screenshots for setup PR (#730/#732)

.github/workflows/release-please.yml

@@ -25,14 +25,33 @@ jobs:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
-          target-branch: stable
 
-      # NOTE: stable release PRs are intentionally NOT auto-merged here
-      # anymore. Fixes accumulate in the rolling release PR and are cut as
-      # ONE patch version per day by release-stable-daily.yml (18:00 UTC,
-      # or on demand via workflow_dispatch / a manual merge of the release
-      # PR). Beta keeps instant releases — see release-please-beta.yml —
-      # because same-day reporter verification depends on it.
+      # Auto-approve + auto-merge the open stable release PR. See the beta
+      # workflow for the full rationale. Skipped on the release-cutting run and
+      # whenever no PAT is configured.
+      - name: Auto-approve and enable auto-merge on the release PR
+        if: ${{ steps.release.outputs.release_created != 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          # No checkout in this job — set the repo explicitly so gh works
+          # without a git remote (same pattern as whatsnew, 2a5f0a8).
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$RELEASE_PAT" ]; then
+            echo "RELEASE_PLEASE_TOKEN not set — skipping auto-merge (manual review still required)."
+            exit 0
+          fi
+          pr=$(gh pr list --head release-please--branches--stable --state open --json number --jq '.[0].number // empty')
+          if [ -n "$pr" ]; then
+            # Approve as github-actions[bot] (GITHUB_TOKEN, ≠ the PAT author) so it
+            # is a valid review; enable auto-merge as the PAT so the merge commit is
+            # attributed to a real identity and triggers the tag-cutting run (#719).
+            gh pr review "$pr" --approve --body "Automated approval — release-please version bump + changelog (#719)." || true
+            GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto || true
+          else
+            echo "No open release PR to auto-merge."
+          fi
 
       - name: Output Release Info
         if: ${{ steps.release.outputs.release_created }}

.github/workflows/release-stable-daily.yml

@@ -1,86 +0,0 @@
-name: Cut Stable Release (daily batch)
-
-# Stable fixes accumulate in release-please's rolling release PR instead of
-# each cutting its own patch version (the old per-merge auto-merge produced
-# e.g. 3.45.8 AND 3.45.9 on the same day). This workflow merges the open
-# stable release PR once a day, so a day of N bugfixes ships as ONE version
-# with all N changelog entries — and one Docker build instead of N.
-#
-# - schedule only fires from the default branch (main); the stable copy of
-#   this file is inert and exists to keep the branches in sync.
-# - Need a release NOW? Run this via workflow_dispatch, or merge the
-#   release PR by hand — the schedule is a default, not a gate.
-# - Approval/merge mechanics mirror the old inline step (#719): approve as
-#   github-actions[bot] (GITHUB_TOKEN, a valid distinct reviewer), enable
-#   auto-merge as the PAT so the merge attributes to a real identity and
-#   triggers the tag-cutting run. --auto waits for green checks.
-
-on:
-  schedule:
-    - cron: '0 18 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  merge-stable-release-pr:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Approve and enable auto-merge on the open stable release PR
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          # No checkout — set the repo explicitly so gh works without a
-          # git remote (same pattern as whatsnew, 2a5f0a8).
-          GH_REPO: ${{ github.repository }}
-        run: |
-          if [ -z "$RELEASE_PAT" ]; then
-            echo "RELEASE_PLEASE_TOKEN not set — skipping (manual review required)."
-            exit 0
-          fi
-          # Strict selection (review P1): this job runs daily even without a
-          # stable push, and `gh pr list --head` matches the branch NAME only
-          # — a fork PR can spoof `release-please--branches--stable`. Pin the
-          # base to stable AND require a same-repo head (isCrossRepository
-          # == false); a fork PR is cross-repository, so it can never be
-          # picked and auto-merged with the privileged PAT.
-          pr=$(gh pr list \
-            --base stable \
-            --head release-please--branches--stable \
-            --state open \
-            --json number,isCrossRepository \
-            --jq '[.[] | select(.isCrossRepository == false)] | .[0].number // empty')
-          if [ -z "$pr" ]; then
-            echo "No open same-repo stable release PR — nothing to cut today."
-            exit 0
-          fi
-          # Approve is tolerant — a pre-existing approval already satisfies
-          # branch protection and re-approving can return non-zero.
-          gh pr review "$pr" --approve --body "Automated approval — daily stable release batch (release-please version bump + changelog)." || echo "::warning::approve returned non-zero (PR may already be approved)"
-          # But the auto-merge enable is the load-bearing step: this scheduled
-          # job is the ONLY automatic stable cut, so DON'T swallow its failure
-          # (review P2) — an expired/under-scoped PAT would otherwise stop
-          # releases while the workflow stays green.
-          GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto
-          # `gh pr merge --auto` merges IMMEDIATELY when the required checks
-          # are already green — the normal case at 18:00, since the fixes
-          # merged hours earlier and CI passed. So success is EITHER the PR is
-          # already merged OR an auto-merge request is now pending; only a PR
-          # that is still open with no auto-merge request is a real failure
-          # (expired/under-scoped PAT) worth failing the job on (review round 2).
-          # One snapshot of both fields (review round 3): querying state and
-          # autoMergeRequest separately races — auto-merge can complete
-          # between the two calls, so the first sees OPEN and the second sees
-          # the request already cleared on the now-merged PR → false failure.
-          read -r state automerge < <(gh pr view "$pr" --json state,autoMergeRequest \
-            --jq '[.state, (.autoMergeRequest != null)] | @tsv')
-          if [ "$state" = "MERGED" ]; then
-            echo "Stable release PR #$pr merged immediately (checks were already green)."
-          elif [ "$automerge" = "true" ]; then
-            echo "Auto-merge enabled on stable release PR #$pr — merges when checks are green."
-          else
-            echo "::error::stable release PR #$pr is still open with no auto-merge — check RELEASE_PLEASE_TOKEN scope/expiry."
-            exit 1
-          fi

.github/workflows/tests.yml

@@ -17,9 +17,9 @@ name: Tests
 
 on:
   push:
-    branches: [main, beta, stable]
+    branches: [main, beta]
   pull_request:
-    branches: [main, beta, stable]
+    branches: [main, beta]
   workflow_dispatch:
 
 permissions:

.release-please-manifest-beta.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.83.0-beta.0"
+  ".": "3.81.0-beta.0"
 }

.release-please-manifest.json

@@ -1 +1,3 @@
-{".":"3.45.11"}
+{
+  ".": "2.6.1"
+}

backend/Dockerfile

@@ -27,26 +27,17 @@ FROM node:22-alpine
 
 WORKDIR /app
 
-# Redeclare CACHEBUST — ARGs don't cross stage boundaries, so the builder
-# stage's declaration never reached this stage. Consuming it in the RUN below
-# busts that layer's cache every CI run (CACHEBUST=github.run_number), so the
-# image always picks up current Alpine security updates instead of reusing a
-# stale cached upgrade layer.
-ARG CACHEBUST=1
-
 # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
-RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
+RUN apk upgrade --no-cache
 
-# Remove the npm CLI from the final image. Nothing runs npm here: the
-# entrypoint is node, runtime deps are COPY'd from the builder stage, and
-# wait-for-db.sh invokes the migration runners via node directly. npm's
-# bundled node_modules kept tripping Trivy (sigstore, tar 7.5.19,
-# brace-expansion 5.0.7 — even npm 12.0.1 still ships the vulnerable
-# copies), so shipping no npm ends that alert class instead of chasing
-# per-release patches. Note: `docker exec … npm run <script>` no longer
-# works in the container — use `node migrations/run-migrations-safe.js`
-# and friends instead.
-RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# Upgrade the npm CLI in the final image so its bundled deps are patched
+# (sigstore 4.x, tar) — closes CVE-2026-48815 and the older @sigstore/core / tar
+# Trivy alerts. Safe here: only the CLI present in the image changes. Runtime
+# dependencies come from the builder stage (COPY --from=builder node_modules
+# below) and the entrypoint runs node, not npm — so npm 11's install behaviour
+# (the reason 10.x was pinned) never executes in this stage. npm 11 needs
+# Node >=22.9, satisfied by node:22-alpine.
+RUN npm install -g npm@11
 
 # Install dumb-init for proper signal handling, postgresql-client for database
 # checks, ffmpeg for video upload support, and su-exec for the root → nodejs

backend/__tests__/integration/adminBackupCoverage.test.js

@@ -40,7 +40,7 @@ jest.mock('../../src/middleware/permissions', () => ({
   requirePermission: () => (_req, _res, next) => next(),
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('GET /api/admin/system-health/backup-coverage', () => {
   let db;

backend/__tests__/integration/adminBackupIntegrity.test.js

@@ -29,7 +29,7 @@ jest.mock('../../src/middleware/permissions', () => ({
   requirePermission: () => (_req, _res, next) => next(),
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('GET /api/admin/system-health/backup-integrity', () => {
   let cleanup;

backend/__tests__/integration/backupService.configurableWalker.test.js

@@ -23,7 +23,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — configurable walker (backup_paths)', () => {
   let db;
@@ -177,203 +177,4 @@ describe('backupService — configurable walker (backup_paths)', () => {
     const filesOn = await backupService.getFilesToBackup(true);
     expect(filesOn.map((f) => f.relativePath)).toContain('events/archived/E3/legacy.jpg');
   });
-
-  // Issue #871 — the "What to Backup" checkboxes were stored but never read.
-  describe('UI opt-out toggles (issue #871)', () => {
-    it('unchecking Thumbnails excludes thumbnails/', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_thumbnails: false,
-      });
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('events/active/E1/photo.jpg');
-      expect(rels).not.toContain('thumbnails/E1/thumb.jpg');
-    });
-
-    it('unchecking Photos excludes events/active', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_photos: false,
-      });
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('thumbnails/E1/thumb.jpg');
-      expect(rels).not.toContain('events/active/E1/photo.jpg');
-    });
-
-    it('defaults to including everything when the keys were never saved', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({});
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('thumbnails/E1/thumb.jpg');
-      expect(rels).toContain('events/active/E1/photo.jpg');
-    });
-
-    it("accepts the UI's plural backup_include_archives for the archived gate", async () => {
-      seedFile('events/archived/E4/archived.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_archives: true,
-      });
-      expect(files.map((f) => f.relativePath)).toContain('events/archived/E4/archived.jpg');
-    });
-
-    it('the UI plural key beats the migration-seeded singular key', async () => {
-      // Migration seeds backup_include_archived=true on every install; the
-      // form only ever writes the plural key, so unchecking Archives must
-      // win over the stale seeded value.
-      seedFile('events/archived/E5/archived.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_archived: true,   // seeded default
-        backup_include_archives: false,  // what the admin actually chose
-      });
-      expect(files.map((f) => f.relativePath)).not.toContain('events/archived/E5/archived.jpg');
-    });
-
-    it('rsync gets the de-selected paths and noise filters as --exclude args', async () => {
-      const excluded = await backupService.resolveExcludedBackupPaths({
-        backup_include_thumbnails: false,
-        backup_include_archives: false,
-      });
-      expect(excluded.map((r) => r.path)).toEqual(
-        expect.arrayContaining(['thumbnails', 'events/archived'])
-      );
-
-      const args = backupService.buildRsyncArgs(
-        { backup_rsync_host: 'backup.example.com', backup_rsync_path: '/srv/backups' },
-        excluded.map((r) => `/${r.path}/`)
-      );
-      const excludes = args
-        .map((a, i) => (a === '--exclude' ? args[i + 1] : null))
-        .filter(Boolean);
-      expect(excludes).toEqual(expect.arrayContaining([
-        '.nfs*',
-        '/thumbnails/',
-        '/events/archived/',
-      ]));
-    });
-
-    it('rows toggled off via include_in_default also become rsync excludes', async () => {
-      // The enabled-only loader hides these rows from the walker, but rsync
-      // syncs the whole storage root, so they must still appear as excludes.
-      await db('backup_paths').where('path', 'previews').update({
-        include_in_default: false,
-      });
-
-      const excluded = await backupService.resolveExcludedBackupPaths({});
-      expect(excluded.map((r) => r.path)).toContain('previews');
-    });
-  });
-
-  // Issue #871 — .nfs* silly-rename artifacts were uploaded to S3.
-  it('never backs up filesystem noise (.nfs*, .DS_Store)', async () => {
-    seedFile('thumbnails/E1/.nfs000000000000006600000008');
-    seedFile('events/active/E1/.DS_Store');
-    seedFile('events/active/E1/photo.jpg');
-
-    const files = await backupService.getFilesToBackup({});
-    const rels = files.map((f) => f.relativePath);
-
-    expect(rels).toContain('events/active/E1/photo.jpg');
-    expect(rels.some((r) => r.includes('.nfs'))).toBe(false);
-    expect(rels.some((r) => r.includes('.DS_Store'))).toBe(false);
-  });
-
-  it('the walker honors backup_exclude_patterns (previously rsync-only)', async () => {
-    seedFile('events/active/E1/photo.jpg');
-    seedFile('events/active/E1/scratch.tmp');
-
-    const files = await backupService.getFilesToBackup({
-      backup_exclude_patterns: ['*.tmp'],
-    });
-    const rels = files.map((f) => f.relativePath);
-
-    expect(rels).toContain('events/active/E1/photo.jpg');
-    expect(rels).not.toContain('events/active/E1/scratch.tmp');
-  });
-
-  it('glob patterns are literal outside the star (.nfs* must not eat anfs-…)', async () => {
-    seedFile('events/active/E1/anfs-photo.jpg');
-    seedFile('events/active/E1/notes-tmp');
-
-    const files = await backupService.getFilesToBackup({
-      backup_exclude_patterns: ['*.tmp'],
-    });
-    const rels = files.map((f) => f.relativePath);
-
-    // '.nfs*' used to compile to /^.nfs.*$/ whose dot matched any char;
-    // '*.tmp' used to compile to /^.*.tmp$/ which also matched 'notes-tmp'.
-    expect(rels).toContain('events/active/E1/anfs-photo.jpg');
-    expect(rels).toContain('events/active/E1/notes-tmp');
-  });
-
-  // Issue #871 — weekly schedules silently ran daily, and the dashboard's
-  // "next backup" was a hardcoded "tomorrow 02:00".
-  describe('schedule resolution + next run (issue #871)', () => {
-    it('a named label beats the stray default cron the UI used to send', () => {
-      expect(backupService.resolveScheduleCron({
-        backup_schedule: 'weekly',
-        backup_schedule_cron: '0 3 * * *', // old UI default, sent unconditionally
-      })).toBe('0 3 * * 0');
-    });
-
-    it('custom schedules use the cron field', () => {
-      expect(backupService.resolveScheduleCron({
-        backup_schedule: 'custom',
-        backup_schedule_cron: '15 5 * * 2',
-      })).toBe('15 5 * * 2');
-    });
-
-    it('falls back to the default daily cron', () => {
-      expect(backupService.resolveScheduleCron({})).toBe('0 2 * * *');
-    });
-
-    it('getNextScheduledRun is null when backups are disabled', () => {
-      expect(backupService.getNextScheduledRun(null)).toBeNull();
-      expect(backupService.getNextScheduledRun({ backup_enabled: false })).toBeNull();
-    });
-
-    it('getNextScheduledRun returns the real next weekly fire time', () => {
-      const iso = backupService.getNextScheduledRun({
-        backup_enabled: true,
-        backup_schedule: 'weekly',
-        backup_schedule_cron: '0 3 * * *',
-      });
-      const next = new Date(iso);
-      expect(Number.isNaN(next.getTime())).toBe(false);
-      expect(next.getTime()).toBeGreaterThan(Date.now());
-      expect(next.getDay()).toBe(0);   // Sunday
-      expect(next.getHours()).toBe(3); // 03:00
-    });
-  });
-
-  // Issue #871 — "Backup Size: 167.6 TB": file_size_bytes is a bigInteger
-  // column, node-postgres returns int8 as a string, and the S3 path did
-  // `backedUpSize += size` — string concatenation.
-  it('getDatabaseBackupInfo coerces file_size_bytes to a number', async () => {
-    await db('database_backup_runs').del();
-    await db('database_backup_runs').insert({
-      backup_type: 'full',
-      status: 'completed',
-      file_path: '/backups/db/dump.sql.gz',
-      // Simulate the PG int8-as-string driver behaviour (sqlite stores
-      // whatever it is handed, so the string round-trips).
-      file_size_bytes: '421988',
-      started_at: new Date().toISOString(),
-      completed_at: new Date().toISOString(),
-    });
-
-    const info = await backupService.getDatabaseBackupInfo();
-    expect(typeof info.size).toBe('number');
-    expect(info.size).toBe(421988);
-  });
 });

backend/__tests__/integration/backupService.inlineDbDump.test.js

@@ -34,7 +34,7 @@ jest.mock('../../src/services/databaseBackup', () => ({
   DatabaseBackupService: class {},
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — inline DB dump + fail-loud guard', () => {
   let db;

backend/__tests__/integration/backupService.perPathStats.test.js

@@ -23,7 +23,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — per-Stage-B-path statistics', () => {
   let db;

backend/__tests__/integration/backupService.smoke.test.js

@@ -14,7 +14,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — config + file collection + manifest (smoke)', () => {
   let db;

backend/__tests__/integration/bookingCutover.test.js

@@ -7,7 +7,7 @@
 const crypto = require('crypto');
 const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('booking cutover — draft invoices on hold', () => {
   let db; let cleanup; let adminId; let customerId; let quoteService;

backend/__tests__/integration/discountLineItems.test.js

@@ -14,7 +14,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 // Service-level CRM calls cold-require heavy modules (pdfService,
 // nodemailer, etc.) on first use; the global 5 s per-test budget is
 // too tight for that. Bump it for this file only.
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('discount line items (negative unit_price_minor)', () => {
   let db;

backend/__tests__/integration/eventTypeRename.test.js

@@ -6,7 +6,7 @@
 const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
 // bootCrmDb runs the full core-migration set in beforeAll.
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('event type slug rename cascade', () => {
   let db;

backend/__tests__/integration/galleryShortUrlRoute.test.js

@@ -17,7 +17,7 @@ const request = require('supertest');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db; let cleanup; let service; let app;
 

backend/__tests__/integration/galleryShortUrls.test.js

@@ -19,7 +19,7 @@
  */
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db; let cleanup; let service; let adminId;
 

backend/__tests__/integration/incomingInvoiceRebill.test.js

@@ -13,7 +13,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
 // Service-level CRM calls cold-require heavy modules (pdfService, nodemailer)
 // on first use; bump the budget for this file.
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 describe('incoming-invoice categorise / re-bill chain', () => {
   let db;

backend/__tests__/integration/installFromBackupBoot.test.js

@@ -32,7 +32,7 @@ jest.mock('../../src/services/restoreService', () => ({
   },
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('installFromBackupBoot', () => {
   let db;

backend/__tests__/integration/invoiceDunning.test.js

@@ -13,7 +13,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;

backend/__tests__/integration/picpeakExport.test.js

@@ -21,7 +21,7 @@ beforeAll(async () => {
   ({ db, cleanup, tmpDir } = await bootCrmDb());
   process.env.STORAGE_PATH = tmpDir; // isolate file collection to the temp dir
   ({ createPicpeak } = require('../../src/services/picpeakExportService'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/picpeakRoundtrip.test.js

@@ -28,7 +28,7 @@ beforeAll(async () => {
   ({ importFromPicpeak, validateManifest } = require('../../src/services/picpeakImportService'));
   const role = await db('roles').where({ name: 'super_admin' }).first();
   superAdminRoleId = role.id;
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/resetAdminMfaCli.test.js

@@ -13,14 +13,14 @@ const { execFileSync } = require('child_process');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db;
 let cleanup;
 
 beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   if (cleanup) await cleanup();

backend/__tests__/integration/restoreService.pgBranch.test.js

@@ -183,24 +183,22 @@ describe('restoreService — PG branch scope contract (PR #596 review)', () => {
     expect(window).toMatch(/was_successful:\s*true/);
   });
 
-  it('the safe migration runner is invoked after the replay in restore()', () => {
+  it('npm run migrate:safe is invoked after the replay in restore()', () => {
     // Contract from PR #596 round 4: backups taken on older picpeak
     // versions must restore COMPLETELY on a newer image — even if new
     // migrations have been added since the backup was taken. The
-    // restore() flow shells out to the safe migration runner AFTER the
+    // restore() flow shells out to `npm run migrate:safe` AFTER the
     // operator-meta replay so the schema catches up to the running
     // code WITHIN the restore boundary (not on the next container
-    // restart). Invoked as `node migrations/run-migrations-safe.js` —
-    // the runtime image ships no npm, so the former `npm run
-    // migrate:safe` would ENOENT into the non-fatal catch.
+    // restart).
     //
     // Contract:
-    //   1. A run-migrations-safe shell-out exists somewhere in restoreService
+    //   1. A `migrate:safe` shell-out exists somewhere in restoreService
     //   2. It sits AFTER the replay drain — verification → replay →
     //      migrations is the documented order
     //   3. It does NOT sit inside performDatabaseRestore (must run
     //      against the reinit'd pool from the parent restore())
-    const migrateLine = findFirst(/run-migrations-safe\.js/);
+    const migrateLine = findFirst(/['"]migrate:safe['"]/);
     expect(migrateLine).toBeGreaterThan(0);
 
     const replayLine = findLast(/this\.preservedMetaSnapshot\.length\s*>\s*0/);

backend/__tests__/integration/setupService.test.js

@@ -27,7 +27,7 @@ beforeAll(async () => {
   setupService = require('../../src/services/setupService');
   ({ getAppSetting, upsertAppSetting } = require('../../src/utils/appSettings'));
   app = buildRouteApp('/api/setup', require('../../src/routes/setup'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/workflowEngine.test.js

@@ -10,7 +10,7 @@ const { bootCrmDb } = require('./helpers/crmDb');
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;
@@ -239,7 +239,7 @@ describe('workflow engine', () => {
     expect(again.already).toBe(true);
   });
 
-  test('seeds the invoice-dunning built-in as the delegation graph (disabled for first beta)', async () => {
+  test('seeds the invoice-dunning built-in as the delegation graph (v6, disabled for first beta)', async () => {
     const { seedBuiltinWorkflowsAtBoot, DUNNING_KEY } = require('../../src/services/_workflowSeedBoot');
     const noopLogger = { info() {}, warn() {} };
     await seedBuiltinWorkflowsAtBoot(db, noopLogger);
@@ -248,7 +248,7 @@ describe('workflow engine', () => {
     expect(wf).toBeTruthy();
     expect(!!wf.is_builtin).toBe(true);
     expect(!!wf.enabled).toBe(false); // first beta: ships disabled; legacy ladder runs until enabled
-    expect(JSON.parse(wf.trigger_config).seedVersion).toBe(7);
+    expect(JSON.parse(wf.trigger_config).seedVersion).toBe(6);
 
     const nodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: wf.version });
     expect(nodes.filter((n) => n.type === 'trigger')).toHaveLength(1);
@@ -273,7 +273,7 @@ describe('workflow engine', () => {
     await seedBuiltinWorkflowsAtBoot(db, noopLogger);
     const reseeded = await db('workflows').where({ id: wf.id }).first();
     expect(reseeded.version).toBe(wf.version + 1); // bumped
-    expect(JSON.parse(reseeded.trigger_config).seedVersion).toBe(7);
+    expect(JSON.parse(reseeded.trigger_config).seedVersion).toBe(6);
     expect(!!reseeded.enabled).toBe(false); // seed default re-applied (not admin-owned → flips enabled→disabled)
     const newNodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: reseeded.version });
     expect(newNodes.some((n) => n.type === 'gate')).toBe(false); // legacy graph replaced

backend/__tests__/integration/workflowRoutes.test.js

@@ -9,7 +9,7 @@ const {
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;

backend/__tests__/routes/adminCrmAuth.test.js

@@ -83,7 +83,7 @@ describe('admin CRM routes — auth + permission gate', () => {
     // Invalid: signed with a different secret. adminAuth must reject.
     const jwt = require('jsonwebtoken');
     invalidToken = jwt.sign({ id: adminId, type: 'admin' }, 'WRONG-SECRET', { issuer: 'picpeak-auth' });
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/adminEvents.smoke.test.js

@@ -180,27 +180,6 @@ describe('admin events CRUD endpoints (smoke)', () => {
       });
       expect(res.status).toBe(404);
     });
-
-    // #822 — hero_logo_visible/position are nullable (null = "inherit the global
-    // branding toggle"), but the validator used .optional() without
-    // { nullable: true }, so an explicit null was rejected with 400.
-    it('accepts hero_logo_visible: null and stores NULL (inherit)', async () => {
-      const id = await insertEvent(db, adminId, { hero_logo_visible: 1 });
-      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
-        hero_logo_visible: null,
-      });
-      expect(res.status).toBe(200);
-      const row = await db('events').where({ id }).first();
-      expect(row.hero_logo_visible).toBeNull();
-    });
-
-    it('still rejects a non-boolean hero_logo_visible', async () => {
-      const id = await insertEvent(db, adminId);
-      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
-        hero_logo_visible: 'maybe',
-      });
-      expect(res.status).toBe(400);
-    });
   });
 
   describe('DELETE /:id', () => {

backend/__tests__/routes/adminMfa.test.js

@@ -39,7 +39,7 @@ const {
   bootCrmDb, mintAdminToken, buildRouteApp,
 } = require('../integration/helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db;
 let cleanup;
@@ -95,7 +95,7 @@ beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
   adminApp = buildRouteApp('/api/admin/auth', require('../../src/routes/adminAuth'));
   authApp = buildRouteApp('/api/auth', require('../../src/routes/auth'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   if (cleanup) await cleanup();

backend/__tests__/routes/adminPhotoContentType.test.js

@@ -1,238 +0,0 @@
-/**
- * Admin photo view route Content-Type (#908).
- *
- * The route built `image/<ext>` from the filename, producing invalid
- * types like image/mp4 for videos. AdminAuthenticatedVideo fetches this
- * URL into a blob whose type inherits the header, and browsers refuse to
- * play a <video> blob labeled image/* — blank/grey admin video preview.
- *
- * Pins (incl. external-review hardening):
- *  - the header is ALWAYS image/* or video/*: a stored non-media MIME
- *    (chunked uploads store the client-sent type unvalidated) is never
- *    echoed — text/html inline under the app origin would be XSS
- *  - stored video/ MIME wins; MIME-less videos map from the extension
- *    (.mov → video/quicktime), unknown video extensions get video/mp4
- *  - images IGNORE the stored MIME (migration 039 backfilled image/jpeg
- *    onto every legacy row, PNGs included) and use the extension,
- *    normalized (jpg → image/jpeg); extensionless files get image/jpeg
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-ct-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'admin-ct-test-event';
-
-describe('admin photo view Content-Type (#908)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let adminToken;
-
-  const addPhoto = async (filename, extra = {}) => {
-    const dir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, filename), Buffer.from(`bytes-${filename}`));
-    const r = await db('photos').insert({
-      event_id: eventId,
-      filename,
-      path: `${SLUG}/${filename}`,
-      type: 'individual',
-      uploaded_at: new Date().toISOString(),
-      ...extra,
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const getPhotoRes = (photoId) => request(app)
-    .get(`/api/admin/photos/${eventId}/photo/${photoId}`)
-    .set('Authorization', `Bearer ${adminToken}`);
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Admin CT Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'admin-ct-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const superRole = await db('roles').where({ name: 'super_admin' }).first();
-    const [rootId] = await db('admin_users').insert({
-      username: 'admin-ct-admin',
-      email: 'admin-ct-admin@example.com',
-      password_hash: await bcrypt.hash('AdminCt123', 4),
-      role_id: superRole.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id').then((r) => [r[0]?.id || r[0]]);
-    adminToken = jwt.sign(
-      { id: rootId, username: 'admin-ct-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' }
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('serves a video with its stored mime_type, not image/<ext>', async () => {
-    const id = await addPhoto('clip.mp4', { media_type: 'video', mime_type: 'video/mp4' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('maps MIME-less videos from their extension (.mov → video/quicktime)', async () => {
-    const id = await addPhoto('clip-nomime.mov', { media_type: 'video' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/quicktime');
-  });
-
-  it('falls back to video/mp4 for a video with an unknown extension', async () => {
-    const id = await addPhoto('clip-unknown.xyz', { media_type: 'video' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('rejects malformed video/ MIME values that would break setHeader', async () => {
-    // Header-invalid chars in the stored value must not 500 the route —
-    // fall back to the extension map instead.
-    const id = await addPhoto('crlf.mp4', {
-      media_type: 'video',
-      mime_type: 'video/mp4\r\nX-Evil: 1',
-    });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-    expect(res.headers['x-evil']).toBeUndefined();
-
-    const bare = await addPhoto('bare.webm', { media_type: 'video', mime_type: 'video/' });
-    const res2 = await getPhotoRes(bare);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('video/webm');
-  });
-
-  it('preserves an auto-imported avif via the safe stored-MIME allowlist', async () => {
-    // .avif isn't in EXTENSION_TO_MIME; s3AutoImporter stores image/avif.
-    // Map-only would mislabel it image/jpeg — the allowlist keeps it.
-    const id = await addPhoto('imported.avif', { mime_type: 'image/avif' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/avif');
-  });
-
-  it('preserves other importer raster types too (apng, x-icon)', async () => {
-    const apng = await addPhoto('anim.apng', { mime_type: 'image/apng' });
-    expect((await getPhotoRes(apng)).headers['content-type']).toBe('image/apng');
-    const ico = await addPhoto('fav.ico', { mime_type: 'image/x-icon' });
-    expect((await getPhotoRes(ico)).headers['content-type']).toBe('image/x-icon');
-  });
-
-  it('does NOT honor a stored scriptable image type (image/svg+xml)', async () => {
-    // svg is inline-scriptable and must never be echoed — allowlist excludes it.
-    const id = await addPhoto('vector.svg', { mime_type: 'image/svg+xml' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('never echoes a stored non-media MIME type (inline XSS guard)', async () => {
-    const id = await addPhoto('evil.png', { mime_type: 'text/html' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('ignores the migration-039 image/jpeg backfill on legacy PNG rows', async () => {
-    const id = await addPhoto('legacy.png', { mime_type: 'image/jpeg' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('normalizes jpg to the canonical image/jpeg', async () => {
-    const id = await addPhoto('shot.jpg');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('keeps the extension fallback for images without a stored mime_type', async () => {
-    const id = await addPhoto('shot.png');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('handles Object.prototype key extensions without a 500 (.constructor)', async () => {
-    // The extension-to-MIME lookup must be own-property only — a raw
-    // index access returns an inherited function for these keys and the
-    // downstream startsWith throws. Serve image/jpeg instead of 500.
-    const id = await addPhoto('payload.constructor');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-
-    const id2 = await addPhoto('payload.__proto__', { media_type: 'video' });
-    const res2 = await getPhotoRes(id2);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('does not synthesize types from unmapped image extensions', async () => {
-    // Raw interpolation would produce image/svg+xml (scriptable inline)
-    // or arbitrary strings from client-controlled filenames — the shared
-    // map is the allowlist, everything else is served as image/jpeg.
-    const svg = await addPhoto('vector.svg+xml');
-    const res = await getPhotoRes(svg);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-
-    const weird = await addPhoto('weird.xyz');
-    const res2 = await getPhotoRes(weird);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('extensionless files get image/jpeg, never a bare image/', async () => {
-    const id = await addPhoto('noext');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-});

backend/__tests__/routes/authShareLoginPassword.test.js

@@ -1,127 +0,0 @@
-/**
- * Regression test for GHSA-9hmx-68vc-qpqw — share-link login must not bypass
- * the gallery password.
- *
- * POST /auth/gallery/share-login validates only the share token. For a
- * password-protected gallery it previously minted a full `type:'gallery'`
- * access token on the share token alone, letting anyone holding the share URL
- * read the gallery without the password. The fix: when the gallery requires a
- * password, return `{ requires_password: true }` with NO token and NO cookie.
- */
-
-const express = require('express');
-const request = require('supertest');
-
-process.env.JWT_SECRET = 'share-login-test-secret';
-
-const events = [];
-
-jest.mock('../../src/database/db', () => {
-  function dbFn(table) {
-    if (table === 'events') {
-      let filter = () => true;
-      return {
-        where(criteria) {
-          filter = (row) => Object.entries(criteria).every(([k, v]) => {
-            if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
-            if (k === 'is_archived') return Boolean(row.is_archived) === Boolean(v);
-            return row[k] === v;
-          });
-          return this;
-        },
-        async first() { return events.find(filter); },
-      };
-    }
-    return { where() { return this; }, async first() { return undefined; } };
-  }
-  dbFn.raw = async () => {};
-  return { db: dbFn, logActivity: async () => {} };
-});
-
-// Share token is stored plainly on the fake event row.
-jest.mock('../../src/services/shareLinkService', () => ({
-  getEventShareToken: (event) => event.share_token,
-  resolveShareIdentifier: async () => ({ event: null }),
-}));
-
-const mockSetGalleryAuthCookies = jest.fn();
-jest.mock('../../src/utils/tokenUtils', () => ({
-  setGalleryAuthCookies: (...args) => mockSetGalleryAuthCookies(...args),
-  clearGalleryAuthCookies: jest.fn(),
-  getGalleryTokenFromRequest: jest.fn(),
-  setAdminAuthCookies: jest.fn(),
-}));
-
-jest.mock('../../src/utils/authSecurity', () => ({
-  trackFailedAttempt: jest.fn(async () => {}),
-  trackSuccessfulLogin: jest.fn(async () => {}),
-  checkAccountLockout: jest.fn(async () => ({ isLocked: false })),
-  resetLockout: jest.fn(async () => {}),
-}));
-
-// Collaborators the router imports at load but the share-login path doesn't hit.
-jest.mock('../../src/services/recaptcha', () => ({ verifyRecaptcha: async () => true }));
-jest.mock('../../src/services/mfaService', () => ({}));
-jest.mock('../../src/middleware/sessionTimeout', () => ({ endSession: jest.fn(), sessionTimeoutMiddleware: (req, res, next) => next() }));
-jest.mock('../../src/utils/tokenRevocation', () => ({ revokeToken: jest.fn(async () => {}), isTokenRevoked: async () => false }));
-
-const authRouter = require('../../src/routes/auth');
-
-function makeApp() {
-  const app = express();
-  app.use(express.json());
-  app.use('/auth', authRouter);
-  return app;
-}
-
-const SHARE_TOKEN = 'a'.repeat(64);
-
-beforeEach(() => {
-  events.length = 0;
-  mockSetGalleryAuthCookies.mockClear();
-});
-
-describe('POST /auth/gallery/share-login password enforcement', () => {
-  it('does NOT mint a token for a password-protected gallery', async () => {
-    events.push({
-      id: 1, slug: 'private-gallery', is_active: 1, is_archived: 0,
-      require_password: 1, share_token: SHARE_TOKEN, event_name: 'Private',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'private-gallery', token: SHARE_TOKEN });
-
-    expect(res.status).toBe(200);
-    expect(res.body.requires_password).toBe(true);
-    expect(res.body.token).toBeUndefined();
-    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
-  });
-
-  it('mints a token for a public (no-password) gallery', async () => {
-    events.push({
-      id: 2, slug: 'public-gallery', is_active: 1, is_archived: 0,
-      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'public-gallery', token: SHARE_TOKEN });
-
-    expect(res.status).toBe(200);
-    expect(typeof res.body.token).toBe('string');
-    expect(res.body.event).toBeDefined();
-    expect(mockSetGalleryAuthCookies).toHaveBeenCalledTimes(1);
-  });
-
-  it('rejects a wrong share token regardless of password setting', async () => {
-    events.push({
-      id: 3, slug: 'public-gallery', is_active: 1, is_archived: 0,
-      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'public-gallery', token: 'b'.repeat(64) });
-
-    expect(res.status).toBe(401);
-    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
-  });
-});

backend/__tests__/routes/authzPermissionGaps.test.js

@@ -1,211 +0,0 @@
-/**
- * Authorization / ownership gaps (GHSA permission cluster):
- *  - jm7j: API-token list must scope to the caller (non-super sees only own)
- *  - gprq: API-token revoke must be owner-or-super_admin
- *  - 3rqx: event update must not mass-assign identity/secret columns
- *  - j2f4: category hero must belong to that category
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'authz-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const bcrypt = require('bcrypt');
-const {
-  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken,
-} = require('../integration/helpers/crmDb');
-
-describe('authorization / ownership gaps', () => {
-  let db; let cleanup; let app;
-  let superId; let superTok; let adminId; let adminTok;
-
-  const grantPermissionToRole = async (roleName, permName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const perm = await db('permissions').where({ name: permName }).first();
-    const exists = await db('role_permissions')
-      .where({ role_id: role.id, permission_id: perm.id }).first();
-    if (!exists) {
-      await db('role_permissions').insert({ role_id: role.id, permission_id: perm.id });
-    }
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    ({ adminId: superId } = await seedMinimal(db));
-    await assignAdminRole(db, superId, 'super_admin');
-    superTok = mintAdminToken(superId);
-
-    const pass = await bcrypt.hash('x', 4);
-    const ins = await db('admin_users').insert({
-      username: 'plain-admin', email: 'plain@example.com',
-      password_hash: pass, must_change_password: false, created_at: new Date(),
-    }).returning('id');
-    adminId = ins[0]?.id ?? ins[0];
-    await assignAdminRole(db, adminId, 'admin');
-    // Grant settings.edit to the admin role BEFORE any request populates the
-    // 60s permission cache, so the revoke test exercises the ownership check
-    // (404) rather than the missing-permission gate (403). This models a
-    // custom role that carries settings.edit — the scenario GHSA-gprq needs.
-    await grantPermissionToRole('admin', 'settings.edit');
-    adminTok = mintAdminToken(adminId);
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/admin/api-tokens', require('../../src/routes/adminApiTokens'));
-    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-    app.use('/api/admin/categories', require('../../src/routes/adminCategories'));
-    // eslint-disable-next-line no-unused-vars
-    app.use((err, req, res, next) => {
-      res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
-    });
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  const auth = (req, tok) => req.set('Authorization', `Bearer ${tok}`);
-
-  describe('API tokens (jm7j / gprq)', () => {
-    let superTokenId;
-
-    beforeAll(async () => {
-      const res = await auth(request(app).post('/api/admin/api-tokens'), superTok)
-        .send({ name: 'super-token', scopes: ['read'] });
-      expect(res.status).toBe(201);
-      superTokenId = res.body.id;
-    });
-
-    it('non-super admin does not see another admin\'s tokens in the list', async () => {
-      const res = await auth(request(app).get('/api/admin/api-tokens'), adminTok);
-      expect(res.status).toBe(200);
-      expect(res.body.find((t) => t.id === superTokenId)).toBeUndefined();
-    });
-
-    it('super_admin sees all tokens', async () => {
-      const res = await auth(request(app).get('/api/admin/api-tokens'), superTok);
-      expect(res.status).toBe(200);
-      expect(res.body.find((t) => t.id === superTokenId)).toBeDefined();
-    });
-
-    it('a non-owner (with settings.edit) cannot revoke another admin\'s token', async () => {
-      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), adminTok);
-      expect(res.status).toBe(404);
-      const row = await db('api_tokens').where({ id: superTokenId }).first();
-      expect(row.revoked_at).toBeFalsy();
-    });
-
-    it('the owner can revoke their own token', async () => {
-      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), superTok);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('event update mass-assignment (3rqx)', () => {
-    it('ignores identity/secret columns in the request body', async () => {
-      const seedShareToken = 'orig-share-token';
-      const ins = await db('events').insert({
-        slug: 'authz-mass-assign', event_type: 'wedding', event_name: 'Before',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'orig-hash', share_link: '/gallery/authz/share', share_token: seedShareToken, expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const eventId = ins[0]?.id ?? ins[0];
-
-      const res = await auth(request(app).put(`/api/admin/events/${eventId}`), superTok).send({
-        event_name: 'After',
-        created_by: 99999,
-        slug: 'hijacked-slug',
-        share_token: 'hijacked-token',
-        password_hash: 'hijacked-hash',
-        is_archived: 1,
-        archive_path: '/hijacked/archive/path',
-        hero_logo_path: '/etc/passwd',
-        is_draft: 1,
-        project_id: 99999,
-        // Case-variant keys — SQLite matches columns case-insensitively.
-        Password_Hash: 'case-hijack-hash',
-        Created_By: 88888,
-      });
-      expect(res.status).toBe(200);
-
-      const row = await db('events').where({ id: eventId }).first();
-      expect(row.event_name).toBe('After');        // legit field applied
-      expect(row.created_by).toBe(superId);         // ownership untouched (+ case-variant)
-      expect(row.slug).toBe('authz-mass-assign');   // routing identity untouched
-      expect(row.share_token).toBe(seedShareToken); // secret untouched
-      expect(row.password_hash).toBe('orig-hash');  // secret untouched (+ case-variant)
-      expect(row.is_archived).toBeFalsy();          // archive lifecycle untouched
-      expect(row.archive_path).toBeFalsy();         // forged archive path rejected
-      expect(row.hero_logo_path).toBeFalsy();       // fs.unlink primitive blocked
-      expect(row.is_draft).toBeFalsy();             // publish workflow not bypassed
-      expect(row.project_id).toBeFalsy();           // server-managed relationship untouched
-    });
-
-    it('returns 200 (no-op) when the body contains only protected fields', async () => {
-      const ins = await db('events').insert({
-        slug: 'authz-empty-update', event_type: 'wedding', event_name: 'Keep',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'x', share_link: '/gallery/authz-empty/share', share_token: 'authz-empty-share',
-        expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const id = ins[0]?.id ?? ins[0];
-      // Body reduces to {} after the denylist — must not 500 (Knex rejects
-      // .update({})).
-      const res = await auth(request(app).put(`/api/admin/events/${id}`), superTok)
-        .send({ created_by: 1, slug: 'x', is_archived: 1 });
-      expect(res.status).toBe(200);
-      const row = await db('events').where({ id }).first();
-      expect(row.event_name).toBe('Keep');
-    });
-  });
-
-  describe('category hero cross-category (j2f4)', () => {
-    it('rejects a hero photo that is not in the category', async () => {
-      const evIns = await db('events').insert({
-        slug: 'authz-cat', event_type: 'wedding', event_name: 'Cat Event',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'x', share_link: '/gallery/authz-cat/share', share_token: 'authz-cat-share', expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const evId = evIns[0]?.id ?? evIns[0];
-
-      const mkCat = async (name) => {
-        const c = await db('photo_categories').insert({
-          event_id: evId, name, slug: name.toLowerCase(), created_at: new Date().toISOString(),
-        }).returning('id');
-        return c[0]?.id ?? c[0];
-      };
-      const cat1 = await mkCat('Cat1');
-      const cat2 = await mkCat('Cat2');
-
-      const pIns = await db('photos').insert({
-        event_id: evId, filename: 'p.jpg', path: 'authz-cat/p.jpg', type: 'individual',
-        category_id: cat1, uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      const photoInCat1 = pIns[0]?.id ?? pIns[0];
-
-      // Pointing cat2's hero at a photo that lives in cat1 must be refused.
-      const bad = await auth(request(app).put(`/api/admin/categories/${cat2}/hero`), superTok)
-        .send({ hero_photo_id: photoInCat1 });
-      expect(bad.status).toBe(404);
-
-      // The photo's own category accepts it.
-      const ok = await auth(request(app).put(`/api/admin/categories/${cat1}/hero`), superTok)
-        .send({ hero_photo_id: photoInCat1 });
-      expect(ok.status).toBe(200);
-    });
-  });
-});

backend/__tests__/routes/backupExportSuperadmin.test.js

@@ -1,95 +0,0 @@
-/**
- * Full-instance export is super_admin only (GHSA-pv6w-rj34-wj9v).
- *
- * GET /api/admin/backup/picpeak/export dumps every table unredacted (bcrypt
- * hashes, 2FA, SMTP/SSO/WhatsApp/webhook/S3 secrets). It was gated only by
- * requirePermission('backup.create'), which the built-in `admin` role holds —
- * so any non-super_admin admin could download the whole database. Pins that
- * `admin` now gets 403 and `super_admin` passes the gate.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-bkexport-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'bkexport-test-secret';
-
-// The export otherwise walks the whole DB and writes a zip — stub it so the
-// super_admin happy path is fast and deterministic; the gate is what's tested.
-// The route deletes path.dirname(filePath) recursively after download, so the
-// stub MUST live in its own dir — a bare os.tmpdir() file would make the route
-// wipe the whole temp root (and other jest workers' DB files).
-const mockExportDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-export-stub-'));
-const mockExportPath = path.join(mockExportDir, 'export.picpeak');
-fs.writeFileSync(mockExportPath, 'stub');
-jest.mock('../../src/services/picpeakExportService', () => ({
-  createPicpeak: jest.fn(async () => ({ filePath: mockExportPath })),
-}));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('backup export super_admin gate (GHSA-pv6w)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let adminToken; let superToken;
-
-  const mkUser = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username,
-      email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    return jwt.sign(
-      { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' },
-    );
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    adminToken = await mkUser('limited-admin', 'admin');
-    superToken = await mkUser('root-admin', 'super_admin');
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/backup', require('../../src/routes/adminBackup'));
-  }, 120000);
-
-  afterAll(async () => {
-    if (cleanup) await cleanup();
-    fs.rmSync(mockExportDir, { recursive: true, force: true });
-  });
-
-  it('denies the built-in admin role (was: full DB dump)', async () => {
-    const res = await request(app)
-      .get('/api/admin/backup/picpeak/export')
-      .set('Authorization', `Bearer ${adminToken}`);
-    expect(res.status).toBe(403);
-  });
-
-  it('allows super_admin', async () => {
-    const res = await request(app)
-      .get('/api/admin/backup/picpeak/export')
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(res.status).not.toBe(403);
-    expect(res.status).toBeLessThan(500);
-  });
-});

backend/__tests__/routes/hiddenPhotoAccessControl.test.js

@@ -1,240 +0,0 @@
-/**
- * Hidden/client-only photo access control across the bulk + secure photo
- * routes (GHSA cluster: fpwq / ghf8 / 3jvw / 9cc4 / 2hqg / jc22).
- *
- * A photo with visibility='hidden' is client-only. The main photo-list and
- * single-photo download/view routes enforced this, but the bulk-download,
- * protected-image, and secure-image routes shipped without the check —
- * letting an ordinary guest reach hidden photos. These tests pin that
- * guests are refused and PIN-clients (accessLevel='client') still succeed.
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-hidden-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'hidden-photo-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-hidden-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'hidden-photo-test-event';
-
-describe('hidden-photo access control (GHSA cluster)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let visibleId;
-  let hiddenId;
-
-  const guestToken = () => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery' },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-  const clientToken = () => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery', accessLevel: 'client' },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Hidden Photo Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'hidden-photo-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0, allow_downloads: 1,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const photoDir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(photoDir, { recursive: true });
-
-    // A real 1x1 PNG so the protected /view route's Sharp processing path
-    // succeeds (fake bytes 500 on metadata()). Content, not extension,
-    // drives Sharp's format detection.
-    const PNG_1x1 = Buffer.from(
-      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M8AAAMCAQGV2rY9AAAAAElFTkSuQmCC',
-      'base64'
-    );
-    const mkPhoto = async (filename, visibility) => {
-      fs.writeFileSync(path.join(photoDir, filename), PNG_1x1);
-      const p = await db('photos').insert({
-        event_id: eventId,
-        filename,
-        path: `${SLUG}/${filename}`,
-        type: 'individual',
-        visibility,
-        uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      return p[0]?.id ?? p[0];
-    };
-    visibleId = await mkPhoto('visible.jpg', 'visible');
-    hiddenId = await mkPhoto('hidden.jpg', 'hidden');
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-    app.use('/api/images', require('../../src/routes/protectedImages'));
-    app.use('/api/secure-images', require('../../src/routes/secureImages'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  describe('download-selected (GHSA-ghf8, medium)', () => {
-    it('omits a hidden photo for a guest even when its id is requested', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photo_ids: [visibleId, hiddenId] });
-      // The visible photo still zips; the hidden one is filtered out. If
-      // only the hidden id were requested, the filter empties the set → 404.
-      expect(res.status).toBe(200);
-      const solo = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photo_ids: [hiddenId] });
-      expect(solo.status).toBe(404);
-    });
-
-    it('includes the hidden photo for a client', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${clientToken()}`)
-        .send({ photo_ids: [hiddenId] });
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('download-all (GHSA-fpwq, medium)', () => {
-    it('streams for a guest without erroring (hidden photos filtered)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download-all`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('protected-image view (GHSA-9cc4)', () => {
-    it('403s a hidden photo for a guest', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${hiddenId}/view`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('serves a visible photo for a guest', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${visibleId}/view`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(200);
-    });
-    it('serves a hidden photo for a client', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${hiddenId}/view`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('signed-URL mint (GHSA-3jvw)', () => {
-    it('403s minting a signed URL for a hidden photo as a guest', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-url`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-url`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-      expect(res.body.url).toContain('/signed/');
-    });
-  });
-
-  describe('legacy secure-token mint (protectedImages generate-secure-token)', () => {
-    it('403s a hidden photo for a guest', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-secure-token`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-secure-token`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-      expect(res.body.token).toBeDefined();
-    });
-  });
-
-  describe('secure-token mint (GHSA-2hqg)', () => {
-    it('403s minting a secure token for a hidden photo as a guest', async () => {
-      const res = await request(app)
-        .post(`/api/secure-images/${SLUG}/generate-token`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photoId: hiddenId });
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/secure-images/${SLUG}/generate-token`)
-        .set('Authorization', `Bearer ${clientToken()}`)
-        .send({ photoId: hiddenId });
-      expect(res.status).toBe(200);
-      expect(res.body.token).toBeDefined();
-    });
-  });
-
-  // A capability minted while a photo is visible must stop serving once the
-  // photo is hidden — unless minted by a client (clientBypass in the token).
-  describe('signed-URL TOCTOU (hidden AFTER minting)', () => {
-    afterEach(async () => {
-      await db('photos').where({ id: visibleId }).update({ visibility: 'visible' });
-    });
-
-    it("a guest's pre-minted signed URL stops serving once the photo is hidden", async () => {
-      const mint = await request(app)
-        .post(`/api/images/${SLUG}/photo/${visibleId}/generate-url`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(mint.status).toBe(200);
-      const url = mint.body.url;
-      // Still visible → serves.
-      expect((await request(app).get(url)).status).toBe(200);
-      // Hide it → the guest token (no clientBypass) must now be refused.
-      await db('photos').where({ id: visibleId }).update({ visibility: 'hidden' });
-      expect((await request(app).get(url)).status).toBe(403);
-    });
-
-    it("a client's pre-minted signed URL keeps serving after the photo is hidden", async () => {
-      const mint = await request(app)
-        .post(`/api/images/${SLUG}/photo/${visibleId}/generate-url`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(mint.status).toBe(200);
-      const url = mint.body.url;
-      await db('photos').where({ id: visibleId }).update({ visibility: 'hidden' });
-      expect((await request(app).get(url)).status).toBe(200);
-    });
-  });
-});

backend/__tests__/routes/legacyEventsRouterRemoved.test.js

@@ -1,119 +0,0 @@
-/**
- * Regression test for GHSA-4j34-x562-5vfq — broken access control in the legacy
- * /api/events router.
- *
- * The legacy router exposed create/list/update/delete/extend guarded by
- * adminAuth ALONE (no requirePermission, no requireEventOwnership), so any
- * back-office account — down to a read-only viewer — could read every gallery's
- * password_hash/share_token and take over any gallery. The fix removes that
- * router entirely and migrates its one UI-used route (POST /:id/extend) to the
- * canonical /api/admin/events mount, where it inherits the permission +
- * ownership guards.
- *
- * This test pins two invariants:
- *   1. The legacy source file is gone (nothing can re-mount it).
- *   2. The migrated extend route enforces ownership — a non-owning editor gets
- *      403, the owner succeeds.
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-legacy-acl-')), 'db.sqlite'
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'legacy-acl-test-secret';
-
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const request = require('supertest');
-const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
-
-async function insertEvent(db, ownerId, over = {}) {
-  const base = {
-    slug: `ev-${Math.random().toString(16).slice(2)}`,
-    event_type: 'wedding',
-    event_name: 'Owner Gallery',
-    event_date: '2026-05-29',
-    host_email: 'host@example.com',
-    admin_email: 'admin@example.com',
-    password_hash: 'x',
-    share_link: `/gallery/share-${Math.random().toString(16).slice(2)}`,
-    share_token: `st-${Math.random().toString(16).slice(2)}`,
-    expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-    is_active: 1, is_archived: 0, is_draft: 0,
-    created_by: ownerId,
-    created_at: new Date().toISOString(),
-    ...over,
-  };
-  const r = await db('events').insert(base).returning('id');
-  return r[0]?.id ?? r[0];
-}
-
-describe('GHSA-4j34: legacy /api/events router removed + extend guarded', () => {
-  it('the legacy events router source file no longer exists', () => {
-    expect(fs.existsSync(path.join(__dirname, '../../src/routes/events.js'))).toBe(false);
-  });
-
-  describe('POST /api/admin/events/:id/extend ownership enforcement', () => {
-    let db; let cleanup; let app;
-    let ownerId; let ownerToken;
-    let editorId; let editorToken;
-
-    beforeAll(async () => {
-      ({ db, cleanup } = await bootCrmDb());
-      ({ adminId: ownerId } = await seedMinimal(db));
-      await assignAdminRole(db, ownerId, 'super_admin');
-      ownerToken = mintAdminToken(ownerId);
-
-      // A second, non-owning account with the low-trust editor role.
-      [editorId] = await db('admin_users').insert({
-        username: 'editor1', email: 'editor1@example.com',
-        password_hash: 'x', is_active: 1,
-      }).returning('id');
-      editorId = editorId?.id ?? editorId;
-      await assignAdminRole(db, editorId, 'editor');
-      editorToken = mintAdminToken(editorId);
-
-      app = express();
-      app.use(express.json());
-      app.use(cookieParser());
-      app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-      // eslint-disable-next-line no-unused-vars
-      app.use((err, req, res, next) => {
-        res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
-      });
-    }, 120000);
-
-    afterAll(async () => { await cleanup(); });
-
-    it('lets the owner extend their own gallery', async () => {
-      const id = await insertEvent(db, ownerId, { expires_at: '2026-06-01T00:00:00.000Z' });
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${ownerToken}`)
-        .send({ days: 10 });
-      expect(res.status).toBe(200);
-      expect(new Date(res.body.expires_at).toISOString()).toBe('2026-06-11T00:00:00.000Z');
-    });
-
-    it('403s a non-owning editor trying to extend someone else\'s gallery', async () => {
-      const id = await insertEvent(db, ownerId); // owned by the super_admin
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${editorToken}`)
-        .send({ days: 30 });
-      expect(res.status).toBe(403); // requireEventOwnership blocks it
-    });
-
-    it('validates the days field', async () => {
-      const id = await insertEvent(db, ownerId);
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${ownerToken}`)
-        .send({ days: 9999 });
-      expect(res.status).toBe(400);
-    });
-  });
-});

backend/__tests__/routes/photoEngagementCounters.test.js

@@ -1,312 +0,0 @@
-/**
- * Per-photo engagement counters (#895).
- *
- * Pins the contract that the admin EVENT > IMAGES table depends on:
- *  - photos.view_count increments when the full-size photo is served
- *    (it existed in the schema + admin UI but had NO writer at all)
- *  - the slideshow kiosk never increments views (migration 138 design)
- *  - single-photo downloads increment download_count (regression pin)
- *  - zip downloads (download-all, download-selected) increment
- *    download_count for the contained photos — previously they didn't,
- *    so zip-heavy galleries showed 0 per-photo downloads forever
- *  - the admin event-detail total_downloads counts singles AND zips
- *    (it counted action='download' only, disagreeing with the dashboard)
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-engagement-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'engagement-test-secret';
-// Real files on disk so /photo and the zip routes actually stream bytes.
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-engagement-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'engagement-test-event';
-
-describe('photo engagement counters (#895)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let photoIds;
-  let adminToken;
-
-  const galleryToken = (extra = {}) => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery', ...extra },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-
-  const getPhoto = async (id) => db('photos').where('id', id).first();
-  // The counter writes are fire-and-forget on purpose — give the event
-  // loop a beat before asserting.
-  const settle = () => new Promise((r) => setTimeout(r, 400));
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Engagement Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'engagement-test-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      allow_downloads: 1,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const photoDir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(photoDir, { recursive: true });
-
-    photoIds = [];
-    for (let i = 0; i < 3; i++) {
-      const filename = `photo-${i}.jpg`;
-      fs.writeFileSync(path.join(photoDir, filename), Buffer.from(`fake-jpeg-bytes-${i}`));
-      const p = await db('photos').insert({
-        event_id: eventId,
-        filename,
-        path: `${SLUG}/${filename}`,
-        type: 'individual',
-        uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      photoIds.push(p[0]?.id ?? p[0]);
-    }
-
-    const superRole = await db('roles').where({ name: 'super_admin' }).first();
-    const [rootId] = await db('admin_users').insert({
-      username: 'engagement-admin',
-      email: 'engagement-admin@example.com',
-      password_hash: await bcrypt.hash('EngagementAdmin123', 4),
-      role_id: superRole.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id').then((r) => [r[0]?.id || r[0]]);
-    adminToken = jwt.sign(
-      { id: rootId, username: 'engagement-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' }
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
-  }, 120000);
-
-  afterAll(async () => {
-    if (cleanup) await cleanup();
-  });
-
-  beforeEach(async () => {
-    await db('photos').where('event_id', eventId).update({ view_count: 0, download_count: 0 });
-    await db('access_logs').where('event_id', eventId).del();
-  });
-
-  describe('view_count via the view beacon (#895 — previously never written)', () => {
-    const beacon = (photoId, token = galleryToken()) => request(app)
-      .post(`/api/gallery/${SLUG}/photo/${photoId}/view`)
-      .set('Authorization', `Bearer ${token}`);
-
-    it('increments exactly the beaconed photo', async () => {
-      expect((await beacon(photoIds[0])).status).toBe(204);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(1);
-
-      expect((await beacon(photoIds[0])).status).toBe(204);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(2);
-      // Other photos untouched
-      expect((await getPhoto(photoIds[1])).view_count).toBe(0);
-    });
-
-    it('serving the image bytes does NOT count (preloads must not inflate)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/photo/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).view_count).toBe(0);
-    });
-
-    it('rejects the slideshow kiosk (migration 138 design)', async () => {
-      const res = await beacon(photoIds[0], galleryToken({ accessLevel: 'slideshow' }));
-      expect(res.status).toBeGreaterThanOrEqual(400);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(0);
-    });
-
-    it("404s a photo that isn't in the event", async () => {
-      const res = await beacon(999999);
-      expect(res.status).toBe(404);
-    });
-  });
-
-  describe('download_count', () => {
-    it('single-photo download increments (regression pin)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[1])).download_count).toBe(0);
-    });
-
-    it('download-selected increments exactly the selected photos (#895)', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${galleryToken()}`)
-        .send({ photo_ids: [photoIds[0], photoIds[1]] });
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[1])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[2])).download_count).toBe(0);
-    });
-
-    it('download-all increments every downloadable photo (#895)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download-all`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      for (const id of photoIds) {
-        expect((await getPhoto(id)).download_count).toBe(1);
-      }
-    });
-
-    it('skipped archive entries do not count (missing source file)', async () => {
-      // Own event so the on-the-fly archiver path is guaranteed — the
-      // main event may have a cached zip from the previous test's
-      // background generation, and racing its build/invalidate hangs.
-      // The route also fires a background pre-zip build after streaming;
-      // against this event's intentionally missing file it crashes with
-      // an async ENOENT that jest attributes to whatever test is running
-      // by then — neutralize it, it's not under test here.
-      const downloadZipService = require('../../src/services/downloadZipService');
-      const generateZipSpy = jest.spyOn(downloadZipService, 'generateZip')
-        .mockResolvedValue({ success: false, error: 'disabled in test' });
-      const slug2 = `${SLUG}-skip`;
-      const ev = await db('events').insert({
-        slug: slug2,
-        event_type: 'wedding',
-        event_name: 'Engagement Skip Test',
-        event_date: '2026-08-01',
-        host_email: 'host@example.com',
-        admin_email: 'admin@example.com',
-        password_hash: 'x',
-        share_link: `/gallery/${slug2}/share`,
-        share_token: 'engagement-skip-share',
-        expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-        is_active: 1,
-        is_archived: 0,
-        is_draft: 0,
-        allow_downloads: 1,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const eventId2 = ev[0]?.id ?? ev[0];
-      const dir2 = path.join(process.env.STORAGE_PATH, 'events/active', slug2);
-      fs.mkdirSync(dir2, { recursive: true });
-      const ids2 = [];
-      for (let i = 0; i < 2; i++) {
-        // Only photo 0 gets a real file — photo 1's source is missing.
-        if (i === 0) fs.writeFileSync(path.join(dir2, `photo-${i}.jpg`), Buffer.from('skip-test-bytes'));
-        const p = await db('photos').insert({
-          event_id: eventId2,
-          filename: `photo-${i}.jpg`,
-          path: `${slug2}/photo-${i}.jpg`,
-          type: 'individual',
-          uploaded_at: new Date().toISOString(),
-        }).returning('id');
-        ids2.push(p[0]?.id ?? p[0]);
-      }
-      const token2 = jwt.sign(
-        { eventId: eventId2, eventSlug: slug2, type: 'gallery' },
-        process.env.JWT_SECRET,
-        { expiresIn: '1h', issuer: 'picpeak-auth' }
-      );
-
-      const res = await request(app)
-        .get(`/api/gallery/${slug2}/download-all`)
-        .set('Authorization', `Bearer ${token2}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await db('photos').where('id', ids2[0]).first()).download_count).toBe(1);
-      // photo-1's source was missing → skipped from the zip → not counted
-      expect((await db('photos').where('id', ids2[1]).first()).download_count).toBe(0);
-      generateZipSpy.mockRestore();
-    });
-  });
-
-  describe('admin photos list exposes the counters (#895 follow-up)', () => {
-    it('returns view_count and download_count so the Engagement column can render them', async () => {
-      // The list mapper builds an explicit object — before this fix it
-      // omitted both fields, so the admin table showed 0 forever even
-      // though the DB counted correctly.
-      await request(app)
-        .post(`/api/gallery/${SLUG}/photo/${photoIds[0]}/view`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      await request(app)
-        .get(`/api/gallery/${SLUG}/download/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      await settle();
-
-      const res = await request(app)
-        .get(`/api/admin/photos/${eventId}/photos`)
-        .set('Authorization', `Bearer ${adminToken}`);
-      expect(res.status).toBe(200);
-      const row = res.body.photos.find((p) => p.id === photoIds[0]);
-      expect(row.view_count).toBe(1);
-      expect(row.download_count).toBe(1);
-      const untouched = res.body.photos.find((p) => p.id === photoIds[1]);
-      expect(untouched.view_count).toBe(0);
-      expect(untouched.download_count).toBe(0);
-    });
-  });
-
-  describe('admin event-detail total_downloads (#895 — one definition everywhere)', () => {
-    it('counts singles and every zip variant, one row each', async () => {
-      const row = (action) => ({
-        event_id: eventId,
-        ip_address: '127.0.0.1',
-        user_agent: 'jest',
-        action,
-      });
-      await db('access_logs').insert([
-        row('download'),
-        row('download_all'),
-        row('download_all_presigned'),
-        row('download_selected'),
-        row('view'), // not a download
-      ]);
-
-      const res = await request(app)
-        .get(`/api/admin/events/${eventId}`)
-        .set('Authorization', `Bearer ${adminToken}`);
-      expect(res.status).toBe(200);
-      expect(res.body.total_downloads).toBe(4);
-    });
-  });
-});

backend/__tests__/routes/publicContracts.test.js

@@ -51,7 +51,7 @@ describe('publicContracts routes', () => {
     contractId = inserted[0]?.id ?? inserted[0];
 
     app = buildRouteApp('/api/public/contracts', require('../../src/routes/publicContracts'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/publicPaymentCheck.test.js

@@ -33,7 +33,7 @@ describe('publicPaymentCheck routes', () => {
     ({ db, cleanup } = await bootCrmDb());
     await seedMinimal(db);
     app = buildRouteApp('/api/public/payment-check', require('../../src/routes/publicPaymentCheck'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/publicQuotes.test.js

@@ -60,7 +60,7 @@ describe('publicQuotes routes', () => {
     quoteId = inserted[0]?.id ?? inserted[0];
 
     app = buildRouteApp('/api/public/quotes', require('../../src/routes/publicQuotes'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/secureImageTokenBinding.test.js

@@ -1,136 +0,0 @@
-/**
- * Secure-image view route token binding (GHSA-g94x-8vv8-3c9f).
- *
- * The view route GET /api/secure-images/:slug/secure/:photoId/:token serves
- * via <img src> with the token in the URL, so it can't carry a gallery-token
- * header like the download sibling. Before the fix it validated only the
- * token signature and took the gallery/photo from the URL — so a token minted
- * on any PUBLIC gallery read every other gallery's photos with no password.
- *
- * Pins that the route now enforces the scope inside the token:
- *  - the URL photoId must equal the token's minted photoId
- *  - the gallery embedded in the token's sessionId must equal the URL gallery
- * A token minted on gallery A cannot read gallery B under either check; a
- * token used on its own gallery+photo passes the binding.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-secimg-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'secimg-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-secimg-storage-'));
-
-// Stub the anti-bot/rate-limit middleware so the fingerprint is deterministic
-// — the token below is minted with the same fingerprint, so verifySecureToken
-// passes and the binding logic under test is what decides the outcome.
-jest.mock('../../src/middleware/secureImageMiddleware', () => ({
-  secureImageAccess: (req, _res, next) => {
-    req.clientInfo = { fingerprint: 'test-fp', ip: '127.0.0.1', userAgent: 'jest' };
-    next();
-  },
-  getSecurityStatus: (_req, res) => res.json({ ok: true }),
-}));
-
-const request = require('supertest');
-const express = require('express');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-const secureImageService = require('../../src/services/secureImageService');
-
-describe('secure-image view route token binding (GHSA-g94x)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let galleryA; let galleryB;
-  let photoA; let photoB;
-
-  const mkEvent = async (slug, requirePassword) => {
-    const r = await db('events').insert({
-      slug,
-      event_type: 'wedding',
-      event_name: slug,
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      require_password: requirePassword ? 1 : 0,
-      share_link: `/gallery/${slug}/share`,
-      share_token: `${slug}-share`,
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const mkPhoto = async (eventId, slug, filename) => {
-    const dir = path.join(process.env.STORAGE_PATH, 'events/active', slug);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, filename), Buffer.from('img'));
-    const r = await db('photos').insert({
-      event_id: eventId,
-      filename,
-      path: `${slug}/${filename}`,
-      type: 'individual',
-      uploaded_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  // Mint a token exactly as the mint route does — bound to (photoId, gallery
-  // sessionId, fingerprint) — bypassing the anti-bot HTTP path.
-  const mint = (photoId, eventId) => secureImageService.generateSecureToken(
-    photoId,
-    `gallery_public_${eventId}_${Date.now()}`,
-    { clientFingerprint: 'test-fp', maxUses: 100, expiresIn: 3600 },
-  );
-
-  const view = (slug, photoId, token) => request(app)
-    .get(`/api/secure-images/${slug}/secure/${photoId}/${token}`);
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    galleryA = await mkEvent('secimg-public-a', false);   // public — token source
-    galleryB = await mkEvent('secimg-private-b', true);   // password-protected — victim
-    photoA = await mkPhoto(galleryA, 'secimg-public-a', 'a.jpg');
-    photoB = await mkPhoto(galleryB, 'secimg-private-b', 'b.jpg');
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/secure-images', require('../../src/routes/secureImages'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('rejects a gallery-A token used against gallery B (cross-photo)', async () => {
-    const token = mint(photoA, galleryA);
-    const res = await view('secimg-private-b', photoB, token);
-    expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/not valid for this photo/i);
-  });
-
-  it('rejects a gallery-A token replayed on gallery B with A\'s photoId', async () => {
-    const token = mint(photoA, galleryA);
-    // URL photoId matches the token, so the photo check passes — the gallery
-    // check (sessionId gallery A != URL gallery B) must catch it.
-    const res = await view('secimg-private-b', photoA, token);
-    expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/not valid for this gallery/i);
-  });
-
-  it('lets a token read its own gallery + photo (binding passes)', async () => {
-    const token = mint(photoA, galleryA);
-    const res = await view('secimg-public-a', photoA, token);
-    // Binding passes; serving may 200/404/500 depending on the pipeline, but
-    // it must NOT be rejected as a token mismatch.
-    expect(res.status).not.toBe(403);
-  });
-});

backend/__tests__/routes/slideshowAdmin.test.js

@@ -75,7 +75,7 @@ describe('admin Live Slideshow endpoints', () => {
     app.use((err, req, res, next) => {
       res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
     });
-  }, 120000);
+  }, 30000);
 
   afterAll(async () => { await cleanup(); });
 

backend/__tests__/routes/slideshowPublic.test.js

@@ -67,10 +67,11 @@ async function insertEvent(db, over = {}) {
 describe('public Live Slideshow routes', () => {
   let db; let cleanup; let app;
 
-  // bootCrmDb runs the full migration set against a fresh SQLite file and the
-  // chain keeps growing via backports. Hook-argument timeouts OVERRIDE the
-  // 120s jest.config default (same trap as the jest.setTimeout pins) — keep
-  // this at 120000, matching the config.
+  // bootCrmDb runs the full migration set against a fresh SQLite file, which
+  // takes <2s locally but has been observed to exceed Jest's default 5s
+  // `beforeAll` timeout on slower GitHub Actions runners (~5.4s — runner-to-
+  // runner I/O variance). Raise the hook timeout so this doesn't intermittently
+  // block PRs on CI; doesn't affect happy-path local runs.
   beforeAll(async () => {
     ({ db, cleanup } = await bootCrmDb());
     await seedMinimal(db);
@@ -85,7 +86,7 @@ describe('public Live Slideshow routes', () => {
     app.use((err, req, res, next) => {
       res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
     });
-  }, 120000);
+  }, 30000);
 
   afterAll(async () => { await cleanup(); });
 

backend/__tests__/services/backupIntegrityService.test.js

@@ -22,7 +22,7 @@ const crypto = require('crypto');
 
 const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupIntegrityService.verifyDocumentArtefacts', () => {
   let db;

backend/__tests__/services/chunkedUploadFilename.test.js

@@ -1,52 +0,0 @@
-const path = require('path');
-const os = require('os');
-const fs = require('fs').promises;
-
-// Point storage at a throwaway temp dir before requiring the service so the
-// module-level getStoragePath() picks it up if evaluated.
-process.env.STORAGE_PATH = path.join(os.tmpdir(), `picpeak-chunk-test-${process.pid}`);
-
-const chunkedUpload = require('../../src/services/chunkedUploadService');
-
-describe('chunkedUploadService.initializeUpload filename sanitisation (GHSA-pc72-jf53-w28j)', () => {
-  afterAll(async () => {
-    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true }).catch(() => {});
-  });
-
-  it('strips directory-traversal components from the stored filename', async () => {
-    const { uploadId } = await chunkedUpload.initializeUpload({
-      filename: '../../uploads/logos/evil.svg',
-      fileSize: 10,
-      mimeType: 'video/mp4',
-      eventId: 1,
-      totalChunks: 1,
-    });
-    const meta = chunkedUpload.getUploadStatus(uploadId);
-    // basename('../../uploads/logos/evil.svg') === 'evil.svg' — the traversal
-    // is gone, so path.join(tempDir, filename) can no longer escape tempDir.
-    expect(meta.filename).toBe('evil.svg');
-  });
-
-  it('keeps a normal filename intact', async () => {
-    const { uploadId } = await chunkedUpload.initializeUpload({
-      filename: 'clip.mp4',
-      fileSize: 10,
-      mimeType: 'video/mp4',
-      eventId: 1,
-      totalChunks: 1,
-    });
-    expect(uploadId).toBeTruthy();
-  });
-
-  it('rejects a filename that collapses to nothing', async () => {
-    await expect(
-      chunkedUpload.initializeUpload({
-        filename: '../',
-        fileSize: 10,
-        mimeType: 'video/mp4',
-        eventId: 1,
-        totalChunks: 1,
-      })
-    ).rejects.toThrow(/Invalid filename/);
-  });
-});

backend/__tests__/services/environmentUpdateInstructions.test.js

@@ -1,58 +0,0 @@
-/**
- * Regression tests for the Docker update instructions (environmentService).
- *
- * A production install (docker-compose.production.yml) must get `-f
- * docker-compose.production.yml` in every update command — bare `docker compose`
- * targets docker-compose.yml, a different build-based stack that also starts the
- * dev-only mailhog, which left production users stranded on the old version
- * (reported against 3.44.0 → 3.45.2).
- */
-const { detectEnvironment, generateUpdateInstructions } = require('../../src/services/environmentService');
-
-describe('detectEnvironment — production compose detection', () => {
-  const orig = process.env.PICPEAK_RELEASE_CHANNEL;
-  afterEach(() => {
-    if (orig === undefined) delete process.env.PICPEAK_RELEASE_CHANNEL;
-    else process.env.PICPEAK_RELEASE_CHANNEL = orig;
-  });
-
-  it('flags isProductionCompose when PICPEAK_RELEASE_CHANNEL is set', async () => {
-    process.env.PICPEAK_RELEASE_CHANNEL = 'stable';
-    const env = await detectEnvironment();
-    expect(env.isProductionCompose).toBe(true);
-  });
-
-  it('does not flag it when the var is absent (default docker-compose.yml)', async () => {
-    delete process.env.PICPEAK_RELEASE_CHANNEL;
-    const env = await detectEnvironment();
-    expect(env.isProductionCompose).toBe(false);
-  });
-});
-
-describe('generateUpdateInstructions — Docker commands', () => {
-  const cmds = (env) => generateUpdateInstructions(env, '3.45.2').steps.map((s) => s.command);
-
-  it('targets docker-compose.production.yml for a production install', () => {
-    const commands = cmds({ isDocker: true, isProductionCompose: true });
-    expect(commands).toEqual([
-      'docker compose -f docker-compose.production.yml pull',
-      'docker compose -f docker-compose.production.yml up -d',
-      'docker compose -f docker-compose.production.yml logs -f backend',
-    ]);
-    // And the warning tells them where to run it.
-    const { warnings } = generateUpdateInstructions({ isDocker: true, isProductionCompose: true }, '3.45.2');
-    expect(warnings.join(' ')).toMatch(/docker-compose\.production\.yml/);
-  });
-
-  it('uses bare commands + a hint when not a production compose', () => {
-    const commands = cmds({ isDocker: true, isProductionCompose: false });
-    expect(commands).toEqual([
-      'docker compose pull',
-      'docker compose up -d',
-      'docker compose logs -f backend',
-    ]);
-    const { warnings } = generateUpdateInstructions({ isDocker: true, isProductionCompose: false }, '3.45.2');
-    // Still nudges production users to add -f in case detection missed.
-    expect(warnings.join(' ')).toMatch(/-f docker-compose\.production\.yml/);
-  });
-});

backend/__tests__/services/picpeakReinjectAdmin.test.js

@@ -1,111 +0,0 @@
-/**
- * Regression tests for reinjectCurrentAdmin — the operator-preservation step of
- * the .picpeak restore (GHSA-qxfx-4493-4v8f follow-up). Runs against a real
- * in-memory SQLite DB so the UNIQUE(email)/UNIQUE(username) constraints behave
- * as in production. Reconciliation is non-destructive (update-in-place / rename,
- * never delete) so restored rows referenced by FKs keep their ids.
- */
-const knex = require('knex');
-
-let db;
-let reinjectCurrentAdmin;
-
-beforeAll(() => {
-  jest.doMock('../../knexfile', () => ({ client: 'sqlite3' }), { virtual: false });
-  reinjectCurrentAdmin = require('../../src/services/picpeakImportService').reinjectCurrentAdmin;
-});
-
-beforeEach(async () => {
-  db = knex({ client: 'sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true });
-  await db.schema.createTable('admin_users', (t) => {
-    t.increments('id');
-    t.string('username').notNullable().unique();
-    t.string('email').notNullable().unique();
-    t.string('password_hash');
-    t.boolean('is_active').defaultTo(true);
-    t.boolean('must_change_password').defaultTo(false);
-    t.integer('role_id');
-    t.integer('created_by');
-    t.boolean('two_factor_enabled').defaultTo(false);
-    t.string('two_factor_secret');
-    t.text('two_factor_recovery_codes');
-  });
-});
-
-afterEach(async () => { await db.destroy(); });
-
-const operator = {
-  id: 1, username: 'admin', email: 'op@example.com',
-  password_hash: 'OP_HASH', is_active: 1, must_change_password: 0, role_id: 1, created_by: 99,
-  two_factor_enabled: 1, two_factor_secret: 'OP_SECRET', two_factor_recovery_codes: '["a","b"]',
-};
-
-test('restores login + MFA in place, keeping the row id and its FK columns (FK-safe)', async () => {
-  await db('admin_users').insert({
-    id: 7, username: 'someoneelse', email: 'OP@example.com',
-    password_hash: 'ATTACKER', is_active: 1, must_change_password: 0, role_id: 4, created_by: 5,
-    two_factor_enabled: 0, two_factor_secret: 'ATTACKER_SECRET', two_factor_recovery_codes: null,
-  });
-  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
-
-  const rows = await db('admin_users');
-  expect(rows).toHaveLength(1);
-  const row = rows[0];
-  expect(row.id).toBe(7);                            // id preserved → FK refs hold
-  expect(row.username).toBe('admin');
-  expect(row.password_hash).toBe('OP_HASH');
-  expect(Boolean(row.two_factor_enabled)).toBe(true);
-  expect(row.two_factor_secret).toBe('OP_SECRET');   // attacker MFA secret gone
-  expect(row.two_factor_recovery_codes).toBe('["a","b"]');
-  // Relationship/audit FKs are NOT forced from the operator snapshot (avoids
-  // dangling role_id/created_by on a cross-instance restore) — the restored
-  // row keeps its own already-valid values.
-  expect(row.role_id).toBe(4);
-  expect(row.created_by).toBe(5);
-});
-
-test('renames (not deletes) a different row holding the operator username', async () => {
-  await db('admin_users').insert({
-    id: 3, username: 'admin', email: 'other@instance.test',
-    password_hash: 'OTHER', is_active: 1, role_id: 4,
-  });
-  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // the other admin survives (FK-safe)
-  const other = rows.find((r) => r.id === 3);
-  expect(other.username).toBe('admin__restored_3');  // renamed, id kept
-  expect(other.email).toBe('other@instance.test');
-  const op = rows.find((r) => r.username === 'admin');
-  expect(op.password_hash).toBe('OP_HASH');
-});
-
-test('reconciles email and username colliding with DIFFERENT rows without deleting either', async () => {
-  await db('admin_users').insert([
-    { id: 4, username: 'someoneelse', email: 'op@example.com', password_hash: 'A', role_id: 4 },
-    { id: 5, username: 'admin', email: 'other@instance.test', password_hash: 'B', role_id: 4 },
-  ]);
-  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // both rows survive
-  const opRow = rows.find((r) => r.id === 4);         // email match updated in place
-  expect(opRow.username).toBe('admin');
-  expect(opRow.password_hash).toBe('OP_HASH');
-  const renamed = rows.find((r) => r.id === 5);       // username holder renamed, not deleted
-  expect(renamed.username).toBe('admin__restored_5');
-});
-
-test('inserts the operator with a non-colliding id when neither key exists in the backup', async () => {
-  await db('admin_users').insert({
-    id: 9, username: 'backupadmin', email: 'backup@instance.test', password_hash: 'B', role_id: 1,
-  });
-  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // backup admin untouched
-  const opRow = rows.find((r) => r.username === 'admin');
-  expect(opRow.password_hash).toBe('OP_HASH');
-  expect(opRow.id).toBe(10);                          // max(9)+1, no collision
-  expect(opRow.created_by).toBeNull();                // self-ref FK nulled so the insert can't dangle
-});

backend/__tests__/services/trackerFactory.test.js

@@ -27,7 +27,7 @@ let db; let cleanup;
 
 beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
-}, 120000);
+}, 30000);
 
 afterAll(async () => { if (cleanup) await cleanup(); });
 

backend/__tests__/services/userManagementService.activateDelete.test.js

@@ -48,7 +48,7 @@ describe('userManagementService — activate + delete (#574 follow-up)', () => {
       is_active: 1, created_at: new Date(),
     }).returning('id');
     targetId = targetInsert[0]?.id ?? targetInsert[0];
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/utils/feedbackPerGuestLimit.test.js

@@ -115,7 +115,7 @@ beforeAll(async () => {
     }).returning('id');
     photoIds.push(r[0]?.id ?? r[0]);
   }
-}, 120000);
+}, 30000);
 
 afterAll(async () => { if (cleanup) await cleanup(); });
 

backend/__tests__/utils/networkValidation.dns.test.js

@@ -1,128 +0,0 @@
-/**
- * DNS-resolving SSRF guard (GHSA SSRF cluster: webhook / S3 / rsync / SMTP /
- * IMAP). The literal isPrivateIP check can't see that a public-looking
- * hostname resolves to an internal/metadata IP; isHostAllowed resolves the
- * name and vets every A/AAAA record.
- */
-jest.mock('dns', () => {
-  const actual = jest.requireActual('dns');
-  return { ...actual, promises: { ...actual.promises, lookup: jest.fn() } };
-});
-const dns = require('dns');
-const {
-  isHostAllowed,
-  validateExternalUrlAsync,
-  classifyHost,
-} = require('../../src/utils/networkValidation');
-
-const lookup = dns.promises.lookup;
-
-describe('classifyHost', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('distinguishes private, unresolved, ok, and invalid', async () => {
-    lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
-    expect(await classifyHost('evil.example')).toBe('private');
-
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect(await classifyHost('example.com')).toBe('ok');
-
-    lookup.mockRejectedValue(new Error('EAI_AGAIN'));
-    expect(await classifyHost('blip.example')).toBe('unresolved');
-
-    lookup.mockResolvedValue([]);
-    expect(await classifyHost('empty.example')).toBe('unresolved');
-
-    expect(await classifyHost('')).toBe('invalid');
-    expect(await classifyHost('10.0.0.1')).toBe('private'); // literal, no lookup
-  });
-});
-
-describe('isHostAllowed', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('rejects a public hostname that resolves to a private IP', async () => {
-    lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
-    expect(await isHostAllowed('evil.example.com')).toBe(false);
-  });
-
-  it('rejects when the hostname resolves to the cloud metadata IP', async () => {
-    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
-    expect(await isHostAllowed('metadata-rebind.example')).toBe(false);
-  });
-
-  it('rejects when ANY resolved address is private (rebinding / mixed records)', async () => {
-    lookup.mockResolvedValue([
-      { address: '93.184.216.34', family: 4 },
-      { address: '169.254.169.254', family: 4 },
-    ]);
-    expect(await isHostAllowed('rebind.example')).toBe(false);
-  });
-
-  it('allows a hostname that resolves only to public IPs', async () => {
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect(await isHostAllowed('example.com')).toBe(true);
-  });
-
-  it('fails closed when resolution errors', async () => {
-    lookup.mockRejectedValue(new Error('ENOTFOUND'));
-    expect(await isHostAllowed('nxdomain.invalid')).toBe(false);
-  });
-
-  it('fails closed on an empty resolution', async () => {
-    lookup.mockResolvedValue([]);
-    expect(await isHostAllowed('empty.example')).toBe(false);
-  });
-
-  it('rejects literal private IPs and blocked names without resolving', async () => {
-    expect(await isHostAllowed('127.0.0.1')).toBe(false);
-    expect(await isHostAllowed('10.0.0.1')).toBe(false);
-    expect(await isHostAllowed('localhost')).toBe(false);
-    expect(await isHostAllowed('metadata.google.internal')).toBe(false);
-    expect(await isHostAllowed('foo.internal')).toBe(false);
-    expect(lookup).not.toHaveBeenCalled();
-  });
-
-  it('allows a public IP literal without resolving', async () => {
-    expect(await isHostAllowed('93.184.216.34')).toBe(true);
-    expect(lookup).not.toHaveBeenCalled();
-  });
-
-  it('rejects empty / non-string input', async () => {
-    expect(await isHostAllowed('')).toBe(false);
-    expect(await isHostAllowed(null)).toBe(false);
-  });
-});
-
-describe('validateExternalUrlAsync', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('rejects a URL whose host resolves to a private address', async () => {
-    lookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }]);
-    const r = await validateExternalUrlAsync('https://evil.example/hook');
-    expect(r.valid).toBe(false);
-  });
-
-  it('accepts a URL whose host resolves public', async () => {
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect((await validateExternalUrlAsync('https://example.com/hook')).valid).toBe(true);
-  });
-
-  it('rejects a malformed URL', async () => {
-    expect((await validateExternalUrlAsync('not a url')).valid).toBe(false);
-  });
-
-  it('reports reason=unresolved for a transient lookup failure (retryable)', async () => {
-    lookup.mockRejectedValue(new Error('EAI_AGAIN'));
-    const r = await validateExternalUrlAsync('https://blip.example/hook');
-    expect(r.valid).toBe(false);
-    expect(r.reason).toBe('unresolved');
-  });
-
-  it('reports reason=private for a resolved-private host (permanent)', async () => {
-    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
-    const r = await validateExternalUrlAsync('https://rebind.example/hook');
-    expect(r.valid).toBe(false);
-    expect(r.reason).toBe('private');
-  });
-});

backend/__tests__/utils/passwordValidation.complexityKey.test.js

@@ -1,61 +0,0 @@
-/**
- * Regression tests for the password-complexity setting read path.
- *
- * Bug 1 (key mismatch): the settings UI saves the admin's choice as
- * `security_password_complexity` (useSettingsState.ts prefixes every
- * security field with `security_`), but getPasswordComplexitySettings()
- * queried `security_password_complexity_level` — a key nothing writes —
- * so the configured level was silently ignored.
- *
- * Bug 2 (driver shape, codex review of #843): on SQLite the TEXT column
- * returns the JSON-stringified value ('"very_strong"'), but on Postgres
- * (production default) `setting_value` is a json column and comes back
- * already decoded ('very_strong'). A bare JSON.parse throws on the
- * decoded shape and the outer catch fell back to 'moderate' — the
- * setting stayed unenforced on Postgres even with the right key.
- */
-
-const mockQueriedKeys = [];
-let mockStoredValue;
-
-jest.mock('../../src/database/db', () => ({
-  db: () => ({
-    where(_col, key) {
-      mockQueriedKeys.push(key);
-      return this;
-    },
-    first() {
-      return Promise.resolve(
-        mockQueriedKeys[mockQueriedKeys.length - 1] === 'security_password_complexity'
-          ? { setting_key: 'security_password_complexity', setting_value: mockStoredValue }
-          : undefined
-      );
-    },
-  }),
-  withRetry: (fn) => fn(),
-}));
-
-const { getPasswordComplexitySettings } = require('../../src/utils/passwordValidation');
-
-describe('getPasswordComplexitySettings', () => {
-  beforeEach(() => { mockQueriedKeys.length = 0; });
-
-  it('reads the key the settings UI actually writes (SQLite shape: JSON-stringified)', async () => {
-    mockStoredValue = JSON.stringify('very_strong'); // '"very_strong"'
-    const level = await getPasswordComplexitySettings();
-    expect(mockQueriedKeys).toContain('security_password_complexity');
-    expect(level).toBe('very_strong');
-  });
-
-  it('accepts the Postgres json-column shape (already decoded, no quotes)', async () => {
-    mockStoredValue = 'very_strong'; // pg driver auto-parses the json column
-    const level = await getPasswordComplexitySettings();
-    expect(level).toBe('very_strong');
-  });
-
-  it('falls back to moderate on an empty value', async () => {
-    mockStoredValue = '';
-    const level = await getPasswordComplexitySettings();
-    expect(level).toBe('moderate');
-  });
-});

backend/__tests__/utils/photoVisibility.test.js

@@ -1,40 +0,0 @@
-/**
- * Unit tests for the shared hidden-photo access-control helper.
- *
- * Pins the rule that ordinary gallery guests never receive photos with
- * visibility='hidden' (NULL = visible), while PIN-clients see everything.
- */
-const {
-  canSeeHiddenPhotos,
-  isPhotoHiddenFromViewer,
-} = require('../../src/utils/photoVisibility');
-
-describe('canSeeHiddenPhotos', () => {
-  it('is true only for the client access level', () => {
-    expect(canSeeHiddenPhotos('client')).toBe(true);
-    expect(canSeeHiddenPhotos('guest')).toBe(false);
-    expect(canSeeHiddenPhotos('slideshow')).toBe(false);
-    expect(canSeeHiddenPhotos(undefined)).toBe(false);
-  });
-});
-
-describe('isPhotoHiddenFromViewer', () => {
-  it('blocks a hidden photo from guests', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'guest')).toBe(true);
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'slideshow')).toBe(true);
-  });
-
-  it('lets clients see hidden photos', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'client')).toBe(false);
-  });
-
-  it('treats visible and NULL visibility as viewable by everyone', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'visible' }, 'guest')).toBe(false);
-    expect(isPhotoHiddenFromViewer({ visibility: null }, 'guest')).toBe(false);
-    expect(isPhotoHiddenFromViewer({}, 'guest')).toBe(false);
-  });
-
-  it('is null-safe', () => {
-    expect(isPhotoHiddenFromViewer(null, 'guest')).toBe(false);
-  });
-});

backend/__tests__/utils/safePathZipEntries.test.js

@@ -1,41 +0,0 @@
-const path = require('path');
-const { assertZipEntriesWithin } = require('../../src/utils/safePath');
-
-describe('assertZipEntriesWithin (ZIP-slip guard, GHSA-jfhw-fj23-fx6x)', () => {
-  const root = path.join('/tmp', 'picpeak-extract-root');
-
-  it('accepts entries that stay within the extraction root', () => {
-    const entries = [
-      { name: 'photo.jpg' },
-      { name: 'category/nested/photo.png' },
-      { name: 'photos_manifest.json' },
-      { name: 'subdir/' },
-    ];
-    expect(() => assertZipEntriesWithin(entries, root)).not.toThrow();
-  });
-
-  it('rejects a parent-traversal entry', () => {
-    const entries = [{ name: '../../uploads/logos/evil.svg' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('rejects an absolute-path entry', () => {
-    const entries = [{ name: '/etc/cron.d/evil' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('rejects when a safe entry is mixed with a traversal entry', () => {
-    const entries = [{ name: 'ok.jpg' }, { name: '../escape.txt' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('tolerates empty / nameless entries', () => {
-    expect(() => assertZipEntriesWithin([{}, { name: '' }, null], root)).not.toThrow();
-  });
-
-  it('does not treat a sibling prefix directory as inside the root', () => {
-    // root is .../picpeak-extract-root; ../picpeak-extract-root-evil must not pass
-    const entries = [{ name: '../picpeak-extract-root-evil/x' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-});

backend/jest.config.js

@@ -1,9 +1,5 @@
 module.exports = {
   testEnvironment: 'node',
-  // bootCrmDb() runs EVERY core migration in beforeAll and the chain keeps
-  // growing (134 migrations and counting via backports). 120s matches the
-  // beta-branch convention from #860.
-  testTimeout: 120000,
   coverageDirectory: 'coverage',
   collectCoverageFrom: [
     'src/**/*.js',

backend/migrations/core/152_hero_logo_visible_inherit.js

@@ -1,52 +0,0 @@
-/**
- * Migration 152: make events.hero_logo_visible NULL-able so NULL means
- * "inherit the global branding_logo_display_hero setting" (#756).
- *
- * Before: hero_logo_visible was `boolean NOT NULL DEFAULT true`, and every
- * event got a concrete true/false snapshotted at creation. The global
- * "Show logo in hero section" toggle (branding_logo_display_hero) was only a
- * creation-time default and never affected existing galleries — so disabling
- * it did nothing to already-published galleries.
- *
- * After: NULL = inherit. gallery read-resolution falls back to the global
- * setting when the per-event value is NULL, so the global toggle controls
- * every gallery that hasn't been deliberately overridden per-event.
- *
- * Data backfill: NULL out the DEFAULTED `true` rows so they start inheriting
- * the global. A deliberate per-gallery hide (`false`) is kept — we can't tell a
- * defaulted-true from a chosen-true, but `false` is almost always a conscious
- * "hide it here", and nulling it could silently re-show a hidden logo.
- */
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_visible'))) return;
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible DROP DEFAULT');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible DROP NOT NULL');
-  } else {
-    // SQLite (and others): knex recreates the table without the NOT NULL/default.
-    await knex.schema.alterTable('events', (t) => {
-      t.boolean('hero_logo_visible').nullable().alter();
-    });
-  }
-
-  // Existing defaulted-`true` galleries now inherit the global toggle.
-  await knex('events').where('hero_logo_visible', true).update({ hero_logo_visible: null });
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_visible'))) return;
-  // Re-materialise NULLs as the old default (true) before restoring NOT NULL.
-  await knex('events').whereNull('hero_logo_visible').update({ hero_logo_visible: true });
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible SET DEFAULT true');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible SET NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.boolean('hero_logo_visible').notNullable().defaultTo(true).alter();
-    });
-  }
-};

backend/migrations/core/153_hero_logo_size_inherit.js

@@ -1,51 +0,0 @@
-/**
- * Migration 153: make events.hero_logo_size NULL-able so NULL means "inherit
- * the global branding_logo_size" (#756 follow-up — the size counterpart of 152).
- *
- * Before: hero_logo_size was `varchar NOT NULL DEFAULT 'medium'`, snapshotted
- * from the global branding_logo_size at creation. The two gallery render paths
- * then disagreed — GalleryLayout read the global size live, while the
- * hero-header path used the per-event snapshot — so a hero logo could render at
- * different sizes on different layouts, and changing the global size didn't
- * update hero-header galleries.
- *
- * After: NULL = inherit. gallery read-resolution falls back to
- * branding_logo_size when the per-event value is NULL, and both render paths
- * consume that resolved size.
- *
- * Data backfill: NULL out ALL existing hero_logo_size so every gallery inherits
- * the global size going forward. Unlike a boolean we can't tell a defaulted
- * value from a chosen one — but nulling is the safe choice here: it restores the
- * live-global behaviour GalleryLayout already had, and the per-event size can be
- * re-set from the event's edit page.
- */
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_size'))) return;
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size DROP DEFAULT');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size DROP NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.string('hero_logo_size', 20).nullable().alter();
-    });
-  }
-
-  await knex('events').update({ hero_logo_size: null });
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_size'))) return;
-  await knex('events').whereNull('hero_logo_size').update({ hero_logo_size: 'medium' });
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw("ALTER TABLE events ALTER COLUMN hero_logo_size SET DEFAULT 'medium'");
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size SET NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.string('hero_logo_size', 20).notNullable().defaultTo('medium').alter();
-    });
-  }
-};

backend/migrations/core/154_mail_accounts_and_bodies.js

@@ -1,52 +0,0 @@
-/**
- * Messages Phase 2 — additional inbound mailboxes + captured message bodies.
- *
- * `mail_accounts` holds inbound mailboxes BEYOND the primary accounting IMAP
- * that already lives in `email_configs` (e.g. the customer `hello@` mailbox).
- * The intake poller (emailIntakeService) polls the accounting mailbox AND every
- * enabled row here; customer mail is logged with its body but not routed to the
- * accounting inbox.
- *
- * The new `received_emails` columns capture the parsed message so the Messages
- * reading pane can show it: `account_key` tags which mailbox it came from,
- * `body_html`/`body_text` hold the (server-sanitized) body, `to_address` the
- * envelope recipient. All additive + guarded.
- */
-exports.up = async function up(knex) {
-  const hasAccounts = await knex.schema.hasTable('mail_accounts');
-  if (!hasAccounts) {
-    await knex.schema.createTable('mail_accounts', (t) => {
-      t.increments('id').primary();
-      t.string('account_key', 64).notNullable().unique(); // e.g. 'customers'
-      t.string('label', 120);
-      t.string('imap_host', 255);
-      t.integer('imap_port').defaultTo(993);
-      t.boolean('imap_secure').defaultTo(true);
-      t.string('imap_user', 255);
-      t.string('imap_pass', 512);
-      t.string('imap_folder', 255).defaultTo('INBOX');
-      t.boolean('enabled').defaultTo(false);
-      t.timestamp('created_at').defaultTo(knex.fn.now());
-      t.timestamp('updated_at').defaultTo(knex.fn.now());
-    });
-  }
-
-  const cols = [
-    ['account_key', (t) => t.string('account_key', 64)],
-    ['to_address', (t) => t.string('to_address', 512)],
-    ['body_html', (t) => t.text('body_html')],
-    ['body_text', (t) => t.text('body_text')],
-  ];
-  for (const [name, add] of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('received_emails', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) await knex.schema.alterTable('received_emails', add);
-  }
-};
-
-exports.down = async function down(knex) {
-  // Non-destructive on the audit log: leave the added columns in place (they're
-  // nullable and harmless). Only drop the new table.
-  await knex.schema.dropTableIfExists('mail_accounts');
-};

backend/migrations/core/155_email_queue_origin.js

@@ -1,25 +0,0 @@
-/**
- * Messages Phase 3 — distinguish human-composed sends from system mail.
- *
- * `origin` is 'system' for everything the app queues automatically (invoices,
- * reminders, gallery notices — the Automated stream) and 'manual' for emails an
- * admin composed/edited in the Messages composer (replies + document messages —
- * the Customers ▸ Sent stream). Existing rows default to 'system'.
- */
-exports.up = async function up(knex) {
-  const has = await knex.schema.hasColumn('email_queue', 'origin');
-  if (!has) {
-    await knex.schema.alterTable('email_queue', (t) => {
-      t.string('origin', 16).defaultTo('system');
-    });
-  }
-};
-
-exports.down = async function down(knex) {
-  const has = await knex.schema.hasColumn('email_queue', 'origin');
-  if (has) {
-    await knex.schema.alterTable('email_queue', (t) => {
-      t.dropColumn('origin');
-    });
-  }
-};

backend/migrations/core/156_mail_accounts_smtp.js

@@ -1,34 +0,0 @@
-/**
- * Messages Phase 3 follow-up — outgoing (SMTP) settings per mail account.
- *
- * The customer mailbox (hello@) needs BOTH incoming (IMAP, migration 154) and
- * outgoing (SMTP) config, so replies to customers send from hello@ instead of
- * the global no-reply@ identity. All additive/guarded.
- */
-exports.up = async function up(knex) {
-  const cols = [
-    ['smtp_host', (t) => t.string('smtp_host', 255)],
-    ['smtp_port', (t) => t.integer('smtp_port')],
-    ['smtp_secure', (t) => t.boolean('smtp_secure').defaultTo(false)],
-    ['smtp_user', (t) => t.string('smtp_user', 255)],
-    ['smtp_pass', (t) => t.string('smtp_pass', 512)],
-    ['from_email', (t) => t.string('from_email', 255)],
-    ['from_name', (t) => t.string('from_name', 120)],
-  ];
-  for (const [name, add] of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('mail_accounts', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) await knex.schema.alterTable('mail_accounts', add);
-  }
-};
-
-exports.down = async function down(knex) {
-  const cols = ['smtp_host', 'smtp_port', 'smtp_secure', 'smtp_user', 'smtp_pass', 'from_email', 'from_name'];
-  for (const name of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('mail_accounts', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (has) await knex.schema.alterTable('mail_accounts', (t) => t.dropColumn(name));
-  }
-};

backend/migrations/core/157_mailbox_state.js

@@ -1,33 +0,0 @@
-/**
- * Messages — Archive / Delete (trash) support.
- *
- * `mailbox_state` on both mail tables: 'active' (normal folders), 'archived'
- * (Archived folder), or 'deleted' (Deleted/trash folder). Delete is soft — the
- * row moves to 'deleted' and is only removed for good when purged FROM the
- * Deleted folder. Legacy rows have NULL, treated as 'active'. Additive/guarded.
- */
-exports.up = async function up(knex) {
-  for (const table of ['email_queue', 'received_emails']) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn(table, 'mailbox_state');
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) {
-      // eslint-disable-next-line no-await-in-loop
-      await knex.schema.alterTable(table, (t) => {
-        t.string('mailbox_state', 16).defaultTo('active');
-      });
-    }
-  }
-};
-
-exports.down = async function down(knex) {
-  for (const table of ['email_queue', 'received_emails']) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn(table, 'mailbox_state');
-    // eslint-disable-next-line no-await-in-loop
-    if (has) {
-      // eslint-disable-next-line no-await-in-loop
-      await knex.schema.alterTable(table, (t) => { t.dropColumn('mailbox_state'); });
-    }
-  }
-};

backend/package.json

@@ -1,11 +1,8 @@
 {
   "name": "picpeak-backend",
-  "version": "3.45.11",
+  "version": "3.81.0-beta.0",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
-  "engines": {
-    "node": "^20.19.0 || >=22"
-  },
   "scripts": {
     "start": "node server.js",
     "dev": "nodemon server.js",
@@ -21,12 +18,11 @@
     "@aws-sdk/lib-storage": "^3.850.0",
     "@aws-sdk/s3-request-presigner": "^3.850.0",
     "archiver": "^5.3.1",
-    "axios": "1.18.1",
+    "axios": "1.16.0",
     "bcrypt": "6.0.0",
     "chokidar": "4.0.3",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "cron-parser": "^4.9.0",
     "dotenv": "^16.0.3",
     "exifr": "^7.1.3",
     "express": "^4.18.2",
@@ -51,20 +47,19 @@
     "node-stream-zip": "^1.15.0",
     "nodemailer": "^9.0.1",
     "otplib": "^12.0.1",
-    "p-limit": "^3.1.0",
     "pdf-lib": "^1.17.1",
     "pdfkit": "^0.17.2",
     "pg": "^8.16.3",
-    "postcss": "8.5.18",
+    "postcss": "8.5.10",
     "qrcode": "^1.5.4",
     "react-i18next": "^15.6.0",
-    "sanitize-html": "2.17.5",
-    "sharp": "0.35.3",
+    "sanitize-html": "^2.17.0",
+    "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",
     "swissqrbill": "^4.3.0",
-    "tar": ">=7.5.21",
+    "tar": ">=7.5.16",
     "uuid": "^11.1.1",
     "winston": "^3.8.2",
     "zxcvbn": "^4.4.2"
@@ -84,8 +79,8 @@
     "js-yaml": "^4.2.0",
     "fast-xml-parser": ">=5.7.0",
     "qs": ">=6.15.2",
-    "tar": ">=7.5.21",
-    "brace-expansion": ">=5.0.7",
+    "tar": ">=7.5.16",
+    "brace-expansion": ">=5.0.6",
     "minimatch": ">=9.0.7",
     "path-to-regexp": "0.1.13",
     "lodash": ">=4.18.1",

backend/server.js

@@ -38,6 +38,7 @@ const {
 
 // Import routes
 const authRoutes = require('./src/routes/auth');
+const eventRoutes = require('./src/routes/events');
 const galleryRoutes = require('./src/routes/gallery');
 const adminRoutes = require('./src/routes/admin');
 const adminAuthRoutes = require('./src/routes/adminAuth');
@@ -694,7 +695,8 @@ app.get('/health', async (req, res) => {
 // Routes
 app.use('/api/setup', setupRoutes); // public first-run bootstrap (self-closes after setup)
 app.use('/api/auth', authRoutes);
-app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
+  app.use('/api/events', eventRoutes);
+  app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
 // Gallery routes - main routes first, then feedback routes
 app.use('/api/gallery', galleryRoutes);
 app.use('/api/gallery', require('./src/routes/galleryFeedback'));

backend/src/__tests__/galleryOgService.shareImage.test.js

@@ -343,34 +343,12 @@ describe('isSocialCrawler — extended bot coverage (#521)', () => {
       // 3rd-party preview services used by business-messaging stacks
       'LinkPreview/1.0',
       'Slack-ImgProxy/1.0',
-      // Viber + broader crawler set (#699 follow-up)
-      'Mozilla/5.0 (compatible; Viber)',
-      'Mozilla/5.0 (compatible; Bluesky Cardyb/1.1)',
-      'facebookcatalog/1.0',
-      'kakaotalk-scrap/1.0',
-      'Mozilla/5.0 (compatible; Synapse/1.98)',
-      'Rocket.Chat/6.0',
     ];
     for (const ua of knownBots) {
       expect(isSocialCrawler(ua)).toBe(true);
     }
   });
 
-  it('does NOT match human in-app-browser UAs (our OG response is meta-only, no redirect)', () => {
-    // These share a token with a preview bot but are also sent by real users
-    // browsing inside the app's webview — matching them would serve a human
-    // the bare OG stub. Deliberately excluded; guard against re-adding them.
-    const inAppBrowsers = [
-      'Mozilla/5.0 (iPhone) AppleWebKit MicroMessenger/8.0.0',        // WeChat in-app
-      'Mozilla/5.0 (iPhone) AppleWebKit Line/13.0.0',                // LINE in-app
-      'Mozilla/5.0 (Linux; Android) Zalo',                          // Zalo in-app
-      'Mozilla/5.0 (Macintosh) Chrome/120.0 Safari/537.36 boxing',  // "XING" substring trap
-    ];
-    for (const ua of inAppBrowsers) {
-      expect(isSocialCrawler(ua)).toBe(false);
-    }
-  });
-
   it('does not match a regular browser UA', () => {
     const browsers = [
       'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36',

backend/src/middleware/uploadValidation.js

@@ -23,7 +23,7 @@ async function validateUploadedFile(filePath) {
       let metadata;
       try {
         metadata = await sharp(filePath, {
-          failOn: 'none', // Don't fail on recoverable errors
+          failOnError: false, // Don't fail on recoverable errors
           limitInputPixels: 268402689 // ~16k x 16k max
         }).metadata();
       } catch (metadataError) {
@@ -43,7 +43,7 @@ async function validateUploadedFile(filePath) {
       // Additional check: verify we can actually decode a small portion of the image
       try {
         await sharp(filePath, {
-          failOn: 'none',
+          failOnError: false,
           limitInputPixels: 268402689
         })
         .resize(10, 10) // Try to resize to very small size

backend/src/routes/adminApiTokens.js

@@ -19,10 +19,7 @@ const router = express.Router();
 // the plaintext, never recoverable after creation.
 router.get('/', adminAuth, requirePermission('settings.view'), async (req, res) => {
   try {
-    // Scope to the caller's own tokens unless super_admin — the previous
-    // query returned every admin's token metadata (name/preview/scopes/
-    // owner) to any settings.view holder (GHSA-jm7j).
-    const tokensQuery = db('api_tokens')
+    const tokens = await db('api_tokens')
       .leftJoin('admin_users', 'admin_users.id', 'api_tokens.created_by')
       .select(
         'api_tokens.id',
@@ -36,10 +33,6 @@ router.get('/', adminAuth, requirePermission('settings.view'), async (req, res)
         'admin_users.username as owner_username'
       )
       .orderBy('api_tokens.created_at', 'desc');
-    if (req.admin.roleName !== 'super_admin') {
-      tokensQuery.where('api_tokens.created_by', req.admin.id);
-    }
-    const tokens = await tokensQuery;
     res.json(tokens);
   } catch (error) {
     logger.error('Failed to list API tokens', { error: error.message });
@@ -108,12 +101,6 @@ router.delete('/:id', adminAuth, requirePermission('settings.edit'), async (req,
     const { id } = req.params;
     const row = await db('api_tokens').where({ id }).first();
     if (!row) return res.status(404).json({ error: 'Token not found' });
-    // Only the token's owner (or a super_admin) may revoke it — otherwise
-    // any settings.edit holder could revoke another admin's tokens
-    // (GHSA-gprq). 404 rather than 403 so a non-owner can't probe token ids.
-    if (req.admin.roleName !== 'super_admin' && row.created_by !== req.admin.id) {
-      return res.status(404).json({ error: 'Token not found' });
-    }
     if (row.revoked_at) return res.status(400).json({ error: 'Token already revoked' });
 
     await db('api_tokens').where({ id }).update({ revoked_at: new Date() });

backend/src/routes/adminArchives.js

@@ -9,7 +9,6 @@ const { requirePermission } = require('../middleware/permissions');
 const archiver = require('archiver');
 const StreamZip = require('node-stream-zip');
 const { requireEventOwnership } = require('../middleware/ownership');
-const { assertZipEntriesWithin } = require('../utils/safePath');
 const logger = require('../utils/logger');
 const { getPagination } = require('../utils/routeHelpers');
 const router = express.Router();
@@ -184,16 +183,6 @@ router.post('/:id/restore', adminAuth, requirePermission('archives.restore'), re
       const entries = Object.values(await zip.entries());
       logger.info(`Archive contains ${entries.length} entries`);
 
-      // Reject ZIP-slip entries before writing anything to disk — extract()
-      // does not neutralise `../` in entry names (GHSA-jfhw-fj23-fx6x).
-      try {
-        assertZipEntriesWithin(entries, eventDir);
-      } catch (slipErr) {
-        await zip.close();
-        logger.warn(`Refusing archive restore — unsafe entry path: ${slipErr.message}`);
-        return res.status(400).json({ error: 'Archive contains invalid entry paths' });
-      }
-
       // Stream-extract everything to disk
       await zip.extract(null, eventDir);
       await zip.close();

backend/src/routes/adminBackup.js

@@ -1,9 +1,7 @@
 const express = require('express');
 const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
-const { requirePermission, requireSuperAdmin } = require('../middleware/permissions');
-const { clearAdminAuthCookie } = require('../utils/tokenUtils');
-const { revokeToken } = require('../utils/tokenRevocation');
+const { requirePermission } = require('../middleware/permissions');
 const { triggerManualBackup, getBackupStatus, cleanupOldBackupRuns, getBackupManifest, validateBackupManifest } = require('../services/backupService');
 const logger = require('../utils/logger');
 const { errorResponse, getPagination } = require('../utils/routeHelpers');
@@ -57,33 +55,14 @@ router.put('/config', adminAuth, requirePermission('backup.create'), async (req,
         }
         break;
       case 's3':
-        if (!updates.backup_s3_endpoint || !updates.backup_s3_bucket ||
+        if (!updates.backup_s3_endpoint || !updates.backup_s3_bucket || 
               !updates.backup_s3_access_key || !updates.backup_s3_secret_key) {
           return res.status(400).json({ error: 'S3 backup requires endpoint, bucket, and credentials' });
         }
         break;
       }
     }
-
-    // SSRF: validate an S3 endpoint whenever one is supplied — NOT only when
-    // the payload also flips backup_destination_type to 's3'. The PUT
-    // persists every backup_* field independently, so with S3 already
-    // selected a caller could PATCH just backup_s3_endpoint to a
-    // private-resolving host; the management ops (manifest, bucket/file
-    // browse, cleanup, test-upload) then connect without going through
-    // testConnection. Prod-only; dev points at localhost MinIO deliberately.
-    if (process.env.NODE_ENV === 'production'
-        && updates.backup_s3_endpoint && updates.backup_s3_endpoint !== '••••••••') {
-      const rawEndpoint = updates.backup_s3_endpoint;
-      const withProto = /^https?:\/\//.test(rawEndpoint) ? rawEndpoint : `https://${rawEndpoint}`;
-      let epHost = null;
-      try { epHost = new URL(withProto).hostname; } catch { epHost = null; }
-      const { isHostAllowed } = require('../utils/networkValidation');
-      if (!epHost || !(await isHostAllowed(epHost))) {
-        return res.status(400).json({ error: 'S3 endpoint resolves to a private or internal network address' });
-      }
-    }
-
+    
     // Update settings
     for (const [key, value] of Object.entries(updates)) {
       if (key.startsWith('backup_')) {
@@ -158,12 +137,7 @@ router.post('/run', adminAuth, requirePermission('backup.create'), async (req, r
 // SECURITY: the file contains plaintext secrets (SMTP password, admin password
 // hashes, API keys). The download UI must warn before offering it. We surface
 // the flag as a response header too so the client can double-confirm.
-// Full-instance export dumps every table unredacted — bcrypt password
-// hashes, 2FA columns, and all integration secrets (SMTP/SSO/WhatsApp/
-// webhook/S3) in cleartext. The built-in `admin` role holds backup.create,
-// but is denied this data everywhere else (config APIs mask secrets as
-// ********). Gate the raw dump behind super_admin (GHSA-pv6w-rj34-wj9v).
-router.get('/picpeak/export', adminAuth, requireSuperAdmin(), async (req, res) => {
+router.get('/picpeak/export', adminAuth, requirePermission('backup.create'), async (req, res) => {
   const fsSync = require('fs');
   try {
     const includePhotos = req.query.includePhotos === 'true' || req.query.includePhotos === '1';
@@ -204,43 +178,12 @@ router.post('/picpeak/import', adminAuth, requirePermission('backup.restore'), p
   const picpeakPath = req.file.path;
   try {
     const { importFromPicpeak } = require('../services/picpeakImportService');
-    // adminAuth populates req.admin, not req.user. Passing req.user.id here
-    // left currentAdminId undefined, so reinjectCurrentAdmin() had no account
-    // to preserve and the admin_users table was fully replaced by the backup —
-    // letting a crafted .picpeak take over every admin account (GHSA-qxfx-4493-4v8f).
-    const result = await importFromPicpeak({ picpeakPath, currentAdminId: req.admin && req.admin.id });
-
-    // The restore rewrote admin_users, so ids may have shifted. The operator's
-    // current JWT is bound only to the pre-restore admin id (adminAuth trusts
-    // `decoded.id` — IP is logged, not enforced, and the backup controls
-    // password_changed_at), which could now resolve to a DIFFERENT restored
-    // account and silently grant its permissions. Force a fresh login instead
-    // of trusting the old session: revoke the token and clear the cookie.
-    // Clearing the cookie is the guarantee — it drops the operator's browser
-    // session unconditionally. Revocation is the extra layer that also kills a
-    // Bearer-header copy of the JWT; revokeToken() swallows DB errors and
-    // returns false, so check the result and log loudly if the denylist write
-    // didn't land (the operator should still re-login, which the cookie clear
-    // forces).
-    let tokenRevoked = false;
-    try {
-      if (req.token) {
-        tokenRevoked = await revokeToken(req.token, 'picpeak-import', { adminId: req.admin && req.admin.id });
-      }
-    } catch (revokeErr) {
-      logger.warn('[picpeak-import] failed to revoke session token after restore', { error: revokeErr.message });
-    }
-    if (req.token && !tokenRevoked) {
-      logger.warn('[picpeak-import] session token was NOT added to the revocation denylist after restore; relying on cookie clear to force re-login');
-    }
-    clearAdminAuthCookie(res);
-
+    const result = await importFromPicpeak({ picpeakPath, currentAdminId: req.user && req.user.id });
     res.json({
       success: true,
       tables: result.tables,
       filesRestored: result.filesRestored,
       usesExternalMedia: result.usesExternalMedia,
-      sessionInvalidated: true,
     });
   } catch (error) {
     const status = error.statusCode || 500;
@@ -375,11 +318,9 @@ router.post('/test-connection', adminAuth, requirePermission('backup.create'), a
         break;
       }
 
-      // SSRF protection: resolve the host and block any private/internal
-      // address. ssh does its own DNS at connect time, so a literal-only
-      // check let a hostname resolving to an internal IP through (#GHSA-4jh8).
-      const { isHostAllowed } = require('../utils/networkValidation');
-      if (!(await isHostAllowed(host))) {
+      // SSRF protection: block connections to private/internal addresses
+      const { isPrivateIP } = require('../utils/networkValidation');
+      if (isPrivateIP(host)) {
         res.json({ success: false, message: 'Host cannot be a private or internal network address' });
         break;
       }

backend/src/routes/adminCategories.js

@@ -141,18 +141,8 @@ router.put('/:id', adminAuth, requirePermission('settings.edit'), [
         .trim()
     };
 
-    // Update hero_photo_id if provided (including null to clear it). A
-    // non-null hero must belong to this category (GHSA-j2f4) — the general
-    // update path previously wrote it with no membership check at all.
+    // Update hero_photo_id if provided (including null to clear it)
     if (Object.prototype.hasOwnProperty.call(req.body, 'hero_photo_id')) {
-      if (hero_photo_id) {
-        const heroPhoto = await db('photos')
-          .where({ id: hero_photo_id, category_id: id })
-          .first();
-        if (!heroPhoto) {
-          return res.status(404).json({ error: 'Photo not found in this category' });
-        }
-      }
       updateData.hero_photo_id = hero_photo_id || null;
     }
 
@@ -202,16 +192,11 @@ router.put('/:id/hero', adminAuth, requirePermission('settings.edit'), [
       return res.status(404).json({ error: 'Category not found' });
     }
 
-    // If hero_photo_id is provided, verify the photo actually belongs to
-    // THIS category — checking existence alone let an admin point a
-    // category's hero at a photo from a different category or event
-    // (GHSA-j2f4).
+    // If hero_photo_id is provided, verify it belongs to a photo in this category
     if (hero_photo_id) {
-      const photo = await db('photos')
-        .where({ id: hero_photo_id, category_id: id })
-        .first();
+      const photo = await db('photos').where('id', hero_photo_id).first();
       if (!photo) {
-        return res.status(404).json({ error: 'Photo not found in this category' });
+        return res.status(404).json({ error: 'Photo not found' });
       }
     }
 

backend/src/routes/adminDashboard.js

@@ -69,7 +69,7 @@ router.get('/stats', adminAuth, requirePermission('analytics.view'), async (req,
 
     // Get total downloads (last 30 days) - include both single and bulk downloads
     const totalDownloads = await db('access_logs')
-      .whereIn('action', ['download', 'download_all', 'download_all_presigned', 'download_selected'])
+      .whereIn('action', ['download', 'download_all'])
       .where('timestamp', '>=', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
@@ -99,7 +99,7 @@ router.get('/stats', adminAuth, requirePermission('analytics.view'), async (req,
       .first();
 
     const previousDownloads = await db('access_logs')
-      .whereIn('action', ['download', 'download_all', 'download_all_presigned', 'download_selected'])
+      .whereIn('action', ['download', 'download_all'])
       .where('timestamp', '>=', sixtyDaysAgo.toISOString())
       .where('timestamp', '<', thirtyDaysAgo.toISOString())
       .count('id as count')
@@ -271,7 +271,7 @@ router.get('/analytics', adminAuth, requirePermission('analytics.view'), async (
     // Get downloads per day - include both single and bulk downloads
     const downloadsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
-      .whereIn('action', ['download', 'download_all', 'download_all_presigned', 'download_selected'])
+      .whereIn('action', ['download', 'download_all'])
       .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
@@ -307,7 +307,7 @@ router.get('/analytics', adminAuth, requirePermission('analytics.view'), async (
       .select('events.id', 'events.event_name', 'events.slug')
       .select(db.raw('COUNT(CASE WHEN action = \'view\' THEN 1 END) as views'))
       .select(db.raw('COUNT(DISTINCT CASE WHEN action = \'view\' THEN ip_address END) as uniqueVisitors'))
-      .select(db.raw('COUNT(CASE WHEN action IN (\'download\', \'download_all\', \'download_all_presigned\', \'download_selected\') THEN 1 END) as downloads'))
+      .select(db.raw('COUNT(CASE WHEN action IN (\'download\', \'download_all\') THEN 1 END) as downloads'))
       .join('events', 'access_logs.event_id', 'events.id')
       .where('access_logs.timestamp', '>=', startDateStr)
       .groupBy('events.id', 'events.event_name', 'events.slug')
@@ -377,7 +377,7 @@ router.get('/analytics', adminAuth, requirePermission('analytics.view'), async (
       .first();
 
     const totalDownloadsCount = await db('access_logs')
-      .whereIn('action', ['download', 'download_all', 'download_all_presigned', 'download_selected'])
+      .whereIn('action', ['download', 'download_all'])
       .where('timestamp', '>=', startDateStr)
       .count('id as count')
       .first();

backend/src/routes/adminEmail.js

@@ -4,10 +4,6 @@ const { body, query, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-// Gate the NEW Messages routes on the `messaging` flag (per-route, NOT the whole
-// /email mount — the pre-existing config/queue/received endpoints stay ungated).
-const { requireFeatureFlag } = require('../middleware/requireFeatureFlag');
-const messagingGate = requireFeatureFlag('messaging');
 const { wrapEmailHtml, processEmailQueue } = require('../services/emailProcessor');
 const { errorResponse } = require('../utils/routeHelpers');
 const logger = require('../utils/logger');
@@ -66,11 +62,9 @@ router.post('/config', [
       tls_reject_unauthorized
     } = req.body;
 
-    // Validate SMTP host is not a private/internal address (SSRF protection).
-    // Resolves DNS so a public-looking hostname pointing at an internal IP
-    // is caught, not just literal private addresses (#GHSA-ch64).
-    const { isHostAllowed } = require('../utils/networkValidation');
-    if (!(await isHostAllowed(smtp_host))) {
+    // Validate SMTP host is not a private/internal address (SSRF protection)
+    const { isPrivateIP } = require('../utils/networkValidation');
+    if (isPrivateIP(smtp_host)) {
       return res.status(400).json({ error: 'SMTP host cannot point to a private or internal network address' });
     }
 
@@ -154,8 +148,8 @@ router.post('/incoming-config', [
     const errors = validationResult(req);
     if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
     const { imap_host, imap_port, imap_secure, imap_user, imap_pass, imap_folder } = req.body;
-    const { isHostAllowed } = require('../utils/networkValidation');
-    if (!(await isHostAllowed(imap_host))) {
+    const { isPrivateIP } = require('../utils/networkValidation');
+    if (isPrivateIP(imap_host)) {
       return res.status(400).json({ error: 'IMAP host cannot point to a private or internal network address' });
     }
     const existing = await db('email_configs').first();
@@ -185,8 +179,8 @@ router.post('/incoming-config/folders', adminAuth, requirePermission('email.view
   try {
     const { imap_host, imap_port, imap_secure, imap_user, imap_pass } = req.body || {};
     if (imap_host) {
-      const { isHostAllowed } = require('../utils/networkValidation');
-      if (!(await isHostAllowed(imap_host))) {
+      const { isPrivateIP } = require('../utils/networkValidation');
+      if (isPrivateIP(imap_host)) {
         return res.status(400).json({ error: 'IMAP host cannot point to a private or internal network address' });
       }
     }
@@ -207,8 +201,8 @@ router.post('/incoming-config/test', adminAuth, requirePermission('email.view'),
   try {
     const { imap_host, imap_port, imap_secure, imap_user, imap_pass, imap_folder } = req.body || {};
     if (imap_host) {
-      const { isHostAllowed } = require('../utils/networkValidation');
-      if (!(await isHostAllowed(imap_host))) {
+      const { isPrivateIP } = require('../utils/networkValidation');
+      if (isPrivateIP(imap_host)) {
         return res.status(400).json({ error: 'IMAP host cannot point to a private or internal network address' });
       }
     }
@@ -266,196 +260,16 @@ router.get('/received', adminAuth, requirePermission('email.view'), async (req,
   try {
     const page = Math.max(1, parseInt(req.query.page, 10) || 1);
     const pageSize = Math.min(100, Math.max(1, parseInt(req.query.pageSize, 10) || 25));
-    const account = req.query.account ? String(req.query.account) : null;
-    // mailbox_state filter: no param → active (+ legacy NULL); else exact.
-    const state = ['archived', 'deleted'].includes(String(req.query.state)) ? String(req.query.state) : 'active';
-    // Optional full-table search (sender / subject) so results aren't truncated
-    // to the first page before matching.
-    const q = req.query.q ? String(req.query.q).trim().slice(0, 255) : '';
-    // 'accounting' matches legacy rows too (account_key was NULL before mig 154).
-    const applyAccount = (qb) => {
-      if (account === 'accounting') qb.where((b) => b.where('account_key', 'accounting').orWhereNull('account_key'));
-      else if (account) qb.where('account_key', account);
-      if (state === 'active') qb.where((b) => b.where('mailbox_state', 'active').orWhereNull('mailbox_state'));
-      else qb.where('mailbox_state', state);
-      if (q) qb.where((b) => b.where('from_address', 'like', `%${q}%`).orWhere('subject', 'like', `%${q}%`));
-      return qb;
-    };
-    const countRow = await applyAccount(db('received_emails')).count({ c: '*' }).first();
+    const base = db('received_emails');
+    const countRow = await base.clone().count({ c: '*' }).first();
     const total = parseInt(countRow?.c || 0, 10);
-    // Bodies are excluded from the list (can be large); fetched per-message.
-    const items = await applyAccount(db('received_emails'))
-      .select('id', 'message_id', 'account_key', 'from_address', 'to_address', 'subject',
-        'received_at', 'attachment_count', 'status', 'inbound_document_id', 'error')
-      .orderBy('received_at', 'desc').limit(pageSize).offset((page - 1) * pageSize);
+    const items = await base.clone().orderBy('received_at', 'desc').limit(pageSize).offset((page - 1) * pageSize);
     res.json({ items, pagination: { page, pageSize, total, totalPages: Math.ceil(total / pageSize) } });
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to fetch received emails');
   }
 });
 
-// Single received email WITH its captured (server-sanitized) body — Messages
-// reading pane. body_html was already sanitized on ingest; the viewer renders
-// it in a script-less sandboxed iframe as well.
-router.get('/received/:id', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const id = parseInt(req.params.id, 10);
-    if (!Number.isInteger(id)) return res.status(400).json({ error: 'Invalid id' });
-    const row = await db('received_emails').where({ id }).first();
-    if (!row) return res.status(404).json({ error: 'Email not found' });
-    res.json(row);
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to fetch email');
-  }
-});
-
-// Move an email between mailbox states: Archive / Delete (soft) or Restore
-// (back to active). kind = 'queue' | 'received'. Delete is a soft move to the
-// trash; the row is only removed for good by the DELETE handler below.
-router.post('/item/:kind/:id/state', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const table = req.params.kind === 'received' ? 'received_emails' : req.params.kind === 'queue' ? 'email_queue' : null;
-    if (!table) return res.status(400).json({ error: 'Invalid kind' });
-    const id = parseInt(req.params.id, 10);
-    if (!Number.isInteger(id)) return res.status(400).json({ error: 'Invalid id' });
-    const state = String(req.body?.state || '');
-    if (!['active', 'archived', 'deleted'].includes(state)) return res.status(400).json({ error: 'Invalid state' });
-    const n = await db(table).where({ id }).update({ mailbox_state: state });
-    if (!n) return res.status(404).json({ error: 'Not found' });
-    res.json({ ok: true });
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to update email');
-  }
-});
-
-// Permanently delete an email row — only offered from the Deleted folder.
-router.delete('/item/:kind/:id', adminAuth, messagingGate, requirePermission('email.edit'), async (req, res) => {
-  try {
-    const table = req.params.kind === 'received' ? 'received_emails' : req.params.kind === 'queue' ? 'email_queue' : null;
-    if (!table) return res.status(400).json({ error: 'Invalid kind' });
-    const id = parseInt(req.params.id, 10);
-    if (!Number.isInteger(id)) return res.status(400).json({ error: 'Invalid id' });
-    await db(table).where({ id }).del();
-    res.json({ ok: true });
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to delete email');
-  }
-});
-
-// Additional inbound mailboxes (beyond the primary accounting IMAP in
-// email_configs) — e.g. the customer hello@ box. Passwords are masked out.
-router.get('/accounts', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const rows = await db('mail_accounts').orderBy('id');
-    res.json({ items: rows.map((a) => ({
-      ...a,
-      imap_pass: a.imap_pass ? '********' : '',
-      smtp_pass: a.smtp_pass ? '********' : '',
-    })) });
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to load mail accounts');
-  }
-});
-
-// Resolved sender/mailbox addresses for the Messages UI — so the sidebar shows
-// the REAL configured addresses instead of hardcoded placeholders. Accounting =
-// the primary IMAP login (rechnungen@); customers = the hello@ mailbox; the
-// automated stream sends from the global SMTP from-address.
-router.get('/identities', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const cfg = await db('email_configs').first();
-    let customers = null;
-    try {
-      const cust = await db('mail_accounts').where({ account_key: 'customers' }).first();
-      customers = cust?.imap_user || cust?.from_email || null;
-    } catch (_) { customers = null; }
-    res.json({
-      automated: cfg?.from_email || null,
-      accounting: cfg?.imap_user || null,
-      customers,
-    });
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to load mail identities');
-  }
-});
-
-// Upsert a mailbox by account_key. A masked password ('********') keeps the
-// stored value so the admin never has to re-type it.
-router.post('/accounts', adminAuth, messagingGate, requirePermission('email.edit'), async (req, res) => {
-  try {
-    const b = req.body || {};
-    if (!b.account_key) return res.status(400).json({ error: 'account_key is required' });
-    // SSRF guard — mirror /config + /incoming-config: neither the IMAP nor the
-    // SMTP host may point at a private/internal address.
-    const { isHostAllowed } = require('../utils/networkValidation');
-    if (b.imap_host && !(await isHostAllowed(b.imap_host))) {
-      return res.status(400).json({ error: 'IMAP host cannot point to a private or internal network address' });
-    }
-    if (b.smtp_host && !(await isHostAllowed(b.smtp_host))) {
-      return res.status(400).json({ error: 'SMTP host cannot point to a private or internal network address' });
-    }
-    const patch = {
-      label: b.label || null,
-      imap_host: b.imap_host || null,
-      imap_port: b.imap_port ? parseInt(b.imap_port, 10) : 993,
-      imap_secure: b.imap_secure !== false,
-      imap_user: b.imap_user || null,
-      imap_folder: b.imap_folder || 'INBOX',
-      // Outgoing (SMTP) identity — replies from this mailbox send from here.
-      smtp_host: b.smtp_host || null,
-      smtp_port: b.smtp_port ? parseInt(b.smtp_port, 10) : 587,
-      smtp_secure: b.smtp_secure === true,
-      smtp_user: b.smtp_user || null,
-      from_email: b.from_email || null,
-      from_name: b.from_name || null,
-      enabled: !!b.enabled,
-      updated_at: new Date(),
-    };
-    if (b.imap_pass && b.imap_pass !== '********') patch.imap_pass = b.imap_pass;
-    if (b.smtp_pass && b.smtp_pass !== '********') patch.smtp_pass = b.smtp_pass;
-    const existing = await db('mail_accounts').where({ account_key: b.account_key }).first();
-    if (existing) {
-      await db('mail_accounts').where({ account_key: b.account_key }).update(patch);
-    } else {
-      await db('mail_accounts').insert({
-        account_key: b.account_key,
-        imap_pass: (b.imap_pass && b.imap_pass !== '********') ? b.imap_pass : '',
-        smtp_pass: (b.smtp_pass && b.smtp_pass !== '********') ? b.smtp_pass : '',
-        created_at: new Date(),
-        ...patch,
-      });
-    }
-    res.json({ ok: true });
-  } catch (error) {
-    errorResponse(res, error, 500, 'Failed to save mail account');
-  }
-});
-
-// Test an inbound mailbox's IMAP connection (before or after saving). Resolves
-// a masked/blank password from the stored row for the given account_key.
-router.post('/accounts/test', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const b = req.body || {};
-    const { isHostAllowed } = require('../utils/networkValidation');
-    if (b.imap_host && !(await isHostAllowed(b.imap_host))) {
-      return res.status(400).json({ error: 'IMAP host cannot point to a private or internal network address' });
-    }
-    let pass = b.imap_pass;
-    if ((!pass || pass === '********') && b.account_key) {
-      const stored = await db('mail_accounts').where({ account_key: b.account_key }).first();
-      pass = stored?.imap_pass || '';
-    }
-    const emailIntakeService = require('../services/emailIntakeService');
-    const result = await emailIntakeService.testConnection({
-      host: b.imap_host, port: b.imap_port, secure: b.imap_secure,
-      user: b.imap_user, pass, folder: b.imap_folder || 'INBOX',
-    });
-    res.json(result);
-  } catch (error) {
-    res.status(422).json({ ok: false, error: `Mailbox test failed (${error.message}).` });
-  }
-});
-
 // Test email configuration
 router.post('/test', adminAuth, requirePermission('email.send'), async (req, res) => {
   try {
@@ -624,8 +438,6 @@ router.post('/flush-queue', adminAuth, requirePermission('email.send'), async (r
 router.get('/queue', adminAuth, requirePermission('email.view'), [
   query('status').optional({ values: 'falsy' }).isIn(['pending', 'sent', 'failed']),
   query('emailType').optional({ values: 'falsy' }).isString().isLength({ max: 64 }),
-  query('origin').optional({ values: 'falsy' }).isIn(['system', 'manual']),
-  query('state').optional({ values: 'falsy' }).isIn(['active', 'archived', 'deleted']),
   query('q').optional({ values: 'falsy' }).isString().isLength({ max: 255 }),
   query('from').optional({ values: 'falsy' }).isISO8601(),
   query('to').optional({ values: 'falsy' }).isISO8601(),
@@ -644,13 +456,6 @@ router.get('/queue', adminAuth, requirePermission('email.view'), [
     const applyFilters = (qb) => {
       if (req.query.status) qb.where('email_queue.status', req.query.status);
       if (req.query.emailType) qb.where('email_queue.email_type', req.query.emailType);
-      // 'system' includes legacy rows (origin was NULL before migration 155).
-      if (req.query.origin === 'manual') qb.where('email_queue.origin', 'manual');
-      else if (req.query.origin === 'system') qb.where((b) => b.where('email_queue.origin', 'system').orWhereNull('email_queue.origin'));
-      // mailbox_state: default active (+ legacy NULL); Archived/Deleted folders pass it explicitly.
-      const st = ['archived', 'deleted'].includes(String(req.query.state)) ? String(req.query.state) : 'active';
-      if (st === 'active') qb.where((b) => b.where('email_queue.mailbox_state', 'active').orWhereNull('email_queue.mailbox_state'));
-      else qb.where('email_queue.mailbox_state', st);
       if (req.query.from) qb.where('email_queue.created_at', '>=', new Date(req.query.from));
       if (req.query.to) qb.where('email_queue.created_at', '<=', new Date(req.query.to));
       if (req.query.q) {
@@ -679,7 +484,6 @@ router.get('/queue', adminAuth, requirePermission('email.view'), [
           'email_queue.sent_at',
           'email_queue.error_message',
           'email_queue.retry_count',
-          'email_queue.origin',
           'email_queue.event_id',
           'events.event_name as event_name',
           'events.slug as event_slug'
@@ -699,7 +503,6 @@ router.get('/queue', adminAuth, requirePermission('email.view'), [
       sentAt: r.sent_at,
       errorMessage: r.error_message,
       retryCount: r.retry_count,
-      origin: r.origin || 'system',
       eventId: r.event_id,
       eventName: r.event_name || null,
       eventSlug: r.event_slug || null,
@@ -715,111 +518,6 @@ router.get('/queue', adminAuth, requirePermission('email.view'), [
   }
 });
 
-// Single queued/sent email WITH its rendered body — powers the Messages
-// reading pane. `rendered_html` is the exact HTML that was sent (migration
-// 119); rows sent before that migration have none. Attachment disk paths in
-// `email_data` are never exposed — only the filenames, so the pane can list
-// attachments without leaking storage paths (same PII posture as the list).
-router.get('/queue/:id', adminAuth, messagingGate, requirePermission('email.view'), async (req, res) => {
-  try {
-    const id = parseInt(req.params.id, 10);
-    if (!Number.isInteger(id)) return res.status(400).json({ error: 'Invalid id' });
-    const row = await db('email_queue')
-      .leftJoin('events', 'events.id', 'email_queue.event_id')
-      .select('email_queue.*', 'events.event_name as event_name', 'events.slug as event_slug')
-      .where('email_queue.id', id)
-      .first();
-    if (!row) return res.status(404).json({ error: 'Email not found' });
-
-    let cc = null;
-    let attachments = [];
-    try {
-      const data = row.email_data ? JSON.parse(row.email_data) : {};
-      if (data.cc) cc = Array.isArray(data.cc) ? data.cc.join(', ') : String(data.cc);
-      if (Array.isArray(data.attachments)) {
-        attachments = data.attachments
-          .filter((a) => a && a.filename)
-          .map((a) => ({ filename: a.filename, contentType: a.contentType || null }));
-      }
-    } catch (_) { /* malformed email_data → no cc/attachments, still return the body */ }
-
-    res.json({
-      id: row.id,
-      recipientEmail: row.recipient_email,
-      emailType: row.email_type,
-      status: row.status,
-      createdAt: row.created_at,
-      scheduledAt: row.scheduled_at,
-      sentAt: row.sent_at,
-      errorMessage: row.error_message,
-      retryCount: row.retry_count,
-      eventId: row.event_id,
-      eventName: row.event_name || null,
-      eventSlug: row.event_slug || null,
-      renderedHtml: row.rendered_html || null,
-      cc,
-      attachments,
-    });
-  } catch (error) {
-    logger.error('Get email queue item error:', error);
-    res.status(500).json({ error: 'Failed to load email', details: error.message });
-  }
-});
-
-// Send a human-composed email from the Messages composer. The admin already
-// edited the body (reply or document message), so it is sent as-is — no
-// template render — after a sanitize pass. Recorded in email_queue as a
-// 'manual' send so it surfaces under Customers > Sent.
-router.post('/send', adminAuth, messagingGate, requirePermission('email.send'), async (req, res) => {
-  try {
-    const b = req.body || {};
-    const to = String(b.to || '').trim();
-    const subject = String(b.subject || '').trim();
-    if (!to || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(to)) {
-      return res.status(400).json({ error: 'A valid recipient email is required.' });
-    }
-    if (!subject) return res.status(400).json({ error: 'A subject is required.' });
-
-    const sanitizeHtml = require('sanitize-html');
-    // Match the stricter inbound sanitizeBody allowlist: no <style> tag, no
-    // data: scheme — inline style/class attributes are enough for composed mail.
-    const html = sanitizeHtml(String(b.html || ''), {
-      allowedTags: sanitizeHtml.defaults.allowedTags.concat(['img']),
-      allowedAttributes: {
-        ...sanitizeHtml.defaults.allowedAttributes,
-        img: ['src', 'alt', 'width', 'height'],
-        '*': ['style', 'class'],
-      },
-      allowedSchemes: ['http', 'https', 'mailto', 'cid'],
-    });
-    const cc = b.cc ? String(b.cc).trim() : null;
-    const accountKey = b.accountKey ? String(b.accountKey) : undefined;
-
-    const emailProcessor = require('../services/emailProcessor');
-    const result = await emailProcessor.sendRawEmail({ to, cc, subject, html, accountKey });
-
-    await db('email_queue').insert({
-      recipient_email: to,
-      email_type: 'manual_message',
-      email_data: JSON.stringify({
-        subject,
-        cc: cc || undefined,
-        replyToReceivedId: b.replyToReceivedId || undefined,
-        messageId: result.messageId,
-      }),
-      status: 'sent',
-      origin: 'manual',
-      rendered_html: html,
-      created_at: new Date(),
-      sent_at: new Date(),
-    });
-    res.json({ ok: true });
-  } catch (error) {
-    logger.error('Manual send error:', error);
-    res.status(500).json({ error: 'Failed to send message', details: error.message });
-  }
-});
-
 // Helper: parse variables JSON safely
 function parseVariables(template) {
   try {

backend/src/routes/adminEvents/crud.js

@@ -94,8 +94,8 @@ module.exports = (router) => {
     body('allow_presigned_download').optional().isBoolean(),
     body('css_template_id').optional({ nullable: true, checkFalsy: true }).isInt(),
     // Hero logo settings
-    body('hero_logo_visible').optional({ nullable: true }).isBoolean(),
-    body('hero_logo_size').optional({ nullable: true }).isIn(['small', 'medium', 'large', 'xlarge']),
+    body('hero_logo_visible').optional().isBoolean(),
+    body('hero_logo_size').optional().isIn(['small', 'medium', 'large', 'xlarge']),
     body('hero_logo_position').optional().isIn(['top', 'center', 'bottom']),
     // Header style settings (decoupled from layout)
     body('header_style').optional().isIn(['hero', 'standard', 'banner', 'minimal', 'none']),
@@ -339,18 +339,8 @@ module.exports = (router) => {
 
       // Get branding defaults for hero logo settings (Feature 7: Branding Inheritance)
       const brandingDefaults = await getBrandingDefaults();
-      // hero_logo_visible: store NULL ("inherit") unless the admin explicitly
-      // set it, so the global branding_logo_display_hero toggle keeps
-      // controlling this gallery afterwards (#756). Only an explicit per-event
-      // choice overrides the global. `!= null` treats an explicit null the same
-      // as omitted (both → inherit); otherwise formatBoolean(null) would coerce
-      // to 0/false on SQLite instead of NULL (the PUT handler already does this).
-      const effectiveHeroLogoVisible = req.body.hero_logo_visible != null
-        ? formatBoolean(hero_logo_visible)
-        : null;
-      // NULL = inherit the global branding_logo_size (#756), resolved at read
-      // time. Only an explicit per-event size overrides it.
-      const effectiveHeroLogoSize = req.body.hero_logo_size || null;
+      const effectiveHeroLogoVisible = req.body.hero_logo_visible !== undefined ? hero_logo_visible : brandingDefaults.hero_logo_visible;
+      const effectiveHeroLogoSize = req.body.hero_logo_size || brandingDefaults.hero_logo_size;
       const effectiveHeroLogoPosition = req.body.hero_logo_position || brandingDefaults.hero_logo_position;
 
       // Inherit "Detect dev tools" from the global Image Security setting unless
@@ -435,8 +425,7 @@ module.exports = (router) => {
         allow_presigned_download: formatBoolean(allow_presigned_download === true || allow_presigned_download === 'true'),
         require_password: formatBoolean(requirePassword),
         css_template_id: css_template_id || null,
-        // Already formatBoolean-coerced above, or null = inherit global (#756).
-        hero_logo_visible: effectiveHeroLogoVisible,
+        hero_logo_visible: formatBoolean(effectiveHeroLogoVisible),
         hero_logo_size: effectiveHeroLogoSize,
         hero_logo_position: effectiveHeroLogoPosition,
         header_style: effectiveHeaderStyle || 'standard',
@@ -771,11 +760,9 @@ module.exports = (router) => {
         .where('action', 'view')
         .count('* as totalViews');
 
-      // One row per download event: singles AND zips (#895). Must stay in
-      // sync with adminDashboard's definition or the two surfaces disagree.
       const [{ totalDownloads }] = await db('access_logs')
         .where('event_id', id)
-        .whereIn('action', ['download', 'download_all', 'download_all_presigned', 'download_selected'])
+        .where('action', 'download')
         .count('* as totalDownloads');
 
       const [{ uniqueVisitors }] = await db('access_logs')
@@ -1228,8 +1215,8 @@ module.exports = (router) => {
     }),
     body('css_template_id').optional({ nullable: true, checkFalsy: true }).isInt(),
     // Hero logo settings
-    body('hero_logo_visible').optional({ nullable: true }).isBoolean(),
-    body('hero_logo_size').optional({ nullable: true }).isIn(['small', 'medium', 'large', 'xlarge']),
+    body('hero_logo_visible').optional().isBoolean(),
+    body('hero_logo_size').optional().isIn(['small', 'medium', 'large', 'xlarge']),
     body('hero_logo_position').optional().isIn(['top', 'center', 'bottom']),
     // Header style settings (decoupled from layout)
     body('header_style').optional().isIn(['hero', 'standard', 'banner', 'minimal', 'none']),
@@ -1269,52 +1256,6 @@ module.exports = (router) => {
 
       const { id } = req.params;
       const updates = { ...req.body };
-
-      // Strip identity/provenance/secret columns from the mass-assigned
-      // body (GHSA-3rqx). The handler spreads req.body straight into the
-      // events UPDATE, so without this an events.edit holder could rewrite
-      // ownership (created_by), routing identity (slug/share_link), the
-      // share/client tokens, or the password hashes directly. Plaintext
-      // `password`/`client_password` inputs are NOT stripped — those are the
-      // supported way to change credentials and get hashed below; the
-      // tokens are regenerated internally where needed.
-      // The handler spreads req.body straight into the events UPDATE, so any
-      // column an events.edit holder names is writable unless blocked here.
-      // This is a COMPLETE deny-set of every server-managed / permission-gated
-      // events column (enumerated from the schema); everything else is a
-      // legitimate edit-form field and passes through, including input-only
-      // keys (password/client_password) the handler transforms below. New
-      // server-managed columns MUST be added here. (codex review — GHSA-3rqx.)
-      const IMMUTABLE_EVENT_COLUMNS = [
-        // Identity / provenance
-        'id', 'created_by', 'created_at', 'updated_at', 'slug',
-        // Routing + share/client tokens (generated at create / internally)
-        'share_link', 'share_token', 'client_share_token', 'show_share_token',
-        // Secrets (set via the plaintext password/client_password inputs)
-        'password_hash', 'client_password_hash',
-        // Server-consumed file paths — e.g. DELETE /:id/logo fs.unlink()s
-        // hero_logo_path, so a forged value is an arbitrary-delete primitive.
-        'hero_logo_path', 'hero_logo_url', 'archive_path', 'download_zip_path',
-        // Server-managed timestamps
-        'download_zip_generated_at', 'archived_at', 'revealed_at', 'event_reminder_sent_at',
-        // Lifecycle — governed by dedicated permission-gated routes
-        // (events.archive/restore, publish, activate/deactivate), not events.edit.
-        'is_archived', 'is_draft', 'is_active',
-        // Relationships — managed by projectService.assignEvent + its
-        // customer-consistency checks, and events.edit ≠ quotes/contracts perms.
-        'project_id', 'quote_id',
-        // Legacy mirrors — rejected explicitly below in favour of customer_*.
-        'host_name', 'host_email',
-      ];
-      // Case-insensitive match: SQLite treats quoted identifiers
-      // case-insensitively, so a `{ "Password_Hash": ... }` key would
-      // otherwise survive a case-sensitive delete and still hit the real
-      // column (codex review).
-      const denied = new Set(IMMUTABLE_EVENT_COLUMNS.map((c) => c.toLowerCase()));
-      for (const key of Object.keys(updates)) {
-        if (denied.has(key.toLowerCase())) delete updates[key];
-      }
-
       const customerColumnsAvailable = await hasCustomerContactColumns();
 
       if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
@@ -1483,13 +1424,9 @@ module.exports = (router) => {
         updates.expires_at = null;
       }
 
-      // Format hero logo settings if provided. null = inherit the global
-      // branding_logo_display_hero toggle (#756); only an explicit true/false
-      // is a per-event override.
+      // Format hero logo settings if provided
       if (Object.prototype.hasOwnProperty.call(updates, 'hero_logo_visible')) {
-        updates.hero_logo_visible = updates.hero_logo_visible === null
-          ? null
-          : formatBoolean(updates.hero_logo_visible);
+        updates.hero_logo_visible = formatBoolean(updates.hero_logo_visible);
       }
 
       // Per-event opt-in for hero-photo OG share image (#474). Coerce so
@@ -1543,15 +1480,10 @@ module.exports = (router) => {
         }
       }
 
-      // Update event. Skip the write when the denylist (or masked secrets)
-      // left nothing to change — Knex rejects .update({}) with an error,
-      // which would surface as a 500 for an otherwise-valid no-op request
-      // (e.g. a body of only protected fields). (codex review.)
-      if (Object.keys(updates).length > 0) {
-        await db('events')
-          .where('id', id)
-          .update(updates);
-      }
+      // Update event
+      await db('events')
+        .where('id', id)
+        .update(updates);
 
       // Customer-account assignments (#354). Same skip semantics as POST:
       // ignore when the customer portal flag is off so stale tabs don't
@@ -1651,51 +1583,4 @@ module.exports = (router) => {
     }
   });
 
-  // Extend a gallery's expiration. Migrated from the legacy /api/events router
-  // (removed — GHSA-4j34-x562-5vfq), now on the canonical mount with the same
-  // permission + ownership guards as every other gallery mutation, so a
-  // non-owning editor/viewer can no longer touch a gallery they don't own.
-  router.post('/:id/extend', adminAuth, requirePermission('events.edit'), requireEventOwnership, [
-    body('days').isInt({ min: 1, max: 365 })
-  ], async (req, res) => {
-    try {
-      const errors = validationResult(req);
-      if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
-      }
-
-      const { id } = req.params;
-      const { days } = req.body;
-
-      let eventQuery = db('events').where('id', id);
-      // Editor role can only touch their own events (defence in depth alongside
-      // requireEventOwnership).
-      if (req.admin.roleName === 'editor') {
-        eventQuery = eventQuery.where('created_by', req.admin.id);
-      }
-      const event = await eventQuery.first();
-      if (!event) {
-        return res.status(404).json({ error: 'Event not found' });
-      }
-
-      const newExpiration = new Date(event.expires_at);
-      newExpiration.setDate(newExpiration.getDate() + days);
-
-      await db('events').where('id', id).update({
-        expires_at: newExpiration,
-        is_active: formatBoolean(true) // reactivate if it had expired
-      });
-
-      await logActivity('event_expiration_extended',
-        { eventName: event.event_name, days },
-        id,
-        { type: 'admin', id: req.admin.id, name: req.admin.username }
-      );
-
-      res.json({ expires_at: newExpiration });
-    } catch (error) {
-      errorResponse(res, error, 500, 'Failed to extend expiration');
-    }
-  });
-
 };

backend/src/routes/adminPhotos.js

@@ -315,10 +315,9 @@ router.post('/:eventId/upload', adminAuth, requirePermission('photos.upload'), r
     const crypto = require('crypto');
     const uploadId = crypto.randomBytes(16).toString('hex');
 
-    // Counter base — a per-request approximation (concurrent upload
-    // requests can compute the same base; there is NO unique index on
-    // photos.filename). Uniqueness of the final path comes from the
-    // random suffix inside generatePhotoFilename (#931).
+    // Counter base — same approximation as before. Strict uniqueness is
+    // already enforced by the filename template + DB unique index, so a
+    // small race here just retries a counter on conflict (rare).
     const existingCount = await db('photos')
       .where({ event_id: eventId, type: photoType })
       .count('id as count')
@@ -757,16 +756,6 @@ router.patch('/:eventId/photos/:photoId', adminAuth, requirePermission('photos.e
       .where({ id: photoId, event_id: eventId })
       .update(updateData);
 
-    // A visibility or category change alters which photos belong in the
-    // guest download bundle — drop the cached ZIP so it rebuilds fresh,
-    // otherwise a hide→unhide cycle can leave the stale cache omitting
-    // photos added in between (codex review).
-    if (updateData.visibility !== undefined
-        || Object.prototype.hasOwnProperty.call(updateData, 'category_id')
-        || Object.prototype.hasOwnProperty.call(updateData, 'type')) {
-      downloadZipService.invalidate(parseInt(eventId, 10));
-    }
-
     // Fetch and return the updated photo
     const updatedPhoto = await db('photos')
       .where({ id: photoId, event_id: eventId })
@@ -915,14 +904,6 @@ router.post('/:eventId/photos/bulk-update', adminAuth, requirePermission('photos
       .where('event_id', eventId)
       .update(updateData);
 
-    // Visibility/category changes alter the guest download bundle — drop the
-    // cached ZIP so it rebuilds fresh (codex review).
-    if (updateData.visibility !== undefined
-        || Object.prototype.hasOwnProperty.call(updateData, 'category_id')
-        || Object.prototype.hasOwnProperty.call(updateData, 'type')) {
-      downloadZipService.invalidate(parseInt(eventId, 10));
-    }
-
     res.json({ message: `${photoIds.length} photos updated successfully` });
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to update photos');
@@ -1110,13 +1091,7 @@ router.get('/:eventId/photos', adminAuth, requirePermission('photos.view'), requ
         average_rating: photo.average_rating || 0,
         comment_count: commentMap[photo.id] || 0,
         like_count: photo.like_count || 0,
-        favorite_count: photo.favorite_count || 0,
-        // Engagement counters (#895 follow-up): the grid reads these, but
-        // this explicit mapper never included them — so the Engagement
-        // column showed 0 regardless of what the DB counted. This, not
-        // stale data, was why per-image downloads always displayed 0.
-        view_count: photo.view_count || 0,
-        download_count: photo.download_count || 0
+        favorite_count: photo.favorite_count || 0
       }))
     });
   } catch (error) {
@@ -1151,65 +1126,7 @@ router.get('/:eventId/photo/:photoId', adminAuth, requirePermission('photos.view
     const event = await db('events').where('id', eventId).first();
     const storageKey = resolvePhotoStorageKey(event, photo);
 
-    // Content-Type resolution (#908 + external review). Invariant: the
-    // header is ALWAYS image/* or video/*.
-    //  - photos.mime_type is never echoed verbatim unless it is a video/
-    //    type: the chunked-upload path stores the client-sent MIME
-    //    unvalidated, so a stored text/html served inline under the app
-    //    origin would be a same-origin XSS gift.
-    //  - Images ignore the stored value entirely — migration 039
-    //    backfilled image/jpeg onto every legacy row (PNGs included), so
-    //    the extension is the more trustworthy signal; normalized via the
-    //    shared map (image/jpg → image/jpeg), jpeg fallback when unknown.
-    //  - Videos prefer a stored video/ type, then the extension map
-    //    (.mov → video/quicktime, .webm → video/webm, …), then video/mp4.
-    //    The old ext-derived image/<ext> (image/mp4) is what made the
-    //    admin player's blob unplayable (#908).
-    const { EXTENSION_TO_MIME } = require('../services/uploadSettings');
-    const ext = path.extname(photo.filename).slice(1).toLowerCase();
-    // Own-property lookup (review): a client-controlled filename ending in
-    // .constructor / .__proto__ / .toString would otherwise return an
-    // inherited Object.prototype member, and the extMime.startsWith below
-    // would throw — a permanent 500 for that photo instead of the fallback.
-    const extMime = Object.prototype.hasOwnProperty.call(EXTENSION_TO_MIME, ext)
-      ? EXTENSION_TO_MIME[ext]
-      : null;
-    // Full-token validation, not just a prefix check: the stored value is
-    // client-controlled, and header-invalid characters (video/mp4\r\nX: y)
-    // would make setHeader throw — a permanent 500 for that photo. Bare
-    // 'video/' is equally invalid; both fall back to the extension map.
-    const storedVideoMime = photo.mime_type && /^video\/[\w.+-]+$/.test(photo.mime_type)
-      ? photo.mime_type
-      : null;
-    // Honor a stored image MIME for any header-safe RASTER type (#908
-    // review): the S3 auto-importer accepts arbitrary image/* from
-    // mime-types and stores it (avif/bmp/tiff/heic/apng/ico/jxl/…), and a
-    // hand-listed allowlist kept missing formats. Allow image/<token> but
-    // NEVER the scriptable svg / *+xml family (image/svg+xml executes
-    // inline). The strict token + anchors also block header injection
-    // (image/x\r\nY:). Migration 039's blanket image/jpeg backfill on
-    // legacy rows is why the mapped extension still wins ahead of this.
-    const storedImageMime =
-      photo.mime_type &&
-      /^image\/[\w.+-]+$/.test(photo.mime_type) &&
-      !/^image\/svg|xml/i.test(photo.mime_type)
-        ? photo.mime_type
-        : null;
-    const isVideo = photo.media_type === 'video' ||
-      Boolean(storedVideoMime) ||
-      Boolean(extMime && extMime.startsWith('video/'));
-    // Never interpolate the raw extension on the image side: it would
-    // synthesize image/svg+xml (scriptable inline) or header-invalid values
-    // from client-controlled chunked-upload filenames. Precedence is
-    // mapped-extension (also corrects the 039 legacy-jpeg backfill on PNGs)
-    // -> safe stored raster MIME (auto-imported avif/bmp/tiff) -> image/jpeg.
-    // A stored type outside the allowlist degrades to image/jpeg; browsers
-    // sniff image bytes in <img>/blob contexts, so a mislabel is harmless
-    // where an injected type is not.
-    const contentType = isVideo
-      ? storedVideoMime || (extMime && extMime.startsWith('video/') ? extMime : null) || 'video/mp4'
-      : (extMime && extMime.startsWith('image/') ? extMime : null) || storedImageMime || 'image/jpeg';
-    res.setHeader('Content-Type', contentType);
+    res.setHeader('Content-Type', `image/${path.extname(photo.filename).slice(1)}`);
     res.setHeader('Cache-Control', 'private, max-age=3600');
     res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
 

backend/src/routes/adminProjects.js

@@ -15,31 +15,8 @@ const { requirePermission, userHasAnyPermission } = require('../middleware/permi
 const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
 const projectService = require('../services/projectService');
 const { db } = require('../database/db');
-const { ForbiddenError } = require('../utils/errors');
 
 const router = express.Router();
-
-// A deal that spans both quotes and contracts cascades a project link across
-// BOTH tables (projectService.linkDealToProject). So attaching one document
-// must also require manage permission on the OTHER domain the cascade will
-// touch — otherwise quotes.manage alone could re-point a linked contract, and
-// vice versa (GHSA-v4vw / codex review). No-op when the deal touches only the
-// one domain, or on older instances without the deal_uuid column.
-async function assertCascadePermitted(req, docTable, docId, otherTable, otherPerm) {
-  let doc;
-  try {
-    doc = await db(docTable).where({ id: docId }).first('deal_uuid');
-  } catch { return; }
-  if (!doc || !doc.deal_uuid) return;
-  let linked;
-  try {
-    linked = await db(otherTable).where({ deal_uuid: doc.deal_uuid }).first('id');
-  } catch { return; }
-  if (!linked) return;
-  if (!(await userHasAnyPermission(req.admin.id, [otherPerm]))) {
-    throw new ForbiddenError(`This deal also links a ${otherTable.replace(/s$/, '')}; the ${otherPerm} permission is required`);
-  }
-}
 router.use(adminAuth);
 
 // Projects is feature-flagged like bills/quotes — when off, the whole cockpit
@@ -128,30 +105,23 @@ router.post('/:id/events',
 );
 
 // Attach a quote to the project (quotes carry no event_id — migration 121).
-// Requires quotes.manage in addition to events.edit — attaching a quote
-// mutates a separately-permissioned document domain (GHSA-v4vw).
 router.post('/:id/quotes',
-  requirePermission(['events.edit', 'quotes.manage'], { requireAll: true }),
+  requirePermission('events.edit'),
   [param('id').isInt({ min: 1 }), body('quoteId').isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);
-    const quoteId = parseInt(req.body.quoteId, 10);
-    await assertCascadePermitted(req, 'quotes', quoteId, 'contracts', 'contracts.manage');
-    const result = await projectService.assignQuote(parseInt(req.params.id, 10), quoteId);
+    const result = await projectService.assignQuote(parseInt(req.params.id, 10), parseInt(req.body.quoteId, 10));
     return successResponse(res, result, 200, 'Quote attached to project');
   }),
 );
 
-// Attach a contract to the project. Requires contracts.manage in addition
-// to events.edit (GHSA-v4vw).
+// Attach a contract to the project.
 router.post('/:id/contracts',
-  requirePermission(['events.edit', 'contracts.manage'], { requireAll: true }),
+  requirePermission('events.edit'),
   [param('id').isInt({ min: 1 }), body('contractId').isInt({ min: 1 })],
   handleAsync(async (req, res) => {
     validateRequest(req);
-    const contractId = parseInt(req.body.contractId, 10);
-    await assertCascadePermitted(req, 'contracts', contractId, 'quotes', 'quotes.manage');
-    const result = await projectService.assignContract(parseInt(req.params.id, 10), contractId);
+    const result = await projectService.assignContract(parseInt(req.params.id, 10), parseInt(req.body.contractId, 10));
     return successResponse(res, result, 200, 'Contract attached to project');
   }),
 );

backend/src/routes/adminWebhooks.js

@@ -20,7 +20,7 @@ const { body, query, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-const { validateExternalUrlAsync } = require('../utils/networkValidation');
+const { validateExternalUrl } = require('../utils/networkValidation');
 const webhookService = require('../services/webhookService');
 const logger = require('../utils/logger');
 
@@ -78,9 +78,9 @@ router.post(
   requirePermission('settings.edit'),
   [
     body('name').isString().trim().isLength({ min: 1, max: 100 }),
-    body('url').isString().isLength({ max: 2048 }).custom(async (url) => {
+    body('url').isString().isLength({ max: 2048 }).custom((url) => {
       if (ALLOW_PRIVATE_URLS) return true;
-      const check = await validateExternalUrlAsync(url);
+      const check = validateExternalUrl(url);
       if (!check.valid) throw new Error(check.error);
       return true;
     }),
@@ -160,9 +160,9 @@ router.put(
   requirePermission('settings.edit'),
   [
     body('name').optional().isString().trim().isLength({ min: 1, max: 100 }),
-    body('url').optional().isString().isLength({ max: 2048 }).custom(async (url) => {
+    body('url').optional().isString().isLength({ max: 2048 }).custom((url) => {
       if (ALLOW_PRIVATE_URLS) return true;
-      const check = await validateExternalUrlAsync(url);
+      const check = validateExternalUrl(url);
       if (!check.valid) throw new Error(check.error);
       return true;
     }),

backend/src/routes/adminWorkflows.js

@@ -254,19 +254,6 @@ router.patch('/:id/enabled', requirePermission('workflows.manage'), async (req,
     // enabled state on the next SEED_VERSION bump (review nit #1).
     if (await hasColumnCached('workflows', 'admin_toggled_at')) patch.admin_toggled_at = db.fn.now();
     await db('workflows').where({ id }).update(patch);
-    // Turning dunning ON enrolls existing open/unpaid invoices (anchored to
-    // their due date) so it starts chasing current debtors, not only invoices
-    // sent after enabling (#750). Scoped to this flow's id so the backfill only
-    // enrolls dunning, not any custom invoice.sent flow. Best-effort — never
-    // fail the toggle over it.
-    if (enabled && wf.builtin_key === 'invoice_dunning') {
-      try {
-        const n = await require('../services/workflows').backfillDunningRuns(id);
-        require('../utils/logger').info('[workflow] dunning enabled — enrolled existing invoices', { enrolled: n });
-      } catch (e) {
-        require('../utils/logger').warn('[workflow] dunning backfill failed', { error: e.message });
-      }
-    }
     res.json({ id, enabled });
   } catch (e) { next(e); }
 });

backend/src/routes/auth.js

@@ -543,18 +543,6 @@ router.post('/gallery/share-login', [
       return res.status(401).json({ error: 'Invalid or expired share link' });
     }
 
-    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
-
-    // The share link only proves the holder was given the link — it is NOT the
-    // gallery password. For a password-protected gallery, minting a full
-    // `type:'gallery'` token here would let anyone with the share URL bypass
-    // the password entirely (GHSA-9hmx-68vc-qpqw). Signal that a password is
-    // still required and return WITHOUT a token/cookie; the client then goes
-    // through POST /gallery/verify, which does check the password.
-    if (requiresPassword) {
-      return res.json({ requires_password: true });
-    }
-
     const jwtToken = jwt.sign({
       eventId: event.id,
       eventSlug: event.slug,
@@ -569,6 +557,8 @@ router.post('/gallery/share-login', [
     await trackSuccessfulLogin(`gallery:${event.slug}:share`, ipAddress, userAgent);
     setGalleryAuthCookies(res, jwtToken, event.slug);
 
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
     res.json({
       token: jwtToken,
       event: {

backend/src/routes/events.js

@@ -0,0 +1,443 @@
+const express = require('express');
+const { body, validationResult } = require('express-validator');
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const { slugify } = require('../utils/slug');
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
+const { adminAuth } = require('../middleware/auth');
+const fs = require('fs').promises;
+const path = require('path');
+const router = express.Router();
+const { buildShareLinkVariants } = require('../services/shareLinkService');
+const { parseBooleanInput, parseStringInput } = require('../utils/parsers');
+const eventTypeService = require('../services/eventTypeService');
+const { IDENTITY_PRESERVING_NORMALIZE_EMAIL } = require('../utils/emailNormalization');
+const logger = require('../utils/logger');
+
+// Use parseStringInput from shared parsers for customer data extraction
+const getCustomerNameFromPayload = (payload = {}) => parseStringInput(payload.customer_name);
+const getCustomerEmailFromPayload = (payload = {}) => parseStringInput(payload.customer_email);
+const getCustomerPhoneFromPayload = (payload = {}) => parseStringInput(payload.customer_phone);
+
+// Whether the global "phone field" toggle (#322) is enabled. Same shape as
+// the helper in adminEvents.js — kept local so this route doesn't import
+// from a sibling route file.
+const isPhoneFieldEnabled = async () => {
+  try {
+    const row = await db('app_settings').where('setting_key', 'event_phone_field_enabled').first();
+    if (!row) return false;
+    let value = row.setting_value;
+    if (typeof value === 'string') {
+      try { value = JSON.parse(value); } catch { /* keep raw */ }
+    }
+    return value === true;
+  } catch {
+    return false;
+  }
+};
+
+const mapEventForApi = (event) => {
+  if (!event || typeof event !== 'object') {
+    return event;
+  }
+
+  const {
+    host_name,
+    host_email,
+    customer_name,
+    customer_email,
+    ...rest
+  } = event;
+
+  return {
+    ...rest,
+    customer_name: customer_name ?? host_name ?? null,
+    customer_email: customer_email ?? host_email ?? null
+  };
+};
+
+let customerColumnCache = null;
+const hasCustomerContactColumns = async () => {
+  if (customerColumnCache === true) {
+    return true;
+  }
+
+  try {
+    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
+    if (hasColumn) {
+      customerColumnCache = true;
+    }
+    return hasColumn;
+  } catch (error) {
+    return false;
+  }
+};
+
+// Create new event
+router.post('/', adminAuth, [
+  body('event_type').notEmpty().trim().custom(async (value) => {
+    const isValid = await eventTypeService.isValidEventType(value);
+    if (!isValid) {
+      throw new Error('Invalid event type');
+    }
+    return true;
+  }),
+  body('event_name').notEmpty(),
+  body('event_date').isDate(),
+  body('customer_name').notEmpty().trim(),
+  body('customer_email').isEmail().normalizeEmail(IDENTITY_PRESERVING_NORMALIZE_EMAIL),
+  body('customer_phone').optional({ nullable: true, checkFalsy: true })
+    .isString().trim()
+    .isLength({ max: 32 }).withMessage('Phone number must be at most 32 characters'),
+  body('admin_email').isEmail(),
+  body('require_password').optional().isBoolean(),
+  body('password').optional().isString().custom((value, { req }) => {
+    const requirePassword = parseBooleanInput(req.body.require_password, true);
+    if (!requirePassword) {
+      return true;
+    }
+    if (typeof value !== 'string' || value.trim().length < 6) {
+      throw new Error('Password must be at least 6 characters long');
+    }
+    return true;
+  }),
+  body('expiration_days').isInt({ min: 1, max: 365 }).optional()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const {
+      event_type,
+      event_name,
+      event_date,
+      admin_email,
+      password,
+      require_password: requirePasswordInput = true,
+      welcome_message,
+      color_theme,
+      expiration_days = 30
+    } = req.body;
+
+    const customerEmail = getCustomerEmailFromPayload(req.body);
+    const customerName = getCustomerNameFromPayload(req.body);
+
+    if (!customerName || !customerEmail) {
+      return res.status(400).json({ error: 'customer_name and customer_email are required' });
+    }
+
+    const customerColumnsAvailable = await hasCustomerContactColumns();
+    const phoneEnabled = await isPhoneFieldEnabled();
+    const customerPhone = phoneEnabled ? getCustomerPhoneFromPayload(req.body) : null;
+
+    const requirePassword = parseBooleanInput(requirePasswordInput, true);
+
+    if (requirePassword) {
+      const passwordValidation = await validatePasswordInContext(password, 'gallery', {
+        eventName: event_name
+      });
+
+      if (!passwordValidation.valid) {
+        return res.status(400).json({ 
+          error: 'Password does not meet security requirements',
+          details: passwordValidation.errors,
+          score: passwordValidation.score,
+          feedback: passwordValidation.feedback
+        });
+      }
+    }
+    
+    // Generate unique slug — slugify() handles accents (see #525).
+    const baseSlug = `${event_type}-${slugify(event_name)}-${event_date}`;
+    let slug = baseSlug;
+    let counter = 1;
+    
+    while (await db('events').where({ slug }).first()) {
+      slug = `${baseSlug}-${counter}`;
+      counter++;
+    }
+    
+    // Generate share link variants (auto-detects short URL preference)
+    const shareToken = crypto.randomBytes(16).toString('hex');
+    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
+    
+    // Hash password (or placeholder when not required)
+    const password_hash = requirePassword
+      ? await bcrypt.hash(password, getBcryptRounds())
+      : await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
+    
+    // Calculate expiration date (days after event date)
+    const expires_at = new Date(event_date);
+    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
+    
+    // Create folder structure
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const eventPath = path.join(storagePath, 'events/active', slug);
+    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
+    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
+    
+    // Insert into database
+    const insertResult = await db('events').insert({
+      slug,
+      event_type,
+      event_name,
+      event_date,
+      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
+      ...(customerPhone ? { customer_phone: customerPhone } : {}),
+      host_name: customerName,
+      host_email: customerEmail,
+      admin_email,
+      password_hash,
+      welcome_message,
+      color_theme,
+      share_link: shareLinkToStore,
+      share_token: shareToken,
+      expires_at,
+      require_password: formatBoolean(requirePassword)
+    }).returning('id');
+    
+    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
+    const eventId = insertResult[0]?.id || insertResult[0];
+    
+    // Queue creation email
+    const { queueEmail } = require('../services/emailProcessor');
+    await queueEmail(eventId, customerEmail, 'gallery_created', {
+      customer_name: customerName,
+      customer_email: customerEmail,
+      host_name: customerName,
+      event_name,
+      event_date: event_date,  // Pass raw date - will be formatted by email processor
+      gallery_link: shareUrl,
+      gallery_password: requirePassword ? password : 'No password required',
+      expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
+      welcome_message: welcome_message || ''
+    });
+
+    // WhatsApp gallery_ready notification (#647 follow-up). Mirrors the
+    // adminEvents.js path: fires when the customer supplied a phone, the
+    // feature is enabled, and a config exists. Non-fatal — a queue failure
+    // must never block gallery creation.
+    if (customerPhone) {
+      try {
+        const { queueWhatsapp, getWhatsAppConfig } = require('../services/whatsappProcessor');
+        const waConfig = await getWhatsAppConfig();
+        if (waConfig && waConfig.enabled) {
+          await queueWhatsapp(eventId, customerPhone, 'gallery_created', {
+            customer_name: customerName || '',
+            event_name,
+            gallery_link: shareUrl,
+            gallery_password: requirePassword ? password : '',
+            expiry_date: expires_at ? expires_at.toISOString() : null,
+            language: null,
+          });
+        }
+      } catch (waError) {
+        logger.warn('Failed to queue WhatsApp notification on create', waError.message);
+      }
+    }
+
+    // Webhook lifecycle (#327). Legacy public endpoint — events go live
+    // immediately so created + published fire together. Payload uses the
+    // canonical event subject (#341) — every event.* webhook now includes
+    // customer contact + share_token.
+    try {
+      const webhookService = require('../services/webhookService');
+      const eventSubject = webhookService.buildEventSubject({
+        id: eventId,
+        slug,
+        event_name,
+        event_type,
+        event_date,
+        share_url: shareUrl,
+        share_token: shareToken,
+        customer_name: customerName,
+        customer_email: customerEmail,
+        customer_phone: customerPhone,
+      });
+      await webhookService.fire('event.created', { event: eventSubject });
+      await webhookService.fire('event.published', { event: eventSubject });
+    } catch (e) { /* non-fatal */ }
+
+    res.json({
+      id: eventId,
+      slug,
+      share_link: shareUrl,
+      expires_at,
+      require_password: requirePassword,
+      customer_name: customerName,
+      customer_email: customerEmail
+    });
+  } catch (error) {
+    logger.error(error);
+    res.status(500).json({ error: 'Failed to create event' });
+  }
+});
+
+// Get all events (admin)
+router.get('/', adminAuth, async (req, res) => {
+  try {
+    const { status = 'all' } = req.query;
+    
+    let query = db('events').select('*');
+    
+    if (status === 'active') {
+      query = query.where('is_active', formatBoolean(true));
+    } else if (status === 'archived') {
+      query = query.where('is_archived', formatBoolean(true));
+    }
+    
+    const events = await query.orderBy('created_at', 'desc');
+    
+    // Add photo counts
+    for (const event of events) {
+      const photoCount = await db('photos').where('event_id', event.id).count('id as count').first();
+      event.photo_count = photoCount.count;
+    }
+    
+    res.json(events.map(mapEventForApi));
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch events' });
+  }
+});
+
+// Update event
+router.put('/:id', adminAuth, [
+  body('customer_name').optional().trim().notEmpty(),
+  body('customer_email').optional().isEmail().normalizeEmail(IDENTITY_PRESERVING_NORMALIZE_EMAIL),
+  body('require_password').optional().isBoolean()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { id } = req.params;
+    const updates = { ...req.body };
+    const customerColumnsAvailable = await hasCustomerContactColumns();
+    
+    // Don't allow updating certain fields
+    delete updates.id;
+    delete updates.slug;
+    delete updates.created_at;
+    delete updates.password_confirmation;
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
+      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
+      const nextName = getCustomerNameFromPayload(updates);
+      if (nextName) {
+        if (customerColumnsAvailable) {
+          updates.customer_name = nextName;
+        } else {
+          delete updates.customer_name;
+        }
+        updates.host_name = nextName;
+      } else {
+        delete updates.customer_name;
+      }
+    }
+
+    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
+      const nextEmail = getCustomerEmailFromPayload(updates);
+      if (nextEmail) {
+        if (customerColumnsAvailable) {
+          updates.customer_email = nextEmail;
+        } else {
+          delete updates.customer_email;
+        }
+        updates.host_email = nextEmail;
+      } else {
+        delete updates.customer_email;
+      }
+    }
+
+    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
+    let requirePasswordUpdate;
+    if (hasRequirePasswordUpdate) {
+      requirePasswordUpdate = parseBooleanInput(updates.require_password, true);
+      updates.require_password = formatBoolean(requirePasswordUpdate);
+    }
+
+    let newPasswordPlain;
+    if (Object.prototype.hasOwnProperty.call(updates, 'password')) {
+      if (updates.password === undefined || updates.password === null || updates.password === '') {
+        delete updates.password;
+      } else {
+        newPasswordPlain = updates.password;
+        delete updates.password;
+      }
+    }
+
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+
+    const currentRequirePassword = parseBooleanInput(event.require_password, true);
+
+    if (hasRequirePasswordUpdate && requirePasswordUpdate === true && !currentRequirePassword && !newPasswordPlain) {
+      return res.status(400).json({ error: 'Password must be provided when enabling password requirement.' });
+    }
+
+    if (newPasswordPlain) {
+      updates.password_hash = await bcrypt.hash(newPasswordPlain, getBcryptRounds());
+    } else if (hasRequirePasswordUpdate && requirePasswordUpdate === false && currentRequirePassword) {
+      updates.password_hash = await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
+    }
+    
+    await db('events').where('id', id).update(updates);
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to update event' });
+  }
+});
+
+// Delete event (mark as inactive)
+router.delete('/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    await db('events').where('id', id).update({ is_active: formatBoolean(false) });
+    
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to delete event' });
+  }
+});
+
+// Extend expiration
+router.post('/:id/extend', adminAuth, [
+  body('days').isInt({ min: 1, max: 365 })
+], async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { days } = req.body;
+    
+    const event = await db('events').where('id', id).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Event not found' });
+    }
+    
+    const newExpiration = new Date(event.expires_at);
+    newExpiration.setDate(newExpiration.getDate() + days);
+    
+    await db('events').where('id', id).update({ 
+      expires_at: newExpiration,
+      is_active: formatBoolean(true) // Reactivate if expired
+    });
+    
+    res.json({ expires_at: newExpiration });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to extend expiration' });
+  }
+});
+
+module.exports = router;

backend/src/routes/gallery.js

@@ -2,21 +2,9 @@ const express = require('express');
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { getAppSetting } = require('../utils/appSettings');
 const archiver = require('archiver');
 const path = require('path');
 const router = express.Router();
-
-// #756: a NULL per-event hero_logo_visible means "inherit the global
-// branding_logo_display_hero toggle". Only an explicit true/false is a
-// per-gallery override. `globalDefault` is branding_logo_display_hero
-// (defaults true when unset).
-function resolveHeroLogoVisible(perEvent, globalDefault) {
-  if (perEvent === null || perEvent === undefined) {
-    return globalDefault !== false;
-  }
-  return perEvent !== false && perEvent !== 0 && perEvent !== '0';
-}
 const watermarkService = require('../services/watermarkService');
 const watermarkGeneratorService = require('../services/watermarkGeneratorService');
 const { verifyGalleryAccess, denySlideshowToken, isAdminPreview } = require('../middleware/gallery');
@@ -30,7 +18,6 @@ const { handleAsync, errorResponse } = require('../utils/routeHelpers');
 const { NotFoundError } = require('../utils/errors');
 const { ensureThumbnail, ensureHeroImage, ensurePreviewImage, withLocalCopy } = require('../services/imageProcessor');
 const downloadZipService = require('../services/downloadZipService');
-const { applyPhotoVisibilityFilter, canSeeHiddenPhotos } = require('../utils/photoVisibility');
 const {
   getUseOriginalFilenames,
   pickRawDownloadName,
@@ -195,8 +182,6 @@ router.get('/:slug/info', async (req, res) => {
     }
     
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
-    const globalHeroLogoVisible = await getAppSetting('branding_logo_display_hero', true);
-    const globalLogoSize = await getAppSetting('branding_logo_size', 'medium');
 
     res.json({
       event_name: event.event_name,
@@ -214,9 +199,8 @@ router.get('/:slug/info', async (req, res) => {
       watermark_text: event.watermark_text,
       enable_devtools_protection: event.enable_devtools_protection === true || event.enable_devtools_protection === 1 || event.enable_devtools_protection === '1',
       use_canvas_rendering: event.use_canvas_rendering === true || event.use_canvas_rendering === 1 || event.use_canvas_rendering === '1',
-      hero_logo_visible: resolveHeroLogoVisible(event.hero_logo_visible, globalHeroLogoVisible),
-      // #756: NULL per-event size inherits the global branding_logo_size.
-      hero_logo_size: event.hero_logo_size || globalLogoSize || 'medium',
+      hero_logo_visible: event.hero_logo_visible !== false && event.hero_logo_visible !== 0 && event.hero_logo_visible !== '0',
+      hero_logo_size: event.hero_logo_size || 'medium',
       hero_logo_position: event.hero_logo_position || 'top',
       hero_logo_url: event.hero_logo_url || null,
       header_style: event.header_style || 'standard',
@@ -651,8 +635,7 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, async (req, res)
     // selection back to source files. Tied to the same toggle as downloads —
     // one switch controls both surfaces.
     const useOriginalFilenames = await getUseOriginalFilenames();
-    const globalHeroLogoVisible = await getAppSetting('branding_logo_display_hero', true);
-    const globalLogoSize = await getAppSetting('branding_logo_size', 'medium');
+    
 
     res.json({
       event: {
@@ -671,8 +654,8 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, async (req, res)
         watermark_text: req.event.watermark_text,
         enable_devtools_protection: req.event.enable_devtools_protection === true,
         use_canvas_rendering: req.event.use_canvas_rendering === true,
-        hero_logo_visible: resolveHeroLogoVisible(req.event.hero_logo_visible, globalHeroLogoVisible),
-        hero_logo_size: req.event.hero_logo_size || globalLogoSize || 'medium',
+        hero_logo_visible: req.event.hero_logo_visible !== false && req.event.hero_logo_visible !== 0 && req.event.hero_logo_visible !== '0',
+        hero_logo_size: req.event.hero_logo_size || 'medium',
         hero_logo_position: req.event.hero_logo_position || 'top',
         hero_logo_url: req.event.hero_logo_url || null,
         header_style: req.event.header_style || 'standard',
@@ -785,10 +768,6 @@ router.patch('/:slug/photos/:photoId/visibility', verifyGalleryAccess, async (re
       .where({ id: photoId, event_id: req.event.id })
       .update({ visibility });
 
-    // A client hiding/showing a photo changes the guest download bundle —
-    // drop the cached ZIP so it rebuilds fresh (codex review).
-    downloadZipService.invalidate(req.event.id);
-
     res.json({ message: 'Photo visibility updated', visibility });
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to update photo visibility');
@@ -817,10 +796,6 @@ router.patch('/:slug/photos/visibility/bulk', verifyGalleryAccess, async (req, r
       .where('event_id', req.event.id)
       .update({ visibility });
 
-    // Client bulk hide/show alters the guest download bundle — invalidate
-    // the cached ZIP (codex review).
-    downloadZipService.invalidate(req.event.id);
-
     res.json({ message: `${count} photos updated`, visibility });
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to update photo visibility');
@@ -942,22 +917,6 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, denySlideshowToken,
 });
 
 // Download all photos as ZIP
-// Zip downloads count toward each contained photo's download_count (#895)
-// — previously only single-photo downloads did, so galleries whose guests
-// grab the zip showed 0 per-photo downloads forever. Used by the
-// pre-generated-zip branches only: it mirrors downloadZipService._build,
-// which zips EVERY event photo with no per-category allow_downloads
-// filter — the counter has to reflect what actually shipped. (That the
-// prebuilt zip ignores per-category download opt-outs is a separate,
-// pre-existing issue.) Known approximation: _build skips entries whose
-// WATERMARK step fails and still publishes the zip; counting those
-// would need a persisted archive manifest, which isn't worth it for
-// that tail case. Fire-and-forget at the call sites: counters must
-// never fail a download.
-async function bumpEventDownloadCounts(eventId) {
-  await db('photos').where('event_id', eventId).increment('download_count', 1);
-}
-
 router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async (req, res) => {
   try {
     // Check if downloads are allowed for this event
@@ -965,21 +924,8 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
       return res.status(403).json({ error: 'Downloads are disabled for this gallery' });
     }
 
-    // Try to serve pre-generated zip (instant download with Content-Length).
-    // Guests may use the prebuilt cache ONLY when the event has no hidden
-    // photos: a cache built before a photo was hidden — or before this
-    // visibility-aware builder shipped — could otherwise still leak it, and
-    // getZipInfo only checks the DB pointer + file stat, not freshness. When
-    // hidden photos exist, guests fall through to the visibility-filtered
-    // stream below. PIN-clients always stream a full archive.
-    const isClient = canSeeHiddenPhotos(req.accessLevel);
-    const eventHasHidden = await db('photos')
-      .where({ event_id: req.event.id, visibility: 'hidden' })
-      .first()
-      .then(Boolean);
-    const zipInfo = (isClient || eventHasHidden)
-      ? null
-      : await downloadZipService.getZipInfo(req.event.id);
+    // Try to serve pre-generated zip (instant download with Content-Length)
+    const zipInfo = await downloadZipService.getZipInfo(req.event.id);
     if (zipInfo) {
       const storage = getStorage();
 
@@ -1000,7 +946,6 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
             user_agent: req.headers['user-agent'],
             action: 'download_all_presigned'
           }).catch(() => {});
-          bumpEventDownloadCounts(req.event.id).catch(() => {});
           res.redirect(302, url);
           return;
         } catch (err) {
@@ -1024,35 +969,26 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
         user_agent: req.headers['user-agent'],
         action: 'download_all'
       }).catch(() => {});
-      bumpEventDownloadCounts(req.event.id).catch(() => {});
       return;
     }
 
-    // Fallback: on-the-fly streaming (existing behavior). Only pre-build the
-    // guest cache when it will actually be served next time — a guest
-    // download of an event with no hidden photos. Client bypasses and
-    // hidden-photo events always stream, so rebuilding the guest archive on
-    // those requests is wasted I/O (codex review).
-    if (!isClient && !eventHasHidden) {
-      downloadZipService.generateZip(req.event.id).catch(err =>
-        logger.warn('Background zip generation failed', { eventId: req.event.id, error: err.message })
-      );
-    }
+    // Fallback: on-the-fly streaming (existing behavior)
+    // Also trigger background zip generation for next time
+    downloadZipService.generateZip(req.event.id).catch(err =>
+      logger.warn('Background zip generation failed', { eventId: req.event.id, error: err.message })
+    );
 
     // Fetch photos — exclude photos in categories that disabled downloads (#640).
     // Uncategorised photos are always included; categories without the column
     // (pre-migration-135) fall through the LEFT JOIN's null and are included.
-    const photos = await applyPhotoVisibilityFilter(
-      db('photos')
-        .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
-        .where('photos.event_id', req.event.id)
-        .where(function () {
-          this.whereNull('photos.category_id')
-            .orWhere('photo_categories.allow_downloads', true)
-            .orWhereNull('photo_categories.allow_downloads');
-        }),
-      req.accessLevel
-    )
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .where(function () {
+        this.whereNull('photos.category_id')
+          .orWhere('photo_categories.allow_downloads', true)
+          .orWhereNull('photo_categories.allow_downloads');
+      })
       .select('photos.*')
       .orderBy('photos.type', 'asc')
       .orderBy('photos.uploaded_at', 'desc');
@@ -1092,10 +1028,6 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
     // get a deterministic `_1` suffix before the entries hit the archive.
     const useOriginalBulk = await getUseOriginalFilenames();
     const bulkEntryNames = getZipEntryNames(photos, useOriginalBulk);
-    // Only photos whose append succeeded count as downloaded (#895) — the
-    // catch below deliberately skips missing/corrupt sources, and those
-    // never make it into the archive.
-    const appendedIds = [];
     for (let i = 0; i < photos.length; i += 1) {
       const photo = photos[i];
       const storageKey = resolvePhotoStorageKey(req.event, photo);
@@ -1109,22 +1041,6 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
       }
 
       try {
-        // Verify the source exists BEFORE appending — but only for local
-        // sources: fs.createReadStream is lazy, so its error fires outside
-        // this try/catch and the archive 'error' handler then kills the
-        // whole response instead of skipping one photo (#895 review). S3's
-        // get() awaits GetObject and rejects right here on a missing key,
-        // so a preflight HEAD per entry would just be a redundant serial
-        // round trip (500-photo zip = 500 extra HEADs).
-        if (storageKey && storage.kind() === 'local') {
-          const srcStat = await storage.stat(storageKey);
-          if (!srcStat) {
-            throw new Error(`Photo missing in storage: ${storageKey}`);
-          }
-        } else if (!storageKey && !fs.existsSync(resolvePhotoFilePath(req.event, photo))) {
-          throw new Error('Photo file missing on disk');
-        }
-
         if (shouldApplyWatermark && effectiveSettings) {
           // Watermark service operates on a local path. For managed photos in
           // S3 mode, materialize a tmp local copy first.
@@ -1144,9 +1060,9 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
           const stream = await storage.get(storageKey);
           archive.append(stream, { name: archiveName });
         } else {
-          archive.file(resolvePhotoFilePath(req.event, photo), { name: archiveName });
+          const filePath = resolvePhotoFilePath(req.event, photo);
+          archive.file(filePath, { name: archiveName });
         }
-        appendedIds.push(photo.id);
       } catch (err) {
         logger.warn('Skipping photo in bulk download due to error', {
           slug: req.params.slug,
@@ -1166,12 +1082,6 @@ router.get('/:slug/download-all', verifyGalleryAccess, denySlideshowToken, async
       user_agent: req.headers['user-agent'],
       action: 'download_all'
     });
-    // Exactly the photos that made it into this archive (#895) — skipped
-    // (missing/corrupt) sources don't count.
-    if (appendedIds.length > 0) {
-      db('photos').whereIn('id', appendedIds)
-        .increment('download_count', 1).catch(() => {});
-    }
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to create download archive');
   }
@@ -1202,18 +1112,15 @@ router.post('/:slug/download-selected', verifyGalleryAccess, denySlideshowToken,
 
     // Fetch photos — exclude photos in categories that disabled downloads (#640).
     // Same LEFT JOIN pattern as the download-all endpoint.
-    const photos = await applyPhotoVisibilityFilter(
-      db('photos')
-        .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
-        .where('photos.event_id', req.event.id)
-        .whereIn('photos.id', photoIds)
-        .where(function () {
-          this.whereNull('photos.category_id')
-            .orWhere('photo_categories.allow_downloads', true)
-            .orWhereNull('photo_categories.allow_downloads');
-        }),
-      req.accessLevel
-    )
+    const photos = await db('photos')
+      .leftJoin('photo_categories', 'photos.category_id', 'photo_categories.id')
+      .where('photos.event_id', req.event.id)
+      .whereIn('photos.id', photoIds)
+      .where(function () {
+        this.whereNull('photos.category_id')
+          .orWhere('photo_categories.allow_downloads', true)
+          .orWhereNull('photo_categories.allow_downloads');
+      })
       .select('photos.*')
       .orderBy('photos.uploaded_at', 'desc');
 
@@ -1256,26 +1163,11 @@ router.post('/:slug/download-selected', verifyGalleryAccess, denySlideshowToken,
     // #493: same display-name resolution as bulk download, with dedup.
     const useOriginalSelected = await getUseOriginalFilenames();
     const selectedEntryNames = getZipEntryNames(photos, useOriginalSelected);
-    // Only photos whose append succeeded count as downloaded (#895).
-    const appendedIds = [];
     for (let i = 0; i < photos.length; i += 1) {
       const photo = photos[i];
       const name = selectedEntryNames[i] || `photo-${photo.id}.jpg`;
       const storageKey = resolveSelectedKey(req.event, photo);
       try {
-        // Same pre-append source check as download-all (#895 review),
-        // local backend only: a lazy fs stream's async error would kill
-        // the response instead of skipping the photo; S3's get() rejects
-        // at the await below, so no redundant per-entry HEAD there.
-        if (storageKey && selectedStorage.kind() === 'local') {
-          const srcStat = await selectedStorage.stat(storageKey);
-          if (!srcStat) {
-            throw new Error(`Photo missing in storage: ${storageKey}`);
-          }
-        } else if (!storageKey && !fs.existsSync(resolvePhotoFilePath(req.event, photo))) {
-          throw new Error('Photo file missing on disk');
-        }
-
         if (shouldApplyWatermark && effectiveSettings) {
           const buf = storageKey
             ? await withSelectedLocalCopy(storageKey, (lp) =>
@@ -1289,7 +1181,6 @@ router.post('/:slug/download-selected', verifyGalleryAccess, denySlideshowToken,
         } else {
           archive.file(resolvePhotoFilePath(req.event, photo), { name });
         }
-        appendedIds.push(photo.id);
       } catch (err) {
         logger.warn('Skipping selected photo due to error', {
           slug: req.params.slug,
@@ -1308,49 +1199,12 @@ router.post('/:slug/download-selected', verifyGalleryAccess, denySlideshowToken,
       user_agent: req.headers['user-agent'],
       action: 'download_selected'
     });
-    // Exactly the photos that made it into this archive (#895) — skipped
-    // (missing/corrupt) sources don't count.
-    if (appendedIds.length > 0) {
-      db('photos').whereIn('id', appendedIds)
-        .increment('download_count', 1).catch(() => {});
-    }
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to download selected photos');
   }
 });
 
 
-// Explicit per-photo view beacon (#895). Counting views on the image-
-// serving routes is wrong in both directions: the lightbox preloads the
-// prev/next neighbours (three fetches per open), while a preloaded
-// neighbour that becomes the current slide is never re-fetched (#505
-// keeps the DOM node alive across the swipe) — so request-level counters
-// overcount preloads AND undercount swipe-throughs. Instead the lightbox
-// pings this endpoint exactly when a photo becomes the visible slide.
-// This also covers enhanced/maximum-protection galleries, whose bytes
-// are served by /api/secure-images and never pass the routes below.
-// The slideshow kiosk is excluded (denySlideshowToken; migration 138).
-router.post('/:slug/photo/:photoId/view',
-  verifyGalleryAccess,
-  denySlideshowToken,
-  async (req, res) => {
-    try {
-      const photo = await db('photos')
-        .where({ id: req.params.photoId, event_id: req.event.id })
-        .first('id', 'visibility');
-      if (!photo) {
-        return res.status(404).json({ error: 'Photo not found' });
-      }
-      if (photo.visibility === 'hidden' && req.accessLevel !== 'client') {
-        return res.status(403).json({ error: 'Photo not available' });
-      }
-      await db('photos').where('id', photo.id).increment('view_count', 1);
-      res.status(204).end();
-    } catch (error) {
-      errorResponse(res, error, 500, 'Failed to record view');
-    }
-  });
-
 // View single photo (with watermark if enabled)
 router.get('/:slug/photo/:photoId',
   verifyGalleryAccess,

backend/src/routes/protectedImages.js

@@ -7,7 +7,6 @@ const secureImageService = require('../services/secureImageService');
 const { getStorage } = require('../services/storage');
 const { resolvePhotoStorageKey, resolvePhotoFilePath } = require('../services/photoResolver');
 const { withLocalCopy } = require('../services/imageProcessor');
-const { isPhotoHiddenFromViewer, canSeeHiddenPhotos } = require('../utils/photoVisibility');
 const crypto = require('crypto');
 const logger = require('../utils/logger');
 const { timingSafeEqualStr } = require('../utils/timingSafe');
@@ -17,14 +16,10 @@ const router = express.Router();
 /**
  * Generate a signed URL token for image access
  */
-function generateImageToken(photoId, expiresIn = 3600, clientBypass = false) {
+function generateImageToken(photoId, expiresIn = 3600) {
   const secret = process.env.JWT_SECRET;
   const expires = Date.now() + (expiresIn * 1000);
-  // Third segment: whether the minter was a PIN-client, letting the serve
-  // route still deliver a photo hidden AFTER minting (TOCTOU) — a guest's
-  // token carries 0, so it stops working the moment the photo is hidden.
-  // Old two-segment tokens verify unchanged and read the flag as no-bypass.
-  const data = `${photoId}:${expires}:${clientBypass ? 1 : 0}`;
+  const data = `${photoId}:${expires}`;
   const signature = crypto.createHmac('sha256', secret).update(data).digest('hex');
   return `${Buffer.from(data).toString('base64')}.${signature}`;
 }
@@ -37,23 +32,20 @@ function verifyImageToken(token) {
     const secret = process.env.JWT_SECRET;
     const [data, signature] = token.split('.');
     const decoded = Buffer.from(data, 'base64').toString();
-    const [photoId, expires, clientFlag] = decoded.split(':');
-
+    const [photoId, expires] = decoded.split(':');
+    
     // Verify signature (constant-time — avoids leaking the HMAC byte-by-byte)
     const expectedSignature = crypto.createHmac('sha256', secret).update(decoded).digest('hex');
     if (!timingSafeEqualStr(signature, expectedSignature)) {
       return null;
     }
-
+    
     // Check expiration
     if (Date.now() > parseInt(expires)) {
       return null;
     }
-    return {
-      photoId: parseInt(photoId),
-      expires: parseInt(expires),
-      clientBypass: clientFlag === '1',
-    };
+    
+    return { photoId: parseInt(photoId), expires: parseInt(expires) };
   } catch (error) {
     return null;
   }
@@ -87,12 +79,6 @@ router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) =
       return res.status(404).json({ error: 'Photo not found' });
     }
 
-    // Block guest access to hidden/client-only photos (parity with the
-    // gallery single-photo routes).
-    if (isPhotoHiddenFromViewer(photo, req.accessLevel)) {
-      return res.status(403).json({ error: 'Photo not available' });
-    }
-
     // Check for suspicious activity
     const isSuspicious = await secureImageService.detectSuspiciousActivity(clientFingerprint, photoId);
     if (isSuspicious) {
@@ -205,23 +191,15 @@ router.post('/:slug/photo/:photoId/generate-secure-token', verifyGalleryAccess,
       return res.status(404).json({ error: 'Photo not found' });
     }
 
-    // Don't mint a secure-image capability for a hidden/client-only photo
-    // when the caller isn't a client — the serve route is token-only.
-    if (isPhotoHiddenFromViewer(photo, req.accessLevel)) {
-      return res.status(403).json({ error: 'Photo not available' });
-    }
-
     // Create client fingerprint
     const clientFingerprint = secureImageService.createClientFingerprint(req);
-
-    // Generate secure token. clientBypass lets a client's token keep serving
-    // a photo hidden after minting; a guest's stops at the serve route.
+    
+    // Generate secure token
     const token = secureImageService.generateSecureToken(photoId, req.sessionID || 'anonymous', {
       expiresIn,
       maxUses: protectionLevel === 'maximum' ? 1 : 3,
       clientFingerprint,
-      protectionLevel,
-      clientBypass: canSeeHiddenPhotos(req.accessLevel)
+      protectionLevel
     });
     
     res.json({ 
@@ -255,19 +233,9 @@ router.post('/:slug/photo/:photoId/generate-url', verifyGalleryAccess, async (re
     if (!photo) {
       return res.status(404).json({ error: 'Photo not found' });
     }
-
-    // Refuse to mint a signed URL for a hidden/client-only photo when the
-    // caller isn't a client. The signed-serve route below is token-only
-    // (no gallery auth), so the access decision has to happen here at mint
-    // time — mirroring how the reveal-bypass flag is baked into the token.
-    if (isPhotoHiddenFromViewer(photo, req.accessLevel)) {
-      return res.status(403).json({ error: 'Photo not available' });
-    }
-
-    // Generate signed token. The client-bypass flag lets a PIN-client's
-    // token keep serving a photo hidden after minting; a guest's token
-    // (clientBypass=0) stops the moment the photo is hidden.
-    const token = generateImageToken(photoId, 3600, canSeeHiddenPhotos(req.accessLevel));
+    
+    // Generate signed token
+    const token = generateImageToken(photoId);
     const signedUrl = `/api/images/${req.params.slug}/photo/${photoId}/signed/${token}`;
     
     res.json({ 
@@ -315,14 +283,7 @@ router.get('/:slug/photo/:photoId/signed/:token', async (req, res) => {
     if (!photo) {
       return res.status(404).json({ error: 'Photo not found' });
     }
-
-    // Recheck visibility at serve time (TOCTOU): a photo hidden AFTER the
-    // URL was minted must stop serving, unless the token was minted by a
-    // client (clientBypass) — mirroring the reveal-mode check above.
-    if (photo.visibility === 'hidden' && !tokenData.clientBypass) {
-      return res.status(403).json({ error: 'Photo not available' });
-    }
-
+    
     // Get watermark settings
     const watermarkSettings = await watermarkService.getWatermarkSettings();
 

backend/src/routes/secureImages.js

@@ -13,7 +13,6 @@ const {
   pickRawDownloadName,
 } = require('../services/downloadFilenameService');
 const { buildContentDisposition } = require('../utils/filenameSanitizer');
-const { isPhotoHiddenFromViewer, canSeeHiddenPhotos } = require('../utils/photoVisibility');
 
 const router = express.Router();
 
@@ -41,12 +40,6 @@ router.post('/:slug/generate-token', async (req, res, next) => {
       return res.status(404).json({ error: 'Photo not found' });
     }
 
-    // Don't mint a secure-image capability for a hidden/client-only photo
-    // when the caller isn't a client (the token is reusable up to 3×).
-    if (isPhotoHiddenFromViewer(photo, req.accessLevel)) {
-      return res.status(403).json({ error: 'Photo not available' });
-    }
-
     // Create client fingerprint
     const clientFingerprint = secureImageService.createClientFingerprint(req);
     
@@ -58,10 +51,7 @@ router.post('/:slug/generate-token', async (req, res, next) => {
       expiresIn: protectionLevel === 'maximum' ? 180 : 300, // 3-5 minutes
       maxUses: accessType === 'download' ? 1 : 3,
       clientFingerprint,
-      protectionLevel,
-      // TOCTOU: a client's token keeps serving a photo hidden after minting;
-      // a guest's stops the moment it's hidden (checked at the serve route).
-      clientBypass: canSeeHiddenPhotos(req.accessLevel)
+      protectionLevel
     };
 
     const token = secureImageService.generateSecureToken(
@@ -147,34 +137,6 @@ router.get('/:slug/secure/:photoId/:token',
         return res.status(404).json({ error: 'Gallery not found' });
       }
 
-      // Bind the token to the gallery + photo it was minted for
-      // (GHSA-g94x-8vv8-3c9f). This route serves via <img src> with the
-      // token in the URL, so it can't require verifyGalleryAccess like the
-      // download sibling does. Instead enforce the scope already inside the
-      // token: it is minted for one photoId (and photos belong to exactly
-      // one gallery), and its sessionId records the minting gallery's id.
-      // Without this, a token minted on any PUBLIC gallery reads every other
-      // gallery's photos with no password.
-      const tokenPhotoId = Number(tokenValidation.data?.photoId);
-      if (!Number.isInteger(tokenPhotoId) || tokenPhotoId !== Number(photoId)) {
-        await secureImageService.logImageAccess(
-          photoId, event.id, req.clientInfo, 'photo_mismatch'
-        );
-        return res.status(403).json({ error: 'Token not valid for this photo' });
-      }
-      // Defense in depth: the sessionId embeds the gallery the token was
-      // minted for (`gallery_public_<id>_...` / `gallery_<id>_...`). Reject a
-      // token whose gallery is parseable and differs from this one.
-      const sessionEventId = Number(
-        (String(tokenValidation.data?.sessionId || '').match(/^gallery_(?:public_)?(\d+)_/) || [])[1]
-      );
-      if (Number.isInteger(sessionEventId) && sessionEventId !== Number(event.id)) {
-        await secureImageService.logImageAccess(
-          photoId, event.id, req.clientInfo, 'gallery_mismatch'
-        );
-        return res.status(403).json({ error: 'Token not valid for this gallery' });
-      }
-
       // Verify photo exists and belongs to event  
       const photo = await db('photos')
         .where({ id: photoId, event_id: event.id })
@@ -184,13 +146,6 @@ router.get('/:slug/secure/:photoId/:token',
         return res.status(404).json({ error: 'Photo not found' });
       }
 
-      // Recheck visibility at serve time (TOCTOU): a photo hidden AFTER the
-      // token was minted must stop serving, unless the token was minted by a
-      // client (clientBypass) — mirroring the reveal-mode check above.
-      if (photo.visibility === 'hidden' && !tokenValidation.data?.clientBypass) {
-        return res.status(403).json({ error: 'Photo not available' });
-      }
-
       // Resolve photo through storage backend (managed) or fall back to local
       // path (external reference mode). secureImageService needs a local file,
       // so we materialize a tmp copy via withLocalCopy in S3 mode.
@@ -347,23 +302,6 @@ router.get('/:slug/secure-download/:photoId/:token',
         return res.status(404).json({ error: 'Photo not found' });
       }
 
-      // Block guest access to hidden/client-only photos.
-      if (isPhotoHiddenFromViewer(photo, req.accessLevel)) {
-        return res.status(403).json({ error: 'Photo not available' });
-      }
-
-      // Per-category download opt-out (#640) — the regular single-photo
-      // download enforces this too; the secure path skipped it. SQLite
-      // returns the boolean as numeric 0, so check both forms.
-      if (photo.category_id) {
-        const cat = await db('photo_categories')
-          .where('id', photo.category_id)
-          .first('allow_downloads');
-        if (cat && (cat.allow_downloads === false || cat.allow_downloads === 0)) {
-          return res.status(403).json({ error: 'Downloads are disabled for this category' });
-        }
-      }
-
       // Resolve photo through storage backend (managed) or local disk (external).
       const storageKey = resolvePhotoStorageKey(req.event, photo);
 

backend/src/services/_workflowSeedBoot.js

@@ -31,10 +31,7 @@ function buildDunningGraph({ firstDays, gapDays, maxReminders }) {
   const nodes = [
     { node_key: 't', type: 'trigger', config: {}, pos_x: 240, pos_y: 0 },
     { node_key: 'waitDue', type: 'wait', config: { untilVar: 'dueDate' }, pos_x: 240, pos_y: 110 },
-    // Anchor the grace period to the invoice's due date (dueDate + firstDays),
-    // not "now + firstDays" — so an already-overdue invoice enrolled via backfill
-    // duns on its real timeline instead of restarting a fresh grace clock (#750).
-    { node_key: 'waitGrace', type: 'wait', config: { untilVar: 'dueDate', delayDays: firstDays }, pos_x: 240, pos_y: 220 },
+    { node_key: 'waitGrace', type: 'wait', config: { delayDays: firstDays }, pos_x: 240, pos_y: 220 },
     { node_key: 'loop', type: 'loop', config: { maxIterations: maxReminders }, pos_x: 240, pos_y: 330 },
     { node_key: 'checkPaid', type: 'condition', config: { condition: 'invoice_paid' }, pos_x: 240, pos_y: 440 },
     { node_key: 'paymentCheck', type: 'action', config: { action: 'queue_payment_check' }, pos_x: 240, pos_y: 550 },
@@ -221,7 +218,7 @@ function buildGalleryExpiredGraph() {
 const BUILTINS = [
   {
     key: DUNNING_KEY,
-    version: 7,
+    version: 6,
     enabled: false,
     name: 'Invoice dunning (built-in)',
     trigger_type: 'invoice.sent',

backend/src/services/backupCoverageService.js

@@ -212,20 +212,17 @@ async function buildConfiguredPathReport(configuredRows, config) {
     const includedInDefault = Boolean(row.include_in_default);
     let featureFlagValue = null;
     if (row.feature_flag) {
-      // Alias-aware: show the value the gate actually used, not a seeded
-      // canonical key shadowed by the UI's spelling. Normalize like the
-      // walker does — Boolean('false') is true.
-      const v = backupService.effectiveFlagValue(row, config);
-      featureFlagValue = v === undefined || v === null ? null : backupService.normalizeBoolean(v);
+      const v = config[row.feature_flag];
+      featureFlagValue = v === undefined ? null : Boolean(v);
     }
 
     let coverage;
     if (!includedInDefault) {
       coverage = 'skipped-by-toggle';
-    } else if (!backupService.backupPathIncluded(row, config)) {
-      // Same gate the walker uses — feature flags (incl. the UI's
-      // backup_include_archives alias) and the What-to-Backup opt-outs.
-      coverage = row.feature_flag ? 'skipped-by-feature-flag' : 'skipped-by-setting';
+    } else if (row.feature_flag && featureFlagValue !== true) {
+      // null (unset) and explicit false both gate the path off — matches
+      // the walker's normalizeBoolean semantics
+      coverage = 'skipped-by-feature-flag';
     } else if (!stat.exists) {
       coverage = 'missing-on-disk';
     } else {
@@ -316,7 +313,6 @@ async function getCoverageReport() {
     willScanCount:           paths.filter((p) => p.coverage === 'will-scan').length,
     skippedByToggleCount:    paths.filter((p) => p.coverage === 'skipped-by-toggle').length,
     skippedByFeatureFlagCount: paths.filter((p) => p.coverage === 'skipped-by-feature-flag').length,
-    skippedBySettingCount:   paths.filter((p) => p.coverage === 'skipped-by-setting').length,
     missingOnDiskCount:      paths.filter((p) => p.coverage === 'missing-on-disk').length,
     driftCount: unconfiguredOnDisk.length,
     tableMissingFallbackInUse: fallback,

backend/src/services/backupService.js

@@ -7,7 +7,6 @@ const os = require('os');
 const { promisify } = require('util');
 
 const cron = require('node-cron');
-const cronParser = require('cron-parser');
 const { db } = require('../database/db');
 const { queueEmail } = require('./emailProcessor');
 const logger = require('../utils/logger');
@@ -349,10 +348,7 @@ async function getDatabaseBackupInfoInternal() {
       return {
         type: recent.backup_type || 'unknown',
         backupFile: recent.file_path,
-        // file_size_bytes is a bigInteger column — node-postgres returns int8
-        // as a STRING, and `backedUpSize += size` then concatenates instead of
-        // adding (issue #871: "167.6 TB" dashboard size). Coerce at the source.
-        size: Number(recent.file_size_bytes) || 0,
+        size: recent.file_size_bytes,
         checksum: recent.checksum,
         hasChanged,
         backupTime: recent.completed_at,
@@ -393,11 +389,7 @@ async function scanDirectory(dirPath, fileList, basePath, excludePatterns = [])
 
       const isExcluded = excludePatterns.some(pattern => {
         if (pattern.includes('*')) {
-          // Escape regex metacharacters before expanding the glob star — the
-          // raw replace turned '.nfs*' into /^.nfs.*$/ whose leading dot
-          // matched any character (e.g. 'anfs-photo.jpg' was excluded too).
-          const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
-          const regex = new RegExp(`^${escaped}$`);
+          const regex = new RegExp(`^${pattern.replace(/\*/g, '.*')}$`);
           return regex.test(entry.name);
         }
         return entry.name === pattern;
@@ -445,26 +437,6 @@ const LEGACY_BACKUP_PATHS = [
   { path: 'business-docs',    feature_flag: null },
 ];
 
-// "What to Backup" opt-OUT toggles written by BackupConfiguration.tsx.
-// Default-ON semantics: only an explicit false excludes the path, so
-// installs that never saved the backup form keep backing up everything
-// (issue #871: unchecking Thumbnails had no effect because these keys
-// were stored but never read).
-const OPT_OUT_FLAGS = {
-  'events/active': 'backup_include_photos',
-  'thumbnails': 'backup_include_thumbnails',
-};
-
-// The UI "Archives" checkbox writes backup_include_archives (plural) while
-// the feature_flag rows use backup_include_archived — accept both.
-const FLAG_ALIASES = {
-  backup_include_archived: 'backup_include_archives',
-};
-
-// Filesystem noise that must never land in a backup: NFS silly-rename
-// artifacts (issue #871 showed .nfs* files uploaded to S3) and OS metadata.
-const DEFAULT_EXCLUDE_PATTERNS = ['.nfs*', '.DS_Store', 'Thumbs.db'];
-
 /**
  * Resolve the walker's target subdirectories from `backup_paths`.
  *
@@ -484,84 +456,34 @@ const DEFAULT_EXCLUDE_PATTERNS = ['.nfs*', '.DS_Store', 'Thumbs.db'];
  *                         Used to evaluate feature_flag gates.
  * @returns {Promise<Array<{ path: string, feature_flag: string|null }>>}
  */
-async function loadBackupPathRows({ includeDisabled = false } = {}) {
+async function resolveBackupPaths(config) {
+  let rows;
   try {
     if (!(await db.schema.hasTable('backup_paths'))) {
       logger.warn('backup_paths table missing — falling back to LEGACY_BACKUP_PATHS');
-      return LEGACY_BACKUP_PATHS;
+      rows = LEGACY_BACKUP_PATHS;
+    } else {
+      rows = await db('backup_paths')
+        .where('include_in_default', formatBoolean(true))
+        .orderBy('display_order', 'asc')
+        .select('path', 'feature_flag');
+      if (!rows.length) {
+        logger.warn('backup_paths has no rows with include_in_default=true — falling back to LEGACY_BACKUP_PATHS');
+        rows = LEGACY_BACKUP_PATHS;
+      }
     }
-    let query = db('backup_paths')
-      .orderBy('display_order', 'asc')
-      .select('path', 'feature_flag', 'include_in_default');
-    if (!includeDisabled) {
-      query = query.where('include_in_default', formatBoolean(true));
-    }
-    const rows = await query;
-    if (!rows.filter((r) => normalizeBoolean(r.include_in_default)).length) {
-      logger.warn('backup_paths has no rows with include_in_default=true — falling back to LEGACY_BACKUP_PATHS');
-      return LEGACY_BACKUP_PATHS;
-    }
-    return rows;
   } catch (err) {
     logger.warn(`Failed to query backup_paths (${err.message}) — falling back to LEGACY_BACKUP_PATHS`);
-    return LEGACY_BACKUP_PATHS;
+    rows = LEGACY_BACKUP_PATHS;
   }
-}
 
-// Per-row gate. Applies the UI opt-out toggles first, then feature_flag
-// gating: a row with feature_flag='backup_include_archived' requires the
-// corresponding config key to be truthy (same semantics as the historical
-// `includeArchived` parameter).
-function backupPathIncluded(row, config) {
-  const optOutKey = OPT_OUT_FLAGS[row.path];
-  if (optOutKey && config) {
-    const optOutValue = config[optOutKey];
-    if (optOutValue !== undefined && optOutValue !== null && normalizeBoolean(optOutValue) === false) {
-      return false;
-    }
-  }
-  if (!row.feature_flag) return true;
-  let flagValue;
-  if (config) {
-    // The alias (backup_include_archives) is what the current UI writes;
-    // the canonical singular key is seeded true by migration on every
-    // install, so the UI value must take precedence or the checkbox can
-    // never turn the flag off.
-    const alias = FLAG_ALIASES[row.feature_flag];
-    if (alias && config[alias] !== undefined && config[alias] !== null) {
-      flagValue = config[alias];
-    } else {
-      flagValue = config[row.feature_flag];
-    }
-  }
-  return normalizeBoolean(flagValue);
-}
-
-// The raw config value the gate actually consulted for a row's feature
-// flag (alias-aware) — the coverage report shows it next to the status,
-// so it must not display the shadowed seeded key.
-function effectiveFlagValue(row, config) {
-  if (!row.feature_flag || !config) return undefined;
-  const alias = FLAG_ALIASES[row.feature_flag];
-  if (alias && config[alias] !== undefined && config[alias] !== null) {
-    return config[alias];
-  }
-  return config[row.feature_flag];
-}
-
-async function resolveBackupPaths(config) {
-  return (await loadBackupPathRows()).filter((row) => backupPathIncluded(row, config));
-}
-
-// The rows the admin de-selected — the rsync destination needs them as
-// --exclude filters because it syncs the whole storage root rather than
-// the walker's file list. Includes rows with include_in_default=false,
-// which the enabled-only loader would otherwise hide from rsync entirely.
-async function resolveExcludedBackupPaths(config) {
-  const rows = await loadBackupPathRows({ includeDisabled: true });
+  // Apply feature_flag gating. A row with feature_flag='backup_include_archived'
+  // requires config.backup_include_archived to be truthy (same semantics as
+  // the historical `includeArchived` parameter).
   return rows.filter((row) => {
-    const disabled = row.include_in_default !== undefined && !normalizeBoolean(row.include_in_default);
-    return disabled || !backupPathIncluded(row, config);
+    if (!row.feature_flag) return true;
+    const flagValue = config ? config[row.feature_flag] : undefined;
+    return normalizeBoolean(flagValue);
   });
 }
 
@@ -652,14 +574,6 @@ async function getFilesToBackupInternal(configOrIncludeArchived = true) {
 
   const targets = await resolveBackupPaths(config);
 
-  // backup_exclude_patterns was only honored by the rsync destination
-  // (as --exclude args); the local/S3 walker ignored it. Merge it with
-  // the always-on noise filters here so every destination agrees.
-  const configuredExcludes = Array.isArray(config.backup_exclude_patterns)
-    ? config.backup_exclude_patterns
-    : [];
-  const excludePatterns = [...new Set([...DEFAULT_EXCLUDE_PATTERNS, ...configuredExcludes])];
-
   for (const target of targets) {
     // CRM document estate is special-cased in the comment block below
     // because it's the most expensive omission to recover from:
@@ -675,7 +589,7 @@ async function getFilesToBackupInternal(configOrIncludeArchived = true) {
     // those values refer to do not, leaving every CRM *_path column a
     // broken FK. scanDirectory short-circuits on ENOENT so installs
     // that never used CRM features won't error.
-    await scanDirectory(path.join(storagePath, target.path), files, storagePath, excludePatterns);
+    await scanDirectory(path.join(storagePath, target.path), files, storagePath);
   }
 
   return files;
@@ -772,7 +686,7 @@ function validateRsyncParam(value, label) {
   return value;
 }
 
-function buildRsyncArgs(config, extraExcludes = []) {
+function buildRsyncArgs(config) {
   const storagePath = getStoragePath();
   const host = validateRsyncParam(config.backup_rsync_host, 'host');
   const remotePath = validateRsyncParam(config.backup_rsync_path, 'remote path');
@@ -799,14 +713,7 @@ function buildRsyncArgs(config, extraExcludes = []) {
     args.push('-e', `ssh -i ${sshKey} -o StrictHostKeyChecking=no`);
   }
 
-  // Same noise filters as the walker, plus the de-selected backup paths
-  // (extraExcludes) — rsync syncs the whole storage root, so this is the
-  // only place the What-to-Backup selection can take effect for rsync.
-  const excludePatterns = [...new Set([
-    ...DEFAULT_EXCLUDE_PATTERNS,
-    ...(Array.isArray(config.backup_exclude_patterns) ? config.backup_exclude_patterns : []),
-    ...extraExcludes,
-  ])];
+  const excludePatterns = config.backup_exclude_patterns || [];
   excludePatterns.forEach(pattern => args.push('--exclude', pattern));
 
   const source = `${storagePath}/`;
@@ -845,19 +752,7 @@ function parseRsyncStats(output) {
 
 async function performRsyncBackup(config, files) {
   const { spawnAsync } = require('../utils/safeExec');
-  // SSRF: the /test-connection route validates the host, but a scheduled or
-  // manual /run reaches here directly with the stored host. Resolve-and-vet
-  // it right before ssh/rsync does its own DNS at connect time, so a host
-  // that resolves to an internal address can't be reached (GHSA-4jh8).
-  const { isHostAllowed } = require('../utils/networkValidation');
-  if (!(await isHostAllowed(config.backup_rsync_host))) {
-    throw new Error('rsync host resolves to a private or internal network address');
-  }
-  // Anchored excludes for the de-selected What-to-Backup paths; rsync
-  // otherwise transfers the whole storage root regardless of the walker's
-  // file list (which only feeds manifests and file state).
-  const excludedPaths = await resolveExcludedBackupPaths(config);
-  const rsyncArgs = buildRsyncArgs(config, excludedPaths.map((row) => `/${row.path}/`));
+  const rsyncArgs = buildRsyncArgs(config);
   const { stdout } = await spawnAsync('rsync', rsyncArgs);
   const stats = parseRsyncStats(stdout);
 
@@ -1280,50 +1175,6 @@ async function runBackupInternal(isManual = false) {
   }
 }
 
-// Two settings cooperate here:
-//   - backup_schedule           — UI label like "daily" / "weekly" / "custom"
-//   - backup_schedule_cron      — actual cron expression (custom schedules)
-// Older startup code read backup_schedule and crashed when it found a label
-// instead of a cron expression. Resolution order: explicit cron field, then
-// map known labels, then fall back to default.
-const NAMED_SCHEDULES = {
-  hourly: '0 * * * *',
-  daily: '0 2 * * *',
-  weekly: '0 3 * * 0',  // Sunday 03:00
-  monthly: '0 4 1 * *',
-};
-
-function resolveScheduleCron(config) {
-  const isCronExpression = (s) => typeof s === 'string' && /^\s*\S+(\s+\S+){4}\s*$/.test(s);
-  const readSetting = (key) => {
-    if (config && Object.prototype.hasOwnProperty.call(config, key)) {
-      return String(config[key] ?? '').trim();
-    }
-    if (config?.__raw && Object.prototype.hasOwnProperty.call(config.__raw, key)) {
-      return String(parseSettingValue(config.__raw[key]) ?? '').trim();
-    }
-    return '';
-  };
-
-  let schedule = '0 2 * * *';
-  const cronCandidate = readSetting('backup_schedule_cron');
-  const labelCandidate = readSetting('backup_schedule');
-  // A named label wins over the cron field: the UI always used to send its
-  // default cron ('0 3 * * *') alongside e.g. backup_schedule='weekly', which
-  // silently turned weekly schedules into daily ones (issue #871). The cron
-  // field only applies for 'custom' (or when no known label is set).
-  if (labelCandidate && labelCandidate.toLowerCase() !== 'custom' && NAMED_SCHEDULES[labelCandidate.toLowerCase()]) {
-    schedule = NAMED_SCHEDULES[labelCandidate.toLowerCase()];
-  } else if (cronCandidate && isCronExpression(cronCandidate)) {
-    schedule = cronCandidate;
-  } else if (labelCandidate && isCronExpression(labelCandidate)) {
-    // Back-compat: a deployment that wrote a cron expression directly into
-    // backup_schedule (no _cron field) still works.
-    schedule = labelCandidate;
-  }
-  return schedule;
-}
-
 async function startBackupService() {
   try {
     const config = await resolveConfigWithFallback();
@@ -1341,7 +1192,42 @@ async function startBackupService() {
       backupJob = null;
     }
 
-    const schedule = resolveScheduleCron(config);
+    // Two settings cooperate here:
+    //   - backup_schedule           — UI label like "daily" / "weekly" / "custom"
+    //   - backup_schedule_cron      — actual cron expression
+    // The frontend writes both (BackupConfiguration.jsx). Older startup code
+    // here read backup_schedule and crashed when it found a label instead of
+    // a cron expression. Resolution order: explicit cron field, then map known
+    // labels, then fall back to default.
+    const NAMED_SCHEDULES = {
+      hourly: '0 * * * *',
+      daily: '0 2 * * *',
+      weekly: '0 3 * * 0',  // Sunday 03:00
+      monthly: '0 4 1 * *',
+    };
+    const isCronExpression = (s) => typeof s === 'string' && /^\s*\S+(\s+\S+){4}\s*$/.test(s);
+    const readSetting = (key) => {
+      if (config && Object.prototype.hasOwnProperty.call(config, key)) {
+        return String(config[key] ?? '').trim();
+      }
+      if (config?.__raw && Object.prototype.hasOwnProperty.call(config.__raw, key)) {
+        return String(parseSettingValue(config.__raw[key]) ?? '').trim();
+      }
+      return '';
+    };
+
+    let schedule = '0 2 * * *';
+    const cronCandidate = readSetting('backup_schedule_cron');
+    const labelCandidate = readSetting('backup_schedule');
+    if (cronCandidate && isCronExpression(cronCandidate)) {
+      schedule = cronCandidate;
+    } else if (labelCandidate && NAMED_SCHEDULES[labelCandidate.toLowerCase()]) {
+      schedule = NAMED_SCHEDULES[labelCandidate.toLowerCase()];
+    } else if (labelCandidate && isCronExpression(labelCandidate)) {
+      // Back-compat: a deployment that wrote a cron expression directly into
+      // backup_schedule (no _cron field) still works.
+      schedule = labelCandidate;
+    }
 
     backupJob = cron.schedule(schedule, async () => {
       logger.info('Starting scheduled backup');
@@ -1433,8 +1319,6 @@ async function getBackupStatus(limit = 10) {
     // ago looked identical to a successful one. Same "silent failure
     // not surfaced" class Stage A was designed to fight.
     const lastSuccessful = runs.find(r => r.status === 'completed') || null;
-    const config = await getBackupConfigInternal();
-    const nextRun = getNextScheduledRun(config);
     // Detect zombie running rows (started >30min ago, never updated)
     // — these are processes that died without writing a completed_at.
     // Surface them so the admin can tell at a glance vs a live run.
@@ -1455,8 +1339,7 @@ async function getBackupStatus(limit = 10) {
       recentRuns: runs,
       recentBackups: runs, // Alias for frontend compatibility
       totalBackups: runs.filter(r => r.status === 'completed').length,
-      nextScheduledRun: nextRun,
-      nextBackup: nextRun // BackupManagement.tsx reads this name
+      nextScheduledRun: getNextScheduledRun()
     };
   } catch (error) {
     logger.error('Failed to get backup status:', error);
@@ -1468,19 +1351,12 @@ async function getBackupStatus(limit = 10) {
   }
 }
 
-function getNextScheduledRun(config) {
-  // null → the UI shows "Not scheduled". Only a real, enabled schedule
-  // produces a date (issue #871: this used to be a hardcoded "tomorrow
-  // 02:00" that ignored the configured schedule entirely).
-  if (!config || !normalizeBoolean(config.backup_enabled)) {
-    return null;
-  }
-  try {
-    return cronParser.parseExpression(resolveScheduleCron(config)).next().toISOString();
-  } catch (error) {
-    logger.warn(`Could not compute next backup run: ${error.message}`);
-    return null;
-  }
+function getNextScheduledRun() {
+  const now = new Date();
+  const next = new Date(now);
+  next.setDate(now.getDate() + 1);
+  next.setHours(2, 0, 0, 0);
+  return next.toISOString();
 }
 
 async function cleanupOldBackupRuns(retentionDays = 30) {
@@ -1693,13 +1569,5 @@ service.getBackupStatus = getBackupStatus;
 service.cleanupOldBackupRuns = cleanupOldBackupRuns;
 service.getBackupManifest = getBackupManifest;
 service.validateBackupManifest = validateBackupManifest;
-service.resolveBackupPaths = resolveBackupPaths;
-service.resolveExcludedBackupPaths = resolveExcludedBackupPaths;
-service.backupPathIncluded = backupPathIncluded;
-service.effectiveFlagValue = effectiveFlagValue;
-service.normalizeBoolean = normalizeBoolean;
-service.buildRsyncArgs = buildRsyncArgs;
-service.resolveScheduleCron = resolveScheduleCron;
-service.getNextScheduledRun = getNextScheduledRun;
 
 module.exports = service;

backend/src/services/chunkedUploadService.js

@@ -30,16 +30,6 @@ async function initializeUpload(options) {
     totalChunks
   } = options;
 
-  // Strip any directory components from the client-supplied filename. It is
-  // later joined onto the temp merge dir (path.join(tempDir, filename)), and
-  // path.join does NOT neutralise `../` — a filename like `../../uploads/
-  // logos/evil.svg` would escape the temp dir and overwrite arbitrary files
-  // (GHSA-pc72-jf53-w28j). basename() collapses it to the leaf name only.
-  const safeFilename = path.basename(String(filename || ''));
-  if (!safeFilename || safeFilename === '.' || safeFilename === '..') {
-    throw new Error('Invalid filename');
-  }
-
   // Generate unique upload ID
   const uploadId = crypto.randomUUID();
 
@@ -53,7 +43,7 @@ async function initializeUpload(options) {
   // Store upload metadata
   const uploadMeta = {
     uploadId,
-    filename: safeFilename,
+    filename,
     fileSize,
     mimeType,
     eventId,
@@ -69,7 +59,7 @@ async function initializeUpload(options) {
 
   logger.info('Initialized chunked upload', {
     uploadId,
-    filename: safeFilename,
+    filename,
     fileSize,
     expectedChunks,
     eventId
@@ -281,12 +271,8 @@ async function cleanupExpiredUploads() {
   return expiredIds.length;
 }
 
-// Run cleanup every hour. unref so this module-level housekeeping timer
-// never holds the process open on its own — in production the HTTP
-// listener keeps the loop alive, and in Jest this exact handle kept the
-// runner from exiting for every suite that requires adminPhotos (#908;
-// it is why adminPhotos.reference sits on the CI ignore list).
-setInterval(cleanupExpiredUploads, 60 * 60 * 1000).unref();
+// Run cleanup every hour
+setInterval(cleanupExpiredUploads, 60 * 60 * 1000);
 
 module.exports = {
   initializeUpload,

backend/src/services/downloadZipService.js

@@ -112,15 +112,8 @@ class DownloadZipService {
       const event = await db('events').where({ id: eventId }).first();
       if (!event) return { success: false, error: 'Event not found' };
 
-      // The prebuilt zip is served to ordinary gallery guests (the
-      // download-all fast path), so it must exclude hidden/client-only
-      // photos — NULL visibility counts as visible (pre-migration rows).
-      // PIN-clients bypass this cache and stream a full archive instead.
       const photos = await db('photos')
         .where({ event_id: eventId })
-        .where(function () {
-          this.where('visibility', 'visible').orWhereNull('visibility');
-        })
         .select('*')
         .orderBy('type', 'asc')
         .orderBy('uploaded_at', 'desc');

backend/src/services/emailIntakeService.js

@@ -16,7 +16,6 @@ const { db } = require('../database/db');
 const logger = require('../utils/logger');
 const { getStoragePath } = require('../config/storage');
 const expenseService = require('./expenseService');
-const sanitizeHtml = require('sanitize-html');
 const { isUniqueViolation } = require('../utils/dbErrors');
 
 const ALLOWED_MIME = ['application/pdf', 'image/jpeg', 'image/png'];
@@ -231,36 +230,14 @@ async function roundTripTest({ timeoutMs = 30000, intervalMs = 3000 } = {}) {
   }
 }
 
-// Sanitize an inbound HTML body before storing it. Inbound mail is untrusted,
-// so this strips scripts/handlers/unknown schemes (the viewer ALSO renders it
-// in a script-less sandboxed iframe — defense in depth). Remote images are kept
-// (many legit emails embed them) but that is the only tracking-vector allowed.
-function sanitizeBody(html) {
-  if (!html) return null;
-  try {
-    return sanitizeHtml(html, {
-      allowedTags: sanitizeHtml.defaults.allowedTags.concat(['img']),
-      allowedAttributes: {
-        ...sanitizeHtml.defaults.allowedAttributes,
-        img: ['src', 'alt', 'width', 'height'],
-        '*': ['style'],
-      },
-      allowedSchemes: ['http', 'https', 'mailto', 'cid'],
-    });
-  } catch (_) {
-    return null;
-  }
-}
+/** Poll the mailbox once. Safe to call repeatedly; self-skips when busy/off. */
+async function pollOnce() {
+  if (polling) return { skipped: 'busy' };
+  if (!(await isEnabled())) return { skipped: 'disabled' };
+  const cfg = await getImapConfig();
+  if (!cfg) return { skipped: 'unconfigured' };
 
-/**
- * Poll ONE mailbox once and return the count of newly-processed messages.
- * `opts.accountKey` tags each received_emails row; `opts.routeToExpenses`
- * controls whether PDF/image attachments are dropped into the accounting inbox
- * (true for the primary rechnungen@ mailbox) or only logged with the body
- * (customer mail, e.g. hello@). The claim/dedup/stale-recovery logic is
- * identical for every mailbox.
- */
-async function pollAccountOnce(cfg, { accountKey = 'accounting', routeToExpenses = true } = {}) {
+  polling = true;
   const client = makeImapClient(cfg);
   let processed = 0;
   try {
@@ -327,7 +304,6 @@ async function pollAccountOnce(cfg, { accountKey = 'accounting', routeToExpenses
           try {
             await db('received_emails').insert({
               message_id: claimKey,
-              account_key: accountKey,
               status: 'processing',
               attachment_count: 0,
               received_at: new Date(),
@@ -339,47 +315,37 @@ async function pollAccountOnce(cfg, { accountKey = 'accounting', routeToExpenses
             throw ce;
           }
 
-          // Attachment handling. The accounting mailbox drops PDF/image
-          // attachments into the incoming-invoices inbox (isolated so one bad
-          // file can't prevent the audit row). Customer mailboxes only COUNT
-          // attachments — they aren't supplier invoices.
+          // Ingest attachments. Isolate each so one bad file can't prevent the
+          // audit row (the symptom: doc lands in Incoming invoices but the
+          // email never shows under Received).
+          const atts = (parsed.attachments || []).filter((a) => ALLOWED_MIME.includes(a.contentType));
           let inboundId = null;
           let count = 0;
           const attErrors = [];
-          if (routeToExpenses) {
-            const atts = (parsed.attachments || []).filter((a) => ALLOWED_MIME.includes(a.contentType));
-            for (const att of atts) {
-              try {
-                const filePath = await saveAttachment(att);
-                const doc = await expenseService.recordInboundDocument({ source: 'email', filePath, originalFilename: att.filename || 'attachment', mimeType: att.contentType }, null);
-                inboundId = doc.id; count += 1;
-              } catch (ae) {
-                attErrors.push(ae.message);
-                logger.error?.(`emailIntake: attachment "${att.filename}" failed: ${ae.message}`);
-              }
+          for (const att of atts) {
+            try {
+              const filePath = await saveAttachment(att);
+              const doc = await expenseService.recordInboundDocument({ source: 'email', filePath, originalFilename: att.filename || 'attachment', mimeType: att.contentType }, null);
+              inboundId = doc.id; count += 1;
+            } catch (ae) {
+              attErrors.push(ae.message);
+              logger.error?.(`emailIntake: attachment "${att.filename}" failed: ${ae.message}`);
             }
-          } else {
-            count = (parsed.attachments || []).length;
           }
 
           // A malformed Date: header yields an Invalid Date, which throws on a
           // Postgres timestamp insert — coerce to now.
           const receivedAt = (parsed.date instanceof Date && !Number.isNaN(parsed.date.getTime())) ? parsed.date : new Date();
-          const status = routeToExpenses
-            ? (count > 0 ? 'ingested' : (attErrors.length ? 'error' : 'no_attachment'))
-            : 'received';
+          const status = count > 0 ? 'ingested' : (attErrors.length ? 'error' : 'no_attachment');
           // Finalise the claimed row — every processed message ends up in the
-          // Received log with its (sanitized) body, even attachment-less ones.
+          // Received tab, even attachment-less ones.
           await db('received_emails').where({ message_id: claimKey }).update({
             from_address: ((parsed.from && parsed.from.text) || '').slice(0, 512) || null,
-            to_address: ((parsed.to && parsed.to.text) || '').slice(0, 512) || null,
             subject: parsed.subject || null,
             received_at: receivedAt,
             attachment_count: count,
             status,
             inbound_document_id: inboundId,
-            body_html: sanitizeBody(parsed.html || null),
-            body_text: parsed.text || null,
             error: attErrors.length ? attErrors.join('; ').slice(0, 2000) : null,
           });
           await client.messageFlagsAdd(cand.uid, ['\\Seen'], { uid: true });
@@ -394,7 +360,7 @@ async function pollAccountOnce(cfg, { accountKey = 'accounting', routeToExpenses
               await db('received_emails').where({ message_id: claimKey })
                 .update({ status: 'error', error: String(e.message).slice(0, 2000) });
             } else {
-              await db('received_emails').insert({ message_id: `err-${cand.uid}-${Date.now()}`, account_key: accountKey, status: 'error', error: e.message, attachment_count: 0, received_at: new Date(), created_at: new Date() });
+              await db('received_emails').insert({ message_id: `err-${cand.uid}-${Date.now()}`, status: 'error', error: e.message, attachment_count: 0, received_at: new Date(), created_at: new Date() });
             }
           } catch (ie) {
             logger.error?.(`emailIntake: could not even write the error row (received_emails insert failing): ${ie.message}`);
@@ -407,55 +373,11 @@ async function pollAccountOnce(cfg, { accountKey = 'accounting', routeToExpenses
     /* eslint-enable no-await-in-loop */
     await client.logout();
   } catch (e) {
-    logger.error?.(`emailIntake: poll failed (${accountKey}): ${e.message}`);
+    logger.error?.(`emailIntake: poll failed: ${e.message}`);
     try { await client.close(); } catch (_e) { /* ignore */ }
-  }
-  return processed;
-}
-
-/**
- * Poll ALL configured inbound mailboxes once: the primary accounting IMAP
- * (email_configs) plus every enabled row in mail_accounts (e.g. hello@).
- * Safe to call repeatedly; self-skips when busy/off.
- */
-async function pollOnce() {
-  if (polling) return { skipped: 'busy' };
-  if (!(await isEnabled())) return { skipped: 'disabled' };
-  polling = true;
-  let processed = 0;
-  let anyConfigured = false;
-  try {
-    // 1) Primary accounting mailbox — routes attachments to the invoices inbox.
-    const acctCfg = await getImapConfig();
-    if (acctCfg) {
-      anyConfigured = true;
-      processed += await pollAccountOnce(acctCfg, { accountKey: 'accounting', routeToExpenses: true });
-    }
-    // 2) Additional mailboxes (customers/hello@) — body captured, no expense
-    //    routing. Guarded so a pre-migration DB simply polls the accounting box.
-    let extras = [];
-    try {
-      if (await db.schema.hasTable('mail_accounts')) {
-        extras = await db('mail_accounts').where({ enabled: true });
-      }
-    } catch (_) { extras = []; }
-    for (const a of extras) {
-      if (!a.imap_host || !a.imap_user) continue;
-      anyConfigured = true;
-      const cfg = {
-        host: a.imap_host,
-        port: a.imap_port || 993,
-        secure: a.imap_secure !== false && a.imap_secure !== 0,
-        auth: { user: a.imap_user, pass: a.imap_pass || '' },
-        folder: a.imap_folder || 'INBOX',
-      };
-      // eslint-disable-next-line no-await-in-loop
-      processed += await pollAccountOnce(cfg, { accountKey: a.account_key, routeToExpenses: false });
-    }
   } finally {
     polling = false;
   }
-  if (!anyConfigured) return { skipped: 'unconfigured' };
   return { processed };
 }
 

backend/src/services/emailProcessor.js

@@ -726,12 +726,9 @@ async function sendTemplateEmail(to, templateKey, variables) {
       throw new Error('Email configuration not found');
     }
 
-    // Determine recipient language. An explicit `__language` in the email data
-    // wins (CRM/billing emails set it to the customer/invoice language so a
-    // gallery event's language can't override a dunning notice — see #760);
-    // otherwise fall back to the event-first recipient resolution.
-    const language = variables.__language || await getRecipientLanguage(to, variables.eventId || null);
-
+    // Determine recipient language (pass eventId if available in variables)
+    const language = await getRecipientLanguage(to, variables.eventId || null);
+    
     // Process template with variables
     const { subject, htmlBody, textBody } = await processTemplate(template, variables, language);
 
@@ -775,62 +772,6 @@ async function sendTemplateEmail(to, templateKey, variables) {
   }
 }
 
-/**
- * Send a fully-composed email (subject + HTML the admin already edited in the
- * Messages composer) WITHOUT a template. Used for replies + human-sent document
- * messages. Uses the configured SMTP identity + from address. Returns
- * { messageId, html } so the caller can persist rendered_html for the record.
- */
-async function sendRawEmail({ to, cc, subject, html, text, attachments, accountKey } = {}) {
-  let tx = null;
-  let fromEmail = null;
-  let fromName = null;
-
-  // Prefer a per-account outgoing identity (e.g. hello@) when the mail account
-  // has its own SMTP config, so customer replies send from that address instead
-  // of the global no-reply@. Falls back to the global SMTP transport.
-  if (accountKey) {
-    const acct = await db('mail_accounts').where({ account_key: accountKey }).first();
-    if (acct && acct.smtp_host && (acct.smtp_user || acct.from_email)) {
-      const nodemailer = require('nodemailer');
-      tx = nodemailer.createTransport({
-        host: acct.smtp_host,
-        port: parseInt(acct.smtp_port, 10) || 587,
-        secure: acct.smtp_secure === true || acct.smtp_secure === 1,
-        auth: acct.smtp_user && acct.smtp_pass ? { user: acct.smtp_user, pass: acct.smtp_pass } : undefined,
-        tls: { rejectUnauthorized: true },
-      });
-      fromEmail = acct.from_email || acct.smtp_user;
-      fromName = acct.from_name || '';
-    }
-  }
-  if (!tx) {
-    tx = await initializeTransporter();
-    if (!tx) throw new Error('Email service not configured');
-    const config = await db('email_configs').first();
-    if (!config || !config.from_email) throw new Error('Email service not configured');
-    fromEmail = config.from_email;
-    fromName = config.from_name;
-  }
-
-  const ccList = Array.isArray(cc) ? cc.filter(Boolean) : (cc ? [cc] : undefined);
-  const atts = Array.isArray(attachments)
-    ? attachments.filter((a) => a && (a.contentPath || a.path || a.content))
-        .map((a) => ({ filename: a.filename, path: a.contentPath || a.path, content: a.content, contentType: a.contentType }))
-    : undefined;
-  const info = await tx.sendMail({
-    from: `${fromName || 'picpeak'} <${fromEmail}>`,
-    to,
-    cc: ccList,
-    subject,
-    html,
-    text: text || htmlToText(html),
-    attachments: atts,
-  });
-  logger.info(`Manual email sent: ${info.messageId}`);
-  return { messageId: info.messageId, html };
-}
-
 /**
  * Render a queued email's HTML WITHOUT sending it. Used by the Project
  * Overview cockpit to preview emails that predate the rendered_html column
@@ -842,7 +783,7 @@ async function sendRawEmail({ to, cc, subject, html, text, attachments, accountK
 async function renderQueuedEmail(templateKey, variables = {}, to = '') {
   const template = await db('email_templates').where('template_key', templateKey).first();
   if (!template) return null;
-  const language = variables.__language || await getRecipientLanguage(to, variables.eventId || null);
+  const language = await getRecipientLanguage(to, variables.eventId || null);
   const { subject, htmlBody } = await processTemplate(template, variables, language);
   return { subject, html: htmlBody };
 }
@@ -1164,7 +1105,6 @@ module.exports = {
   initializeTransporter,
   startEmailQueueProcessor,
   sendTemplateEmail,
-  sendRawEmail,
   renderQueuedEmail,
   processEmailQueue,
   queueEmail,

backend/src/services/environmentService.js

@@ -47,23 +47,11 @@ async function detectEnvironment() {
     type = 'standalone';
   }
 
-  // Detect a production compose install. The backend runs INSIDE a container and
-  // cannot see the host's compose files (the image only carries backend/), so we
-  // can't stat docker-compose.production.yml. Instead we key off an env var the
-  // production compose sets in the backend environment (PICPEAK_RELEASE_CHANNEL)
-  // and the default docker-compose.yml does not. When present, the update
-  // instructions must target that file explicitly — bare `docker compose`
-  // operates on docker-compose.yml, a different (build-based) stack that also
-  // starts the dev-only mailhog and leaves the real production containers on the
-  // old version.
-  const isProductionCompose = Boolean(process.env.PICPEAK_RELEASE_CHANNEL);
-
   return {
     type,
     isDocker,
     isGit,
     hasDockerCompose,
-    isProductionCompose,
     platform: process.platform,
     nodeVersion: process.version,
     appVersion
@@ -106,36 +94,25 @@ function generateUpdateInstructions(env, targetVersion) {
 
   if (env.isDocker) {
     instructions.environmentName = 'Docker';
-    // Production installs use docker-compose.production.yml (the file the README
-    // documents and the only one with pinned GHCR images + no dev-only mailhog).
-    // Bare `docker compose` targets docker-compose.yml instead, so a production
-    // user who runs it stays on the old version and gets a stray mailhog. When we
-    // detect a production compose (PICPEAK_RELEASE_CHANNEL set), point every
-    // command at that file with `-f`.
-    const composeFile = env.isProductionCompose ? '-f docker-compose.production.yml ' : '';
     instructions.steps = [
       {
         description: 'Pull latest images',
-        command: `docker compose ${composeFile}pull`,
+        command: 'docker compose pull',
         note: 'Downloads the new version images'
       },
       {
         description: 'Recreate containers with new images',
-        command: `docker compose ${composeFile}up -d`,
+        command: 'docker compose up -d',
         note: 'Restarts containers with new version'
       },
       {
         description: 'Watch logs for startup (optional)',
-        command: `docker compose ${composeFile}logs -f backend`,
+        command: 'docker compose logs -f backend',
         note: 'Press Ctrl+C to exit logs',
         optional: true
       }
     ];
-    if (env.isProductionCompose) {
-      instructions.warnings.push('Run these from the directory containing your docker-compose.production.yml file.');
-    } else {
-      instructions.warnings.push('Make sure you are in the directory containing your compose file. If you installed with docker-compose.production.yml, add `-f docker-compose.production.yml` to each command.');
-    }
+    instructions.warnings.push('Make sure you are in the directory containing your docker-compose.yml file');
   } else if (env.isGit) {
     instructions.environmentName = 'Git (Development)';
     instructions.steps = [

backend/src/services/galleryOgService.js

@@ -34,29 +34,7 @@ const SOCIAL_CRAWLER_PATTERNS = [
   // messaging stacks (Twilio, LinkPreview.net, etc.). Match the
   // canonical lowercase substring; the /i flag handles case.
   /LinkPreview/i,
-  /Slack-ImgProxy/i,
-  // Viber's link-preview fetcher — was never detected, so shared links
-  // showed no rich preview in Viber (#699 follow-up). Keep in sync with the
-  // UA list in frontend/nginx.conf.
-  /Viber/i,
-  // Broader crawler coverage (#699 follow-up, from alexvaltchev's field list).
-  // IMPORTANT: only CRAWLER-EXCLUSIVE tokens are added here. Our OG response is
-  // meta-only (no client redirect), so a UA shared with a real human in-app
-  // browser would serve that human the bare stub. That rules out WeChat
-  // (MicroMessenger), LINE (Line/), Zalo, and generic strings like
-  // "InAppBrowser"/"preview"/"unfurl" — deliberately NOT added.
-  /Cardyb/i, // Bluesky's link-card service (the actual fetcher UA)
-  /facebookcatalog/i, // Facebook catalog crawler
-  /Signal/i, // Signal link preview
-  /Misskey/i, // fediverse (server-side preview fetch)
-  /Pleroma/i, // fediverse
-  /Synapse/i, // Matrix homeserver URL preview
-  /Nextcloud/i, // Nextcloud Talk/News link crawler
-  /Rocket\.Chat/i, // Rocket.Chat server preview
-  /kakaotalk-scrap/i, // KakaoTalk's scraper (NOT the in-app browser UA)
-  /Google-PageRenderer/i, // Google Chat previews (not Search)
-  /OdklBot/i, // Odnoklassniki
-  /ZoomBot/i // Zoom Team Chat
+  /Slack-ImgProxy/i
 ];
 
 function isSocialCrawler(userAgent) {

backend/src/services/imageProcessor.js

@@ -149,7 +149,7 @@ async function generateThumbnail(imagePath, options = {}) {
     let sharpInstance = sharp(imagePath, {
       limitInputPixels: 268402689, // ~16k x 16k max
       sequentialRead: true,
-      failOn: 'none'
+      failOnError: false
     });
 
     // Strip EXIF/metadata from thumbnails (privacy: prevent GPS leak etc.)
@@ -389,7 +389,7 @@ async function generateHeroImage(imagePath, options = {}) {
     let sharpInstance = sharp(imagePath, {
       limitInputPixels: 268402689,
       sequentialRead: true,
-      failOn: 'none'
+      failOnError: false
     });
 
     // Strip EXIF/metadata from hero images (privacy: prevent GPS leak etc.)
@@ -519,7 +519,7 @@ async function generatePreviewImage(imagePath, options = {}) {
     let sharpInstance = sharp(imagePath, {
       limitInputPixels: 268402689, // ~16k x 16k max
       sequentialRead: true,
-      failOn: 'none',
+      failOnError: false,
     });
 
     // Strip EXIF — same privacy reasoning as thumbnails/heroes.

backend/src/services/invoice/payments.js

@@ -185,8 +185,6 @@ async function queueInvoicePaidAdminNotification({
         || [customer?.first_name, customer?.last_name].filter(Boolean).join(' ')
         || customer?.email || '',
       event_name: invoice.event_name || '',
-      // Keep the body language consistent with the locale-formatted amounts.
-      __language: locale,
       total_amount: formatMajor(invoice.total_amount_minor, invoice.currency, locale),
       paid_amount: formatMajor(paidTotalMinor, invoice.currency, locale),
       payment_method: paymentMethod || '',
@@ -280,16 +278,13 @@ async function queuePaymentCheckEmail(invoiceId, { skipThrottle = false } = {})
     : null;
 
   await emailProcessor.queueEmail(invoice.event_id || null, adminContact.email,
-    'invoice_payment_check', {
+    'invoice_payment_check_admin', {
       invoice_number: invoice.invoice_number,
       customer_name: customer?.company_name
         || customer?.display_name
         || [customer?.first_name, customer?.last_name].filter(Boolean).join(' ')
         || customer?.email || '',
       event_name: invoice.event_name || '',
-      // Keep the body language consistent with the locale the amounts are
-      // formatted in, instead of event-first resolution (admin-facing gate).
-      __language: locale,
       due_date: formatShortDate(invoice.due_date),
       total_amount: formatMajor(invoice.total_amount_minor, invoice.currency, locale),
       paid_amount: formatMajor(paidMinor, invoice.currency, locale),

backend/src/services/invoice/reminders.js

@@ -141,7 +141,7 @@ async function applyReminder(invoice, lineItems, level, adminId) {
   const rawDaysOverdue = Math.floor((Date.now() - new Date(invoice.due_date).getTime()) / 86400000);
   const daysOverdue = Math.max(1, rawDaysOverdue);
   const templateKey = level === 1 ? 'invoice_reminder_first' : 'invoice_reminder_second';
-  const locale = ctx.locale || customer.preferred_language || invoice.language || 'de';
+  const locale = ctx.locale || invoice.language || 'de';
   const outstandingMinor = Math.max(0, newTotal - Number(invoice.paid_amount_minor || 0));
 
   // Attach the (unchanged) original invoice PDF + the new Mahnung.
@@ -154,8 +154,6 @@ async function applyReminder(invoice, lineItems, level, adminId) {
   const { to: reminderTo, cc: reminderCc } = resolveBillingRecipients(customer, invoice.cc_pdf_email);
   try {
     await emailProcessor.queueEmail(invoice.event_id || null, reminderTo, templateKey, {
-      // Render in the customer/invoice language, not the gallery event's (#760).
-      __language: locale,
       invoice_number: invoice.invoice_number,
       customer_name: customer.display_name || customer.first_name || customer.email.split('@')[0],
       total_amount: formatMajor(invoice.total_amount_minor, invoice.currency, locale),

backend/src/services/invoice/sending.js

@@ -127,9 +127,6 @@ async function sendInvoice(id, adminId) {
     installment_label: invoice.installment_label || '',
     installment_index: invoice.installment_index + 1,
     installment_total: invoice.installment_total,
-    // Send in the customer's language (matches the ctx.locale-formatted amounts
-    // above) rather than the event-first default resolution.
-    __language: ctx.locale,
     cc: invoiceCc,
     attachments: [{
       filename: `${invoice.invoice_number}.pdf`,
@@ -371,8 +368,6 @@ async function sendStorno(stornoId, adminId) {
     original_issue_date: originalRow?.issue_date ? formatShortDate(originalRow.issue_date) : '',
     customer_name: customer.display_name || customer.first_name || customer.email.split('@')[0],
     total_amount: formatMajor(Math.abs(storno.total_amount_minor), storno.currency, ctx.locale),
-    // Match the customer's language (as with the ctx.locale-formatted amount).
-    __language: ctx.locale,
     cc: stornoCc,
     attachments: [{
       filename: `${storno.invoice_number}.pdf`,

backend/src/services/photoProcessor.js

@@ -326,11 +326,9 @@ async function queueFilesForProcessing(files, options = {}) {
 
   if (fileList.length === 0) return { uploadId, photos: queued, errors };
 
-  // Counter base — a per-request approximation (concurrent calls can
-  // compute the same base). Uniqueness of the final path comes from the
-  // random suffix inside generatePhotoFilename (#931) — before that
-  // suffix, a counter collision silently overwrote the first photo's
-  // bytes at its already-recorded path.
+  // Counter base — same approximation the upload route used pre-async.
+  // Strict uniqueness is still enforced by the filename template; on a
+  // collision the worker would just fail one photo.
   const existingCount = await db('photos')
     .where({ event_id: eventId, type: photoType })
     .count('id as count')

backend/src/services/picpeakImportService.js

@@ -18,7 +18,6 @@ const fsp = require('fs').promises;
 const path = require('path');
 const os = require('os');
 const StreamZip = require('node-stream-zip');
-const { assertZipEntriesWithin } = require('../utils/safePath');
 const { db } = require('../database/db');
 const knexConfig = require('../../knexfile');
 const { getStoragePath } = require('../config/storage');
@@ -81,85 +80,25 @@ function parseNdjson(filePath) {
 }
 
 // Re-insert the operator's account inside the restore transaction so they keep
-// working credentials after the wipe.
-//
-// The operator's login + credentials + MFA must be restored, not just the
-// password. A crafted backup can carry a row with the operator's email whose
-// two_factor_* fields are attacker-chosen — leaving those in place would let
-// the backup strip or hijack the operator's MFA, or (cross-instance) pin a TOTP
-// secret encrypted with the source instance's key the operator can never
-// satisfy. These columns are scalar/text (recovery codes are a JSON string in a
-// TEXT column), so writing them needs no special json handling. Relationship/
-// audit FKs (role_id, created_by) are deliberately NOT forced from the snapshot
-// — see the update branch below.
-//
-// admin_users has UNIQUE constraints on BOTH email and username, and a restored
-// backup can collide with the operator on either — possibly on two DIFFERENT
-// rows (one shares the email, another shares the default `admin` username). We
-// reconcile WITHOUT deleting any restored row: deleting would fire ON DELETE
-// actions (SQLite) or dangle references such as events.created_by (Postgres,
-// where replica mode suppresses cascades). Instead:
-//   - if a row already has the operator's email, overwrite it in place (its id
-//     is preserved, so every FK pointing at the operator stays valid);
-//   - if a DIFFERENT row holds the operator's username, rename that row (id
-//     preserved, its own FKs stay valid) to free the username;
-//   - only when no row has the operator's email do we insert a fresh row.
+// working credentials. If the backup already loaded an admin with the same
+// email, overwrite that row's credentials with the current account's (current
+// creds win); otherwise insert the snapshot with a fresh id.
 async function reinjectCurrentAdmin(trx, currentAdmin) {
   if (!currentAdmin) return;
-
-  const emailMatch = await trx('admin_users')
-    .whereRaw('lower(email) = lower(?)', [currentAdmin.email])
-    .first();
-
-  // Free the operator's username if a different row holds it (rename, not delete).
-  const usernameHolder = await trx('admin_users')
-    .whereRaw('lower(username) = lower(?)', [currentAdmin.username])
-    .first();
-  if (usernameHolder && (!emailMatch || usernameHolder.id !== emailMatch.id)) {
-    await trx('admin_users')
-      .where({ id: usernameHolder.id })
-      .update({ username: `${usernameHolder.username}__restored_${usernameHolder.id}` });
-  }
-
-  if (emailMatch) {
-    // Update in place — keeps emailMatch.id so restored FKs to the operator
-    // hold. Write only the AUTH-critical columns (login identity + credentials
-    // + MFA), never the relationship/audit FKs (role_id → roles, created_by →
-    // admin_users). Forcing the operator's pre-restore role_id/created_by here
-    // could reference rows absent from a cross-instance backup and dangle the
-    // FK (SQLite rolls back at commit); the row already carries the backup's
-    // own valid values for those. This still closes the MFA-hijack gap — a
-    // crafted backup can't strip or replace the operator's second factor.
-    const authUpdate = {};
-    for (const field of PRESERVED_AUTH_FIELDS) {
-      if (field in currentAdmin) authUpdate[field] = currentAdmin[field];
-    }
-    await trx('admin_users').where({ id: emailMatch.id }).update(authUpdate);
+  const existing = await trx('admin_users').whereRaw('lower(email) = lower(?)', [currentAdmin.email]).first();
+  if (existing) {
+    await trx('admin_users').where({ id: existing.id }).update({
+      password_hash: currentAdmin.password_hash,
+      is_active: currentAdmin.is_active,
+      must_change_password: currentAdmin.must_change_password,
+    });
   } else {
-    // The operator's email isn't in the backup, so nothing restored references
-    // their id — a fresh row can't dangle a reference TO the operator. Null the
-    // self-referential created_by (its target admin may be absent from this
-    // backup; ON DELETE SET NULL makes null the correct "unknown inviter"
-    // value) so the insert itself can't dangle. Use an explicit max(id)+1
-    // rather than the identity sequence, which batchInsert left unadvanced on
-    // Postgres (a sequence-based insert could collide with a restored id).
-    const snapshot = { ...currentAdmin };
-    delete snapshot.id;
-    if ('created_by' in snapshot) snapshot.created_by = null;
-    const maxRow = await trx('admin_users').max({ m: 'id' }).first();
-    snapshot.id = (Number(maxRow && maxRow.m) || 0) + 1;
-    await trx('admin_users').insert(snapshot);
+    const row = { ...currentAdmin };
+    delete row.id; // let the engine assign a fresh id to avoid collision
+    await trx('admin_users').insert(row);
   }
 }
 
-// AUTH-critical admin_users columns preserved when overwriting a restored row
-// that shares the operator's email. Deliberately excludes relationship/audit
-// FKs (role_id, created_by) — see reinjectCurrentAdmin for why.
-const PRESERVED_AUTH_FIELDS = [
-  'username', 'email', 'password_hash', 'is_active', 'must_change_password',
-  'two_factor_enabled', 'two_factor_secret', 'two_factor_recovery_codes', 'two_factor_enrolled_at',
-];
-
 // The json/jsonb columns of a table (Postgres only). The pg driver returns
 // jsonb as parsed JS values, so on re-insert they must be serialised back to
 // valid JSON text — otherwise a scalar like the string "PicPeak" is sent
@@ -293,10 +232,6 @@ async function importFromPicpeak({ picpeakPath, currentAdminId }) {
   try {
     const zip = new StreamZip.async({ file: picpeakPath });
     try {
-      // Reject ZIP-slip entries before extracting — a crafted .picpeak could
-      // otherwise write outside the staging dir via `../` entry names
-      // (same class as GHSA-jfhw-fj23-fx6x).
-      assertZipEntriesWithin(Object.values(await zip.entries()), staging);
       await zip.extract(null, staging);
     } finally {
       await zip.close();
@@ -333,5 +268,4 @@ module.exports = {
   importFromPicpeak,
   readManifestFromZip,
   validateManifest,
-  reinjectCurrentAdmin,
 };

backend/src/services/restoreService.js

@@ -298,10 +298,7 @@ class RestoreService {
         this.log('info', 'Applying post-restore migrations to restored database...');
         this.updateProgress('Applying any post-backup migrations...');
         const backendRoot = path.join(__dirname, '..', '..');
-        // Invoked via node directly — the runtime image ships no npm
-        // (see Dockerfile), and an ENOENT here would be swallowed by the
-        // non-fatal catch below, silently skipping post-restore migrations.
-        const { stderr } = await spawnAsync('node', ['migrations/run-migrations-safe.js'], {
+        const { stderr } = await spawnAsync('npm', ['run', 'migrate:safe'], {
           cwd: backendRoot,
           env: { ...process.env },
         });