FILE_COUNT') {
+        if (err.code === 'LIMIT_FILE_COUNT' || err.code === 'LIMIT_UNEXPECTED_FILE') {
-          return res.status(400).json({ error: 'Too many files. Maximum 500 files per upload.' });
+          return res.status(400).json({ error: `Too many files. Maximum ${maxFilesPerUpload} files per upload.` });
        }
        return res.status(400).json({ error: `Upload error: ${err.message}` });
      }
@@ -464,21 +481,42 @@ router.patch('/:eventId/photos/:photoId', adminAuth, async (req, res) => {
  try {
    const { eventId, photoId } = req.params;
    const { category_id } = req.body;
-    
+
    // Verify photo belongs to event
    const photo = await db('photos')
      .where({ id: photoId, event_id: eventId })
      .first();
-    
+
    if (!photo) {
      return res.status(404).json({ error: 'Photo not found' });
    }
-    
+
    // Prepare update data
    const updateData = {};
    // Handle type-based categories ('individual' or 'collage')
    // These are string values that map to the photo.type field
    if (category_id === 'individual' || category_id === 'collage') {
      updateData.type = category_id;
      updateData.category_id = null; // Clear legacy category_id
    } else if (category_id === null || category_id === undefined) {
      // Explicitly clear category
      updateData.category_id = null;
    } else {
      // Handle numeric category IDs from photo_categories table
      const numericCategoryId = parseInt(category_id, 10);
      if (!isNaN(numericCategoryId)) {
        updateData.category_id = numericCategoryId;
      } else {
        updateData.category_id = null;
      }
    }
    // Update photo
    await db('photos')
-      .where({ id: photoId })
+      .where({ id: photoId, event_id: eventId })
-      .update({ category_id: category_id || null });
+      .update(updateData);
-    
+
    res.json({ message: 'Photo updated successfully' });
  } catch (error) {
    console.error('Error updating photo:', error);
@@ -571,21 +609,40 @@ router.post('/:eventId/photos/bulk-update', adminAuth, async (req, res) => {
      .count('id as count')
      .first();
-    if (photoCount.count !== photoIds.length) {
+    if (parseInt(photoCount.count) !== photoIds.length) {
      return res.status(400).json({ error: 'Some photos do not belong to this event' });
    }
-    // Update photos
+    // Prepare update data
-    const updateData = {};
+    const updateData = {
      updated_at: new Date()
    };
    if (updates.category_id !== undefined) {
-      updateData.category_id = updates.category_id || null;
+      // Handle type-based categories ('individual' or 'collage')
      // These are string values that map to the photo.type field
      if (updates.category_id === 'individual' || updates.category_id === 'collage') {
        updateData.type = updates.category_id;
        updateData.category_id = null; // Clear legacy category_id
      } else if (updates.category_id === null) {
        // Explicitly clear category
        updateData.category_id = null;
      } else {
        // Handle numeric category IDs from photo_categories table
        const numericCategoryId = parseInt(updates.category_id, 10);
        if (!isNaN(numericCategoryId)) {
          updateData.category_id = numericCategoryId;
        } else {
          updateData.category_id = null;
        }
      }
    }
-    
+
    await db('photos')
      .whereIn('id', photoIds)
      .where('event_id', eventId)
      .update(updateData);
-    
+
    res.json({ message: `${photoIds.length} photos updated successfully` });
  } catch (error) {
    console.error('Error bulk updating photos:', error);
@@ -807,4 +864,142 @@ router.get('/:eventId/debug', adminAuth, async (req, res) => {
  }
 });
 // ============================================
 // CHUNKED UPLOAD ENDPOINTS
 // For large file uploads (videos up to 10GB)
 // ============================================
 // Initialize a chunked upload
 router.post('/:eventId/chunked-upload/init', adminAuth, async (req, res) => {
  try {
    const { eventId } = req.params;
    const { filename, fileSize, mimeType, totalChunks } = req.body;
    // Validate event exists
    const event = await db('events').where({ id: eventId }).first();
    if (!event) {
      return res.status(404).json({ error: 'Event not found' });
    }
    // Validate required fields
    if (!filename || !fileSize || !mimeType) {
      return res.status(400).json({ error: 'Missing required fields: filename, fileSize, mimeType' });
    }
    // Validate file size (max 10GB)
    const maxSize = 10 * 1024 * 1024 * 1024;
    if (fileSize > maxSize) {
      return res.status(400).json({ error: `File too large. Maximum size is 10GB.` });
    }
    const result = await chunkedUpload.initializeUpload({
      filename,
      fileSize,
      mimeType,
      eventId: parseInt(eventId),
      totalChunks
    });
    res.json(result);
  } catch (error) {
    console.error('Error initializing chunked upload:', error);
    res.status(500).json({ error: 'Failed to initialize upload' });
  }
 });
 // Upload a chunk
 router.post('/:eventId/chunked-upload/:uploadId/chunk/:chunkIndex', adminAuth, async (req, res) => {
  try {
    const { uploadId, chunkIndex } = req.params;
    // Get chunk data from request body
    const chunks = [];
    for await (const chunk of req) {
      chunks.push(chunk);
    }
    const chunkData = Buffer.concat(chunks);
    const result = await chunkedUpload.uploadChunk(uploadId, parseInt(chunkIndex), chunkData);
    res.json(result);
  } catch (error) {
    console.error('Error uploading chunk:', error);
    res.status(500).json({ error: error.message || 'Failed to upload chunk' });
  }
 });
 // Complete chunked upload and process the file
 router.post('/:eventId/chunked-upload/:uploadId/complete', adminAuth, async (req, res) => {
  try {
    const { eventId, uploadId } = req.params;
    const { category_id } = req.body;
    // Complete the chunked upload (merge chunks)
    const mergedFile = await chunkedUpload.completeUpload(uploadId);
    // Process the merged file as a regular upload
    const fileObj = {
      originalname: mergedFile.filename,
      mimetype: mergedFile.mimeType,
      size: mergedFile.size,
      path: mergedFile.path
    };
    const uploadedPhotos = await processUploadedPhotos(
      [fileObj],
      parseInt(eventId),
      'admin',
      category_id || null
    );
    // Clean up temp directory
    try {
      await fs.rm(mergedFile.tempDir, { recursive: true, force: true });
    } catch (cleanupErr) {
      console.warn('Failed to clean up temp directory:', cleanupErr.message);
    }
    res.json({
      success: true,
      uploaded: uploadedPhotos.length,
      photos: uploadedPhotos
    });
  } catch (error) {
    console.error('Error completing chunked upload:', error);
    res.status(500).json({ error: error.message || 'Failed to complete upload' });
  }
 });
 // Get upload status
 router.get('/:eventId/chunked-upload/:uploadId/status', adminAuth, async (req, res) => {
  try {
    const { uploadId } = req.params;
    const status = chunkedUpload.getUploadStatus(uploadId);
    if (!status) {
      return res.status(404).json({ error: 'Upload not found or expired' });
    }
    res.json(status);
  } catch (error) {
    console.error('Error getting upload status:', error);
    res.status(500).json({ error: 'Failed to get upload status' });
  }
 });
 // Abort chunked upload
 router.delete('/:eventId/chunked-upload/:uploadId', adminAuth, async (req, res) => {
  try {
    const { uploadId } = req.params;
    await chunkedUpload.abortUpload(uploadId);
    res.json({ success: true, message: 'Upload aborted' });
  } catch (error) {
    console.error('Error aborting upload:', error);
    res.status(500).json({ error: 'Failed to abort upload' });
  }
 });
 module.exports = router;
@@ -18,7 +18,10 @@ const {
  getRawPublicSiteSettings,
 } = require('../services/publicSiteService');
 const { sanitizeCss } = require('../utils/cssSanitizer');
 const { clearShareLinkSettingsCache } = require('../services/shareLinkService');
 const { resetSecurityConfigCache } = require('../utils/authSecurity');
 const router = express.Router();
 const { clearMaxFilesPerUploadCache, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../services/uploadSettings');
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
@@ -188,7 +191,8 @@ router.put('/branding', adminAuth, async (req, res) => {
      logo_position,
      logo_display_header,
      logo_display_hero,
-      logo_display_mode
+      logo_display_mode,
      hide_powered_by
    } = req.body;
    const brandingSettings = {
@@ -208,7 +212,8 @@ router.put('/branding', adminAuth, async (req, res) => {
      logo_position,
      logo_display_header,
      logo_display_hero,
-      logo_display_mode
+      logo_display_mode,
      hide_powered_by
    };
    // Handle favicon deletion if empty string or null is provided
@@ -472,9 +477,24 @@ router.put('/theme', adminAuth, async (req, res) => {
 router.put('/general', adminAuth, async (req, res) => {
  try {
    const settings = { ...req.body };
    let uploadLimitTouched = false;
    const publicSiteKeysTouched = Object.keys(settings).some((key) => key.startsWith('general_public_site_'));
    if (Object.prototype.hasOwnProperty.call(settings, 'general_max_files_per_upload')) {
      uploadLimitTouched = true;
      const rawValue = Number(settings.general_max_files_per_upload);
      const normalizedValue = Number.isFinite(rawValue) ? Math.floor(rawValue) : NaN;
      if (!Number.isInteger(normalizedValue) || normalizedValue < 1 || normalizedValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
        return res.status(400).json({
          error: `general_max_files_per_upload must be an integer between 1 and ${MAX_ALLOWED_FILES_PER_UPLOAD}`
        });
      }
      settings.general_max_files_per_upload = normalizedValue;
    }
    if (publicSiteKeysTouched) {
      if (Object.prototype.hasOwnProperty.call(settings, 'general_public_site_custom_css')) {
        settings.general_public_site_custom_css = sanitizeCss(settings.general_public_site_custom_css || '');
@@ -529,6 +549,12 @@ router.put('/general', adminAuth, async (req, res) => {
    if (publicSiteKeysTouched) {
      clearPublicSiteCache();
    }
    if (uploadLimitTouched) {
      clearMaxFilesPerUploadCache();
    }
    if (Object.prototype.hasOwnProperty.call(settings, 'general_short_gallery_urls')) {
      clearShareLinkSettingsCache();
    }
    // Log activity
    await db('activity_logs').insert({
@@ -567,6 +593,8 @@ router.put('/security', adminAuth, async (req, res) => {
        });
    }
    resetSecurityConfigCache();
    // Log activity
    await db('activity_logs').insert({
      activity_type: 'security_settings_updated',
@@ -12,13 +12,14 @@ const {
  checkSuspiciousActivity,
  getGenericAuthError
 } = require('../utils/authSecurity');
-const { 
+const {
  validatePasswordInContext,
  getBcryptRounds,
  logPasswordValidationFailure
 } = require('../utils/passwordValidation');
 const { endSession } = require('../middleware/sessionTimeout');
 const logger = require('../utils/logger');
 const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 // Admin login with enhanced security
@@ -33,7 +34,7 @@ router.post('/admin/login', [
    }
    const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
    const userAgent = req.headers['user-agent'] || '';
    // Check account lockout first
@@ -175,7 +176,7 @@ router.post('/admin/change-password', [
    logger.info('Admin password changed', {
      userId: adminId,
      username: admin.username,
-      ip: req.ip
+      ip: ipAddress
    });
    res.json({ 
@@ -229,14 +230,14 @@ router.post('/gallery/verify', [
    }
    const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
    const userAgent = req.headers['user-agent'] || '';
    const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
    const requiresPassword = !(event && (event.require_password === false || event.require_password === 0 || event.require_password === '0'));
    if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
      if (lockoutStatus.isLocked) {
        logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
        return res.status(423).json({ 
@@ -22,6 +22,8 @@ const {
  getAdminTokenFromRequest,
  getGalleryTokenFromRequest,
 } = require('../utils/tokenUtils');
 const { getEventShareToken, resolveShareIdentifier } = require('../services/shareLinkService');
 const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 // Admin login with enhanced security
@@ -36,7 +38,7 @@ router.post('/admin/login', [
    }
    const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
    const userAgent = req.headers['user-agent'] || '';
    // Check account lockout first
@@ -171,7 +173,7 @@ router.post('/gallery/verify', [
    }
    const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
    const userAgent = req.headers['user-agent'] || '';
    const event = await db('events')
      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
@@ -185,7 +187,7 @@ router.post('/gallery/verify', [
    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
    if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
      if (lockoutStatus.isLocked) {
        logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
        return res.status(423).json({ 
@@ -281,21 +283,25 @@ router.post('/gallery/share-login', [
    }
    const { slug, token } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
    const userAgent = req.headers['user-agent'] || '';
-    const event = await db('events')
+    let event = await db('events')
      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
      .first();
    if (!event) {
      const resolved = await resolveShareIdentifier(slug);
      if (resolved?.event) {
        event = resolved.event;
      }
    }
    if (!event) {
      return res.status(404).json({ error: 'Gallery not found' });
    }
-    let expectedToken = event.share_link;
+    const expectedToken = getEventShareToken(event);
    if (expectedToken && expectedToken.includes('/')) {
      expectedToken = expectedToken.split('/').pop();
    }
    if (!expectedToken || token !== expectedToken) {
      return res.status(401).json({ error: 'Invalid or expired share link' });
@@ -312,7 +318,7 @@ router.post('/gallery/share-login', [
      issuer: 'picpeak-auth'
    });
-    await trackSuccessfulLogin(`gallery:${slug}:share`, ipAddress, userAgent);
+    await trackSuccessfulLogin(`gallery:${event.slug}:share`, ipAddress, userAgent);
    setGalleryAuthCookies(res, jwtToken, event.slug);
    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
@@ -9,6 +9,7 @@ const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const fs = require('fs').promises;
 const path = require('path');
 const router = express.Router();
 const { buildShareLinkVariants } = require('../services/shareLinkService');
 const parseBooleanInput = (value, defaultValue = true) => {
  if (value === undefined || value === null) {
@@ -32,12 +33,66 @@ const parseBooleanInput = (value, defaultValue = true) => {
  return defaultValue;
 };
 const getCustomerNameFromPayload = (payload = {}) => {
  if (typeof payload.customer_name === 'string') {
    const trimmed = payload.customer_name.trim();
    return trimmed || null;
  }
  return null;
 };
 const getCustomerEmailFromPayload = (payload = {}) => {
  if (typeof payload.customer_email === 'string') {
    const trimmed = payload.customer_email.trim();
    return trimmed || null;
  }
  return null;
 };
 const mapEventForApi = (event) => {
  if (!event || typeof event !== 'object') {
    return event;
  }
  const {
    host_name,
    host_email,
    customer_name,
    customer_email,
    ...rest
  } = event;
  return {
    ...rest,
    customer_name: customer_name ?? host_name ?? null,
    customer_email: customer_email ?? host_email ?? null
  };
 };
 let customerColumnCache = null;
 const hasCustomerContactColumns = async () => {
  if (customerColumnCache === true) {
    return true;
  }
  try {
    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
    if (hasColumn) {
      customerColumnCache = true;
    }
    return hasColumn;
  } catch (error) {
    return false;
  }
 };
 // Create new event
 router.post('/', adminAuth, [
  body('event_type').isIn(['wedding', 'birthday', 'corporate', 'other']),
  body('event_name').notEmpty(),
  body('event_date').isDate(),
-  body('host_email').isEmail(),
+  body('customer_name').notEmpty().trim(),
  body('customer_email').isEmail().normalizeEmail(),
  body('admin_email').isEmail(),
  body('require_password').optional().isBoolean(),
  body('password').optional().isString().custom((value, { req }) => {
@@ -62,7 +117,6 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
      host_email,
      admin_email,
      password,
      require_password: requirePasswordInput = true,
@@ -71,6 +125,15 @@ router.post('/', adminAuth, [
      expiration_days = 30
    } = req.body;
    const customerEmail = getCustomerEmailFromPayload(req.body);
    const customerName = getCustomerNameFromPayload(req.body);
    if (!customerName || !customerEmail) {
      return res.status(400).json({ error: 'customer_name and customer_email are required' });
    }
    const customerColumnsAvailable = await hasCustomerContactColumns();
    const requirePassword = parseBooleanInput(requirePasswordInput, true);
    if (requirePassword) {
@@ -98,12 +161,9 @@ router.post('/', adminAuth, [
      counter++;
    }
-    // Generate share link (just slug/token, not full URL)
+    // Generate share link variants (auto-detects short URL preference)
    const shareToken = crypto.randomBytes(16).toString('hex');
-    const sharePath = `/gallery/${slug}/${shareToken}`;
+    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
    const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
    const fullShareLink = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
    const shareLinkSlug = `${slug}/${shareToken}`;
    // Hash password (or placeholder when not required)
    const password_hash = requirePassword
@@ -126,12 +186,15 @@ router.post('/', adminAuth, [
      event_type,
      event_name,
      event_date,
-      host_email,
+      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
      host_name: customerName,
      host_email: customerEmail,
      admin_email,
      password_hash,
      welcome_message,
      color_theme,
-      share_link: shareLinkSlug,
+      share_link: shareLinkToStore,
      share_token: shareToken,
      expires_at,
      require_password: formatBoolean(requirePassword)
    }).returning('id');
@@ -141,11 +204,13 @@ router.post('/', adminAuth, [
    // Queue creation email
    const { queueEmail } = require('../services/emailProcessor');
-    await queueEmail(eventId, host_email, 'gallery_created', {
+    await queueEmail(eventId, customerEmail, 'gallery_created', {
-      host_name: host_email.split('@')[0], // Extract name from email
+      customer_name: customerName,
      customer_email: customerEmail,
      host_name: customerName,
      event_name,
      event_date: event_date,  // Pass raw date - will be formatted by email processor
-      gallery_link: fullShareLink,
+      gallery_link: shareUrl,
      gallery_password: requirePassword ? password : 'No password required',
      expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
      welcome_message: welcome_message || ''
@@ -154,9 +219,11 @@ router.post('/', adminAuth, [
    res.json({
      id: eventId,
      slug,
-      share_link: fullShareLink,
+      share_link: shareUrl,
      expires_at,
-      require_password: requirePassword
+      require_password: requirePassword,
      customer_name: customerName,
      customer_email: customerEmail
    });
  } catch (error) {
    console.error(error);
@@ -185,17 +252,27 @@ router.get('/', adminAuth, async (req, res) => {
      event.photo_count = photoCount.count;
    }
-    res.json(events);
+    res.json(events.map(mapEventForApi));
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch events' });
  }
 });
 // Update event
-router.put('/:id', adminAuth, async (req, res) => {
+router.put('/:id', adminAuth, [
  body('customer_name').optional().trim().notEmpty(),
  body('customer_email').optional().isEmail().normalizeEmail(),
  body('require_password').optional().isBoolean()
 ], async (req, res) => {
  try {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    const { id } = req.params;
    const updates = { ...req.body };
    const customerColumnsAvailable = await hasCustomerContactColumns();
    // Don't allow updating certain fields
    delete updates.id;
@@ -203,6 +280,38 @@ router.put('/:id', adminAuth, async (req, res) => {
    delete updates.created_at;
    delete updates.password_confirmation;
    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
    }
    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
      const nextName = getCustomerNameFromPayload(updates);
      if (nextName) {
        if (customerColumnsAvailable) {
          updates.customer_name = nextName;
        } else {
          delete updates.customer_name;
        }
        updates.host_name = nextName;
      } else {
        delete updates.customer_name;
      }
    }
    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
      const nextEmail = getCustomerEmailFromPayload(updates);
      if (nextEmail) {
        if (customerColumnsAvailable) {
          updates.customer_email = nextEmail;
        } else {
          delete updates.customer_email;
        }
        updates.host_email = nextEmail;
      } else {
        delete updates.customer_email;
      }
    }
    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
    let requirePasswordUpdate;
    if (hasRequirePasswordUpdate) {
@@ -9,10 +9,41 @@ const { verifyGalleryAccess } = require('../middleware/gallery');
 const secureImageService = require('../services/secureImageService');
 const logger = require('../utils/logger');
 const { resolvePhotoFilePath } = require('../services/photoResolver');
 const { getEventShareToken, resolveShareIdentifier, buildShareLinkVariants } = require('../services/shareLinkService');
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
 // Resolve gallery identifier (slug or token) to canonical data
 router.get('/resolve/:identifier', async (req, res) => {
  try {
    const { identifier } = req.params;
    const result = await resolveShareIdentifier(identifier);
    if (!result) {
      return res.status(404).json({ error: 'Gallery not found' });
    }
    const { event, matchType, shareToken } = result;
    const linkVariants = await buildShareLinkVariants({ slug: event.slug, shareToken });
    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
    res.json({
      slug: event.slug,
      token: shareToken,
      matchType,
      share_link: event.share_link,
      share_path: linkVariants.sharePath,
      share_url: linkVariants.shareUrl,
      short_enabled: linkVariants.shortEnabled,
      requires_password: requiresPassword
    });
  } catch (error) {
    logger.error('Error resolving gallery identifier:', error);
    res.status(500).json({ error: 'Failed to resolve gallery link' });
  }
 });
 // Verify share token
 router.get('/:slug/verify-token/:token', async (req, res) => {
  try {
@@ -20,15 +51,14 @@ router.get('/:slug/verify-token/:token', async (req, res) => {
    const event = await db('events')
      .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
-      .select('id', 'share_link')
+      .select('id', 'share_link', 'share_token')
      .first();
    if (!event) {
      return res.status(404).json({ error: 'Gallery not found' });
    }
-    // Extract token from share link and verify
+    const expectedToken = getEventShareToken(event);
    const expectedToken = event.share_link.split('/').pop();
    if (token !== expectedToken) {
      return res.status(404).json({ error: 'Invalid gallery link' });
    }
@@ -56,6 +86,7 @@ router.get('/:slug/info', async (req, res) => {
        'is_active',
        'is_archived',
        'share_link',
        'share_token',
        'allow_downloads',
        'disable_right_click',
        'watermark_downloads',
@@ -76,12 +107,8 @@ router.get('/:slug/info', async (req, res) => {
    // If token provided, verify it matches the share link
    if (token) {
-      let expectedToken = event.share_link;
+      const expectedToken = getEventShareToken(event);
-      // Handle both formats: full URL or just token
+      if (!expectedToken || token !== expectedToken) {
      if (event.share_link && event.share_link.includes('/')) {
        expectedToken = event.share_link.split('/').pop();
      }
      if (token !== expectedToken) {
        return res.status(404).json({ error: 'Invalid gallery link' });
      }
    }
@@ -583,38 +610,41 @@ router.post('/:slug/download-selected', verifyGalleryAccess, async (req, res) =>
 // View single photo (with watermark if enabled)
-router.get('/:slug/photo/:photoId', 
+router.get('/:slug/photo/:photoId',
-  verifyGalleryAccess, 
+  verifyGalleryAccess,
  async (req, res) => {
    try {
      const { photoId } = req.params;
-      
+
      const photo = await db('photos')
        .where({ id: photoId, event_id: req.event.id })
        .first();
-      
+
-      
+
      if (!photo) {
        return res.status(404).json({ error: 'Photo not found' });
      }
      // Check if this is a video
      const isVideo = photo.media_type === 'video' || (photo.mime_type && photo.mime_type.startsWith('video/'));
      // Check protection level - basic and standard protection allow direct JWT access
      const protectionLevel = req.event.protection_level || 'standard';
-      
+
      if (protectionLevel === 'enhanced' || protectionLevel === 'maximum') {
        // For enhanced/maximum protection, redirect to secure endpoint
-        return res.status(302).json({ 
+        return res.status(302).json({
          error: 'Secure access required',
          secureEndpoint: `/api/secure-images/${req.params.slug}/generate-token`,
          photoId: photoId
        });
      }
-      
+
      // Resolve the absolute file path for this photo, supporting both managed and external reference modes
      const { resolvePhotoFilePath } = require('../services/photoResolver');
      const filePath = resolvePhotoFilePath(req.event, photo);
-      
+
-      
+
      // Log access - temporarily disabled for debugging
      // await secureImageService.logImageAccess(
      //   photoId,
@@ -622,20 +652,61 @@ router.get('/:slug/photo/:photoId',
      //   req.clientInfo,
      //   'view_basic'
      // );
-      
+
      // Handle video streaming with range requests
      if (isVideo) {
        const fs = require('fs');
        const stat = fs.statSync(filePath);
        const fileSize = stat.size;
        const range = req.headers.range;
        if (range) {
          // Parse range header
          const parts = range.replace(/bytes=/, "").split("-");
          const start = parseInt(parts[0], 10);
          const end = parts[1] ? parseInt(parts[1], 10) : fileSize - 1;
          const chunksize = (end - start) + 1;
          const file = fs.createReadStream(filePath, { start, end });
          res.writeHead(206, {
            'Content-Range': `bytes ${start}-${end}/${fileSize}`,
            'Accept-Ranges': 'bytes',
            'Content-Length': chunksize,
            'Content-Type': photo.mime_type || 'video/mp4',
            'Cache-Control': 'private, max-age=1800',
            'X-Protection-Level': 'basic'
          });
          file.pipe(res);
        } else {
          // No range request, send entire file
          res.writeHead(200, {
            'Content-Length': fileSize,
            'Content-Type': photo.mime_type || 'video/mp4',
            'Accept-Ranges': 'bytes',
            'Cache-Control': 'private, max-age=1800',
            'X-Protection-Level': 'basic'
          });
          fs.createReadStream(filePath).pipe(res);
        }
        return;
      }
      // Handle images (existing logic)
      // Get watermark settings
      const watermarkSettings = await watermarkService.getWatermarkSettings();
-      
+
      if (watermarkSettings && watermarkSettings.enabled) {
        // Apply watermark and send
        const watermarkedBuffer = await watermarkService.applyWatermark(filePath, watermarkSettings);
-        
+
        res.set({
          'Content-Type': photo.mime_type || 'image/jpeg',
          'Cache-Control': 'private, max-age=1800', // Cache for 30 minutes
          'X-Protection-Level': 'basic'
        });
-        
+
        res.send(watermarkedBuffer);
      } else {
        // Send original file with basic protection headers
@@ -773,22 +844,35 @@ router.get('/:slug/stats', verifyGalleryAccess, async (req, res) => {
 router.post('/:eventId/upload', verifyGalleryAccess, async (req, res) => {
  try {
    const eventId = parseInt(req.params.eventId);
-    
+
    // Verify the event matches the token
    if (req.event.id !== eventId) {
      return res.status(403).json({ error: 'Access denied' });
    }
-    
+
    // Check if user uploads are allowed
    if (!req.event.allow_user_uploads) {
      return res.status(403).json({ error: 'User uploads are not allowed for this event' });
    }
-    
+
    // Ensure temp upload directory exists
    const fs = require('fs');
    const tempUploadDir = '/tmp/uploads/';
    if (!fs.existsSync(tempUploadDir)) {
      try {
        fs.mkdirSync(tempUploadDir, { recursive: true, mode: 0o755 });
        logger.info('Created temp upload directory:', tempUploadDir);
      } catch (mkdirErr) {
        logger.error('Failed to create temp upload directory:', mkdirErr);
        return res.status(500).json({ error: 'Server configuration error: unable to create upload directory' });
      }
    }
    // Import multer and photo processing
    const multer = require('multer');
-    const upload = multer({ 
+    const upload = multer({
-      dest: '/tmp/uploads/',
+      dest: tempUploadDir,
-      limits: { 
+      limits: {
        fileSize: 50 * 1024 * 1024, // 50MB
        files: 10 // Max 10 files at once
      },
@@ -0,0 +1,285 @@
 const path = require('path');
 const fs = require('fs').promises;
 const crypto = require('crypto');
 const logger = require('../utils/logger');
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const getChunksPath = () => path.join(getStoragePath(), 'chunks');
 // In-memory store for active uploads (in production, consider Redis)
 const activeUploads = new Map();
 // Chunk size: 10MB
 const CHUNK_SIZE = 10 * 1024 * 1024;
 // Upload expiration: 24 hours
 const UPLOAD_EXPIRATION_MS = 24 * 60 * 60 * 1000;
 /**
 * Initialize a new chunked upload
 * @param {Object} options - Upload options
 * @returns {Promise<Object>} - Upload metadata
 */
 async function initializeUpload(options) {
  const {
    filename,
    fileSize,
    mimeType,
    eventId,
    totalChunks
  } = options;
  // Generate unique upload ID
  const uploadId = crypto.randomUUID();
  // Create chunks directory for this upload
  const uploadDir = path.join(getChunksPath(), uploadId);
  await fs.mkdir(uploadDir, { recursive: true });
  // Calculate expected chunks
  const expectedChunks = totalChunks || Math.ceil(fileSize / CHUNK_SIZE);
  // Store upload metadata
  const uploadMeta = {
    uploadId,
    filename,
    fileSize,
    mimeType,
    eventId,
    expectedChunks,
    receivedChunks: new Set(),
    uploadDir,
    createdAt: Date.now(),
    expiresAt: Date.now() + UPLOAD_EXPIRATION_MS,
    status: 'in_progress'
  };
  activeUploads.set(uploadId, uploadMeta);
  logger.info('Initialized chunked upload', {
    uploadId,
    filename,
    fileSize,
    expectedChunks,
    eventId
  });
  return {
    uploadId,
    chunkSize: CHUNK_SIZE,
    expectedChunks,
    expiresAt: uploadMeta.expiresAt
  };
 }
 /**
 * Upload a single chunk
 * @param {string} uploadId - Upload ID
 * @param {number} chunkIndex - Chunk index (0-based)
 * @param {Buffer} chunkData - Chunk data
 * @returns {Promise<Object>} - Chunk upload result
 */
 async function uploadChunk(uploadId, chunkIndex, chunkData) {
  const uploadMeta = activeUploads.get(uploadId);
  if (!uploadMeta) {
    throw new Error('Upload not found or expired');
  }
  if (uploadMeta.status !== 'in_progress') {
    throw new Error(`Upload is ${uploadMeta.status}`);
  }
  // Check expiration
  if (Date.now() > uploadMeta.expiresAt) {
    await abortUpload(uploadId);
    throw new Error('Upload expired');
  }
  // Write chunk to disk
  const chunkPath = path.join(uploadMeta.uploadDir, `chunk_${String(chunkIndex).padStart(6, '0')}`);
  await fs.writeFile(chunkPath, chunkData);
  // Mark chunk as received
  uploadMeta.receivedChunks.add(chunkIndex);
  const progress = (uploadMeta.receivedChunks.size / uploadMeta.expectedChunks) * 100;
  logger.debug('Chunk uploaded', {
    uploadId,
    chunkIndex,
    receivedChunks: uploadMeta.receivedChunks.size,
    expectedChunks: uploadMeta.expectedChunks,
    progress: progress.toFixed(1)
  });
  return {
    chunkIndex,
    received: uploadMeta.receivedChunks.size,
    expected: uploadMeta.expectedChunks,
    progress,
    complete: uploadMeta.receivedChunks.size === uploadMeta.expectedChunks
  };
 }
 /**
 * Complete the upload by merging all chunks
 * @param {string} uploadId - Upload ID
 * @returns {Promise<Object>} - Merged file info
 */
 async function completeUpload(uploadId) {
  const uploadMeta = activeUploads.get(uploadId);
  if (!uploadMeta) {
    throw new Error('Upload not found or expired');
  }
  // Verify all chunks received
  if (uploadMeta.receivedChunks.size !== uploadMeta.expectedChunks) {
    throw new Error(`Missing chunks: received ${uploadMeta.receivedChunks.size} of ${uploadMeta.expectedChunks}`);
  }
  uploadMeta.status = 'merging';
  // Create temp file for merged result
  const tempDir = path.join(getStoragePath(), 'temp', `merge_${Date.now()}_${Math.random().toString(36).substring(7)}`);
  await fs.mkdir(tempDir, { recursive: true });
  const mergedFilePath = path.join(tempDir, uploadMeta.filename);
  const writeStream = require('fs').createWriteStream(mergedFilePath);
  try {
    // Merge chunks in order
    for (let i = 0; i < uploadMeta.expectedChunks; i++) {
      const chunkPath = path.join(uploadMeta.uploadDir, `chunk_${String(i).padStart(6, '0')}`);
      const chunkData = await fs.readFile(chunkPath);
      await new Promise((resolve, reject) => {
        writeStream.write(chunkData, (err) => {
          if (err) reject(err);
          else resolve();
        });
      });
    }
    await new Promise((resolve) => writeStream.end(resolve));
    // Verify file size
    const stats = await fs.stat(mergedFilePath);
    if (stats.size !== uploadMeta.fileSize) {
      logger.warn('Merged file size mismatch', {
        expected: uploadMeta.fileSize,
        actual: stats.size
      });
    }
    // Clean up chunks
    await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true });
    uploadMeta.status = 'completed';
    activeUploads.delete(uploadId);
    logger.info('Chunked upload completed', {
      uploadId,
      filename: uploadMeta.filename,
      fileSize: stats.size,
      eventId: uploadMeta.eventId
    });
    return {
      path: mergedFilePath,
      filename: uploadMeta.filename,
      size: stats.size,
      mimeType: uploadMeta.mimeType,
      eventId: uploadMeta.eventId,
      tempDir
    };
  } catch (error) {
    writeStream.destroy();
    uploadMeta.status = 'failed';
    throw error;
  }
 }
 /**
 * Abort and clean up an upload
 * @param {string} uploadId - Upload ID
 */
 async function abortUpload(uploadId) {
  const uploadMeta = activeUploads.get(uploadId);
  if (uploadMeta) {
    try {
      await fs.rm(uploadMeta.uploadDir, { recursive: true, force: true });
    } catch (err) {
      logger.warn('Failed to clean up upload directory', { uploadId, error: err.message });
    }
    activeUploads.delete(uploadId);
    logger.info('Chunked upload aborted', { uploadId });
  }
 }
 /**
 * Get upload status
 * @param {string} uploadId - Upload ID
 * @returns {Object|null} - Upload status or null if not found
 */
 function getUploadStatus(uploadId) {
  const uploadMeta = activeUploads.get(uploadId);
  if (!uploadMeta) {
    return null;
  }
  return {
    uploadId,
    filename: uploadMeta.filename,
    fileSize: uploadMeta.fileSize,
    receivedChunks: uploadMeta.receivedChunks.size,
    expectedChunks: uploadMeta.expectedChunks,
    progress: (uploadMeta.receivedChunks.size / uploadMeta.expectedChunks) * 100,
    status: uploadMeta.status,
    createdAt: uploadMeta.createdAt,
    expiresAt: uploadMeta.expiresAt
  };
 }
 /**
 * Clean up expired uploads
 */
 async function cleanupExpiredUploads() {
  const now = Date.now();
  const expiredIds = [];
  for (const [uploadId, meta] of activeUploads.entries()) {
    if (now > meta.expiresAt) {
      expiredIds.push(uploadId);
    }
  }
  for (const uploadId of expiredIds) {
    await abortUpload(uploadId);
  }
  if (expiredIds.length > 0) {
    logger.info(`Cleaned up ${expiredIds.length} expired uploads`);
  }
  return expiredIds.length;
 }
 // Run cleanup every hour
 setInterval(cleanupExpiredUploads, 60 * 60 * 1000);
 module.exports = {
  initializeUpload,
  uploadChunk,
  completeUpload,
  abortUpload,
  getUploadStatus,
  cleanupExpiredUploads,
  CHUNK_SIZE
 };
@@ -9,7 +9,7 @@ let lastConfigHash = null;
 // Generate hash from config for change detection
 function generateConfigHash(config) {
  const crypto = require('crypto');
-  const configString = `${config.smtp_host}:${config.smtp_port}:${config.smtp_user}:${config.smtp_pass}:${config.smtp_secure}`;
+  const configString = `${config.smtp_host}:${config.smtp_port}:${config.smtp_user}:${config.smtp_pass}:${config.smtp_secure}:${config.tls_reject_unauthorized}`;
  return crypto.createHash('md5').update(configString).digest('hex');
 }
@@ -40,7 +40,11 @@ async function initializeTransporter(forceReinit = false) {
      auth: config.smtp_user ? {
        user: config.smtp_user,
        pass: config.smtp_pass
-      } : undefined
+      } : undefined,
      tls: {
        // Allow ignoring SSL certificate errors when tls_reject_unauthorized is false
        rejectUnauthorized: config.tls_reject_unauthorized !== false
      }
    });
    // Verify configuration
@@ -58,11 +58,15 @@ async function queueExpirationWarning(event) {
  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
  // Determine language based on email domain
-  const emailLang = event.host_email.endsWith('.de') ? 'de' : 'en';
+  const recipientEmail = event.customer_email || event.host_email;
  const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
  const emailLang = recipientEmail && recipientEmail.endsWith('.de') ? 'de' : 'en';
-  // Queue email to host
+  // Queue email to customer
-  await queueEmail(event.id, event.host_email, 'expiration_warning', {
+  await queueEmail(event.id, recipientEmail, 'expiration_warning', {
-    host_name: event.host_name || event.host_email.split('@')[0],
+    customer_name: recipientName,
    customer_email: recipientEmail,
    host_name: recipientName,
    event_name: event.event_name,
    days_remaining: daysRemaining.toString(),
    expiration_date: await formatDate(event.expires_at, emailLang),
@@ -78,9 +82,14 @@ async function handleExpiredEvent(event) {
    await db('events').where('id', event.id).update({ is_active: formatBoolean(false) });
    // Queue expiration emails
-    await queueEmail(event.id, event.host_email, 'gallery_expired', {
+    const recipientEmail = event.customer_email || event.host_email;
    const recipientName = event.customer_name || event.host_name || (recipientEmail ? recipientEmail.split('@')[0] : null);
    await queueEmail(event.id, recipientEmail, 'gallery_expired', {
      event_name: event.event_name,
-      admin_email: event.admin_email
+      admin_email: event.admin_email,
      customer_name: recipientName,
      customer_email: recipientEmail
    });
    // Also notify admin
@@ -3,8 +3,10 @@ const path = require('path');
 const fs = require('fs').promises;
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { generateThumbnail } = require('./imageProcessor');
+const { generateThumbnail, generateVideoPlaceholder } = require('./imageProcessor');
 const logger = require('../utils/logger');
 const { isVideoMimeType } = require('../utils/fileSecurityUtils');
 const mime = require('mime-types');
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const WATCH_PATH = () => path.join(getStoragePath(), 'events/active');
@@ -47,9 +49,11 @@ async function processNewPhoto(filePath) {
  const eventSlug = pathParts[0];
  const photoType = pathParts[1] === 'collages' ? 'collage' : 'individual';
-  // Check if this is an image file
+  // Check if this is an image or video file
  const ext = path.extname(filePath).toLowerCase();
-  if (!['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
+  const detectedMime = mime.lookup(filePath) || '';
  const isVideo = isVideoMimeType(detectedMime, filePath) || ['.mp4', '.mov', '.webm'].includes(ext);
  if (!isVideo && !['.jpg', '.jpeg', '.png', '.webp'].includes(ext)) return;
  // Skip temporary upload files
  const filename = path.basename(filePath);
@@ -65,11 +69,17 @@ async function processNewPhoto(filePath) {
  // Get file stats
  const stats = await fs.stat(filePath);
-  // Generate thumbnail
+  // Generate thumbnail or placeholder
-  const thumbnailPath = await generateThumbnail(filePath);
+  let thumbnailPath = null;
  if (isVideo) {
    thumbnailPath = await generateVideoPlaceholder(filename);
  } else {
    thumbnailPath = await generateThumbnail(filePath);
  }
  // Calculate relative thumbnail path
  const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
  const mimeType = detectedMime || (isVideo ? 'video/mp4' : 'image/jpeg');
  // Check if photo already exists
  const existingPhoto = await db('photos')
@@ -83,8 +93,9 @@ async function processNewPhoto(filePath) {
      filename: path.basename(filePath),
      path: relativePath,
      thumbnail_path: relativeThumbPath,
-      type: photoType,
+      type: isVideo ? 'video' : photoType,
-      size_bytes: stats.size
+      size_bytes: stats.size,
      mime_type: mimeType
    });
    logger.info(`Added new photo: ${relativePath}`);
@@ -18,6 +18,29 @@ const DEFAULT_THUMBNAIL_FORMAT = 'jpeg';
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 const getThumbnailPath = () => path.join(getStoragePath(), 'thumbnails');
 // Helper to parse setting value (handles both JSON-encoded and plain values)
 function parseSettingValue(value) {
  if (value === null || value === undefined) {
    return null;
  }
  // Try to parse as JSON first (in case it's a JSON-encoded string like '"cover"')
  try {
    return JSON.parse(value);
  } catch (e) {
    // If it's not valid JSON, return the raw value
    return value;
  }
 }
 // Validate that fit value is valid for Sharp
 function validateFitValue(fit) {
  const validFitValues = ['cover', 'contain', 'fill', 'inside', 'outside'];
  if (fit && validFitValues.includes(fit)) {
    return fit;
  }
  return DEFAULT_THUMBNAIL_FIT;
 }
 // Get thumbnail settings from database
 async function getThumbnailSettings() {
  try {
@@ -30,16 +53,19 @@ async function getThumbnailSettings() {
        'thumbnail_format'
      ])
      .select('setting_key', 'setting_value');
-    
+
    const settingsMap = {};
    settings.forEach(s => {
-      settingsMap[s.setting_key] = s.setting_value;
+      settingsMap[s.setting_key] = parseSettingValue(s.setting_value);
    });
-    
+
    // Parse and validate fit value
    const fitValue = validateFitValue(settingsMap.thumbnail_fit);
    return {
      width: parseInt(settingsMap.thumbnail_width) || DEFAULT_THUMBNAIL_WIDTH,
      height: parseInt(settingsMap.thumbnail_height) || DEFAULT_THUMBNAIL_HEIGHT,
-      fit: settingsMap.thumbnail_fit || DEFAULT_THUMBNAIL_FIT,
+      fit: fitValue,
      quality: parseInt(settingsMap.thumbnail_quality) || DEFAULT_THUMBNAIL_QUALITY,
      format: settingsMap.thumbnail_format || DEFAULT_THUMBNAIL_FORMAT
    };
@@ -211,4 +237,54 @@ async function ensureThumbnail(photo) {
  return null;
 }
-module.exports = { generateThumbnail, isThumbnailValid, ensureThumbnail };
+async function generateVideoPlaceholder(originalFilename, options = {}) {
  const parsed = path.parse(originalFilename || '');
  const baseName = parsed.name || 'video';
  const thumbnailDir = getThumbnailPath();
  const thumbnailFilename = `thumb_${baseName}.jpg`;
  const thumbnailPath = path.join(thumbnailDir, thumbnailFilename);
  const settings = await getThumbnailSettings();
  const width = settings.width || DEFAULT_THUMBNAIL_WIDTH;
  const height = settings.height || DEFAULT_THUMBNAIL_HEIGHT;
  if (options.regenerate) {
    try {
      await fs.unlink(thumbnailPath);
    } catch (_) {
      // ignore if missing
    }
  }
  try {
    await fs.mkdir(thumbnailDir, { recursive: true });
    const svg = `
      <svg width="${width}" height="${height}" viewBox="0 0 ${width} ${height}" xmlns="http://www.w3.org/2000/svg">
        <defs>
          <linearGradient id="grad" x1="0%" y1="0%" x2="100%" y2="100%">
            <stop offset="0%" stop-color="#0f172a" stop-opacity="0.9"/>
            <stop offset="100%" stop-color="#1e293b" stop-opacity="0.9"/>
          </linearGradient>
        </defs>
        <rect width="${width}" height="${height}" rx="18" fill="url(#grad)"/>
        <circle cx="${width / 2}" cy="${height / 2}" r="${Math.min(width, height) / 6}" fill="rgba(255,255,255,0.85)"/>
        <polygon points="${width / 2 - 10},${height / 2 - 14} ${width / 2 - 10},${height / 2 + 14} ${width / 2 + 16},${height / 2}" fill="#0f172a"/>
        <text x="50%" y="${height - 18}" font-family="Arial, sans-serif" font-size="16" fill="rgba(255,255,255,0.9)" text-anchor="middle">
          VIDEO
        </text>
      </svg>
    `;
    await sharp(Buffer.from(svg))
      .resize(width, height, { fit: 'cover' })
      .jpeg({ quality: settings.quality || DEFAULT_THUMBNAIL_QUALITY })
      .toFile(thumbnailPath);
    return path.relative(getStoragePath(), thumbnailPath);
  } catch (error) {
    logger.error('Failed to generate video placeholder thumbnail:', error.message);
    return null;
  }
 }
 module.exports = { generateThumbnail, isThumbnailValid, ensureThumbnail, generateVideoPlaceholder };
@@ -3,25 +3,52 @@ const fs = require('fs').promises;
 const { db } = require('../database/db');
 const { generateThumbnail } = require('./imageProcessor');
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
 const { processUploadedVideo, isVideoMimeType } = require('./videoProcessor');
 // Get storage path from environment or default
 const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
 function normalizeFiles(files) {
-  if (!files) return [];
+  // Handle null, undefined, or falsy values
-  if (Array.isArray(files)) return files.filter(Boolean);
+  if (!files) {
-
+    console.log('[normalizeFiles] No files provided');
-  // Multer may expose files as an iterable object
+    return [];
  if (typeof files[Symbol.iterator] === 'function') {
    return Array.from(files).filter(Boolean);
  }
  // Handle arrays
  if (Array.isArray(files)) {
    const validFiles = files.filter(Boolean);
    console.log(`[normalizeFiles] Normalized ${validFiles.length} files from array`);
    return validFiles;
  }
  // Handle iterable objects (some multer configurations)
  try {
    if (typeof files === 'object' && typeof files[Symbol.iterator] === 'function') {
      const validFiles = Array.from(files).filter(Boolean);
      console.log(`[normalizeFiles] Normalized ${validFiles.length} files from iterable`);
      return validFiles;
    }
  } catch (err) {
    console.warn('[normalizeFiles] Failed to iterate files object:', err.message);
  }
  // Handle plain objects (multer fieldname mapping)
  if (typeof files === 'object') {
-    return Object.values(files)
+    try {
-      .flatMap((value) => (Array.isArray(value) ? value : [value]))
+      const validFiles = Object.values(files)
-      .filter(Boolean);
+        .flatMap((value) => (Array.isArray(value) ? value : [value]))
        .filter(Boolean);
      console.log(`[normalizeFiles] Normalized ${validFiles.length} files from object`);
      return validFiles;
    } catch (err) {
      console.warn('[normalizeFiles] Failed to process files object:', err.message);
      return [];
    }
  }
  // Unexpected type
  console.warn('[normalizeFiles] Unexpected files type:', typeof files);
  return [];
 }
@@ -80,59 +107,110 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
      const tempPath = file?.path || file?.filepath || file?.tempFilePath;
      if (!tempPath) {
-        throw new Error('Uploaded file is missing a temporary path');
+        const fileInfo = JSON.stringify({
          originalname: file?.originalname,
          mimetype: file?.mimetype,
          size: file?.size,
          availableKeys: Object.keys(file || {})
        });
        throw new Error(`Uploaded file is missing a temporary path. File info: ${fileInfo}`);
      }
      // Verify temp file exists before copying
      try {
        await fs.access(tempPath);
      } catch (accessErr) {
        console.error(`Temp file not accessible: ${tempPath}`, {
          originalname: file?.originalname,
          error: accessErr.message
        });
        throw new Error(`Uploaded file not found at temporary location: ${tempPath}`);
      }
      // Use copyFile and unlink instead of rename to avoid cross-device issues
      try {
        await fs.copyFile(tempPath, newPath);
        console.log(`Successfully copied ${file.originalname} to ${newPath}`);
      } catch (copyErr) {
        console.error(`Failed to copy file from ${tempPath} to ${newPath}:`, copyErr);
        throw new Error(`Failed to copy uploaded file: ${copyErr.message}`);
      } finally {
        // Clean up temp file with better error handling
        try {
          await fs.unlink(tempPath);
          console.log(`Cleaned up temp file: ${tempPath}`);
        } catch (unlinkErr) {
          // Only warn if file exists but couldn't be deleted
          // ENOENT means file was already deleted, which is fine
          if (unlinkErr?.code !== 'ENOENT') {
-            console.warn(`Failed to clean up temp upload ${tempPath}:`, unlinkErr);
+            console.warn(`Failed to clean up temp upload ${tempPath}:`, {
              error: unlinkErr.message,
              code: unlinkErr.code
            });
          }
        }
      }
-      // Generate thumbnail
+      // Determine if this is a video or image
-      const thumbnailPath = await generateThumbnail(newPath);
+      const isVideo = isVideoMimeType(file.mimetype);
-      
+      const mediaType = isVideo ? 'video' : 'image';
      // Generate thumbnail and extract metadata
      let thumbnailPath;
      let videoMetadata = null;
      if (isVideo) {
        // Process video: extract metadata and generate thumbnail
        const thumbnailDir = path.join(getStoragePath(), 'thumbnails');
        await fs.mkdir(thumbnailDir, { recursive: true });
        const videoThumbnailPath = path.join(thumbnailDir, `thumb_${newFilename.replace(/\.[^.]+$/, '.jpg')}`);
        const result = await processUploadedVideo(newPath, videoThumbnailPath);
        videoMetadata = result.metadata;
        thumbnailPath = path.relative(getStoragePath(), videoThumbnailPath);
      } else {
        // Process image: generate thumbnail
        thumbnailPath = await generateThumbnail(newPath);
      }
      // Calculate relative paths
      const storagePath = getStoragePath();
      const relativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
      const relativeThumbPath = thumbnailPath; // thumbnailPath is already relative to storage root
-      
+
-      // Add to database with uploaded_by field
+      // Add to database with uploaded_by field and media metadata
      let insertResult;
      const clientName = trx?.client?.config?.client;
      const supportsReturning = ['pg', 'postgres', 'postgresql'].includes(clientName);
      const photoData = {
        event_id: eventId,
        filename: newFilename,
        path: relativePath,
        thumbnail_path: relativeThumbPath,
        type: photoType,
        size_bytes: file.size,
        uploaded_by: uploadedBy,
        source_origin: 'managed',
        media_type: mediaType,
        mime_type: file.mimetype
      };
      // Add video-specific metadata if applicable
      if (isVideo && videoMetadata) {
        photoData.duration = videoMetadata.duration;
        photoData.video_codec = videoMetadata.videoCodec;
        photoData.audio_codec = videoMetadata.audioCodec;
        photoData.width = videoMetadata.width;
        photoData.height = videoMetadata.height;
      }
      if (supportsReturning) {
        insertResult = await trx('photos')
-          .insert({
+          .insert(photoData)
            event_id: eventId,
            filename: newFilename,
            path: relativePath,
            thumbnail_path: relativeThumbPath,
            type: photoType,
            size_bytes: file.size,
            uploaded_by: uploadedBy,
            source_origin: 'managed'
          })
          .returning('id');
      } else {
-        insertResult = await trx('photos').insert({
+        insertResult = await trx('photos').insert(photoData);
          event_id: eventId,
          filename: newFilename,
          path: relativePath,
          thumbnail_path: relativeThumbPath,
          type: photoType,
          size_bytes: file.size,
          uploaded_by: uploadedBy,
          source_origin: 'managed'
        });
      }
      const insertedId = Array.isArray(insertResult)
@@ -154,10 +232,28 @@ async function processUploadedPhotos(files, eventId, uploadedBy = 'admin', categ
        size: file.size,
        type: photoType
      });
      console.log(`Successfully processed file ${file.originalname} (ID: ${photoId})`);
    } catch (error) {
-      console.error(`Error processing file ${file.originalname}:`, error);
+      console.error(`Error processing file ${file.originalname}:`, {
-      if (trx) await trx.rollback();
+        error: error.message,
        stack: error.stack,
        originalname: file.originalname,
        mimetype: file.mimetype,
        size: file.size,
        tempPath: file?.path || file?.filepath || file?.tempFilePath
      });
      if (trx) {
        try {
          await trx.rollback();
        } catch (rollbackErr) {
          console.error('Failed to rollback transaction:', rollbackErr);
        }
      }
      // Continue with other files
      // Note: Individual file failures don't stop the entire upload batch
    }
  }
@@ -12,8 +12,12 @@ const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '.
 function resolvePhotoFilePath(event, photo) {
  if (!event || !photo) throw new Error('resolvePhotoFilePath requires event and photo');
-  const mode = (event.source_mode || photo.source_origin || 'managed');
+  // IMPORTANT: photo.source_origin takes precedence over event.source_mode
-  if (mode === 'reference' || photo.source_origin === 'external') {
+  // This allows events in "reference" mode to have mixed sources:
  // - Imported photos: source_origin = 'external'
  // - Uploaded photos: source_origin = 'managed'
  const mode = (photo.source_origin || event.source_mode || 'managed');
  if (mode === 'reference' || mode === 'external') {
    if (!photo.external_relpath) {
      throw new Error('Missing external_relpath for external photo');
    }
@@ -0,0 +1,181 @@
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { extractShareToken, isPotentialShareToken, buildSharePath } = require('../utils/shareLinkUtils');
 const SETTING_KEY = 'general_short_gallery_urls';
 const CACHE_TTL_MS = 60_000;
 let cachedSetting = null;
 let cacheExpiresAt = 0;
 const parseSettingValue = (rawValue) => {
  if (rawValue === undefined || rawValue === null) {
    return null;
  }
  if (typeof rawValue === 'boolean') {
    return rawValue;
  }
  if (typeof rawValue === 'number') {
    return rawValue !== 0;
  }
  if (typeof rawValue === 'string') {
    const trimmed = rawValue.trim();
    if (!trimmed) {
      return null;
    }
    try {
      const parsed = JSON.parse(trimmed);
      return parseSettingValue(parsed);
    } catch {
      const normalized = trimmed.toLowerCase();
      if (normalized === 'true' || normalized === '1' || normalized === 'yes') {
        return true;
      }
      if (normalized === 'false' || normalized === '0' || normalized === 'no') {
        return false;
      }
      return null;
    }
  }
  if (typeof rawValue === 'object') {
    try {
      return parseSettingValue(JSON.parse(JSON.stringify(rawValue)));
    } catch {
      return null;
    }
  }
  return null;
 };
 const getRawSettingValue = async () => {
  try {
    const setting = await db('app_settings').where({ setting_key: SETTING_KEY }).first();
    return setting?.setting_value ?? null;
  } catch (error) {
    console.error('Failed to read gallery URL setting:', error.message);
    return null;
  }
 };
 const isShortGalleryUrlsEnabled = async () => {
  if (cachedSetting !== null && Date.now() < cacheExpiresAt) {
    return cachedSetting;
  }
  const rawValue = await getRawSettingValue();
  const parsed = parseSettingValue(rawValue);
  cachedSetting = parsed === null ? false : Boolean(parsed);
  cacheExpiresAt = Date.now() + CACHE_TTL_MS;
  return cachedSetting;
 };
 const clearShareLinkSettingsCache = () => {
  cachedSetting = null;
  cacheExpiresAt = 0;
 };
 const buildShareLinkVariants = async ({ slug, shareToken }) => {
  if (!shareToken) {
    throw new Error('shareToken is required to build share link variants');
  }
  const shortEnabled = await isShortGalleryUrlsEnabled();
  const sharePath = buildSharePath(slug, shareToken, shortEnabled);
  const frontendBase = (process.env.FRONTEND_URL || '').replace(/\/$/, '');
  const shareUrl = frontendBase ? `${frontendBase}${sharePath}` : sharePath;
  return {
    shortEnabled,
    sharePath,
    shareUrl,
    shareLinkToStore: sharePath
  };
 };
 const getEventShareToken = (event) => {
  if (!event) {
    return null;
  }
  if (event.share_token) {
    return event.share_token;
  }
  return extractShareToken(event.share_link);
 };
 const ACTIVE_EVENT_FILTER = {
  is_active: formatBoolean(true),
  is_archived: formatBoolean(false)
 };
 const resolveShareIdentifier = async (identifier) => {
  if (!identifier) {
    return null;
  }
  const trimmed = String(identifier).trim();
  if (!trimmed) {
    return null;
  }
  const baseQuery = db('events')
    .select(
      'id',
      'slug',
      'share_link',
      'share_token',
      'require_password',
      'event_name',
      'event_type',
      'event_date',
      'expires_at',
      'is_active',
      'is_archived'
    )
    .where(ACTIVE_EVENT_FILTER);
  let event = await baseQuery.clone().where({ slug: trimmed }).first();
  if (event) {
    return { event, matchType: 'slug', shareToken: getEventShareToken(event) };
  }
  event = await baseQuery.clone().where({ share_token: trimmed }).first();
  if (event) {
    return { event, matchType: 'token', shareToken: getEventShareToken(event) };
  }
  event = await baseQuery.clone().where({ share_link: trimmed }).first();
  if (event) {
    return { event, matchType: 'link', shareToken: getEventShareToken(event) };
  }
  event = await baseQuery.clone().where('share_link', 'like', `%/${trimmed}`).first();
  if (event) {
    return { event, matchType: 'link_partial', shareToken: getEventShareToken(event) };
  }
  // As a final fallback, if identifier looks like a token but we did not match via share_token
  if (isPotentialShareToken(trimmed)) {
    event = await baseQuery.clone().whereRaw('LOWER(share_token) = ?', [trimmed.toLowerCase()]).first();
    if (event) {
      return { event, matchType: 'token_case_insensitive', shareToken: getEventShareToken(event) };
    }
  }
  return null;
 };
 module.exports = {
  isShortGalleryUrlsEnabled,
  clearShareLinkSettingsCache,
  buildShareLinkVariants,
  getEventShareToken,
  resolveShareIdentifier
 };
@@ -0,0 +1,87 @@
 const { db } = require('../database/db');
 const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
 const MAX_ALLOWED_FILES_PER_UPLOAD = 2000;
 const CACHE_TTL_MS = 60_000;
 let cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
 let cacheExpiresAt = 0;
 const parseSettingValue = (setting) => {
  if (!setting || setting.setting_value == null) {
    return null;
  }
  let rawValue = setting.setting_value;
  if (typeof rawValue === 'string') {
    try {
      rawValue = JSON.parse(rawValue);
    } catch {
      // keep original string
    }
  }
  if (typeof rawValue === 'string') {
    const trimmed = rawValue.trim();
    if (trimmed === '') {
      return null;
    }
    const parsed = Number(trimmed);
    return Number.isFinite(parsed) ? parsed : null;
  }
  if (typeof rawValue === 'number') {
    return rawValue;
  }
  return null;
 };
 const normalizeLimit = (value) => {
  if (!Number.isFinite(value)) {
    return DEFAULT_MAX_FILES_PER_UPLOAD;
  }
  const intValue = Math.floor(value);
  if (intValue < 1) {
    return DEFAULT_MAX_FILES_PER_UPLOAD;
  }
  if (intValue > MAX_ALLOWED_FILES_PER_UPLOAD) {
    return MAX_ALLOWED_FILES_PER_UPLOAD;
  }
  return intValue;
 };
 const getMaxFilesPerUpload = async () => {
  if (Date.now() < cacheExpiresAt) {
    return cachedValue;
  }
  try {
    const setting = await db('app_settings')
      .where({ setting_key: 'general_max_files_per_upload' })
      .first();
    const parsedValue = normalizeLimit(parseSettingValue(setting));
    cachedValue = parsedValue;
    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
    return parsedValue;
  } catch (error) {
    console.error('Failed to read max files per upload setting:', error.message);
    cachedValue = DEFAULT_MAX_FILES_PER_UPLOAD;
    cacheExpiresAt = Date.now() + CACHE_TTL_MS;
    return DEFAULT_MAX_FILES_PER_UPLOAD;
  }
 };
 const clearMaxFilesPerUploadCache = () => {
  cacheExpiresAt = 0;
 };
 module.exports = {
  getMaxFilesPerUpload,
  clearMaxFilesPerUploadCache,
  DEFAULT_MAX_FILES_PER_UPLOAD,
  MAX_ALLOWED_FILES_PER_UPLOAD
 };
@@ -0,0 +1,182 @@
 const ffmpeg = require('fluent-ffmpeg');
 const ffmpegPath = require('@ffmpeg-installer/ffmpeg').path;
 const path = require('path');
 const fs = require('fs').promises;
 const logger = require('../utils/logger');
 // Set FFmpeg path
 ffmpeg.setFfmpegPath(ffmpegPath);
 /**
 * Extract video metadata using FFmpeg
 * @param {string} videoPath - Path to the video file
 * @returns {Promise<Object>} - Video metadata
 */
 async function extractVideoMetadata(videoPath) {
  return new Promise((resolve, reject) => {
    ffmpeg.ffprobe(videoPath, (err, metadata) => {
      if (err) {
        logger.error('Error extracting video metadata', { error: err.message, videoPath });
        return reject(err);
      }
      try {
        const videoStream = metadata.streams.find(s => s.codec_type === 'video');
        const audioStream = metadata.streams.find(s => s.codec_type === 'audio');
        const result = {
          duration: Math.floor(metadata.format.duration || 0),
          width: videoStream?.width || null,
          height: videoStream?.height || null,
          videoCodec: videoStream?.codec_name || null,
          audioCodec: audioStream?.codec_name || null,
          size: metadata.format.size || 0,
          bitrate: metadata.format.bit_rate || null,
          format: metadata.format.format_name || null
        };
        resolve(result);
      } catch (parseErr) {
        logger.error('Error parsing video metadata', { error: parseErr.message });
        reject(parseErr);
      }
    });
  });
 }
 /**
 * Generate thumbnail from video
 * @param {string} videoPath - Path to the video file
 * @param {string} outputPath - Path for the output thumbnail
 * @param {Object} options - Thumbnail options
 * @returns {Promise<string>} - Path to generated thumbnail
 */
 async function generateVideoThumbnail(videoPath, outputPath, options = {}) {
  const {
    timeOffset = '00:00:01', // Take screenshot at 1 second
    size = '300x300',
    quality = 2 // 1-31, lower is better quality
  } = options;
  return new Promise((resolve, reject) => {
    ffmpeg(videoPath)
      .screenshots({
        timestamps: [timeOffset],
        filename: path.basename(outputPath),
        folder: path.dirname(outputPath),
        size: size
      })
      .on('end', () => {
        logger.info('Video thumbnail generated', { videoPath, outputPath });
        resolve(outputPath);
      })
      .on('error', (err) => {
        logger.error('Error generating video thumbnail', { error: err.message, videoPath });
        reject(err);
      });
  });
 }
 /**
 * Validate that a file is a valid video
 * @param {string} videoPath - Path to the video file
 * @returns {Promise<boolean>} - True if valid video
 */
 async function isValidVideo(videoPath) {
  try {
    const metadata = await extractVideoMetadata(videoPath);
    return metadata.duration > 0 && metadata.width > 0 && metadata.height > 0;
  } catch (error) {
    logger.error('Video validation failed', { error: error.message, videoPath });
    return false;
  }
 }
 /**
 * Get video duration in seconds
 * @param {string} videoPath - Path to the video file
 * @returns {Promise<number>} - Duration in seconds
 */
 async function getVideoDuration(videoPath) {
  try {
    const metadata = await extractVideoMetadata(videoPath);
    return metadata.duration;
  } catch (error) {
    logger.error('Error getting video duration', { error: error.message });
    return 0;
  }
 }
 /**
 * Process uploaded video - extract metadata and generate thumbnail
 * @param {string} videoPath - Path to the video file
 * @param {string} thumbnailPath - Path for the thumbnail
 * @param {Object} options - Processing options
 * @returns {Promise<Object>} - Video metadata and processing result
 */
 async function processUploadedVideo(videoPath, thumbnailPath, options = {}) {
  try {
    // Validate video
    const isValid = await isValidVideo(videoPath);
    if (!isValid) {
      throw new Error('Invalid video file');
    }
    // Extract metadata
    const metadata = await extractVideoMetadata(videoPath);
    // Generate thumbnail
    await generateVideoThumbnail(videoPath, thumbnailPath, options);
    // Verify thumbnail was created
    try {
      await fs.access(thumbnailPath);
    } catch (err) {
      throw new Error('Thumbnail generation failed');
    }
    return {
      success: true,
      metadata,
      thumbnailPath
    };
  } catch (error) {
    logger.error('Error processing video', { error: error.message, videoPath });
    throw error;
  }
 }
 /**
 * Get video thumbnail at specific time
 * @param {string} videoPath - Path to video file
 * @param {string} outputPath - Output path for thumbnail
 * @param {number} timeInSeconds - Time in seconds to capture thumbnail
 * @returns {Promise<string>} - Path to thumbnail
 */
 async function getThumbnailAtTime(videoPath, outputPath, timeInSeconds = 1) {
  const hours = Math.floor(timeInSeconds / 3600);
  const minutes = Math.floor((timeInSeconds % 3600) / 60);
  const seconds = Math.floor(timeInSeconds % 60);
  const timeOffset = `${String(hours).padStart(2, '0')}:${String(minutes).padStart(2, '0')}:${String(seconds).padStart(2, '0')}`;
  return generateVideoThumbnail(videoPath, outputPath, { timeOffset });
 }
 /**
 * Check if file is a video based on MIME type
 * @param {string} mimeType - MIME type of the file
 * @returns {boolean} - True if video MIME type
 */
 function isVideoMimeType(mimeType) {
  return mimeType && mimeType.startsWith('video/');
 }
 module.exports = {
  extractVideoMetadata,
  generateVideoThumbnail,
  isValidVideo,
  getVideoDuration,
  processUploadedVideo,
  getThumbnailAtTime,
  isVideoMimeType
 };
@@ -0,0 +1,72 @@
 /**
 * Worker Manager - Background service for PicPeak
 *
 * This service runs as a separate process to handle:
 * - File watching for new photos
 * - Expiration checking for events
 * - Other background tasks
 */
 const path = require('path');
 const logger = require('../utils/logger');
 // Load environment variables
 require('dotenv').config({ path: path.join(__dirname, '../../.env') });
 // Import services
 const { startFileWatcher } = require('./fileWatcher');
 const { startExpirationChecker } = require('./expirationChecker');
 let isShuttingDown = false;
 async function startWorkers() {
  logger.info('Starting PicPeak background workers...');
  try {
    // Start file watcher for automatic photo processing
    startFileWatcher();
    logger.info('File watcher started successfully');
    // Start expiration checker for event lifecycle management
    startExpirationChecker();
    logger.info('Expiration checker started successfully');
    logger.info('All background workers started successfully');
  } catch (error) {
    logger.error('Failed to start background workers:', error);
    process.exit(1);
  }
 }
 function handleShutdown(signal) {
  if (isShuttingDown) {
    logger.info('Shutdown already in progress...');
    return;
  }
  isShuttingDown = true;
  logger.info(`Received ${signal}. Shutting down gracefully...`);
  // Give time for cleanup
  setTimeout(() => {
    logger.info('Worker manager shutdown complete');
    process.exit(0);
  }, 1000);
 }
 // Handle shutdown signals
 process.on('SIGTERM', () => handleShutdown('SIGTERM'));
 process.on('SIGINT', () => handleShutdown('SIGINT'));
 // Handle uncaught errors
 process.on('uncaughtException', (error) => {
  logger.error('Uncaught exception in worker manager:', error);
  process.exit(1);
 });
 process.on('unhandledRejection', (reason, promise) => {
  logger.error('Unhandled rejection in worker manager:', reason);
 });
 // Start workers
 startWorkers();
@@ -7,10 +7,140 @@ const { db } = require('../database/db');
 const { formatBoolean } = require('./dbCompat');
 const logger = require('./logger');
-// Configuration constants
+const DEFAULT_SECURITY_CONFIG = Object.freeze({
-const MAX_LOGIN_ATTEMPTS = 5;
+  maxAttempts: 5,
-const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
+  lockoutDurationMs: 30 * 60 * 1000, // 30 minutes
-const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
+  attemptWindowMs: 15 * 60 * 1000 // 15 minutes
 });
 const SECURITY_CONFIG_CACHE_MS = 60 * 1000; // 1 minute cache
 let cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
 let cachedConfigFetchedAt = 0;
 function parseStoredValue(rawValue) {
  if (rawValue === undefined || rawValue === null) {
    return undefined;
  }
  if (typeof rawValue !== 'string') {
    return rawValue;
  }
  try {
    return JSON.parse(rawValue);
  } catch (error) {
    logger.warn(`Unable to parse stored security setting value "${rawValue}", using raw string.`);
    return rawValue;
  }
 }
 function normalizePositiveInteger(name, value, fallback, options = {}) {
  if (value === undefined || value === null || value === '') {
    return fallback;
  }
  const numericValue = Number(value);
  if (!Number.isFinite(numericValue)) {
    logger.warn(`Invalid numeric value for ${name}: ${value}. Falling back to default (${fallback}).`);
    return fallback;
  }
  let adjustedValue = Math.floor(numericValue);
  if (options.min !== undefined && adjustedValue < options.min) {
    logger.warn(`Value for ${name} below minimum (${options.min}). Clamping to minimum.`);
    adjustedValue = options.min;
  }
  if (options.max !== undefined && adjustedValue > options.max) {
    logger.warn(`Value for ${name} exceeds maximum (${options.max}). Clamping to maximum.`);
    adjustedValue = options.max;
  }
  if (adjustedValue <= 0) {
    logger.warn(`Value for ${name} must be positive. Falling back to default (${fallback}).`);
    return fallback;
  }
  return adjustedValue;
 }
 async function loadSecurityConfigFromSettings() {
  const rows = await db('app_settings').whereIn('setting_key', [
    'security_max_login_attempts',
    'security_lockout_duration_minutes',
    'security_attempt_window_minutes'
  ]);
  const config = { ...DEFAULT_SECURITY_CONFIG };
  rows.forEach(row => {
    const value = parseStoredValue(row.setting_value);
    switch (row.setting_key) {
      case 'security_max_login_attempts': {
        config.maxAttempts = normalizePositiveInteger(
          'security_max_login_attempts',
          value,
          DEFAULT_SECURITY_CONFIG.maxAttempts,
          { min: 1, max: 50 }
        );
        break;
      }
      case 'security_lockout_duration_minutes': {
        const minutes = normalizePositiveInteger(
          'security_lockout_duration_minutes',
          value,
          DEFAULT_SECURITY_CONFIG.lockoutDurationMs / (60 * 1000),
          { min: 1, max: 24 * 60 }
        );
        config.lockoutDurationMs = minutes * 60 * 1000;
        break;
      }
      case 'security_attempt_window_minutes': {
        const minutes = normalizePositiveInteger(
          'security_attempt_window_minutes',
          value,
          DEFAULT_SECURITY_CONFIG.attemptWindowMs / (60 * 1000),
          { min: 1, max: 24 * 60 }
        );
        config.attemptWindowMs = minutes * 60 * 1000;
        break;
      }
      default:
        break;
    }
  });
  return config;
 }
 async function getSecurityConfig(options = {}) {
  const now = Date.now();
  const forceRefresh = options.forceRefresh === true;
  if (!forceRefresh && cachedSecurityConfig && (now - cachedConfigFetchedAt) < SECURITY_CONFIG_CACHE_MS) {
    return cachedSecurityConfig;
  }
  try {
    const config = await loadSecurityConfigFromSettings();
    cachedSecurityConfig = config;
    cachedConfigFetchedAt = now;
    return cachedSecurityConfig;
  } catch (error) {
    logger.error('Error loading security configuration:', error);
    cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
    cachedConfigFetchedAt = now;
    return cachedSecurityConfig;
  }
 }
 function resetSecurityConfigCache() {
  cachedSecurityConfig = { ...DEFAULT_SECURITY_CONFIG };
  cachedConfigFetchedAt = 0;
 }
 /**
 * Track failed login attempt
@@ -59,6 +189,8 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
    if (!tableExists) {
      return;
    }
    const { attemptWindowMs } = await getSecurityConfig();
    await db('login_attempts').insert({
      identifier,
@@ -69,7 +201,7 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
    });
    // Clear old failed attempts for this user
-    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
+    const cutoffTime = new Date(Date.now() - attemptWindowMs);
    await db('login_attempts')
      .where('identifier', identifier)
      .where('success', formatBoolean(false))
@@ -83,30 +215,39 @@ async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
 /**
 * Check if account is locked due to too many failed attempts
 * @param {string} identifier - Username or email
 * @param {string} [ipAddress] - Optional IP address scope
 * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
 */
-async function checkAccountLockout(identifier) {
+async function checkAccountLockout(identifier, ipAddress) {
  try {
    // Check if table exists first
    const tableExists = await db.schema.hasTable('login_attempts');
    if (!tableExists) {
      return { isLocked: false };
    }
    const { attemptWindowMs, maxAttempts, lockoutDurationMs } = await getSecurityConfig();
-    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
+    const recentWindow = new Date(Date.now() - attemptWindowMs);
    // Get recent failed attempts
-    const failedAttempts = await db('login_attempts')
+    const failedAttemptsQuery = db('login_attempts')
      .where('identifier', identifier)
      .where('success', formatBoolean(false))
-      .where('attempt_time', '>=', recentWindow.toISOString())
+      .where('attempt_time', '>=', recentWindow.toISOString());
      .orderBy('attempt_time', 'desc')
      .limit(MAX_LOGIN_ATTEMPTS);
-    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
+    if (ipAddress) {
      failedAttemptsQuery.andWhere('ip_address', ipAddress);
    }
    const failedAttempts = await failedAttemptsQuery
      .orderBy('attempt_time', 'desc')
      .limit(maxAttempts);
    if (failedAttempts.length >= maxAttempts) {
      // Check if still within lockout period
      const oldestAttempt = failedAttempts[failedAttempts.length - 1];
-      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + lockoutDurationMs;
      const now = Date.now();
      if (now < lockoutEnd) {
@@ -216,6 +357,6 @@ module.exports = {
  checkSuspiciousActivity,
  getGenericAuthError,
  initializeCleanupJob,
-  MAX_LOGIN_ATTEMPTS,
+  getSecurityConfig,
-  LOCKOUT_DURATION
+  resetSecurityConfigCache
-};
+};
@@ -45,7 +45,7 @@ function isPathSafe(filePath) {
 }
 /**
- * Enhanced MIME type validation
+ * Enhanced MIME type validation for images and videos
 */
 const ALLOWED_IMAGE_TYPES = {
  'image/jpeg': {
@@ -81,6 +81,40 @@ const ALLOWED_IMAGE_TYPES = {
  }
 };
 const ALLOWED_VIDEO_TYPES = {
  'video/mp4': {
    extensions: ['.mp4', '.m4v'],
    magicNumbers: [
      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70] } // 'ftyp' signature for MP4
    ]
  },
  'video/webm': {
    extensions: ['.webm'],
    magicNumbers: [
      { offset: 0, bytes: [0x1A, 0x45, 0xDF, 0xA3] } // EBML header for WebM/MKV
    ]
  },
  'video/quicktime': {
    extensions: ['.mov'],
    magicNumbers: [
      { offset: 4, bytes: [0x66, 0x74, 0x79, 0x70, 0x71, 0x74] } // 'ftypqt' signature for QuickTime
    ]
  },
  'video/x-msvideo': {
    extensions: ['.avi'],
    magicNumbers: [
      { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF
      { offset: 8, bytes: [0x41, 0x56, 0x49, 0x20] }  // 'AVI '
    ]
  }
 };
 // Combined media types
 const ALLOWED_MEDIA_TYPES = {
  ...ALLOWED_IMAGE_TYPES,
  ...ALLOWED_VIDEO_TYPES
 };
 /**
 * Validate file type by MIME type and extension
 * @param {string} filename - The filename
@@ -93,16 +127,16 @@ function validateFileType(filename, mimetype, allowedTypes) {
  if (!allowedTypes.includes(mimetype)) {
    return false;
  }
-  
+
  // Get file extension
  const ext = path.extname(filename).toLowerCase();
-  
+
  // Check if extension matches the MIME type
-  const typeConfig = ALLOWED_IMAGE_TYPES[mimetype];
+  const typeConfig = ALLOWED_MEDIA_TYPES[mimetype];
  if (!typeConfig || !typeConfig.extensions.includes(ext)) {
    return false;
  }
-  
+
  return true;
 }
@@ -114,22 +148,22 @@ function validateFileType(filename, mimetype, allowedTypes) {
 */
 async function validateFileContent(filePath, expectedMimeType) {
  try {
-    const typeConfig = ALLOWED_IMAGE_TYPES[expectedMimeType];
+    const typeConfig = ALLOWED_MEDIA_TYPES[expectedMimeType];
    if (!typeConfig) {
      return false;
    }
-    
+
    // Skip validation for file types without magic numbers (like SVG)
    if (!typeConfig.magicNumbers) {
      return true;
    }
-    
+
    // Read the first 20 bytes of the file (enough for most magic numbers)
    const buffer = Buffer.alloc(20);
    const fileHandle = await fs.open(filePath, 'r');
    await fileHandle.read(buffer, 0, 20, 0);
    await fileHandle.close();
-    
+
    // Check magic numbers
    return typeConfig.magicNumbers.every(magic => {
      for (let i = 0; i < magic.bytes.length; i++) {
@@ -154,13 +188,13 @@ function getSafeFilename(originalFilename) {
  const timestamp = Date.now();
  const randomString = Math.random().toString(36).substring(2, 15);
  const ext = path.extname(originalFilename).toLowerCase();
-  
+
-  // Validate extension
+  // Validate extension - including both image and video extensions
-  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico'];
+  const validExtensions = ['.jpg', '.jpeg', '.png', '.webp', '.gif', '.svg', '.ico', '.mp4', '.m4v', '.webm', '.mov', '.avi'];
  if (!validExtensions.includes(ext)) {
    throw new Error('Invalid file extension');
  }
-  
+
  return `upload_${timestamp}_${randomString}${ext}`;
 }
@@ -229,5 +263,7 @@ module.exports = {
  validateFileContent,
  getSafeFilename,
  createFileUploadValidator,
-  ALLOWED_IMAGE_TYPES
+  ALLOWED_IMAGE_TYPES,
  ALLOWED_VIDEO_TYPES,
  ALLOWED_MEDIA_TYPES
 };
@@ -0,0 +1,36 @@
 /**
 * Resolve the originating client IP address, accounting for reverse proxies.
 * Returns the first entry from X-Forwarded-For when available, otherwise falls back
 * to Express/Node connection properties.
 * @param {import('express').Request} req
 * @returns {string}
 */
 function getClientIp(req) {
  if (!req) {
    return '';
  }
  const forwardedFor = req.headers['x-forwarded-for'];
  if (typeof forwardedFor === 'string' && forwardedFor.length > 0) {
    const [firstIp] = forwardedFor.split(',').map(part => part.trim()).filter(Boolean);
    if (firstIp) {
      return firstIp;
    }
  } else if (Array.isArray(forwardedFor) && forwardedFor.length > 0) {
    const [firstIp] = forwardedFor;
    if (firstIp) {
      return firstIp.trim();
    }
  }
  return (
    req.ip ||
    req.connection?.remoteAddress ||
    req.socket?.remoteAddress ||
    req.connection?.socket?.remoteAddress ||
    ''
  );
 }
 module.exports = { getClientIp };
@@ -0,0 +1,63 @@
 const SHARE_TOKEN_REGEX = /^[0-9a-fA-F]{32}$/;
 /**
 * Extracts the share token portion from a stored share link.
 * Supports full URLs, absolute paths, and legacy slug/token formats.
 * @param {string|null|undefined} shareLink
 * @returns {string|null}
 */
 function extractShareToken(shareLink) {
  if (!shareLink) {
    return null;
  }
  const trimmed = String(shareLink).trim();
  if (!trimmed) {
    return null;
  }
  // Remove protocol + host when a full URL is stored
  const path = trimmed.replace(/^https?:\/\/[^/]+/i, '');
  const segments = path.split('/').filter(Boolean);
  if (segments.length === 0) {
    return null;
  }
  const candidate = segments[segments.length - 1];
  return candidate || null;
 }
 /**
 * Returns true if the provided identifier looks like a generated share token.
 * @param {string|null|undefined} identifier
 * @returns {boolean}
 */
 function isPotentialShareToken(identifier) {
  if (!identifier) {
    return false;
  }
  return SHARE_TOKEN_REGEX.test(String(identifier).trim());
 }
 /**
 * Builds the gallery share path depending on whether short URLs are enabled.
 * @param {string} slug
 * @param {string} shareToken
 * @param {boolean} useShort
 * @returns {string}
 */
 function buildSharePath(slug, shareToken, useShort) {
  if (!shareToken) {
    throw new Error('shareToken is required to build share path');
  }
  if (useShort || !slug) {
    return `/gallery/${shareToken}`;
  }
  return `/gallery/${slug}/${shareToken}`;
 }
 module.exports = {
  extractShareToken,
  isPotentialShareToken,
  buildSharePath
 };
@@ -3,19 +3,52 @@
 set -e
-host="$DB_HOST"
+host="${DB_HOST:-postgres}"
 port="${DB_PORT:-5432}"
 user="${DB_USER:-picpeak}"
 target_db="${DB_NAME:-picpeak}"
 default_db="${DB_CHECK_DB:-postgres}"
 sanitize_identifier() {
  printf '%s' "$1" | sed "s/'/''/g"
 }
 echo "Waiting for PostgreSQL at $host:$port..."
-# Wait for PostgreSQL to be ready
+# Wait for PostgreSQL server to accept connections (using the default database)
-until PGPASSWORD=$DB_PASSWORD psql -h "$host" -p "$port" -U "$user" -d "${DB_NAME:-picpeak}" -c '\q' 2>/dev/null; do
+until PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -c '\q' >/dev/null 2>&1; do
  >&2 echo "PostgreSQL is unavailable - sleeping"
  sleep 2
 done
->&2 echo "PostgreSQL is up - executing command"
+>&2 echo "PostgreSQL is up - verifying target database \"$target_db\""
 # Ensure the target database exists (helps when volumes are reused or DB_NAME is customised)
 db_exists=$(PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -tAc "SELECT 1 FROM pg_database WHERE datname = '$(sanitize_identifier "$target_db")'" 2>/dev/null || echo 0)
 if [ "$db_exists" != "1" ]; then
  >&2 echo "Database \"$target_db\" not found. Attempting to create..."
  if ! PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$default_db" -c "CREATE DATABASE \"$target_db\";" >/dev/null 2>&1; then
    >&2 echo "Failed to create database \"$target_db\". Please ensure it exists and is accessible."
    exit 1
  fi
  >&2 echo "Database \"$target_db\" created successfully."
 fi
 # Wait until the target database itself is ready to accept connections
 until PGPASSWORD="$DB_PASSWORD" psql -h "$host" -p "$port" -U "$user" -d "$target_db" -c '\q' >/dev/null 2>&1; do
  >&2 echo "Waiting for database \"$target_db\" to accept connections..."
  sleep 2
 done
 >&2 echo "Target database \"$target_db\" is ready."
 # Ensure storage directories exist with proper permissions (Issue #67 fix)
 # When host directories are bind-mounted, the container's built-in directories are overridden
 # This ensures the required directory structure exists before the application starts
 echo "Ensuring storage directories exist..."
 STORAGE_BASE="${STORAGE_PATH:-/app/storage}"
 mkdir -p "$STORAGE_BASE/events/active" "$STORAGE_BASE/events/archived" "$STORAGE_BASE/thumbnails" 2>/dev/null || true
 # Run migrations (use safe runner in production)
 echo "Running database migrations..."
@@ -26,4 +59,4 @@ else
 fi
 # Execute the main command
-exec "$@"
+exec "$@"
@@ -4,6 +4,7 @@ services:
  postgres:
    image: postgres:15-alpine
    container_name: picpeak-postgres
    userns_mode: "host"
    environment:
      POSTGRES_USER: ${DB_USER:-picpeak}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
@@ -22,6 +23,7 @@ services:
  redis:
    image: redis:7-alpine
    container_name: picpeak-redis
    userns_mode: "host"
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis-data:/data
@@ -60,6 +60,7 @@ services:
    image: postgres:15-alpine
    container_name: picpeak-postgres
    restart: unless-stopped
    userns_mode: "host"
    environment:
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
@@ -83,6 +84,7 @@ services:
    image: redis:7-alpine
    container_name: picpeak-redis
    restart: unless-stopped
    userns_mode: "host"
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-picpeak_redis_pass}
    volumes:
      - redis-data:/data
@@ -101,7 +103,7 @@ services:
      context: ./frontend
      dockerfile: Dockerfile
      args:
-        - VITE_API_URL=${VITE_API_URL:-http://localhost:3001/api}
+        - VITE_API_URL=${VITE_API_URL:-/api}
        - VITE_UMAMI_URL=${VITE_UMAMI_URL:-}
        - VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID:-}
        - VITE_UMAMI_SHARE_URL=${VITE_UMAMI_SHARE_URL:-}
@@ -109,7 +109,7 @@ If ADMIN_CREDENTIALS.txt is missing:
 - File is created in the backend directory root
 - File might have been deleted for security (as recommended)
 - Regenerate it by running `node scripts/reset-admin-password.js --force --credentials-file data/ADMIN_CREDENTIALS.txt`
- When using the unified `setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
+- When using the unified `picpeak-setup.sh` installer for a reinstall, append `--force-admin-password-reset` to have the script perform the reset automatically
 ## Best Practices
@@ -0,0 +1,147 @@
 # PicPeak Admin API Quickstart
 This guide explains how to authenticate against the PicPeak Admin API, use the OpenAPI documentation, and exercise the three automation endpoints (`create event`, `photo upload`, `resend email`) that now ship with machine-readable docs.
 > **Prerequisites**
 >
 > - PicPeak backend running (Docker or local `node backend/server.js`)
 > - An admin account (see `data/ADMIN_CREDENTIALS.txt` for the seeded defaults)
 > - API base URL (defaults to `http://localhost:3001/api`)
 ---
 ## 1. Obtain an Admin API Token
 1. Determine whether reCAPTCHA is enabled in **Admin → Settings → Security**. If disabled (the default), you can skip the `recaptchaToken` field shown below.
 2. Authenticate with your admin username/email and password:
 ```bash
 curl --fail --silent --show-error \
  -X POST "http://localhost:3001/api/auth/admin/login" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "BoldTiger5872%",
    "recaptchaToken": ""
  }' | jq
 ```
 Successful responses look like:
 ```json
 {
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": 1,
    "username": "admin",
    "email": "admin@example.com",
    "mustChangePassword": false
  }
 }
 ```
 - PicPeak also sets the `admin_token` cookie; however, when scripting you typically pass the token in an `Authorization: Bearer <token>` header.
 - Tokens expire after 24 hours. Log in again to refresh them.
 ---
 ## 2. Use the OpenAPI Documentation
 The machine-readable spec lives at `docs/picpeak-admin-api.openapi.yaml`. You can:
 - Preview it interactively with Redocly:
  ```bash
  npx --yes @redocly/cli preview-docs docs/picpeak-admin-api.openapi.yaml
  ```
 - Import it into Postman, Insomnia, or VS Code REST client.
 - Validate changes as part of CI with:
  ```bash
  npx --yes @apidevtools/swagger-cli@4.0.4 validate docs/picpeak-admin-api.openapi.yaml
  ```
 Keep this file in sync whenever the backend endpoints evolve.
 ---
 ## 3. Call the Key Admin Endpoints
 Below are minimal `curl` examples that rely on the bearer token captured earlier.
 ### 3.1 Create an Event
 ```bash
 API_URL="http://localhost:3001/api"
 TOKEN="REPLACE_WITH_JWT"
 curl --fail --silent --show-error \
  -X POST "$API_URL/admin/events" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "wedding",
    "event_name": "Emily & Jordan Celebration",
    "event_date": "2025-06-07",
    "customer_name": "Emily Carter",
    "customer_email": "emily@example.com",
    "admin_email": "studio@example.com",
    "require_password": true,
    "password": "Shutter123",
    "expiration_days": 45
  }' | jq
 ```
 ### 3.2 Upload Photos to the Event
 ```bash
 EVENT_ID=512
 curl --fail --silent --show-error \
  -X POST "$API_URL/admin/events/$EVENT_ID/upload" \
  -H "Authorization: Bearer $TOKEN" \
  -F "photos=@/path/to/DSC_2031.jpg" \
  -F "photos=@/path/to/DSC_2032.jpg" \
  -F "category_id=individual" | jq
 ```
 - Files must be JPEG/PNG/WebP, each ≤ 50 MB.
 - The per-request file count respects the `general_max_files_per_upload` admin setting (default 500).
 ### 3.3 Resend the Gallery Email
 ```bash
 curl --fail --silent --show-error \
  -X POST "$API_URL/admin/events/$EVENT_ID/resend-email" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"password": "Shutter123"}' | jq
 ```
 Omit `"password"` to send the standard security message instead.
 ---
 ## 4. Quick Testing Checklist
 - ✅ Login succeeds and returns a token (HTTP 200).
 - ✅ Creating an event returns `id`, `slug`, and `share_link`.
 - ✅ Uploading more files than allowed returns HTTP 400 with a helpful message.
 - ✅ Resending email for a missing event returns HTTP 404.
 - ✅ `swagger-cli validate` passes after any spec edits.
 Automate these checks using your preferred test harness or CI pipeline to catch regressions early.
 ---
 ## 5. Migrating From `host_*`
 - Run backend migrations to add the new `customer_name` / `customer_email` columns: `npm --prefix backend run migrate` (or your existing deployment flow). The migration copies legacy data automatically, so upgrades remain seamless.
 - All admin APIs now require the `customer_*` fields. Older `host_*` payloads are rejected, which makes downstream client issues obvious during testing instead of silently dropping data.
 - API responses still mirror `customer_*` even if migrations have not run yet (the server falls back to legacy columns until the upgrade is complete), so existing frontends can move over incrementally.
 - Once every consumer writes and reads the new fields, you can safely plan the removal of the legacy `host_*` columns in a future release.
 ---
 Need deeper integration examples or language-specific SDKs? Import the OpenAPI spec into code generators such as `openapi-generator` or `orval` to scaffold API clients quickly.
@@ -0,0 +1,584 @@
 openapi: 3.1.0
 info:
  title: PicPeak Admin API
  version: 1.1.11
  summary: High-level administrative endpoints for creating events, uploading photos, and resending gallery access emails.
  description: |
    This document describes the core administrative endpoints that power PicPeak automations.
    It focuses on the three workflows requested by integrators:
    1. Creating events with customer access credentials.
    2. Uploading photos in bulk to an event gallery.
    3. Resending the customer-facing gallery email.
    The specification follows the latest [OpenAPI 3.1](https://spec.openapis.org/oas/v3.1.0) best practices
    and is intended to be kept in sync with backend changes.
  contact:
    name: PicPeak Maintainers
    url: https://github.com/the-luap/picpeak
 servers:
  - url: https://api.picpeak.example.com/api
    description: Example production deployment
  - url: http://localhost:3001/api
    description: Local development
 tags:
  - name: Admin Events
    description: Administrative endpoints for managing event galleries.
 components:
  securitySchemes:
    CookieAuth:
      type: apiKey
      in: cookie
      name: admin_token
      description: >
        Session cookie issued by the admin authentication flow. When present, the backend mirrors
        it into the `Authorization` header automatically.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        JSON Web Token created by the admin login endpoint. You can also pass the token explicitly
        as `Authorization: Bearer <token>` instead of using the admin cookie.
  parameters:
    EventId:
      name: eventId
      in: path
      description: Numeric identifier of the event.
      required: true
      schema:
        type: integer
        minimum: 1
      example: 341
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Human readable error message.
        details:
          type: string
          nullable: true
          description: Additional context (when available).
      required:
        - error
      example:
        error: Invalid token
    ValidationErrorItem:
      type: object
      properties:
        type:
          type: string
          nullable: true
          description: Validation error type reported by express-validator.
        msg:
          type: string
        path:
          type: string
          description: Dot-delimited path to the invalid field.
        value:
          description: Value that failed validation.
        location:
          type: string
          description: Location of the invalid value (always `body` for these endpoints).
      required:
        - msg
        - path
        - location
      example:
        type: field
        msg: Event date must be a valid ISO 8601 date
        path: event_date
        value: 2025/05/01
        location: body
    ValidationErrorResponse:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ValidationErrorItem'
      required:
        - errors
      example:
        errors:
          - type: field
            msg: Customer email must be a valid address
            path: customer_email
            value: example@invalid
            location: body
    CreateEventRequest:
      type: object
      required:
        - event_type
        - event_name
        - event_date
        - customer_name
        - customer_email
        - admin_email
      properties:
        event_type:
          type: string
          description: Type of event. Controls default theme and copy in the UI.
          enum: [wedding, birthday, corporate, other]
        event_name:
          type: string
          minLength: 1
          description: Display name for the gallery shown to end customers.
        event_date:
          type: string
          format: date
          description: Event date (YYYY-MM-DD). Used to calculate the default expiration.
        customer_name:
          type: string
          minLength: 1
          description: Name of the customer receiving gallery access.
        customer_email:
          type: string
          format: email
          description: Email address of the customer who will receive the gallery link.
        admin_email:
          type: string
          format: email
          description: Admin contact email included in notification messages.
        require_password:
          type: boolean
          default: true
          description: When true, the gallery requires `password`; when false a random placeholder is stored.
        password:
          type: string
          minLength: 6
          description: >
            Gallery password issued to the customer. Required when `require_password` is `true`.
            Left unset to auto-generate a placeholder when password protection is disabled.
        expiration_days:
          type: integer
          minimum: 1
          maximum: 365
          default: 30
          description: Number of days after the event date before the gallery expires.
        welcome_message:
          type: string
          description: Optional welcome message displayed in the gallery.
        color_theme:
          type: string
          nullable: true
          description: Optional theme identifier or CSS color settings.
        allow_user_uploads:
          type: boolean
          default: false
          description: Allow gallery guests to upload their own photos.
        upload_category_id:
          type: integer
          nullable: true
          description: ID of the default category for user uploads.
        allow_downloads:
          type: boolean
          default: true
          description: Allow guests to download photos.
        disable_right_click:
          type: boolean
          default: false
          description: Disable right-click in the gallery view.
        watermark_downloads:
          type: boolean
          default: false
          description: Enable watermarking on downloaded images.
        watermark_text:
          type: string
          nullable: true
          description: Custom watermark text when `watermark_downloads` is true.
        feedback_enabled:
          type: boolean
          default: false
          description: Enable the feedback module for this gallery.
        allow_ratings:
          type: boolean
          default: true
        allow_likes:
          type: boolean
          default: true
        allow_comments:
          type: boolean
          default: true
        allow_favorites:
          type: boolean
          default: true
        require_name_email:
          type: boolean
          default: false
          description: Require guests to provide name and email when leaving feedback.
        moderate_comments:
          type: boolean
          default: true
          description: Hold guest comments for moderation.
        show_feedback_to_guests:
          type: boolean
          default: true
          description: Display aggregated feedback metrics back to guests.
      example:
        event_type: wedding
        event_name: Emily & Jordan Celebration
        event_date: 2025-06-07
        customer_name: Emily Carter
        customer_email: emily@example.com
        admin_email: studio@example.com
        require_password: true
        password: Shutter123
        expiration_days: 45
        welcome_message: >
          We loved capturing your day! Use the password below to view and download your photos.
        allow_user_uploads: false
        allow_downloads: true
        feedback_enabled: true
        allow_comments: true
        show_feedback_to_guests: true
    EventSummary:
      type: object
      properties:
        id:
          type: integer
          description: Database identifier of the newly created event.
        slug:
          type: string
          description: Unique slug used to build the gallery URL.
        event_name:
          type: string
        event_type:
          type: string
          enum: [wedding, birthday, corporate, other]
        customer_name:
          type: string
          nullable: true
          description: Name of the customer associated with the event.
        customer_email:
          type: string
          format: email
          nullable: true
          description: Email address of the customer associated with the event.
        require_password:
          type: boolean
        share_link:
          type: string
          description: Absolute or relative URL guests can use to reach the gallery.
        expires_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp when the gallery expires.
        created_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp when the event was created.
      required:
        - id
        - slug
        - event_name
        - event_type
        - require_password
        - share_link
        - expires_at
        - created_at
      example:
        id: 512
        slug: wedding-emily-jordan-2025-06-07
        event_name: Emily & Jordan Celebration
        event_type: wedding
        customer_name: Emily Carter
        customer_email: emily@example.com
        require_password: true
        share_link: https://app.picpeak.io/gallery/wedding-emily-jordan-2025-06-07/2f3c8a4d90bb11ef9b2e0242ac120002
        expires_at: 2025-07-22T00:00:00.000Z
        created_at: 2025-05-01T14:32:45.000Z
    UploadPhotosResponse:
      type: object
      properties:
        message:
          type: string
        photos:
          type: array
          items:
            $ref: '#/components/schemas/UploadedPhotoSummary'
          description: Metadata for each photo that was persisted successfully.
        totalFiles:
          type: integer
          minimum: 0
          description: Total number of files included in the request (valid + invalid).
        successCount:
          type: integer
          minimum: 0
        failureCount:
          type: integer
          minimum: 0
        errors:
          type: array
          items:
            $ref: '#/components/schemas/UploadFailure'
          description: Present when some files failed validation or processing.
      required:
        - message
        - photos
        - totalFiles
        - successCount
        - failureCount
      example:
        message: Uploaded 18 of 20 photos. 2 failed.
        photos:
          - id: 9821
            filename: DSC_2031.jpg
            size: 4812096
            category_id: 2
          - id: 9822
            filename: DSC_2032.jpg
            size: 5216743
            category_id: 2
        totalFiles: 20
        successCount: 18
        failureCount: 2
        errors:
          - filename: DSC_2020.raw
            error: Only JPEG, PNG and WebP images are allowed
          - filename: portrait.png
            error: File is empty
    UploadedPhotoSummary:
      type: object
      properties:
        id:
          type: integer
        filename:
          type: string
        size:
          type: integer
          description: File size in bytes.
        category_id:
          type: integer
          nullable: true
      required:
        - id
        - filename
        - size
      example:
        id: 9821
        filename: DSC_2031.jpg
        size: 4812096
        category_id: 2
    UploadFailure:
      type: object
      properties:
        filename:
          type: string
        error:
          type: string
      required:
        - filename
        - error
      example:
        filename: DSC_2031.gif
        error: Only JPEG, PNG and WebP images are allowed
    ResendEmailRequest:
      type: object
      properties:
        password:
          type: string
          minLength: 1
          description: >
            Optional plain-text password to include in the email. When omitted a security notice
            placeholder is inserted because the stored hash cannot be reversed.
      example:
        password: Shutter123
    ResendEmailResponse:
      type: object
      properties:
        success:
          type: boolean
        message:
          type: string
      required:
        - success
        - message
      example:
        success: true
        message: Creation email has been queued for sending
 paths:
  /admin/events:
    post:
      tags: [Admin Events]
      operationId: createAdminEvent
      summary: Create a new event
      description: >
        Creates a new event, provisions storage folders, stores the gallery password, and queues
        the initial gallery email for the customer. Requires admin authentication.
      security:
        - CookieAuth: []
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEventRequest'
            examples:
              weddingExample:
                summary: Wedding with password protection
                value:
                  event_type: wedding
                  event_name: Emily & Jordan Celebration
                  event_date: 2025-06-07
                  customer_name: Emily Carter
                  customer_email: emily@example.com
                  admin_email: studio@example.com
                  require_password: true
                  password: Shutter123
                  expiration_days: 45
                  welcome_message: >
                    We loved capturing your day! Use the password below to view and download your photos.
                  allow_user_uploads: false
                  allow_downloads: true
                  feedback_enabled: true
                  allow_comments: true
                  show_feedback_to_guests: true
      responses:
        '200':
          description: Event created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventSummary'
        '400':
          description: Validation failed. At least one field is invalid or missing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorResponse'
        '401':
          description: Authentication required or token invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Unexpected server error while creating the event.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /admin/events/{eventId}/upload:
    post:
      tags: [Admin Events]
      operationId: uploadEventPhotos
      summary: Upload photos to an event gallery
      description: |
        Uploads one or more photos to the specified event. Files are validated, moved into the
        event storage directory, and thumbnails are generated asynchronously.
        The maximum number of files per upload is controlled via the `general_max_files_per_upload`
        setting (default 500, capped at 2000). Files exceeding 50 MB are rejected.
      security:
        - CookieAuth: []
        - BearerAuth: []
      parameters:
        - $ref: '#/components/parameters/EventId'
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                photos:
                  type: array
                  description: >
                    One or more image files (JPEG, PNG, WebP). Each file must be <= 50 MB.
                  items:
                    type: string
                    format: binary
                category_id:
                  oneOf:
                    - type: integer
                    - type: string
                  description: >
                    Optional category assignment. Accepts numeric IDs or the string values `collage`
                    and `individual` for backward compatibility.
              required:
                - photos
            encoding:
              photos:
                style: form
                explode: false
      responses:
        '200':
          description: Upload completed. Failed files (if any) are listed in the response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UploadPhotosResponse'
        '400':
          description: Request failed validation (invalid files, too many files, etc.).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Authentication required or token invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: The referenced event does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Unexpected server error while processing uploads.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /admin/events/{eventId}/resend-email:
    post:
      tags: [Admin Events]
      operationId: resendEventEmail
      summary: Resend the gallery access email to the customer
      description: >
        Queues the standard `gallery_created` email for the event's customer. Useful when resending
        credentials to the customer or communicating an updated password. Requires admin authentication.
      security:
        - CookieAuth: []
        - BearerAuth: []
      parameters:
        - $ref: '#/components/parameters/EventId'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResendEmailRequest'
            example:
              password: NewSecurePassword!
      responses:
        '200':
          description: Email successfully queued for delivery.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResendEmailResponse'
        '401':
          description: Authentication required or token invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Event not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Unexpected server error while queuing the email.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
@@ -12,6 +12,9 @@ LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
 LABEL org.opencontainers.image.description="PicPeak Frontend Application"
 LABEL org.opencontainers.image.licenses="MIT"
 # Upgrade npm to fix glob CVE-2025-64756 vulnerability
 RUN npm install -g npm@latest
 # Set working directory
 WORKDIR /app
@@ -27,8 +30,13 @@ COPY . .
 # Build the application
 RUN npm run build
-# Production stage
+# Production stage (use Alpine with patched libpng)
-FROM nginx:alpine
+FROM nginx:1.27-alpine3.21
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 # Ensure libpng includes CVE fixes (pull patched version from edge)
 RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main 'libpng>=1.6.51-r0'
 # Install runtime dependencies
 RUN apk add --no-cache curl
@@ -60,4 +68,4 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
 USER nginx
 # Start nginx
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]
@@ -3,6 +3,9 @@ FROM node:20-alpine
 WORKDIR /app
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 # Copy package files
 COPY package*.json ./
@@ -25,6 +25,9 @@ RUN npm run build
 # Production stage
 FROM nginx:alpine
 # Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
 RUN apk upgrade --no-cache
 # Install runtime dependencies
 RUN apk add --no-cache curl
@@ -19,5 +19,28 @@ export default tseslint.config([
      ecmaVersion: 2020,
      globals: globals.browser,
    },
    rules: {
      '@typescript-eslint/no-explicit-any': 'off',
      '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
      'react-hooks/rules-of-hooks': 'off',
      'react-hooks/exhaustive-deps': 'warn',
      'no-useless-escape': 'off',
      'no-case-declarations': 'off',
      'prefer-const': 'off',
      'no-control-regex': 'off',
      'no-useless-catch': 'off',
      'react-refresh/only-export-components': 'off',
      'no-empty': 'off',
      'no-debugger': 'off',
      '@typescript-eslint/no-unused-expressions': 'off',
      '@typescript-eslint/ban-ts-comment': 'off',
    },
  },
  {
    files: ['**/*.d.ts'],
    rules: {
      '@typescript-eslint/no-explicit-any': 'off',
      '@typescript-eslint/no-unused-vars': 'off',
    },
  },
 ])
@@ -1,14 +1,15 @@
 {
  "name": "picpeak-frontend",
  "private": true,
-  "version": "1.1.12",
+  "version": "1.1.15",
  "type": "module",
  "scripts": {
    "dev": "vite",
-    "build": "vite build",
+    "build": "node ./scripts/build.js",
-    "build:check": "tsc -b && vite build",
+    "build:check": "tsc -b && node ./scripts/build.js",
    "lint": "eslint .",
-    "preview": "vite preview"
+    "preview": "vite preview",
    "test": "vitest run src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx"
  },
  "dependencies": {
    "@tanstack/react-query": "^5.0.0",
@@ -47,18 +48,31 @@
  },
  "devDependencies": {
    "@eslint/js": "^9.29.0",
    "@testing-library/jest-dom": "^6.6.3",
    "@testing-library/react": "^16.1.0",
    "@testing-library/user-event": "^14.6.1",
    "@types/react": "^18.3.12",
    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react": "^4.5.2",
+    "@vitejs/plugin-react": "^4.5.3",
    "autoprefixer": "^10.4.13",
    "cross-env": "^10.1.0",
    "eslint": "^9.29.0",
    "eslint-plugin-react-hooks": "^5.2.0",
    "eslint-plugin-react-refresh": "^0.4.20",
    "globals": "^16.2.0",
    "jsdom": "^25.0.1",
    "postcss": "^8.4.21",
    "tailwindcss": "^3.3.0",
    "typescript": "~5.8.3",
    "typescript-eslint": "^8.34.1",
-    "vite": "^7.1.6"
+    "vite": "^7.1.12",
    "vitest": "^3.2.4"
  },
  "optionalDependencies": {
    "@rollup/rollup-linux-x64-gnu": "^4.45.1"
  },
  "overrides": {
    "glob": "^11.1.0",
    "js-yaml": "^4.1.1"
  }
 }
@@ -0,0 +1,93 @@
 #!/usr/bin/env node
 import { execSync } from 'node:child_process';
 import { resolve, join } from 'node:path';
 import process from 'node:process';
 import { promises as fs } from 'node:fs';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import https from 'node:https';
 const TARGET_NODE_VERSION = '20.19.1';
 const env = { ...process.env, ROLLUP_USE_NODE_JS: 'true' };
 const viteBin = resolve(process.cwd(), 'node_modules', 'vite', 'bin', 'vite.js');
 async function ensureNodeBinary(version) {
  const platformMap = {
    linux: 'linux',
    darwin: 'darwin',
    win32: 'win'
  };
  const archMap = {
    x64: 'x64',
    arm64: 'arm64'
  };
  const platform = platformMap[process.platform];
  const arch = archMap[process.arch];
  if (!platform || !arch) {
    throw new Error(`Unsupported platform/architecture combination: ${process.platform} ${process.arch}`);
  }
  if (platform === 'win') {
    throw new Error('Automatic Node.js download is not supported on Windows runners. Please upgrade Node.js to >=20.19 manually.');
  }
  const cacheDir = join(process.cwd(), 'node_modules', '.cache', `node-v${version}-${platform}-${arch}`);
  const nodeBinary = join(cacheDir, `node-v${version}-${platform}-${arch}`, 'bin', 'node');
  try {
    await fs.access(nodeBinary);
    return nodeBinary;
  } catch {
    // continue with download
  }
  await fs.mkdir(cacheDir, { recursive: true });
  const archiveExt = platform === 'win' ? 'zip' : 'tar.xz';
  const archiveName = `node-v${version}-${platform}-${arch}.${archiveExt}`;
  const archivePath = join(cacheDir, archiveName);
  const downloadUrl = `https://nodejs.org/dist/v${version}/${archiveName}`;
  await downloadFile(downloadUrl, archivePath);
  if (archiveExt === 'tar.xz') {
    execSync(`tar -xf "${archivePath}" -C "${cacheDir}"`, { stdio: 'inherit' });
  } else {
    throw new Error('ZIP extraction not implemented. Please upgrade Node.js manually.');
  }
  await fs.rm(archivePath, { force: true });
  return nodeBinary;
 }
 async function downloadFile(url, destination) {
  await new Promise((resolvePromise, rejectPromise) => {
    const fileStream = createWriteStream(destination);
    https.get(url, (response) => {
      if (response.statusCode && response.statusCode >= 400) {
        rejectPromise(new Error(`Failed to download ${url}: HTTP ${response.statusCode}`));
        return;
      }
      pipeline(response, fileStream).then(resolvePromise).catch(rejectPromise);
    }).on('error', rejectPromise);
  });
 }
 async function main() {
  console.log(`Node.js ${process.version} detected; forcing Rollup's JavaScript fallback for compatibility.`);
  if (!process.env.USE_DOWNLOADED_NODE) {
    const [major] = process.versions.node.split('.').map(Number);
    if (major < 20) {
      const nodeBinary = await ensureNodeBinary(TARGET_NODE_VERSION);
      const childEnv = { ...env, USE_DOWNLOADED_NODE: '1' };
      execSync(`"${nodeBinary}" "${viteBin}" build`, { stdio: 'inherit', env: childEnv });
      return;
    }
  }
  execSync(`node "${viteBin}" build`, { stdio: 'inherit', env });
 }
 await main();
@@ -25,7 +25,7 @@ export const MaintenanceMode: React.FC = () => {
      try {
        const response = await api.get('/public/settings');
        return response.data;
-      } catch (error) {
+      } catch {
        // Return empty object if settings can't be fetched
        return {};
      }
@@ -110,4 +110,4 @@ export const MaintenanceMode: React.FC = () => {
      )}
    </div>
  );
-};
+};
@@ -31,7 +31,7 @@ export const MaintenanceWrapper: React.FC<MaintenanceWrapperProps> = ({ children
        if (isMounted) {
          setHasAdminSession(Boolean(response.data?.valid && response.data.type === 'admin'));
        }
-      } catch (error) {
+      } catch {
        if (isMounted) {
          setHasAdminSession(false);
        }
@@ -18,11 +18,13 @@ export const AdminAuthenticatedImage: React.FC<AdminAuthenticatedImageProps> = (
  useEffect(() => {
    let cancelled = false;
    let objectUrl: string | null = null;
    const loadImage = async () => {
      try {
        setLoading(true);
        setError(false);
        setImageSrc(null);
        // Make authenticated request to get the image
        const response = await api.get(src, {
@@ -31,11 +33,11 @@ export const AdminAuthenticatedImage: React.FC<AdminAuthenticatedImageProps> = (
        if (!cancelled) {
          // Create object URL from blob
-          const imageUrl = URL.createObjectURL(response.data);
+          objectUrl = URL.createObjectURL(response.data);
-          setImageSrc(imageUrl);
+          setImageSrc(objectUrl);
          setLoading(false);
        }
-      } catch (err: any) {
+      } catch {
        // Image loading failed - handled by error state
        if (!cancelled) {
          setError(true);
@@ -51,8 +53,8 @@ export const AdminAuthenticatedImage: React.FC<AdminAuthenticatedImageProps> = (
    // Cleanup function
    return () => {
      cancelled = true;
-      if (imageSrc) {
+      if (objectUrl) {
-        URL.revokeObjectURL(imageSrc);
+        URL.revokeObjectURL(objectUrl);
      }
    };
  }, [src]);
@@ -74,4 +76,4 @@ export const AdminAuthenticatedImage: React.FC<AdminAuthenticatedImageProps> = (
  }
  return <img src={imageSrc || ''} alt={alt} {...props} />;
-};
+};
@@ -0,0 +1,77 @@
 import React, { useEffect, useState } from 'react';
 import { api } from '../../config/api';
 interface AdminAuthenticatedVideoProps extends React.VideoHTMLAttributes<HTMLVideoElement> {
  src: string;
  fallback?: React.ReactNode;
 }
 export const AdminAuthenticatedVideo: React.FC<AdminAuthenticatedVideoProps> = ({
  src,
  fallback,
  ...props
 }) => {
  const [videoSrc, setVideoSrc] = useState<string | null>(null);
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState(false);
  useEffect(() => {
    let cancelled = false;
    let objectUrl: string | null = null;
    const loadVideo = async () => {
      try {
        setLoading(true);
        setError(false);
        setVideoSrc(null);
        const response = await api.get(src, { responseType: 'blob' });
        if (!cancelled) {
          objectUrl = URL.createObjectURL(response.data);
          setVideoSrc(objectUrl);
          setLoading(false);
        }
      } catch {
        if (!cancelled) {
          setError(true);
          setLoading(false);
        }
      }
    };
    if (src) {
      loadVideo();
    }
    return () => {
      cancelled = true;
      if (objectUrl) {
        URL.revokeObjectURL(objectUrl);
      }
    };
  }, [src]);
  if (loading) {
    return <div className="w-full h-full bg-neutral-200 animate-pulse" />;
  }
  if (error || !videoSrc) {
    return fallback ? (
      <>{fallback}</>
    ) : (
      <div className="w-full h-full bg-neutral-100 flex items-center justify-center text-neutral-400">
        <span className="text-xs">Failed to load</span>
      </div>
    );
  }
  return (
    <video
      src={videoSrc}
      controls
      preload="metadata"
      {...props}
    />
  );
 };
@@ -55,12 +55,12 @@ export const AdminHeader: React.FC<AdminHeaderProps> = ({ onMenuClick }) => {
    },
  });
-  // Clear old notifications mutation
+  // Clear notifications mutation
-  const clearOldMutation = useMutation({
+  const clearAllMutation = useMutation({
-    mutationFn: notificationsService.clearOldNotifications,
+    mutationFn: notificationsService.clearAllNotifications,
    onSuccess: (data) => {
      queryClient.invalidateQueries({ queryKey: ['notifications'] });
-      toast.success(t('admin.notificationToasts.clearedOld', { count: data.deletedCount }));
+      toast.success(t('admin.notificationToasts.clearedAll', { count: data.deletedCount }));
    },
  });
@@ -128,12 +128,12 @@ export const AdminHeader: React.FC<AdminHeaderProps> = ({ onMenuClick }) => {
                        </button>
                      )}
                      <button
-                        onClick={() => clearOldMutation.mutate()}
+                        onClick={() => clearAllMutation.mutate()}
                        className="text-xs text-neutral-600 hover:text-neutral-700 flex items-center gap-1"
-                        title={t('admin.clearOld')}
+                        title={t('admin.clearAll')}
                      >
                        <Trash2 className="w-3 h-3" />
-                        {t('admin.clearOld')}
+                        {t('admin.clearAll')}
                      </button>
                    </div>
                  </div>
@@ -1,6 +1,7 @@
 import React, { useState } from 'react';
-import { Check, Download, Trash2, Eye, Package, MessageSquare, Star } from 'lucide-react';
+import { Check, Download, Trash2, Eye, Package, MessageSquare, Star, Video } from 'lucide-react';
 import { toast } from 'react-toastify';
 import { useTranslation } from 'react-i18next';
 import { AdminPhoto } from '../../services/photos.service';
 import { photosService } from '../../services/photos.service';
@@ -20,6 +21,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
  onPhotoClick,
  onPhotosDeleted
 }) => {
  const { t } = useTranslation();
  const [selectedPhotos, setSelectedPhotos] = useState<Set<number>>(new Set());
  const [isSelectionMode, setIsSelectionMode] = useState(false);
  const [isDeleting, setIsDeleting] = useState(false);
@@ -62,7 +64,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
      await photosService.deletePhoto(eventId, photo.id);
      toast.success('Photo deleted successfully');
      onPhotosDeleted();
-    } catch (error) {
+    } catch {
      toast.error('Failed to delete photo');
      setDeletingPhotos(prev => {
        const newSet = new Set(prev);
@@ -90,7 +92,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
      setSelectedPhotos(new Set());
      setIsSelectionMode(false);
      onPhotosDeleted();
-    } catch (error) {
+    } catch {
      toast.error('Failed to delete photos');
      setDeletingPhotos(new Set());
    } finally {
@@ -103,7 +105,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
    try {
      await photosService.downloadPhoto(eventId, photo.id, photo.filename);
      toast.success('Download started');
-    } catch (error) {
+    } catch {
      toast.error('Failed to download photo');
    }
  };
@@ -126,7 +128,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
            onClick={toggleSelectionMode}
            leftIcon={<Package className="w-4 h-4" />}
          >
-            {isSelectionMode ? 'Cancel Selection' : 'Select Photos'}
+            {isSelectionMode ? t('gallery.cancelSelection', 'Cancel Selection') : t('gallery.selectPhotos', 'Select Photos')}
          </Button>
          {(isSelectionMode || selectedPhotos.size > 0) && (
@@ -136,13 +138,13 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                size="sm"
                onClick={handleSelectAll}
              >
-                {selectedPhotos.size === photos.length ? 'Deselect All' : 'Select All'}
+                {selectedPhotos.size === photos.length ? t('gallery.deselectAll', 'Deselect All') : t('gallery.selectAll', 'Select All')}
              </Button>
              {selectedPhotos.size > 0 && (
                <>
                  <span className="text-sm text-neutral-600">
-                    {selectedPhotos.size} selected
+                    {t('gallery.photosSelected', { count: selectedPhotos.size })}
                  </span>
                  <button
                    onClick={handleDeleteSelected}
@@ -150,7 +152,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                    className="px-3 py-1.5 text-sm font-medium text-white bg-red-600 hover:bg-red-700 disabled:bg-red-400 rounded-lg flex items-center gap-2"
                  >
                    <Trash2 className="w-4 h-4" />
-                    Delete Selected
+                    {t('gallery.deleteSelected', 'Delete Selected')}
                  </button>
                </>
              )}
@@ -159,7 +161,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
        </div>
        <div className="text-sm text-neutral-600">
-          {photos.length} photo{photos.length !== 1 ? 's' : ''}
+          {t('gallery.photosCount', { count: photos.length })}
        </div>
      </div>
@@ -170,6 +172,9 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
          const commentCount = photo.comment_count ?? 0;
          const averageRating = photo.average_rating ?? 0;
          const likeCount = photo.like_count ?? 0;
          const isVideo = (photo.media_type === 'video') ||
            (photo.mime_type && photo.mime_type.startsWith('video/')) ||
            photo.type === 'video';
          return (
            <div
              key={photo.id}
@@ -259,6 +264,15 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
                </span>
              </div>
            )}
            {isVideo && (
              <div className="absolute bottom-2 left-2 pointer-events-none">
                <span className="px-2 py-1 text-[11px] font-semibold bg-black/70 text-white rounded flex items-center gap-1">
                  <Video className="w-3 h-3" />
                  {t('common.video', 'Video')}
                </span>
              </div>
            )}
            {/* Feedback Indicators (moved to bottom-right to avoid covering category) */}
            {(commentCount > 0 || averageRating > 0 || likeCount > 0) && (
@@ -284,7 +298,7 @@ export const AdminPhotoGrid: React.FC<AdminPhotoGridProps> = ({
      {photos.length === 0 && (
        <div className="text-center py-12">
-          <p className="text-neutral-500">No photos uploaded yet</p>
+          <p className="text-neutral-500">{t('gallery.noMedia', 'No media uploaded yet')}</p>
        </div>
      )}
    </div>
@@ -9,6 +9,7 @@ import { photosService } from '../../services/photos.service';
 import { feedbackService, type PhotoFeedback, type FeedbackSummary } from '../../services/feedback.service';
 import { Button } from '../common';
 import { AdminAuthenticatedImage } from './AdminAuthenticatedImage';
 import { AdminAuthenticatedVideo } from './AdminAuthenticatedVideo';
 type AdminFeedbackResponse = {
  feedback: PhotoFeedback[];
@@ -39,6 +40,11 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
  const queryClient = useQueryClient();
  const currentPhoto = photos[currentIndex];
  const isVideo = currentPhoto
    ? (currentPhoto.media_type === 'video' ||
      (currentPhoto.mime_type && String(currentPhoto.mime_type).startsWith('video/')) ||
      currentPhoto.type === 'video')
    : false;
  const averageRating = currentPhoto?.average_rating ?? 0;
  const likeCount = currentPhoto?.like_count ?? 0;
  const favoriteCount = currentPhoto?.favorite_count ?? 0;
@@ -109,8 +115,11 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
      await photosService.updatePhotoCategory(eventId, currentPhoto.id, categoryId);
      toast.success('Category updated');
      setShowCategoryMenu(false);
-      // Trigger refresh to update the photo data
+      // Invalidate photos query to refresh data
-      onPhotoDeleted(); // This will refresh the photos list
+      await queryClient.invalidateQueries({ queryKey: ['admin-event-photos', eventId.toString()] });
      await queryClient.invalidateQueries({ queryKey: ['admin-event-photos', eventId] });
      // Also trigger the parent's refresh callback
      onPhotoDeleted();
    } catch (error) {
      toast.error('Failed to update category');
    }
@@ -188,19 +197,35 @@ export const AdminPhotoViewer: React.FC<AdminPhotoViewerProps> = ({
      <div className="flex flex-col lg:flex-row gap-6 max-w-7xl mx-auto p-4 w-full h-full">
        {/* Image */}
        <div className="flex-1 flex items-center justify-center min-h-0">
-          <AdminAuthenticatedImage
+          {isVideo ? (
-            src={currentPhoto.url}
+            <AdminAuthenticatedVideo
-            alt={currentPhoto.filename}
+              src={currentPhoto.url}
-            className="max-w-full max-h-full object-contain"
+              className="max-w-full max-h-full bg-black"
-            fallback={
+              poster={currentPhoto.thumbnail_url || undefined}
-              <div className="flex items-center justify-center text-neutral-400">
+              fallback={
-                <div className="text-center">
+                <div className="flex items-center justify-center text-neutral-400">
-                  <Eye className="w-12 h-12 mx-auto mb-2" />
+                  <div className="text-center">
-                  <p className="text-sm">Failed to load image</p>
+                    <Eye className="w-12 h-12 mx-auto mb-2" />
                    <p className="text-sm">Failed to load media</p>
                  </div>
                </div>
-              </div>
+              }
-            }
+            />
-          />
+          ) : (
            <AdminAuthenticatedImage
              src={currentPhoto.url}
              alt={currentPhoto.filename}
              className="max-w-full max-h-full object-contain"
              fallback={
                <div className="flex items-center justify-center text-neutral-400">
                  <div className="text-center">
                    <Eye className="w-12 h-12 mx-auto mb-2" />
                    <p className="text-sm">Failed to load image</p>
                  </div>
                </div>
              }
            />
          )}
        </div>
        {/* Sidebar */}
@@ -1,16 +1,20 @@
 import React from 'react';
 import { Search, Filter, SortAsc, SortDesc } from 'lucide-react';
 import { Input } from '../common';
 import { useTranslation } from 'react-i18next';
 interface PhotoFiltersProps {
-  categories: Array<{ id: number; name: string; slug: string }>;
+  categories: Array<{ id: number | string; name: string; slug: string }>;
-  selectedCategory: number | null | undefined;
+  selectedCategory: number | string | null | undefined;
  searchTerm: string;
  sortBy: 'date' | 'name' | 'size' | 'rating';
  sortOrder: 'asc' | 'desc';
-  onCategoryChange: (categoryId: number | null | undefined) => void;
+  onCategoryChange: (categoryId: number | string | null | undefined) => void;
  onSearchChange: (search: string) => void;
  onSortChange: (sort: 'date' | 'name' | 'size' | 'rating', order: 'asc' | 'desc') => void;
  mediaType?: 'all' | 'photo' | 'video';
  onMediaTypeChange?: (mediaType: 'all' | 'photo' | 'video') => void;
  showMediaFilter?: boolean;
 }
 export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
@@ -21,8 +25,12 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
  sortOrder,
  onCategoryChange,
  onSearchChange,
-  onSortChange
+  onSortChange,
  mediaType = 'all',
  onMediaTypeChange,
  showMediaFilter = false
 }) => {
  const { t } = useTranslation();
  const handleSortToggle = () => {
    onSortChange(sortBy, sortOrder === 'asc' ? 'desc' : 'asc');
  };
@@ -34,7 +42,7 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
        <div className="flex-1">
          <Input
            type="text"
-            placeholder="Search by filename..."
+            placeholder={t('gallery.searchByFilename', 'Search by filename...')}
            value={searchTerm}
            onChange={(e) => onSearchChange(e.target.value)}
            leftIcon={<Search className="w-5 h-5 text-neutral-400" />}
@@ -46,11 +54,16 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
          <Filter className="w-5 h-5 text-neutral-400" />
          <select
            value={selectedCategory === null ? '' : selectedCategory || ''}
-            onChange={(e) => onCategoryChange(e.target.value === '' ? null : Number(e.target.value) || undefined)}
+            onChange={(e) => {
              const raw = e.target.value;
              if (raw === '') return onCategoryChange(null);
              const numeric = Number(raw);
              onCategoryChange(Number.isNaN(numeric) ? raw : numeric);
            }}
            className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
          >
-            <option value="">All Categories</option>
+            <option value="">{t('gallery.allCategories', 'All Categories')}</option>
-            <option value="0">Uncategorized</option>
+            <option value="0">{t('gallery.uncategorized', 'Uncategorized')}</option>
            {categories.map(cat => (
              <option key={cat.id} value={cat.id}>
                {cat.name}
@@ -59,6 +72,21 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
          </select>
        </div>
        {showMediaFilter && onMediaTypeChange && (
          <div className="flex items-center gap-2">
            <Filter className="w-5 h-5 text-neutral-400" />
            <select
              value={mediaType}
              onChange={(e) => onMediaTypeChange(e.target.value as 'all' | 'photo' | 'video')}
              className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
            >
              <option value="all">{t('gallery.allMedia', 'All media')}</option>
              <option value="photo">{t('gallery.photosOnly', 'Photos only')}</option>
              <option value="video">{t('gallery.videosOnly', 'Videos only')}</option>
            </select>
          </div>
        )}
        {/* Sort Options */}
        <div className="flex items-center gap-2">
          <select
@@ -66,16 +94,16 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
            onChange={(e) => onSortChange(e.target.value as 'date' | 'name' | 'size' | 'rating', sortOrder)}
            className="px-3 py-2 border border-neutral-300 rounded-lg focus:ring-2 focus:ring-primary-500 focus:border-primary-500"
          >
-            <option value="date">Sort by Date</option>
+            <option value="date">{t('gallery.sortByDate', 'Sort by Date')}</option>
-            <option value="name">Sort by Name</option>
+            <option value="name">{t('gallery.sortByName', 'Sort by Name')}</option>
-            <option value="size">Sort by Size</option>
+            <option value="size">{t('gallery.sortBySize', 'Sort by Size')}</option>
-            <option value="rating">Sort by Rating</option>
+            <option value="rating">{t('gallery.sortByRating', 'Sort by Rating')}</option>
          </select>
          <button
            onClick={handleSortToggle}
            className="p-2 border border-neutral-300 rounded-lg hover:bg-neutral-50 transition-colors"
-            aria-label={sortOrder === 'asc' ? 'Sort descending' : 'Sort ascending'}
+            aria-label={sortOrder === 'asc' ? t('gallery.sortDescending', 'Sort descending') : t('gallery.sortAscending', 'Sort ascending')}
          >
            {sortOrder === 'asc' ? (
              <SortAsc className="w-5 h-5 text-neutral-600" />
@@ -87,4 +115,4 @@ export const PhotoFilters: React.FC<PhotoFiltersProps> = ({
      </div>
    </div>
  );
-};
+};
@@ -6,6 +6,7 @@ import { api } from '../../config/api';
 import { toast } from 'react-toastify';
 import { useQuery } from '@tanstack/react-query';
 import { categoriesService } from '../../services/categories.service';
 import { settingsService } from '../../services/settings.service';
 import { useTranslation } from 'react-i18next';
 interface PhotoUploadProps {
@@ -13,6 +14,9 @@ interface PhotoUploadProps {
  onUploadComplete?: () => void;
 }
 const DEFAULT_MAX_FILES_PER_UPLOAD = 500;
 const MAX_FILES_PER_UPLOAD_LIMIT = 2000;
 export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadComplete }) => {
  const { t } = useTranslation();
  const [isUploading, setIsUploading] = useState(false);
@@ -29,6 +33,22 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
    queryFn: () => categoriesService.getEventCategories(eventId),
  });
  const { data: settings } = useQuery({
    queryKey: ['admin-settings'],
    queryFn: () => settingsService.getAllSettings(),
  });
  const maxFilesPerUpload = React.useMemo(() => {
    const rawValue = settings?.general_max_files_per_upload;
    const parsed = Number(rawValue);
    if (!Number.isFinite(parsed)) {
      return DEFAULT_MAX_FILES_PER_UPLOAD;
    }
    return Math.min(MAX_FILES_PER_UPLOAD_LIMIT, Math.max(1, Math.floor(parsed)));
  }, [settings]);
  const remainingSlots = Math.max(maxFilesPerUpload - selectedFiles.length, 0);
  const handleFileSelect = (e: React.ChangeEvent<HTMLInputElement>) => {
    const files = Array.from(e.target.files || []);
    const imageFiles = files.filter(file => 
@@ -37,13 +57,19 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
    // Check total file count with existing files
    const totalFiles = selectedFiles.length + imageFiles.length;
-    if (totalFiles > 500) {
+    if (totalFiles > maxFilesPerUpload) {
-      const allowedNewFiles = 500 - selectedFiles.length;
+      const allowedNewFiles = maxFilesPerUpload - selectedFiles.length;
      if (allowedNewFiles <= 0) {
-        toast.error(t('upload.maxFilesReached') || 'Maximum 500 files allowed');
+        toast.error(
          t('upload.maxFilesReached', { limit: maxFilesPerUpload }) ||
          `Maximum ${maxFilesPerUpload} files allowed`
        );
        return;
      }
-      toast.warning(t('upload.someFilesSkipped') || `Only ${allowedNewFiles} more files can be added (500 max)`);
+      toast.warning(
        t('upload.someFilesSkipped', { allowed: allowedNewFiles, limit: maxFilesPerUpload }) ||
        `Only ${allowedNewFiles} more files can be added (limit ${maxFilesPerUpload})`
      );
      setSelectedFiles(prev => [...prev, ...imageFiles.slice(0, allowedNewFiles)]);
      return;
    }
@@ -59,8 +85,11 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
    if (selectedFiles.length === 0) return;
    // Validate file count
-    if (selectedFiles.length > 500) {
+    if (selectedFiles.length > maxFilesPerUpload) {
-      toast.error(t('upload.tooManyFiles') || 'Maximum 500 files can be uploaded at once');
+      toast.error(
        t('upload.tooManyFiles', { limit: maxFilesPerUpload }) ||
        `Maximum ${maxFilesPerUpload} files can be uploaded at once`
      );
      return;
    }
@@ -68,7 +97,7 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
    setUploadProgress(0);
    // For large uploads, chunk the files to prevent memory issues
-    const CHUNK_SIZE = 50; // Upload 50 files at a time
+    const CHUNK_SIZE = Math.max(1, Math.min(50, maxFilesPerUpload)); // Upload up to 50 (or limit) files at a time
    const chunks = [];
    for (let i = 0; i < selectedFiles.length; i += CHUNK_SIZE) {
@@ -187,13 +216,27 @@ export const PhotoUpload: React.FC<PhotoUploadProps> = ({ eventId, onUploadCompl
          {t('upload.clickToUpload')}
        </p>
        <p className="text-sm text-neutral-500">
-          {t('upload.fileRequirements')}
+          {t('upload.fileRequirements', { limit: maxFilesPerUpload })}
        </p>
        <p
          className={clsx(
            "text-xs mt-2",
            remainingSlots === 0 ? "text-red-600" : "text-neutral-500"
          )}
        >
          {remainingSlots === 0
            ? t('upload.limitReached', { limit: maxFilesPerUpload })
            : t('upload.limitInfo', {
                selected: selectedFiles.length,
                limit: maxFilesPerUpload,
                remaining: remainingSlots,
              })}
        </p>
        <input
          ref={fileInputRef}
          type="file"
          multiple
-          accept="image/jpeg,image/png,image/webp"
+          accept="image/jpeg,image/png,image/webp,video/mp4,video/webm,video/quicktime,video/x-msvideo"
          onChange={handleFileSelect}
          className="hidden"
        />
@@ -33,7 +33,7 @@ export const PhotoUploadModal: React.FC<PhotoUploadModalProps> = ({
      <div className="bg-white rounded-lg shadow-xl w-full max-w-2xl flex flex-col max-h-[90vh]">
        {/* Fixed Header */}
        <div className="flex items-center justify-between p-6 border-b border-neutral-200">
-          <h2 className="text-xl font-semibold text-neutral-900">{t('events.uploadPhotos')}</h2>
+          <h2 className="text-xl font-semibold text-neutral-900">{t('upload.uploadMedia', t('events.uploadPhotos'))}</h2>
          <Button
            variant="ghost"
            size="sm"
@@ -56,4 +56,4 @@ export const PhotoUploadModal: React.FC<PhotoUploadModalProps> = ({
  );
 };
-PhotoUploadModal.displayName = 'PhotoUploadModal';
+PhotoUploadModal.displayName = 'PhotoUploadModal';
@@ -14,6 +14,8 @@ interface ThemeCustomizerEnhancedProps {
  isPreviewMode?: boolean;
  showGalleryLayouts?: boolean;
  hideActions?: boolean;
  onApply?: (theme: ThemeConfig, metadata: { presetName: string }) => Promise<void> | void;
  isApplying?: boolean;
 }
 const layoutIcons: Record<GalleryLayoutType, React.ReactNode> = {
@@ -34,7 +36,9 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
  onPresetChange,
  isPreviewMode = false,
  showGalleryLayouts = true,
-  hideActions = false
+  hideActions = false,
  onApply,
  isApplying = false
 }) => {
  const { t } = useTranslation();
  const [localTheme, setLocalTheme] = useState<ThemeConfig>(value);
@@ -80,8 +84,13 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
    }
  };
-  const handleApply = () => {
+  const handleApply = async () => {
-    onChange({ ...localTheme, customCss });
+    const themeWithCss = { ...localTheme, customCss };
    onChange(themeWithCss);
    if (onApply) {
      await onApply(themeWithCss, { presetName: selectedPreset });
    }
  };
  const handleReset = () => {
@@ -587,11 +596,12 @@ export const ThemeCustomizerEnhanced: React.FC<ThemeCustomizerEnhancedProps> = (
            variant="primary"
            leftIcon={<Palette className="w-4 h-4" />}
            onClick={handleApply}
            disabled={isApplying}
          >
-            {t('branding.applyTheme')}
+            {isApplying ? t('common.applying', 'Applying...') : t('branding.applyTheme')}
          </Button>
        </div>
      )}
    </div>
  );
-};
+};
@@ -0,0 +1,70 @@
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { vi } from 'vitest';
 import { ThemeCustomizerEnhanced } from '../ThemeCustomizerEnhanced';
 import type { ThemeConfig } from '../../../types/theme.types';
 vi.mock('react-i18next', async () => {
  const actual = await vi.importActual<typeof import('react-i18next')>('react-i18next');
  return {
    ...actual,
    useTranslation: () => ({
      t: (_key: string, fallback?: string) => fallback ?? _key
    })
  };
 });
 describe('ThemeCustomizerEnhanced', () => {
  const baseTheme: ThemeConfig = {
    primaryColor: '#000000',
    accentColor: '#ffffff',
    backgroundColor: '#eeeeee',
    textColor: '#111111',
    galleryLayout: 'grid',
    gallerySettings: {
      spacing: 'normal'
    }
  };
  it('invokes onApply when Apply Theme is clicked', async () => {
    const user = userEvent.setup();
    const handleChange = vi.fn();
    const handleApply = vi.fn().mockResolvedValue(undefined);
    render(
      <ThemeCustomizerEnhanced
        value={baseTheme}
        onChange={handleChange}
        presetName="default"
        onApply={handleApply}
      />
    );
    const applyButton = screen.getByRole('button', { name: /branding\.applyTheme/i });
    await user.click(applyButton);
    expect(handleChange).toHaveBeenCalled();
    expect(handleApply).toHaveBeenCalledTimes(1);
    expect(handleApply).toHaveBeenCalledWith(
      expect.objectContaining({ primaryColor: '#000000' }),
      expect.objectContaining({ presetName: 'default' })
    );
  });
  it('disables the Apply button while applying', () => {
    const handleChange = vi.fn();
    render(
      <ThemeCustomizerEnhanced
        value={baseTheme}
        onChange={handleChange}
        presetName="default"
        isApplying={true}
      />
    );
    const applyButton = screen.getByRole('button', { name: /applying/i });
    expect(applyButton).toBeDisabled();
  });
 });
@@ -17,6 +17,7 @@ export { AdminPhotoViewer } from './AdminPhotoViewer';
 export { PhotoFilters } from './PhotoFilters';
 export { PasswordResetModal } from './PasswordResetModal';
 export { AdminAuthenticatedImage } from './AdminAuthenticatedImage';
 export { AdminAuthenticatedVideo } from './AdminAuthenticatedVideo';
 export { ThemeCustomizerEnhanced } from './ThemeCustomizerEnhanced';
 export { ThemeDisplay } from './ThemeDisplay';
 export { ThemeEditorModal } from './ThemeEditorModal';
@@ -29,4 +30,4 @@ export { BackupHistory } from './BackupHistory';
 export { RestoreWizard } from './RestoreWizard';
 export { FeedbackSettings } from './FeedbackSettings';
 export { FeedbackModerationPanel } from './FeedbackModerationPanel';
-export { WordFilterManager } from './WordFilterManager';
+export { WordFilterManager } from './WordFilterManager';
@@ -1,5 +1,11 @@
 import React, { useState, useEffect } from 'react';
 import { buildResourceUrl } from '../../utils/url';
 import {
  getActiveGallerySlug,
  getGalleryToken,
  inferGallerySlugFromLocation,
  resolveSlugFromRequestUrl,
 } from '../../utils/galleryAuthStorage';
 interface AuthenticatedImageProps extends React.ImgHTMLAttributes<HTMLImageElement> {
  src: string;
@@ -52,7 +58,6 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
 }) => {
  const unusedProps = {
    protectFromDownload,
    slug,
    photoId,
    requiresToken,
    secureUrlTemplate,
@@ -76,7 +81,8 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
  const [isLoading, setIsLoading] = useState(true);
  useEffect(() => {
-    let objectUrl: string | null = null;
+    let aborted = false;
    const objectUrls: string[] = [];
    // Determine which token to use based on context
    if (!src) {
@@ -88,37 +94,79 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
    setIsLoading(true);
    setError(false);
-    // Create a new URL with auth header
+    const resolveSlug = (candidateSrc?: string): string | null => {
      if (slug) {
        return slug;
      }
      const fromUrl = candidateSrc ? resolveSlugFromRequestUrl(candidateSrc) : null;
      if (fromUrl) {
        return fromUrl;
      }
      return getActiveGallerySlug() || inferGallerySlugFromLocation();
    };
    const fetchWithAuth = async (rawUrl: string | undefined | null): Promise<string> => {
      if (!rawUrl) {
        throw new Error('No URL provided');
      }
      // Build full URL for the image
      const fullImageUrl = rawUrl.startsWith('/admin')
        ? buildResourceUrl(`/api${rawUrl}`)
        : rawUrl.startsWith('/')
          ? buildResourceUrl(rawUrl)
          : rawUrl;
      const headers: Record<string, string> = {};
      const slugForRequest = resolveSlug(rawUrl);
      const token = getGalleryToken(slugForRequest);
      if (token) {
        headers.Authorization = `Bearer ${token}`;
      }
      const response = await fetch(fullImageUrl, {
        credentials: 'include',
        headers: Object.keys(headers).length ? headers : undefined,
      });
      if (!response.ok) {
        throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
      }
      const blob = await response.blob();
      const objectUrl = URL.createObjectURL(blob);
      objectUrls.push(objectUrl);
      return objectUrl;
    };
    const fetchImage = async () => {
      try {
-        // Use the src as-is since it should already be the correct endpoint
+        const primaryUrl = await fetchWithAuth(src);
-        let imageUrl = src;
+        if (!aborted) {
-        
+          setImageSrc(primaryUrl);
-        // Build full URL for the image
+          setError(false);
        // For API paths that start with /admin, we need to prepend /api
        const fullImageUrl = imageUrl.startsWith('/admin') 
          ? buildResourceUrl(`/api${imageUrl}`)
          : imageUrl.startsWith('/') 
          ? buildResourceUrl(imageUrl) 
          : imageUrl;
        // Fetch authenticated image
        const response = await fetch(fullImageUrl, {
          credentials: 'include'
        });
        if (!response.ok) {
          throw new Error(`Failed to fetch image: ${response.status} ${response.statusText}`);
        }
        const blob = await response.blob();
        objectUrl = URL.createObjectURL(blob);
        setImageSrc(objectUrl);
        setIsLoading(false);
      } catch (err) {
-        // Image loading failed - use fallback
+        setIsLoading(false);
-        setError(true);
+        if (fallbackSrc && fallbackSrc !== src) {
-        setImageSrc(fallbackSrc || '');
+          try {
            const fallbackUrl = await fetchWithAuth(fallbackSrc);
            if (!aborted) {
              setImageSrc(fallbackUrl);
              setError(false);
            }
            return;
          } catch (fallbackError) {
            // Swallow and mark error below
          }
        }
        if (!aborted) {
          setError(true);
          setImageSrc('');
        }
        return;
      }
      if (!aborted) {
        setIsLoading(false);
      }
    };
@@ -127,11 +175,11 @@ export const AuthenticatedImage: React.FC<AuthenticatedImageProps> = ({
    // Cleanup function
    return () => {
-      if (objectUrl) {
+      aborted = true;
-        URL.revokeObjectURL(objectUrl);
+      objectUrls.forEach((url) => URL.revokeObjectURL(url));
      }
    };
-  }, [src, fallbackSrc, useWatermark, isGallery]);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, [src, fallbackSrc, slug]);
  if (isLoading) {
    return (
@@ -0,0 +1,125 @@
 import React, { useEffect, useState } from 'react';
 import { buildResourceUrl } from '../../utils/url';
 import {
  getActiveGallerySlug,
  getGalleryToken,
  inferGallerySlugFromLocation,
  resolveSlugFromRequestUrl,
 } from '../../utils/galleryAuthStorage';
 interface AuthenticatedVideoProps extends React.VideoHTMLAttributes<HTMLVideoElement> {
  src: string;
  fallbackSrc?: string;
  slug?: string;
 }
 export const AuthenticatedVideo: React.FC<AuthenticatedVideoProps> = ({
  src,
  fallbackSrc,
  slug,
  ...props
 }) => {
  const [videoSrc, setVideoSrc] = useState<string>('');
  const [error, setError] = useState(false);
  useEffect(() => {
    let aborted = false;
    const objectUrls: string[] = [];
    if (!src) {
      setVideoSrc('');
      setError(true);
      return;
    }
    const resolveSlug = (candidateSrc?: string): string | null => {
      if (slug) {
        return slug;
      }
      const fromUrl = candidateSrc ? resolveSlugFromRequestUrl(candidateSrc) : null;
      if (fromUrl) {
        return fromUrl;
      }
      return getActiveGallerySlug() || inferGallerySlugFromLocation();
    };
    const fetchWithAuth = async (rawUrl: string | undefined | null): Promise<string> => {
      if (!rawUrl) {
        throw new Error('No URL provided');
      }
      const fullUrl = rawUrl.startsWith('/')
        ? buildResourceUrl(rawUrl)
        : rawUrl;
      const headers: Record<string, string> = {};
      const slugForRequest = resolveSlug(rawUrl);
      const token = getGalleryToken(slugForRequest);
      if (token) {
        headers.Authorization = `Bearer ${token}`;
      }
      const response = await fetch(fullUrl, {
        credentials: 'include',
        headers: Object.keys(headers).length ? headers : undefined,
      });
      if (!response.ok) {
        throw new Error(`Failed to fetch media: ${response.status} ${response.statusText}`);
      }
      const blob = await response.blob();
      const objectUrl = URL.createObjectURL(blob);
      objectUrls.push(objectUrl);
      return objectUrl;
    };
    const load = async () => {
      try {
        const primaryUrl = await fetchWithAuth(src);
        if (!aborted) {
          setVideoSrc(primaryUrl);
          setError(false);
        }
      } catch (err) {
        if (fallbackSrc && fallbackSrc !== src) {
          try {
            const fallbackUrl = await fetchWithAuth(fallbackSrc);
            if (!aborted) {
              setVideoSrc(fallbackUrl);
              setError(false);
            }
            return;
          } catch (_) {
            // ignore and set error below
          }
        }
        if (!aborted) {
          setError(true);
          setVideoSrc('');
        }
      }
    };
    load();
    return () => {
      aborted = true;
      objectUrls.forEach((url) => URL.revokeObjectURL(url));
    };
    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, [src, fallbackSrc, slug]);
  if (error || !videoSrc) {
    return null;
  }
  return (
    <video
      src={videoSrc}
      controls
      preload="metadata"
      {...props}
    />
  );
 };
@@ -16,7 +16,8 @@ export { SkipLink } from './SkipLink';
 export { DynamicFavicon } from './DynamicFavicon';
 export { LanguageSelector } from './LanguageSelector';
 export { AuthenticatedImage } from './AuthenticatedImage';
 export { AuthenticatedVideo } from './AuthenticatedVideo';
 export { ProtectedImage } from './ProtectedImage';
 export { ProtectionWarning } from './ProtectionWarning';
 export { ReCaptcha } from './ReCaptcha';
-export { PasswordGenerator } from './PasswordGenerator';
+export { PasswordGenerator } from './PasswordGenerator';
@@ -29,6 +29,7 @@ interface GalleryLayoutProps {
    logo_display_header?: boolean;
    logo_display_hero?: boolean;
    logo_display_mode?: 'logo_only' | 'text_only' | 'logo_and_text';
    hide_powered_by?: boolean;
  };
  showLogout?: boolean;
  onLogout?: () => void;
@@ -438,7 +439,10 @@ export const GalleryLayout: React.FC<GalleryLayoutProps> = ({
            </p>
          )}
          <p className="text-xs sm:text-sm text-neutral-500">
-            {brandingSettings?.footer_text || '© 2024 Your Company. All rights reserved.'} | Powered by <span className="font-semibold">PicPeak</span>
+            {brandingSettings?.footer_text || '© 2024 Your Company. All rights reserved.'}
            {!brandingSettings?.hide_powered_by && (
              <> | Powered by <span className="font-semibold">PicPeak</span></>
            )}
          </p>
          {brandingSettings?.company_name && brandingSettings?.company_tagline && (
            <p className="text-xs text-neutral-400 mt-2">
@@ -9,8 +9,8 @@ interface GallerySidebarProps {
  isOpen: boolean;
  onClose: () => void;
  categories: PhotoCategory[];
-  selectedCategoryId: number | null;
+  selectedCategoryId: number | string | null;
-  onCategoryChange: (categoryId: number | null) => void;
+  onCategoryChange: (categoryId: number | string | null) => void;
  searchTerm: string;
  onSearchChange: (term: string) => void;
  sortBy: 'date' | 'name' | 'size' | 'rating';
@@ -22,7 +22,7 @@ interface GallerySidebarProps {
  onDownloadSelected: () => void;
  isDownloading: boolean;
  allowDownloads?: boolean;
-  photoCounts?: Record<number, number>;
+  photoCounts?: Record<number | string, number>;
  totalPhotos: number;
  isMobile: boolean;
  galleryLayout?: string;
@@ -34,6 +34,9 @@ interface GallerySidebarProps {
  likeCount?: number;
  favoriteCount?: number;
  ratedCount?: number;
  mediaFilter?: 'all' | 'photo' | 'video';
  onMediaFilterChange?: (filter: 'all' | 'photo' | 'video') => void;
  showMediaFilter?: boolean;
 }
 export const GallerySidebar: React.FC<GallerySidebarProps> = ({
@@ -64,7 +67,10 @@ export const GallerySidebar: React.FC<GallerySidebarProps> = ({
  onFilterChange,
  likeCount = 0,
  favoriteCount = 0,
-  ratedCount = 0
+  ratedCount = 0,
  mediaFilter = 'all',
  onMediaFilterChange,
  showMediaFilter = false
 }) => {
  const { t } = useTranslation();
  const sidebarRef = useRef<HTMLDivElement>(null);
@@ -288,6 +294,47 @@ export const GallerySidebar: React.FC<GallerySidebarProps> = ({
            </div>
          )}
          {showMediaFilter && onMediaFilterChange && (
            <div className="p-4 border-b border-neutral-200">
              <h3 className="text-sm font-semibold text-neutral-700 mb-3 flex items-center gap-2">
                <Filter className="w-4 h-4" />
                {t('gallery.mediaType', 'Media')}
              </h3>
              <div className="flex items-center gap-2 flex-wrap">
                <Button
                  variant={mediaFilter === 'all' ? 'primary' : 'outline'}
                  size="sm"
                  onClick={() => {
                    onMediaFilterChange('all');
                    if (isMobile) onClose();
                  }}
                >
                  {t('gallery.allMedia', 'All')}
                </Button>
                <Button
                  variant={mediaFilter === 'photo' ? 'primary' : 'outline'}
                  size="sm"
                  onClick={() => {
                    onMediaFilterChange('photo');
                    if (isMobile) onClose();
                  }}
                >
                  {t('gallery.photosOnly', 'Photos')}
                </Button>
                <Button
                  variant={mediaFilter === 'video' ? 'primary' : 'outline'}
                  size="sm"
                  onClick={() => {
                    onMediaFilterChange('video');
                    if (isMobile) onClose();
                  }}
                >
                  {t('gallery.videosOnly', 'Videos')}
                </Button>
              </div>
            </div>
          )}
          {/* Sort Section - Hidden for carousel and timeline layouts */}
          {galleryLayout !== 'carousel' && galleryLayout !== 'timeline' && (
            <div className="p-4">
@@ -44,7 +44,7 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
  const { t } = useTranslation();
  const { logout } = useGalleryAuth();
  const { setTheme, theme } = useTheme();
-  const [selectedCategoryId, setSelectedCategoryId] = useState<number | null>(null);
+  const [selectedCategoryId, setSelectedCategoryId] = useState<number | string | null>(null);
  const [searchTerm, setSearchTerm] = useState('');
  const [sortBy, setSortBy] = useState<'date' | 'name' | 'size' | 'rating'>('date');
  const [brandingSettings, setBrandingSettings] = useState<any>(null);
@@ -57,8 +57,22 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
  const { watermarkEnabled } = useWatermarkSettings();
  const [protectionLevel, setProtectionLevel] = useState<'basic' | 'standard' | 'enhanced' | 'maximum'>('standard');
  const [filterType, setFilterType] = useState<FilterType>('all');
  const [mediaFilter, setMediaFilter] = useState<'all' | 'photo' | 'video'>('all');
  const [guestId, setGuestId] = useState<string>('');
  const [staticHeroPhoto, setStaticHeroPhoto] = useState<Photo | null>(null);
  const resolveMediaType = (photo: Photo) => {
    if (photo.media_type === 'video' || photo.media_type === 'photo') {
      return photo.media_type;
    }
    if (photo.mime_type && photo.mime_type.startsWith('video/')) {
      return 'video';
    }
    if ((photo as any).type === 'video') {
      return 'video';
    }
    return 'photo';
  };
  // Generate a unique guest ID for this session
  useEffect(() => {
@@ -71,8 +85,9 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
    setGuestId(storedGuestId);
  }, []);
-  // Fetch photos with filter support
+  // Fetch photos WITHOUT filter (always get all photos, filter on frontend)
-  const { data, isLoading, error, refetch } = useGalleryPhotos(slug, filterType, guestId);
+  // This ensures counts are always calculated from the full dataset
  const { data, isLoading, error, refetch } = useGalleryPhotos(slug, 'all', guestId);
  // Set protection level when data is available
  useEffect(() => {
@@ -164,10 +179,36 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
        footer_text: settingsData.branding_footer_text || '© 2024 Your Company. All rights reserved.',
        watermark_enabled: settingsData.branding_watermark_enabled || false,
        logo_url: settingsData.branding_logo_url || null,
        logo_size: settingsData.branding_logo_size || 'medium',
        logo_max_height: settingsData.branding_logo_max_height || 48,
        logo_position: settingsData.branding_logo_position || 'left',
        logo_display_header: settingsData.branding_logo_display_header !== false,
        logo_display_hero: settingsData.branding_logo_display_hero !== false,
        logo_display_mode: settingsData.branding_logo_display_mode || 'logo_and_text',
        hide_powered_by: settingsData.branding_hide_powered_by === true,
      });
    }
  }, [settingsData]);
  const availableMediaTypes = useMemo(() => {
    const types = new Set<'photo' | 'video'>();
    (data?.photos || []).forEach((photo) => {
      const mediaType = resolveMediaType(photo);
      if (mediaType === 'photo' || mediaType === 'video') {
        types.add(mediaType);
      }
    });
    return types;
  }, [data?.photos]);
  const showMediaFilter = availableMediaTypes.has('photo') && availableMediaTypes.has('video');
  useEffect(() => {
    if (!showMediaFilter && mediaFilter !== 'all') {
      setMediaFilter('all');
    }
  }, [showMediaFilter, mediaFilter]);
  // Determine a stable hero photo from the initial (unfiltered) load
  useEffect(() => {
    if (!staticHeroPhoto && data?.photos && filterType === 'all') {
@@ -177,7 +218,8 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
        hero = data.photos.find(p => p.id === heroId) || null;
      }
      if (!hero && data.photos.length > 0) {
-        hero = data.photos[0];
+        const firstPhoto = data.photos.find(p => resolveMediaType(p) === 'photo');
        hero = firstPhoto || data.photos[0];
      }
      if (hero) {
        setStaticHeroPhoto(hero);
@@ -209,7 +251,7 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
              }
            }
          }
-        } catch (e) {
+        } catch {
          // Invalid theme format - use default
          // Fall back to global theme
          if (settingsData.theme_config) {
@@ -251,6 +293,12 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
    if (!data?.photos) return [];
    let photos = [...data.photos];
    if (mediaFilter === 'photo') {
      photos = photos.filter(photo => resolveMediaType(photo) !== 'video');
    } else if (mediaFilter === 'video') {
      photos = photos.filter(photo => resolveMediaType(photo) === 'video');
    }
    // Apply category filter
    if (selectedCategoryId) {
@@ -315,7 +363,7 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
    }
    return photos;
-  }, [data?.photos, selectedCategoryId, searchTerm, sortBy, watermarkEnabled, slug, filterType]);
+  }, [data?.photos, selectedCategoryId, searchTerm, sortBy, watermarkEnabled, slug, filterType, mediaFilter]);
  const likeCount = useMemo(
    () => data?.photos?.filter(p => (p.like_count ?? 0) > 0).length || 0,
@@ -380,14 +428,20 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
  // Calculate photo counts per category
  const photoCounts = useMemo(() => {
    if (!data?.photos) return {};
-    const counts: Record<number, number> = {};
+    const counts: Record<number | string, number> = {};
-    data.photos.forEach(photo => {
+    data.photos
      .filter(photo => {
        if (mediaFilter === 'photo') return resolveMediaType(photo) !== 'video';
        if (mediaFilter === 'video') return resolveMediaType(photo) === 'video';
        return true;
      })
      .forEach(photo => {
      if (photo.category_id) {
        counts[photo.category_id] = (counts[photo.category_id] || 0) + 1;
      }
    });
    return counts;
-  }, [data?.photos]);
+  }, [data?.photos, mediaFilter]);
  // Track search usage with debouncing
  useEffect(() => {
@@ -489,6 +543,9 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
          feedbackEnabled={feedbackEnabled}
          filterType={filterType}
          onFilterChange={setFilterType}
          mediaFilter={mediaFilter}
          onMediaFilterChange={setMediaFilter}
          showMediaFilter={showMediaFilter}
          likeCount={likeCount}
          favoriteCount={favoriteCount}
          ratedCount={ratedCount}
@@ -574,16 +631,19 @@ export const GalleryView: React.FC<GalleryViewProps> = ({ slug, event }) => {
              onCategoryChange={setSelectedCategoryId}
              searchTerm={searchTerm}
              onSearchChange={setSearchTerm}
-              sortBy={sortBy}
+            sortBy={sortBy}
-              onSortChange={setSortBy}
+            onSortChange={setSortBy}
-              photoCount={filteredPhotos.length}
+            photoCount={filteredPhotos.length}
-              // Feedback filter props
+            // Feedback filter props
-              feedbackEnabled={feedbackEnabled}
+            feedbackEnabled={feedbackEnabled}
-              currentFilter={filterType}
+            currentFilter={filterType}
-              onFilterChange={setFilterType}
+            onFilterChange={setFilterType}
-            />
+            mediaFilter={mediaFilter}
-          </div>
+            onMediaFilterChange={setMediaFilter}
-        ) : null}
+            showMediaFilter={showMediaFilter}
          />
        </div>
      ) : null}
        {/* Photo Grid */}
        <div className={showSidebar ? "mt-6" : "mt-6"}>
@@ -32,6 +32,9 @@ interface PhotoFilterBarProps {
  feedbackEnabled?: boolean;
  currentFilter?: FilterType;
  onFilterChange?: (filter: FilterType) => void;
  mediaFilter?: 'all' | 'photo' | 'video';
  onMediaFilterChange?: (filter: 'all' | 'photo' | 'video') => void;
  showMediaFilter?: boolean;
 }
 export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
@@ -47,6 +50,9 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
  feedbackEnabled = false,
  currentFilter = 'all',
  onFilterChange,
  mediaFilter = 'all',
  onMediaFilterChange,
  showMediaFilter = false
 }) => {
  const { t } = useTranslation();
  const [showSortMenu, setShowSortMenu] = useState(false);
@@ -148,7 +154,7 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
                  leftIcon={<Grid className="w-3 h-3 md:w-4 md:h-4" />}
                  className="text-xs md:text-sm whitespace-nowrap flex-shrink-0"
                >
-                  {t('gallery.allPhotos')} ({photos.length})
+                  {showMediaFilter ? t('gallery.allMedia', 'All media') : t('gallery.allPhotos')} ({photos.length})
                </Button>
                {categories.map((category) => {
                  const categoryPhotoCount = photos.filter(p => p.category_id === category.id).length;
@@ -226,10 +232,44 @@ export const PhotoFilterBar: React.FC<PhotoFilterBarProps> = ({
            )}
            <p className="text-xs md:text-sm text-neutral-600 flex-shrink-0 ml-auto">
-              {photoCount} {photoCount === 1 ? t('common.photo') : t('common.photos')}
+              {photoCount} {t('common.media', 'media')}
            </p>
          </div>
        )}
        {showMediaFilter && onMediaFilterChange && (
          <div className="flex items-center gap-2 flex-wrap">
            <span className="text-xs md:text-sm text-neutral-600 whitespace-nowrap">
              {t('gallery.mediaType', 'Media')}
            </span>
            <div className="flex items-center gap-2">
              <Button
                variant={mediaFilter === 'all' ? 'primary' : 'outline'}
                size="sm"
                onClick={() => onMediaFilterChange('all')}
                className="text-xs md:text-sm"
              >
                {t('gallery.allMedia', 'All')}
              </Button>
              <Button
                variant={mediaFilter === 'photo' ? 'primary' : 'outline'}
                size="sm"
                onClick={() => onMediaFilterChange('photo')}
                className="text-xs md:text-sm"
              >
                {t('gallery.photosOnly', 'Photos')}
              </Button>
              <Button
                variant={mediaFilter === 'video' ? 'primary' : 'outline'}
                size="sm"
                onClick={() => onMediaFilterChange('video')}
                className="text-xs md:text-sm"
              >
                {t('gallery.videosOnly', 'Videos')}
              </Button>
            </div>
          </div>
        )}
        {/* Mobile/Tablet: compact horizontal icons with headline below categories */}
        {feedbackEnabled && onFilterChange && (
@@ -1,5 +1,5 @@
 import React, { useState, useEffect } from 'react';
-import { Download, Maximize2, Check, Package, MessageSquare, Star } from 'lucide-react';
+import { Download, Maximize2, Check, Package, MessageSquare, Star, Play } from 'lucide-react';
 import { useInView } from 'react-intersection-observer';
 import { toast as toastify } from 'react-toastify';
 import { useTranslation } from 'react-i18next';
@@ -336,14 +336,25 @@ const PhotoThumbnail: React.FC<PhotoThumbnailProps> = ({
            </div>
          )}
-          {/* Photo type badge */}
+          {/* Media type badges */}
-          {photo.type === 'collage' && (
+          <div className="absolute bottom-2 left-2 flex gap-2">
-            <div className="absolute bottom-2 left-2">
+            {photo.type === 'collage' && (
              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded">
                Collage
              </span>
-            </div>
+            )}
-          )}
+            {photo.media_type === 'video' && (
              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded flex items-center gap-1">
                <Play className="w-3 h-3" fill="white" />
                Video
                {photo.duration && (
                  <span className="ml-1">
                    {Math.floor(photo.duration / 60)}:{String(photo.duration % 60).padStart(2, '0')}
                  </span>
                )}
              </span>
            )}
          </div>
        </>
      ) : (
        <div className="skeleton aspect-square w-full" />
@@ -7,6 +7,7 @@ import { AuthenticatedImage } from '../common';
 import { PhotoFeedback } from './PhotoFeedback';
 import { feedbackService } from '../../services/feedback.service';
 import { FeedbackIdentityModal } from './FeedbackIdentityModal';
 import { VideoPlayer } from './VideoPlayer';
 interface PhotoLightboxProps {
  photos: Photo[];
@@ -448,49 +449,58 @@ export const PhotoLightbox: React.FC<PhotoLightboxProps> = ({
        </div>
      </div>
-      {/* Image container */}
+      {/* Image/Video container */}
      <div
        className="absolute top-0 left-0 bottom-0 flex items-center justify-center z-0"
-        onClick={handleImageClick}
+        onClick={currentPhoto.media_type === 'video' ? undefined : handleImageClick}
-        onMouseDown={handleMouseDown}
+        onMouseDown={currentPhoto.media_type === 'video' ? undefined : handleMouseDown}
-        onMouseMove={handleMouseMove}
+        onMouseMove={currentPhoto.media_type === 'video' ? undefined : handleMouseMove}
-        onMouseUp={handleMouseUp}
+        onMouseUp={currentPhoto.media_type === 'video' ? undefined : handleMouseUp}
-        onMouseLeave={handleMouseUp}
+        onMouseLeave={currentPhoto.media_type === 'video' ? undefined : handleMouseUp}
-        onTouchStart={handleTouchStart}
+        onTouchStart={currentPhoto.media_type === 'video' ? undefined : handleTouchStart}
-        onTouchMove={handleTouchMove}
+        onTouchMove={currentPhoto.media_type === 'video' ? undefined : handleTouchMove}
-        onTouchEnd={handleTouchEnd}
+        onTouchEnd={currentPhoto.media_type === 'video' ? undefined : handleTouchEnd}
        style={{
-          cursor: zoom > 1 ? (isDragging ? 'grabbing' : 'grab') : 'default',
+          cursor: currentPhoto.media_type === 'video' ? 'default' : (zoom > 1 ? (isDragging ? 'grabbing' : 'grab') : 'default'),
          right: isDesktopFeedback ? `${desktopFeedbackWidth}px` : 0,
        }}
      >
-        <AuthenticatedImage
+        {currentPhoto.media_type === 'video' ? (
-          src={currentPhoto.url}
+          <VideoPlayer
-          alt={currentPhoto.filename}
+            src={currentPhoto.url}
-          fallbackSrc={currentPhoto.thumbnail_url || undefined}
+            poster={currentPhoto.thumbnail_url}
-          className="max-w-full max-h-full object-contain select-none"
+            className="max-w-full max-h-full"
-          style={{
+            controls={true}
-            transform: `scale(${zoom}) translate(${dragOffset.x / zoom}px, ${dragOffset.y / zoom}px)`,
+            autoPlay={false}
-            transition: isDragging ? 'none' : 'transform 0.2s',
+          />
-          }}
+        ) : (
-          draggable={false}
+          <AuthenticatedImage
-          useWatermark={useEnhancedProtection}
+            src={currentPhoto.url}
-          watermarkText={useEnhancedProtection ? `${currentPhoto.filename} - Protected` : undefined}
+            alt={currentPhoto.filename}
-          isGallery={true}
+            fallbackSrc={currentPhoto.thumbnail_url || undefined}
-          slug={slug}
+            className="max-w-full max-h-full object-contain select-none"
-          photoId={currentPhoto.id}
+            style={{
-          requiresToken={currentPhoto.requires_token}
+              transform: `scale(${zoom}) translate(${dragOffset.x / zoom}px, ${dragOffset.y / zoom}px)`,
-          secureUrlTemplate={currentPhoto.secure_url_template}
+              transition: isDragging ? 'none' : 'transform 0.2s',
-          protectFromDownload={!allowDownloads || useEnhancedProtection}
+            }}
-          protectionLevel={protectionLevel}
+            draggable={false}
-          useEnhancedProtection={useEnhancedProtection}
+            useWatermark={useEnhancedProtection}
-          useCanvasRendering={protectionLevel === 'maximum'}
+            watermarkText={useEnhancedProtection ? `${currentPhoto.filename} - Protected` : undefined}
-          fragmentGrid={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
+            isGallery={true}
-          blockKeyboardShortcuts={useEnhancedProtection}
+            slug={slug}
-          detectPrintScreen={useEnhancedProtection}
+            photoId={currentPhoto.id}
-          detectDevTools={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
+            requiresToken={currentPhoto.requires_token}
-          onProtectionViolation={(violationType) => {
+            secureUrlTemplate={currentPhoto.secure_url_template}
-            console.warn(`Protection violation in lightbox for photo ${currentPhoto.id}: ${violationType}`);
+            protectFromDownload={!allowDownloads || useEnhancedProtection}
            protectionLevel={protectionLevel}
            useEnhancedProtection={useEnhancedProtection}
            useCanvasRendering={protectionLevel === 'maximum'}
            fragmentGrid={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
            blockKeyboardShortcuts={useEnhancedProtection}
            detectPrintScreen={useEnhancedProtection}
            detectDevTools={protectionLevel === 'enhanced' || protectionLevel === 'maximum'}
            onProtectionViolation={(violationType) => {
              console.warn(`Protection violation in lightbox for photo ${currentPhoto.id}: ${violationType}`);
            // Track analytics
            if (typeof window !== 'undefined' && (window as any).umami) {
@@ -503,12 +513,13 @@ export const PhotoLightbox: React.FC<PhotoLightboxProps> = ({
            }
            // For maximum protection, close lightbox on violation
-            if (protectionLevel === 'maximum' && 
+            if (protectionLevel === 'maximum' &&
                ['devtools_detected', 'print_screen_detected', 'canvas_access_blocked'].includes(violationType)) {
              onClose();
            }
          }}
        />
        )}
      </div>
      {/* Touch/swipe indicators for mobile */}
@@ -143,7 +143,7 @@ export const UserPhotoUpload: React.FC<UserPhotoUploadProps> = ({
                    type="file"
                    className="hidden"
                    multiple
-                    accept="image/jpeg,image/png,image/webp"
+                    accept="image/jpeg,image/png,image/webp,video/mp4,video/webm,video/quicktime,video/x-msvideo"
                    onChange={handleFileSelect}
                    disabled={uploading}
                  />
@@ -0,0 +1,232 @@
 import React, { useRef, useState, useEffect } from 'react';
 import { Play, Pause, Volume2, VolumeX, Maximize, Minimize } from 'lucide-react';
 interface VideoPlayerProps {
  src: string;
  poster?: string;
  className?: string;
  autoPlay?: boolean;
  muted?: boolean;
  loop?: boolean;
  controls?: boolean;
  width?: string | number;
  height?: string | number;
 }
 export const VideoPlayer: React.FC<VideoPlayerProps> = ({
  src,
  poster,
  className = '',
  autoPlay = false,
  muted = false,
  loop = false,
  controls = true,
  width = '100%',
  height = 'auto'
 }) => {
  const videoRef = useRef<HTMLVideoElement>(null);
  const [isPlaying, setIsPlaying] = useState(false);
  const [isMuted, setIsMuted] = useState(muted);
  const [isFullscreen, setIsFullscreen] = useState(false);
  const [progress, setProgress] = useState(0);
  const [currentTime, setCurrentTime] = useState(0);
  const [duration, setDuration] = useState(0);
  const [showControls, setShowControls] = useState(true);
  const controlsTimeoutRef = useRef<NodeJS.Timeout>();
  useEffect(() => {
    const video = videoRef.current;
    if (!video) return;
    const handleTimeUpdate = () => {
      setCurrentTime(video.currentTime);
      setProgress((video.currentTime / video.duration) * 100 || 0);
    };
    const handleLoadedMetadata = () => {
      setDuration(video.duration);
    };
    const handlePlay = () => setIsPlaying(true);
    const handlePause = () => setIsPlaying(false);
    const handleEnded = () => setIsPlaying(false);
    video.addEventListener('timeupdate', handleTimeUpdate);
    video.addEventListener('loadedmetadata', handleLoadedMetadata);
    video.addEventListener('play', handlePlay);
    video.addEventListener('pause', handlePause);
    video.addEventListener('ended', handleEnded);
    return () => {
      video.removeEventListener('timeupdate', handleTimeUpdate);
      video.removeEventListener('loadedmetadata', handleLoadedMetadata);
      video.removeEventListener('play', handlePlay);
      video.removeEventListener('pause', handlePause);
      video.removeEventListener('ended', handleEnded);
    };
  }, []);
  const togglePlayPause = () => {
    const video = videoRef.current;
    if (!video) return;
    if (isPlaying) {
      video.pause();
    } else {
      video.play();
    }
  };
  const toggleMute = () => {
    const video = videoRef.current;
    if (!video) return;
    video.muted = !video.muted;
    setIsMuted(!isMuted);
  };
  const toggleFullscreen = async () => {
    const video = videoRef.current;
    if (!video) return;
    try {
      if (!isFullscreen) {
        if (video.requestFullscreen) {
          await video.requestFullscreen();
        }
        setIsFullscreen(true);
      } else {
        if (document.exitFullscreen) {
          await document.exitFullscreen();
        }
        setIsFullscreen(false);
      }
    } catch (error) {
      console.error('Error toggling fullscreen:', error);
    }
  };
  const handleProgressClick = (e: React.MouseEvent<HTMLDivElement>) => {
    const video = videoRef.current;
    if (!video) return;
    const rect = e.currentTarget.getBoundingClientRect();
    const pos = (e.clientX - rect.left) / rect.width;
    video.currentTime = pos * video.duration;
  };
  const formatTime = (seconds: number): string => {
    if (!seconds || isNaN(seconds)) return '0:00';
    const mins = Math.floor(seconds / 60);
    const secs = Math.floor(seconds % 60);
    return `${mins}:${secs.toString().padStart(2, '0')}`;
  };
  const handleMouseMove = () => {
    setShowControls(true);
    if (controlsTimeoutRef.current) {
      clearTimeout(controlsTimeoutRef.current);
    }
    controlsTimeoutRef.current = setTimeout(() => {
      if (isPlaying) {
        setShowControls(false);
      }
    }, 3000);
  };
  useEffect(() => {
    return () => {
      if (controlsTimeoutRef.current) {
        clearTimeout(controlsTimeoutRef.current);
      }
    };
  }, []);
  return (
    <div
      className={`relative bg-black rounded-lg overflow-hidden ${className}`}
      style={{ width, height: height === 'auto' ? undefined : height }}
      onMouseMove={handleMouseMove}
      onMouseLeave={() => isPlaying && setShowControls(false)}
    >
      <video
        ref={videoRef}
        src={src}
        poster={poster}
        autoPlay={autoPlay}
        muted={muted}
        loop={loop}
        className="w-full h-full object-contain"
        playsInline
        onClick={togglePlayPause}
      />
      {controls && (
        <div
          className={`absolute bottom-0 left-0 right-0 bg-gradient-to-t from-black/80 to-transparent p-4 transition-opacity duration-300 ${
            showControls ? 'opacity-100' : 'opacity-0'
          }`}
        >
          {/* Progress bar */}
          <div
            className="w-full h-1 bg-gray-600 rounded-full cursor-pointer mb-3"
            onClick={handleProgressClick}
          >
            <div
              className="h-full bg-white rounded-full transition-all"
              style={{ width: `${progress}%` }}
            />
          </div>
          {/* Controls */}
          <div className="flex items-center justify-between text-white">
            <div className="flex items-center gap-3">
              <button
                onClick={togglePlayPause}
                className="hover:bg-white/20 p-2 rounded-full transition-colors"
                aria-label={isPlaying ? 'Pause' : 'Play'}
              >
                {isPlaying ? <Pause size={20} /> : <Play size={20} />}
              </button>
              <button
                onClick={toggleMute}
                className="hover:bg-white/20 p-2 rounded-full transition-colors"
                aria-label={isMuted ? 'Unmute' : 'Mute'}
              >
                {isMuted ? <VolumeX size={20} /> : <Volume2 size={20} />}
              </button>
              <span className="text-sm">
                {formatTime(currentTime)} / {formatTime(duration)}
              </span>
            </div>
            <button
              onClick={toggleFullscreen}
              className="hover:bg-white/20 p-2 rounded-full transition-colors"
              aria-label={isFullscreen ? 'Exit fullscreen' : 'Fullscreen'}
            >
              {isFullscreen ? <Minimize size={20} /> : <Maximize size={20} />}
            </button>
          </div>
        </div>
      )}
      {/* Play button overlay when paused */}
      {!isPlaying && showControls && (
        <div className="absolute inset-0 flex items-center justify-center">
          <button
            onClick={togglePlayPause}
            className="bg-black/50 hover:bg-black/70 text-white rounded-full p-6 transition-colors"
            aria-label="Play"
          >
            <Play size={48} fill="white" />
          </button>
        </div>
      )}
    </div>
  );
 };
 export default VideoPlayer;
@@ -1,5 +1,5 @@
 import React from 'react';
-import { Download, Maximize2, Check, MessageSquare, Star, Heart } from 'lucide-react';
+import { Download, Maximize2, Check, MessageSquare, Star, Heart, Video } from 'lucide-react';
 import { useInView } from 'react-intersection-observer';
 import { useTheme } from '../../../contexts/ThemeContext';
 import { AuthenticatedImage } from '../../common';
@@ -12,7 +12,7 @@ interface GridPhotoProps {
  photo: Photo;
  isSelected: boolean;
  isSelectionMode: boolean;
-  onClick: (e: React.MouseEvent) => void;
+  onClick: () => void;
  onDownload: (e: React.MouseEvent) => void;
  onToggleSelect: () => void;
  animationType?: string;
@@ -57,6 +57,79 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
  liked = false,
  onLikeSuccess
 }) => {
  const [overlayVisible, setOverlayVisible] = React.useState(false);
  const [isTouchDevice, setIsTouchDevice] = React.useState(false);
  const overlayTimeoutRef = React.useRef<number | null>(null);
  React.useEffect(() => {
    if (typeof window === 'undefined') return;
    const mediaQuery = window.matchMedia('(hover: none) and (pointer: coarse)');
    const updateTouchState = () => {
      const hasNavigator = typeof navigator !== 'undefined';
      setIsTouchDevice(
        mediaQuery.matches ||
        ('ontouchstart' in window) ||
        (hasNavigator && navigator.maxTouchPoints > 0)
      );
    };
    updateTouchState();
    const listener = (event: MediaQueryListEvent) => {
      setIsTouchDevice(event.matches);
    };
    if (mediaQuery.addEventListener) {
      mediaQuery.addEventListener('change', listener);
    } else if (mediaQuery.addListener) {
      mediaQuery.addListener(listener);
    }
    return () => {
      if (mediaQuery.removeEventListener) {
        mediaQuery.removeEventListener('change', listener);
      } else if (mediaQuery.removeListener) {
        mediaQuery.removeListener(listener);
      }
    };
  }, []);
  const hideOverlay = React.useCallback(() => {
    if (overlayTimeoutRef.current !== null && typeof window !== 'undefined') {
      window.clearTimeout(overlayTimeoutRef.current);
    }
    overlayTimeoutRef.current = null;
    setOverlayVisible(false);
  }, []);
  const showOverlayTemporarily = React.useCallback(() => {
    setOverlayVisible(true);
    if (overlayTimeoutRef.current !== null && typeof window !== 'undefined') {
      window.clearTimeout(overlayTimeoutRef.current);
    }
    if (typeof window !== 'undefined') {
      overlayTimeoutRef.current = window.setTimeout(() => {
        overlayTimeoutRef.current = null;
        setOverlayVisible(false);
      }, 2500);
    }
  }, []);
  React.useEffect(() => {
    return () => {
      if (overlayTimeoutRef.current !== null && typeof window !== 'undefined') {
        window.clearTimeout(overlayTimeoutRef.current);
      }
    };
  }, []);
  React.useEffect(() => {
    if (isSelectionMode) {
      hideOverlay();
    }
  }, [isSelectionMode, hideOverlay]);
  // handled by parent layout; kept here for type completeness but not used
  const { ref, inView } = useInView({
    triggerOnce: true,
@@ -73,11 +146,38 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
  const commentCount = photo.comment_count ?? 0;
  const showFeedbackActions = feedbackEnabled && Boolean(feedbackOptions);
  const overlayVisibilityClass = overlayVisible
    ? 'opacity-100 md:opacity-100'
    : 'opacity-0 md:opacity-0';
  const checkboxVisibilityClass =
    isSelected || isSelectionMode || overlayVisible
      ? 'opacity-100 md:opacity-100'
      : 'opacity-0 md:opacity-0';
  const isVideo = (photo.media_type === 'video') ||
    (photo.mime_type && photo.mime_type.startsWith('video/')) ||
    photo.type === 'video';
  const handlePhotoClick = (e: React.MouseEvent<HTMLDivElement>) => {
    if (isTouchDevice && !overlayVisible && !isSelectionMode) {
      e.preventDefault();
      e.stopPropagation();
      showOverlayTemporarily();
      return;
    }
    onClick();
    if (isTouchDevice) {
      hideOverlay();
    }
  };
  return (
    <div
      ref={ref}
      className={`relative group cursor-pointer aspect-square ${animationClass}`}
-      onClick={onClick}
+      onClick={handlePhotoClick}
      style={{
        opacity: !inView && animationType === 'fade' ? 0 : 1
      }}
@@ -108,14 +208,15 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
            }}
          />
-          <div className="absolute inset-0 bg-black/40 opacity-100 md:opacity-0 md:group-hover:opacity-100 transition-opacity duration-200 rounded-lg flex items-center justify-center gap-2">
+          <div className={`absolute inset-0 bg-black/40 transition-opacity duration-200 rounded-lg flex items-center justify-center gap-2 ${overlayVisibilityClass} md:group-hover:opacity-100`}>
            {!isSelectionMode && (
              <>
                <button
                  className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                  onClick={(e) => {
                    e.stopPropagation();
-                    onClick(e);
+                    onClick();
                    hideOverlay();
                  }}
                  aria-label="View full size"
                >
@@ -124,16 +225,24 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
                {allowDownloads && (
                  <button
                    className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
-                    onClick={onDownload}
+                    onClick={(e) => {
                      e.stopPropagation();
                      onDownload(e);
                      hideOverlay();
                    }}
                    aria-label="Download photo"
                  >
                    <Download className="w-5 h-5 text-neutral-800" />
                  </button>
                )}
-                {showFeedbackActions && onQuickComment && (
+                {showFeedbackActions && feedbackOptions?.allowComments && onQuickComment && (
                  <button
                    className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
-                    onClick={(e) => { e.stopPropagation(); onQuickComment(); }}
+                    onClick={(e) => {
                      e.stopPropagation();
                      onQuickComment();
                      hideOverlay();
                    }}
                    aria-label="Comment on photo"
                    title="Comment"
                  >
@@ -148,6 +257,7 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
                      e.stopPropagation();
                      if (feedbackOptions?.requireNameEmail && !savedIdentity && onRequireIdentity) {
                        onRequireIdentity('like', photo.id);
                        hideOverlay();
                        return;
                      }
                      // Optimistic UI: mark as liked immediately
@@ -163,6 +273,7 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
                        console.warn('Like submit failed, keeping optimistic UI', err);
                      }
                      if (onFeedbackChange) onFeedbackChange();
                      hideOverlay();
                    }}
                    aria-label="Like photo"
                    aria-pressed={liked}
@@ -182,9 +293,7 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
            role="checkbox"
            aria-checked={isSelected}
            data-testid={`gallery-photo-checkbox-${photo.id}`}
-            className={`absolute top-2 right-2 z-20 transition-opacity ${
+            className={`absolute top-2 right-2 z-20 transition-opacity ${checkboxVisibilityClass} md:group-hover:opacity-100`}
              isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-100'
            }`}
            onClick={(e) => { e.stopPropagation(); onToggleSelect(); }}
          >
            <div className={`w-6 h-6 rounded-full border-2 ${isSelected ? 'bg-primary-600 border-primary-600' : 'bg-white/90 border-white'} flex items-center justify-center transition-colors`}>
@@ -213,6 +322,15 @@ const GridPhoto: React.FC<GridPhotoProps> = ({
            </div>
          )}
          {isVideo && (
            <div className="absolute bottom-2 right-2">
              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded flex items-center gap-1">
                <Video className="w-3 h-3" />
                {t('common.video', 'Video')}
              </span>
            </div>
          )}
          {photo.type === 'collage' && (
            <div className="absolute bottom-2 right-2">
              <span className="px-2 py-1 bg-black/60 text-white text-xs rounded">
@@ -1,4 +1,4 @@
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useRef, useCallback } from 'react';
 import { Download, Maximize2, Check, ChevronDown, Calendar, Clock, Heart, MessageSquare } from 'lucide-react';
 import { parseISO } from 'date-fns';
 import { useTranslation } from 'react-i18next';
@@ -50,6 +50,12 @@ export const HeroGalleryLayout: React.FC<HeroGalleryLayoutProps> = ({
  const overlayOpacity = gallerySettings.heroOverlayOpacity || 0.3;
  const [likedIds, setLikedIds] = useState<Set<number>>(new Set());
  const canQuickComment = Boolean(feedbackEnabled && feedbackOptions?.allowComments && onOpenPhotoWithFeedback);
  const gridRef = useRef<HTMLDivElement | null>(null);
  const handleScrollToGrid = useCallback(() => {
    if (gridRef.current) {
      gridRef.current.scrollIntoView({ behavior: 'smooth', block: 'start' });
    }
  }, []);
  // If an override is provided, always use it and skip initialization logic
  useEffect(() => {
@@ -162,31 +168,44 @@ export const HeroGalleryLayout: React.FC<HeroGalleryLayoutProps> = ({
        </div>
        {/* Scroll Indicator */}
-        <div className="absolute bottom-8 left-1/2 transform -translate-x-1/2 animate-bounce">
+        <button
          onClick={() => {
            // Scroll to the grid section
            const gridSection = document.getElementById('gallery-grid-section');
            if (gridSection) {
              gridSection.scrollIntoView({ behavior: 'smooth', block: 'start' });
            } else {
              // Fallback: scroll down by hero section height
              window.scrollBy({ top: window.innerHeight * 0.9, behavior: 'smooth' });
            }
          }}
          className="absolute bottom-8 left-1/2 transform -translate-x-1/2 animate-bounce cursor-pointer hover:scale-110 transition-transform focus:outline-none focus:ring-2 focus:ring-white focus:ring-opacity-50 rounded-full p-2"
          aria-label="Scroll to gallery"
        >
          <ChevronDown className="w-8 h-8 text-white drop-shadow-lg" />
-        </div>
+        </button>
      </div>
      {/* Grid Section */}
-      <div className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4">
+      <div id="gallery-grid-section" className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-4">
        {remainingPhotos.map((photo) => {
          const actualIndex = photos.findIndex(p => p.id === photo.id);
          return (
            <div
              key={photo.id}
-              className="relative group cursor-pointer aspect-square"
+              className="relative group cursor-pointer overflow-hidden rounded-lg"
              onClick={() => onPhotoClick(actualIndex)}
            >
              <AuthenticatedImage
                src={photo.thumbnail_url || photo.url}
                alt={photo.filename}
-                className="w-full h-full object-cover rounded-lg transition-transform duration-300 group-hover:scale-105"
+                className="w-full h-auto object-cover transition-transform duration-300 group-hover:scale-105"
                loading="lazy"
                isGallery={true}
                protectFromDownload={!allowDownloads}
              />
-              
+
-              <div className="absolute inset-0 bg-black/40 opacity-0 group-hover:opacity-100 transition-opacity duration-200 rounded-lg flex items-center justify-center gap-2">
+              <div className="absolute inset-0 bg-black/40 opacity-0 group-hover:opacity-100 transition-opacity duration-200 flex items-center justify-center gap-2">
                {!isSelectionMode && (
                  <>
                    <button
@@ -117,7 +117,7 @@ const MasonryPhoto: React.FC<MasonryPhotoProps> = ({
                <Download className="w-5 h-5 text-neutral-800" />
              </button>
            )}
-            {onQuickComment && (
+            {feedbackEnabled && feedbackOptions?.allowComments && onQuickComment && (
              <button
                className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                onClick={(e) => { e.stopPropagation(); onQuickComment(); }}
@@ -127,7 +127,7 @@ const MasonryPhoto: React.FC<MasonryPhotoProps> = ({
                <MessageSquare className="w-5 h-5 text-neutral-800" />
              </button>
            )}
-            {feedbackOptions?.allowLikes && (
+            {feedbackEnabled && feedbackOptions?.allowLikes && (
              <button
                className="p-2 bg-white/90 rounded-full hover:bg-white transition-colors"
                onClick={async (e) => {
@@ -5,6 +5,7 @@ import {
  inferGallerySlugFromLocation,
  resolveSlugFromRequestUrl,
 } from '../utils/galleryAuthStorage';
 import { getApiBaseUrl } from '../utils/url';
 // Maintenance mode callback
 let maintenanceModeCallback: ((enabled: boolean) => void) | null = null;
@@ -15,7 +16,7 @@ export const setMaintenanceModeCallback = (callback: (enabled: boolean) => void)
 // Create axios instance
 export const api = axios.create({
-  baseURL: import.meta.env.VITE_API_URL || '/api',
+  baseURL: getApiBaseUrl(),
  headers: {
    'Content-Type': 'application/json',
  },
@@ -1,5 +1,6 @@
-import React, { createContext, useContext, useState, useEffect } from 'react';
+import React, { createContext, useContext, useState, useEffect, useRef } from 'react';
 import type { ReactNode } from 'react';
 import { useLocation } from 'react-router-dom';
 import { api } from '../config/api';
 import { authService, galleryService } from '../services';
 import { cleanupOldGalleryAuth } from '../utils/cleanupGalleryAuth';
@@ -61,52 +62,133 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
  const [event, setEvent] = useState<GalleryEvent | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const [error, setError] = useState<string | null>(null);
-
+  const [routeError, setRouteError] = useState<string | null>(null);
-  // Get current gallery slug from URL
+  const location = useLocation();
-  const getCurrentGallerySlug = () => {
+  const [routeInfo, setRouteInfo] = useState<{ slug: string | null; token?: string; identifier: string | null; ready: boolean }>({
-    const pathParts = window.location.pathname.split('/');
+    slug: null,
-    if (pathParts[1] === 'gallery' && pathParts[2]) {
+    token: undefined,
-      return pathParts[2];
+    identifier: null,
-    }
+    ready: false,
-    return null;
+  });
-  };
+  const lastResolvedIdentifier = useRef<string | null>(null);
  useEffect(() => {
    cleanupOldGalleryAuth();
  }, []);
-    const slugAtMount = getCurrentGallerySlug();
+  useEffect(() => {
-    if (slugAtMount) {
+    let cancelled = false;
      setActiveGallerySlug(slugAtMount);
    } else {
      clearActiveGallerySlug();
    }
-    const initialise = async () => {
+    const parseRoute = async () => {
-      const currentSlug = getCurrentGallerySlug();
+      const segments = location.pathname.split('/').filter(Boolean);
-      if (!currentSlug) {
+      if (segments[0] !== 'gallery') {
-        setIsLoading(false);
+        if (!cancelled) {
          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
          setRouteError(null);
        }
        return;
      }
-      setActiveGallerySlug(currentSlug);
+      const identifier = segments[1] || null;
      const tokenSegment = segments[2];
-      const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
+      if (!identifier) {
-      if (storedEvent) {
+        if (!cancelled) {
-        try {
+          setRouteInfo({ slug: null, token: undefined, identifier: null, ready: true });
          const parsed = JSON.parse(storedEvent);
          if (parsed && parsed.id) {
            const normalizedStored = normalizeEvent(parsed);
            setEvent(normalizedStored);
            if (normalizedStored) {
              sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
            }
          }
        } catch (err) {
          sessionStorage.removeItem(`gallery_event_${currentSlug}`);
        }
        return;
      }
      const looksLikeToken = /^[0-9a-fA-F]{32}$/.test(identifier) && !tokenSegment;
      if (looksLikeToken) {
        if (lastResolvedIdentifier.current === identifier) {
          setRouteInfo(prev => ({
            slug: prev.slug,
            token: prev.token,
            identifier,
            ready: true,
          }));
          setRouteError(null);
          return;
        }
        try {
          const resolved = await galleryService.resolveIdentifier(identifier);
          if (cancelled) return;
          lastResolvedIdentifier.current = identifier;
          setRouteInfo({
            slug: resolved.slug,
            token: resolved.token,
            identifier,
            ready: true,
          });
          setRouteError(null);
        } catch (err: any) {
          if (cancelled) return;
          lastResolvedIdentifier.current = identifier;
          setRouteInfo({
            slug: null,
            token: undefined,
            identifier,
            ready: true,
          });
          setRouteError(err?.response?.data?.error || 'Unable to resolve gallery link');
        }
      } else {
        lastResolvedIdentifier.current = null;
        setRouteInfo({
          slug: identifier,
          token: tokenSegment,
          identifier,
          ready: true,
        });
        setRouteError(null);
      }
    };
    setRouteInfo(prev => ({ ...prev, ready: false }));
    parseRoute();
    return () => {
      cancelled = true;
    };
  }, [location.pathname]);
  useEffect(() => {
    if (!routeInfo.ready) {
      return;
    }
    if (!routeInfo.slug) {
      clearActiveGallerySlug();
      setIsAuthenticated(false);
      setEvent(null);
      setIsLoading(false);
      return;
    }
    const currentSlug = routeInfo.slug;
    setActiveGallerySlug(currentSlug);
    const storedEvent = sessionStorage.getItem(`gallery_event_${currentSlug}`);
    if (storedEvent) {
      try {
        const parsed = JSON.parse(storedEvent);
        if (parsed && parsed.id) {
          const normalizedStored = normalizeEvent(parsed);
          setEvent(normalizedStored);
          if (normalizedStored) {
            sessionStorage.setItem(`gallery_event_${currentSlug}`, JSON.stringify(normalizedStored));
          }
        }
      } catch {
        sessionStorage.removeItem(`gallery_event_${currentSlug}`);
      }
    }
    const initialise = async () => {
      try {
        setIsLoading(true);
        const sessionResponse = await api.get<{ valid: boolean; type: string; eventSlug?: string }>(
@@ -118,7 +200,6 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
          setIsAuthenticated(true);
          if (!storedEvent) {
            // Fetch gallery details to hydrate context
            const galleryData = await galleryService.getGalleryPhotos(currentSlug);
            if (galleryData?.event) {
              const normalizedEvent = normalizeEvent(galleryData.event);
@@ -132,14 +213,10 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
          return;
        }
-        // If no active session, check for share token in URL
+        if (routeInfo.token) {
-        const parts = window.location.pathname.split('/');
+          const verify = await galleryService.verifyToken(currentSlug, routeInfo.token);
        const urlToken = parts.length >= 5 ? parts[4] : (parts.length >= 4 ? parts[3] : undefined);
        if (urlToken) {
          const verify = await galleryService.verifyToken(currentSlug, urlToken);
          if (verify?.valid) {
-            const response = await authService.shareLinkLogin(currentSlug, urlToken);
+            const response = await authService.shareLinkLogin(currentSlug, routeInfo.token);
            if (response?.event) {
              const normalizedEvent = normalizeEvent(response.event);
              setEvent(normalizedEvent);
@@ -156,29 +233,33 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
          }
        }
        // No valid session found
        setIsAuthenticated(false);
        sessionStorage.removeItem(`gallery_event_${currentSlug}`);
        setEvent(null);
        clearGalleryToken(currentSlug);
-      } catch (error) {
+      } catch (initialiseError: any) {
        setIsAuthenticated(false);
        sessionStorage.removeItem(`gallery_event_${currentSlug}`);
        setEvent(null);
        clearGalleryToken(currentSlug);
        if (initialiseError?.response?.data?.error) {
          setError(initialiseError.response.data.error);
        }
      } finally {
        setIsLoading(false);
      }
    };
    initialise();
    return () => {
      clearActiveGallerySlug();
    };
-  }, []);
+  }, [routeInfo]);
  const login = async (slug: string, password?: string, recaptchaToken?: string | null) => {
    try {
      setRouteError(null);
      setError(null);
      setIsLoading(true);
      const response = await authService.verifyGalleryPassword(slug, password, recaptchaToken);
@@ -190,7 +271,6 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
      }
      setActiveGallerySlug(slug);
      // Store event data for quick reloads (non-sensitive)
      if (normalizedEvent) {
        sessionStorage.setItem(`gallery_event_${slug}`, JSON.stringify(normalizedEvent));
      }
@@ -203,7 +283,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
  };
  const logout = () => {
-    const currentSlug = getCurrentGallerySlug();
+    const currentSlug = routeInfo.slug;
    if (currentSlug) {
      sessionStorage.removeItem(`gallery_event_${currentSlug}`);
      clearGalleryToken(currentSlug);
@@ -222,7 +302,7 @@ export const GalleryAuthProvider: React.FC<GalleryAuthProviderProps> = ({ childr
        login,
        logout,
        isLoading,
-        error,
+        error: routeError ?? error,
      }}
    >
      {children}
@@ -2,12 +2,18 @@ import { useQuery, useMutation } from '@tanstack/react-query';
 import { galleryService } from '../services';
 import { toast } from 'react-toastify';
-export const useGalleryInfo = (slug: string, token?: string) => {
+export const useGalleryInfo = (slug?: string, token?: string, enabled: boolean = true) => {
  return useQuery({
    queryKey: ['gallery-info', slug, token],
-    queryFn: () => galleryService.getGalleryInfo(slug, token),
+    queryFn: () => {
      if (!slug) {
        throw new Error('Gallery slug is required');
      }
      return galleryService.getGalleryInfo(slug, token);
    },
    retry: 1,
    staleTime: 5 * 60 * 1000, // 5 minutes
    enabled: Boolean(slug) && enabled,
  });
 };
@@ -26,6 +26,9 @@
    "uploaded": "Hochgeladen",
    "photo": "Foto",
    "photos": "Fotos",
    "video": "Video",
    "videos": "Videos",
    "media": "Medien",
    "restore": "Wiederherstellen",
    "actions": "Aktionen",
    "refresh": "Aktualisieren",
@@ -48,21 +51,28 @@
    "noCategory": "Keine Kategorie",
    "eventSpecific": "(Veranstaltungsspezifisch)",
    "clickToUpload": "Klicken zum Hochladen oder per Drag & Drop",
-    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei)",
+    "fileRequirements": "JPEG, PNG oder WebP (max. 50MB pro Datei, {{limit}} Dateien pro Upload)",
    "fileRequirementsMedia": "JPEG-, PNG- oder WebP-Bilder sowie MP4/MOV/WEBM-Videos (max. 50MB pro Datei, {{limit}} Dateien pro Upload)",
    "unsupportedFiles": "Einige Dateien wurden übersprungen, da das Format nicht unterstützt wird (JPEG/PNG/WebP/MP4/MOV/WEBM verwenden).",
    "selectedFiles": "Ausgewählte Dateien",
    "uploading": "Wird hochgeladen...",
    "uploadComplete": "Upload abgeschlossen!",
    "uploadFailed": "Upload fehlgeschlagen",
    "someFilesFailed": "Einige Dateien konnten nicht hochgeladen werden",
    "uploadPhotos": "Fotos hochladen",
    "uploadMedia": "Fotos & Videos hochladen",
    "importExternal": "Aus externem Ordner importieren",
    "externalImportInfo": "Alle Bilder aus dem ausgewählten Ordner werden importiert.",
    "selectExternalFolder": "Externen Ordner unter /external-media auswählen",
    "importFromSelectedFolder": "Ausgewählten Ordner importieren",
-    "maxFilesReached": "Maximal 500 Dateien erlaubt",
+    "maxFilesReached": "Maximal {{limit}} Dateien erlaubt",
-    "someFilesSkipped": "Einige Dateien wurden übersprungen (500 Dateien Limit)",
+    "someFilesSkipped": "Nur {{allowed}} weitere Dateien erlaubt (Limit {{limit}})",
-    "tooManyFiles": "Maximal 500 Dateien können gleichzeitig hochgeladen werden",
+    "tooManyFiles": "Maximal {{limit}} Dateien können gleichzeitig hochgeladen werden",
-    "uploadingChunks": "Lade {{count}} Dateien in {{total}} Teilen hoch..."
+    "limitInfo": "{{selected}} von {{limit}} Dateien ausgewählt ({{remaining}} verbleibend)",
    "limitReached": "Upload-Limit erreicht ({{limit}} Dateien pro Vorgang)",
    "uploadingChunks": "Lade {{count}} Dateien in {{total}} Teilen hoch...",
    "mediaCategory": "Medienkategorie",
    "uploadAction": "{{count}} Dateien hochladen"
  },
  "navigation": {
    "dashboard": "Dashboard",
@@ -511,6 +521,13 @@
    "selectAll": "Alle auswählen",
    "deselectAll": "Auswahl aufheben",
    "downloadSelected": "{{count}} ausgewählte herunterladen",
    "deleteSelected": "Ausgewählte löschen",
    "photosCount": "{{count}} Foto",
    "photosCount_plural": "{{count}} Fotos",
    "searchByFilename": "Nach Dateinamen suchen...",
    "uncategorized": "Ohne Kategorie",
    "sortAscending": "Aufsteigend sortieren",
    "sortDescending": "Absteigend sortieren",
    "remaining": "verbleibend",
    "selectPhotosHint": "Tipp: Verwenden Sie Strg+Klick (Cmd+Klick auf Mac), um schnell mehrere Fotos auszuwählen",
    "filters": "Filter",
@@ -519,7 +536,12 @@
    "toggleMenu": "Menü umschalten",
    "allCategories": "Alle Kategorien",
    "categories": "Kategorien",
    "mediaType": "Medien",
    "allMedia": "Alle Medien",
    "photosOnly": "Fotos",
    "videosOnly": "Videos",
    "download": "Herunterladen",
    "noMedia": "Noch keine Medien hochgeladen",
    "searchPlaceholder": "Fotos suchen...",
    "sortBy": "Sortieren nach",
    "sortByDate": "Nach Datum sortieren",
@@ -773,12 +795,16 @@
      "defaultExpirationHelp": "Wie lange Galerien standardmäßig aktiv bleiben",
      "maxFileSize": "Max. Dateigröße (MB)",
      "maxFileSizeHelp": "Maximale Größe pro hochgeladenem Foto",
      "maxFilesPerUpload": "Max. Dateien pro Upload",
      "maxFilesPerUploadHelp": "Maximale Anzahl an Fotos pro Upload-Vorgang (1-{{max}}).",
      "allowedFileTypes": "Erlaubte Dateitypen",
      "allowedFileTypesHelp": "Kommagetrennte Liste von Dateierweiterungen",
      "featureToggles": "Funktionsschalter",
      "enableWatermark": "Wasserzeichen auf Fotos aktivieren",
      "enableAnalytics": "Analytics-Tracking aktivieren",
      "enableRegistration": "Selbstregistrierung für Admins erlauben",
      "enableShortGalleryUrls": "Kurze Galerie-Links verwenden",
      "enableShortGalleryUrlsHelp": "Entfernt den Veranstaltungs-Slug aus neuen Freigabelinks und lässt bestehende Links weiterhin funktionieren.",
      "maintenanceMode": "Wartungsmodus aktivieren",
      "language": "Sprache",
      "defaultLanguage": "Standardsprache",
@@ -886,7 +912,11 @@
      "sessionTimeout": "Sitzungs-Timeout (Minuten)",
      "sessionTimeoutHelp": "Admin-Sitzungs-Timeout in Minuten",
      "maxLoginAttempts": "Max. Anmeldeversuche",
-      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche vor Sperrung",
+      "maxLoginAttemptsHelp": "Maximale fehlgeschlagene Anmeldeversuche pro IP vor Sperrung",
      "attemptWindowMinutes": "Versuchsfenster (Minuten)",
      "attemptWindowMinutesHelp": "Zeitraum, in dem fehlgeschlagene Anmeldeversuche gezählt werden",
      "lockoutDurationMinutes": "Sperrdauer (Minuten)",
      "lockoutDurationMinutesHelp": "Wie lange Galerie oder Konto nach zu vielen Fehlern gesperrt bleiben",
      "enable2FA": "Zwei-Faktor-Authentifizierung für Admins aktivieren",
      "recaptchaSettings": "reCAPTCHA-Einstellungen",
      "enableRecaptcha": "reCAPTCHA für Anmeldeformulare aktivieren",
@@ -1091,7 +1121,7 @@
    "viewAllNotifications": "Alle Benachrichtigungen anzeigen",
    "noNotifications": "Keine neuen Benachrichtigungen",
    "markAllRead": "Alle als gelesen markieren",
-    "clearOld": "Alte löschen",
+    "clearAll": "Alle löschen",
    "close": "Schließen",
    "noNotificationsMessage": "Keine Benachrichtigungen",
    "notificationMessages": {
@@ -1124,11 +1154,13 @@
      "archiveDownloaded": "Archiv für \"{{eventName}}\" heruntergeladen",
      "archiveDeleted": "Archiv für \"{{eventName}}\" gelöscht",
      "archiveRestored": "Archiv für \"{{eventName}}\" wiederhergestellt",
-      "systemActivity": "Systemaktivität: {{type}}"
+      "systemActivity": "Systemaktivität: {{type}}",
      "adminProfileUpdated": "Admin-Profil aktualisiert von {{actorName}}"
    },
    "notificationToasts": {
      "markedAllRead": "Alle Benachrichtigungen als gelesen markiert",
-      "clearedOld": "{{count}} alte Benachrichtigungen gelöscht"
+      "clearedAll": "{{count}} Benachrichtigungen gelöscht",
      "profileUpdated": "Admin-Profil aktualisiert"
    },
    "viewAllNotifications": "Alle Benachrichtigungen anzeigen",
    "noNotifications": "Keine neuen Benachrichtigungen",
@@ -1136,6 +1168,16 @@
    "markAllAsRead": "Alle als gelesen markieren",
    "notificationSettings": "Benachrichtigungseinstellungen",
    "changePassword": "Passwort ändern",
    "accountSettings": {
      "title": "Admin-Konto",
      "description": "Aktualisiere die Zugangsdaten für die PicPeak-Administration.",
      "username": "Benutzername",
      "usernamePlaceholder": "Admin",
      "email": "E-Mail",
      "emailPlaceholder": "admin@example.com",
      "updateButton": "Profil aktualisieren"
    },
    "profileUpdateError": "Admin-Profil konnte nicht aktualisiert werden. Bitte versuche es erneut.",
    "loadingDashboard": "Dashboard wird geladen...",
    "activeEvents": "Aktive Veranstaltungen",
    "expiringSoon": "Demnächst ablaufend",
@@ -1317,7 +1359,34 @@
    "saveConfiguration": "Konfiguration speichern",
    "emailTemplates": "E-Mail-Vorlagen",
    "templateVariables": "Verfügbare Variablen",
-    "previewTemplate": "Vorlage anzeigen"
+    "previewTemplate": "Vorlage anzeigen",
    "smtpSettings": "SMTP-Einstellungen",
    "testEmailSuccess": "Test-E-Mail erfolgreich gesendet",
    "saveSmtpSettings": "SMTP-Einstellungen speichern",
    "testEmailSection": "E-Mail testen",
    "beforeTesting": "Vor dem Testen:",
    "saveSmtpFirst": "Speichern Sie zuerst Ihre SMTP-Einstellungen",
    "ensureFirewall": "Stellen Sie sicher, dass Ihre Firewall ausgehende SMTP-Verbindungen erlaubt",
    "gmailAppPassword": "Für Gmail verwenden Sie ein App-spezifisches Passwort",
    "testEmailAddressLabel": "Test-E-Mail-Adresse",
    "sendTestEmailButton": "Test-E-Mail senden",
    "commonSmtpSettings": "Häufige SMTP-Einstellungen:",
    "editTemplate": "Vorlage bearbeiten",
    "templateName": "Vorlagenname",
    "subjectLine": "Betreffzeile",
    "emailBody": "E-Mail-Text",
    "preview": "Vorschau",
    "saveChanges": "Änderungen speichern",
    "templates": "Vorlagen",
    "variableHelp": "Verwenden Sie diese Variablen in Ihrer Vorlage. Sie werden beim Senden durch tatsächliche Werte ersetzt.",
    "port": "Port",
    "security": "Sicherheit",
    "username": "Benutzername",
    "password": "Passwort",
    "enterPassword": "Passwort eingeben",
    "required": "erforderlich",
    "ignoreSslErrors": "SSL/TLS-Zertifikatfehler ignorieren",
    "ignoreSslWarning": "Warnung: Das Deaktivieren der Zertifikatüberprüfung macht die Verbindung anfällig für Man-in-the-Middle-Angriffe. Aktivieren Sie dies nur, wenn Sie dem SMTP-Server vertrauen und die Sicherheitsrisiken verstehen."
  },
  "cms": {
    "title": "CMS-Seiten",
@@ -26,6 +26,9 @@
    "uploaded": "Uploaded",
    "photo": "photo",
    "photos": "photos",
    "video": "video",
    "videos": "videos",
    "media": "media",
    "restore": "Restore",
    "actions": "Actions",
    "refresh": "Refresh",
@@ -48,21 +51,28 @@
    "noCategory": "No category",
    "eventSpecific": "(Event specific)",
    "clickToUpload": "Click to upload or drag and drop",
-    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file)",
+    "fileRequirements": "JPEG, PNG or WebP (max 50MB per file, {{limit}} files per upload)",
    "fileRequirementsMedia": "JPEG, PNG or WebP images, plus MP4/MOV/WEBM videos (max 50MB per file, {{limit}} files per upload)",
    "unsupportedFiles": "Some files were skipped because the format is not supported (use JPEG/PNG/WebP/MP4/MOV/WEBM).",
    "selectedFiles": "Selected files",
    "uploading": "Uploading...",
    "uploadComplete": "Upload complete!",
    "uploadFailed": "Upload failed",
    "someFilesFailed": "Some files failed to upload",
    "uploadPhotos": "Upload Photos",
    "uploadMedia": "Upload Photos & Videos",
    "importExternal": "Import from External Folder",
    "externalImportInfo": "All pictures from the selected folder will be imported.",
    "selectExternalFolder": "Select external folder under /external-media",
    "importFromSelectedFolder": "Import from selected folder",
-    "maxFilesReached": "Maximum 500 files allowed",
+    "maxFilesReached": "Maximum {{limit}} files allowed",
-    "someFilesSkipped": "Some files were skipped (500 file limit)",
+    "someFilesSkipped": "Only {{allowed}} more files can be added (limit {{limit}})",
-    "tooManyFiles": "Maximum 500 files can be uploaded at once",
+    "tooManyFiles": "Maximum {{limit}} files can be uploaded at once",
-    "uploadingChunks": "Uploading {{count}} files in {{total}} batches..."
+    "limitInfo": "{{selected}} of {{limit}} files selected ({{remaining}} remaining)",
    "limitReached": "Upload limit reached ({{limit}} files per batch)",
    "uploadingChunks": "Uploading {{count}} files in {{total}} batches...",
    "mediaCategory": "Media category",
    "uploadAction": "Upload {{count}} files"
  },
  "navigation": {
    "dashboard": "Dashboard",
@@ -176,6 +186,13 @@
    "selectAll": "Select All",
    "deselectAll": "Deselect All",
    "downloadSelected": "Download {{count}} Selected",
    "deleteSelected": "Delete Selected",
    "photosCount": "{{count}} photo",
    "photosCount_plural": "{{count}} photos",
    "searchByFilename": "Search by filename...",
    "uncategorized": "Uncategorized",
    "sortAscending": "Sort ascending",
    "sortDescending": "Sort descending",
    "remaining": "remaining",
    "selectPhotosHint": "Tip: Use Ctrl+Click (Cmd+Click on Mac) to quickly select multiple photos",
    "filters": "Filters",
@@ -184,7 +201,12 @@
    "toggleMenu": "Toggle menu",
    "allCategories": "All Categories",
    "categories": "Categories",
    "mediaType": "Media",
    "allMedia": "All media",
    "photosOnly": "Photos",
    "videosOnly": "Videos",
    "download": "Download",
    "noMedia": "No media uploaded yet",
    "searchPlaceholder": "Search photos...",
    "sortBy": "Sort By",
    "sortByDate": "Sort by Date",
@@ -453,12 +475,16 @@
      "defaultExpirationHelp": "How long galleries remain active by default",
      "maxFileSize": "Max File Size (MB)",
      "maxFileSizeHelp": "Maximum size per uploaded photo",
      "maxFilesPerUpload": "Max Files per Upload",
      "maxFilesPerUploadHelp": "Maximum number of photos allowed in a single upload batch (1-{{max}}).",
      "allowedFileTypes": "Allowed File Types",
      "allowedFileTypesHelp": "Comma-separated list of file extensions",
      "featureToggles": "Feature Toggles",
      "enableWatermark": "Enable watermark on photos",
      "enableAnalytics": "Enable analytics tracking",
      "enableRegistration": "Allow self-registration for admins",
      "enableShortGalleryUrls": "Use short gallery URLs",
      "enableShortGalleryUrlsHelp": "Removes the event slug from new share links while keeping existing links working.",
      "maintenanceMode": "Enable maintenance mode",
      "language": "Language",
      "defaultLanguage": "Default Language",
@@ -566,7 +592,11 @@
      "sessionTimeout": "Session Timeout (minutes)",
      "sessionTimeoutHelp": "Admin session timeout in minutes",
      "maxLoginAttempts": "Max Login Attempts",
-      "maxLoginAttemptsHelp": "Maximum failed login attempts before lockout",
+      "maxLoginAttemptsHelp": "Maximum failed login attempts per IP before lockout",
      "attemptWindowMinutes": "Attempt Window (minutes)",
      "attemptWindowMinutesHelp": "How long to look back when counting failed login attempts",
      "lockoutDurationMinutes": "Lockout Duration (minutes)",
      "lockoutDurationMinutesHelp": "How long the gallery or account stays locked after too many failures",
      "enable2FA": "Enable two-factor authentication for admins",
      "recaptchaSettings": "reCAPTCHA Settings",
      "enableRecaptcha": "Enable reCAPTCHA for login forms",
@@ -829,7 +859,7 @@
    "viewAllNotifications": "View all notifications",
    "noNotifications": "No new notifications",
    "markAllRead": "Mark all read",
-    "clearOld": "Clear old",
+    "clearAll": "Clear all",
    "close": "Close",
    "noNotificationsMessage": "No notifications",
    "notificationMessages": {
@@ -862,16 +892,28 @@
      "archiveDownloaded": "Archive downloaded for \"{{eventName}}\"",
      "archiveDeleted": "Archive deleted for \"{{eventName}}\"",
      "archiveRestored": "Archive restored for \"{{eventName}}\"",
-      "systemActivity": "System activity: {{type}}"
+      "systemActivity": "System activity: {{type}}",
      "adminProfileUpdated": "Admin profile updated by {{actorName}}"
    },
    "notificationToasts": {
      "markedAllRead": "All notifications marked as read",
-      "clearedOld": "Cleared {{count}} old notifications"
+      "clearedAll": "Cleared {{count}} notifications",
      "profileUpdated": "Admin profile updated"
    },
    "markAsRead": "Mark as read",
    "markAllAsRead": "Mark all as read",
    "notificationSettings": "Notification Settings",
    "changePassword": "Change Password",
    "accountSettings": {
      "title": "Admin account",
      "description": "Update the credentials used to sign in to PicPeak.",
      "username": "Username",
      "usernamePlaceholder": "Admin",
      "email": "Email",
      "emailPlaceholder": "admin@example.com",
      "updateButton": "Update profile"
    },
    "profileUpdateError": "Unable to update admin profile. Please try again.",
    "loadingDashboard": "Loading dashboard...",
    "activeEvents": "Active Events",
    "expiringSoon": "Expiring Soon",
@@ -1062,7 +1104,9 @@
    "enterPassword": "Enter password",
    "fromEmail": "From Email",
    "fromName": "From Name",
-    "required": "required"
+    "required": "required",
    "ignoreSslErrors": "Ignore SSL/TLS certificate errors",
    "ignoreSslWarning": "Warning: Disabling certificate verification makes the connection vulnerable to man-in-the-middle attacks. Only enable this if you trust the SMTP server and understand the security implications."
  },
  "cms": {
    "title": "CMS Pages",
--- a/Show More
+++ b/Show More