screenshots for setup PR (#730/#732)

.env.example

@@ -56,9 +56,8 @@ DB_NAME=picpeak_prod
 # Admin Account (initial setup) — OPTIONAL
 # Leave these unset (default) to create your admin IN THE BROWSER on first run:
 # open /admin and PicPeak shows a setup screen. The one-time setup token is
-# written to data/SETUP_TOKEN with mode 0600 — read it with
-# `docker compose exec backend cat /app/data/SETUP_TOKEN`. It is NOT logged
-# unless that write fails, so it never sits in `docker logs`.
+# printed to the backend logs (`docker compose logs backend | grep -i "setup token"`)
+# and saved to data/SETUP_TOKEN.
 # Set ADMIN_PASSWORD to auto-create the admin on first boot instead (legacy;
 # credentials written to data/ADMIN_CREDENTIALS.txt).
 #ADMIN_USERNAME=admin

.github/workflows/release-please.yml

@@ -25,14 +25,33 @@ jobs:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
-          target-branch: stable
 
-      # NOTE: stable release PRs are intentionally NOT auto-merged here
-      # anymore. Fixes accumulate in the rolling release PR and are cut as
-      # ONE patch version per day by release-stable-daily.yml (18:00 UTC,
-      # or on demand via workflow_dispatch / a manual merge of the release
-      # PR). Beta keeps instant releases — see release-please-beta.yml —
-      # because same-day reporter verification depends on it.
+      # Auto-approve + auto-merge the open stable release PR. See the beta
+      # workflow for the full rationale. Skipped on the release-cutting run and
+      # whenever no PAT is configured.
+      - name: Auto-approve and enable auto-merge on the release PR
+        if: ${{ steps.release.outputs.release_created != 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          # No checkout in this job — set the repo explicitly so gh works
+          # without a git remote (same pattern as whatsnew, 2a5f0a8).
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$RELEASE_PAT" ]; then
+            echo "RELEASE_PLEASE_TOKEN not set — skipping auto-merge (manual review still required)."
+            exit 0
+          fi
+          pr=$(gh pr list --head release-please--branches--stable --state open --json number --jq '.[0].number // empty')
+          if [ -n "$pr" ]; then
+            # Approve as github-actions[bot] (GITHUB_TOKEN, ≠ the PAT author) so it
+            # is a valid review; enable auto-merge as the PAT so the merge commit is
+            # attributed to a real identity and triggers the tag-cutting run (#719).
+            gh pr review "$pr" --approve --body "Automated approval — release-please version bump + changelog (#719)." || true
+            GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto || true
+          else
+            echo "No open release PR to auto-merge."
+          fi
 
       - name: Output Release Info
         if: ${{ steps.release.outputs.release_created }}

.github/workflows/release-stable-daily.yml

@@ -1,86 +0,0 @@
-name: Cut Stable Release (daily batch)
-
-# Stable fixes accumulate in release-please's rolling release PR instead of
-# each cutting its own patch version (the old per-merge auto-merge produced
-# e.g. 3.45.8 AND 3.45.9 on the same day). This workflow merges the open
-# stable release PR once a day, so a day of N bugfixes ships as ONE version
-# with all N changelog entries — and one Docker build instead of N.
-#
-# - schedule only fires from the default branch (main); the stable copy of
-#   this file is inert and exists to keep the branches in sync.
-# - Need a release NOW? Run this via workflow_dispatch, or merge the
-#   release PR by hand — the schedule is a default, not a gate.
-# - Approval/merge mechanics mirror the old inline step (#719): approve as
-#   github-actions[bot] (GITHUB_TOKEN, a valid distinct reviewer), enable
-#   auto-merge as the PAT so the merge attributes to a real identity and
-#   triggers the tag-cutting run. --auto waits for green checks.
-
-on:
-  schedule:
-    - cron: '0 18 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  merge-stable-release-pr:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Approve and enable auto-merge on the open stable release PR
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_PAT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          # No checkout — set the repo explicitly so gh works without a
-          # git remote (same pattern as whatsnew, 2a5f0a8).
-          GH_REPO: ${{ github.repository }}
-        run: |
-          if [ -z "$RELEASE_PAT" ]; then
-            echo "RELEASE_PLEASE_TOKEN not set — skipping (manual review required)."
-            exit 0
-          fi
-          # Strict selection (review P1): this job runs daily even without a
-          # stable push, and `gh pr list --head` matches the branch NAME only
-          # — a fork PR can spoof `release-please--branches--stable`. Pin the
-          # base to stable AND require a same-repo head (isCrossRepository
-          # == false); a fork PR is cross-repository, so it can never be
-          # picked and auto-merged with the privileged PAT.
-          pr=$(gh pr list \
-            --base stable \
-            --head release-please--branches--stable \
-            --state open \
-            --json number,isCrossRepository \
-            --jq '[.[] | select(.isCrossRepository == false)] | .[0].number // empty')
-          if [ -z "$pr" ]; then
-            echo "No open same-repo stable release PR — nothing to cut today."
-            exit 0
-          fi
-          # Approve is tolerant — a pre-existing approval already satisfies
-          # branch protection and re-approving can return non-zero.
-          gh pr review "$pr" --approve --body "Automated approval — daily stable release batch (release-please version bump + changelog)." || echo "::warning::approve returned non-zero (PR may already be approved)"
-          # But the auto-merge enable is the load-bearing step: this scheduled
-          # job is the ONLY automatic stable cut, so DON'T swallow its failure
-          # (review P2) — an expired/under-scoped PAT would otherwise stop
-          # releases while the workflow stays green.
-          GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto
-          # `gh pr merge --auto` merges IMMEDIATELY when the required checks
-          # are already green — the normal case at 18:00, since the fixes
-          # merged hours earlier and CI passed. So success is EITHER the PR is
-          # already merged OR an auto-merge request is now pending; only a PR
-          # that is still open with no auto-merge request is a real failure
-          # (expired/under-scoped PAT) worth failing the job on (review round 2).
-          # One snapshot of both fields (review round 3): querying state and
-          # autoMergeRequest separately races — auto-merge can complete
-          # between the two calls, so the first sees OPEN and the second sees
-          # the request already cleared on the now-merged PR → false failure.
-          read -r state automerge < <(gh pr view "$pr" --json state,autoMergeRequest \
-            --jq '[.state, (.autoMergeRequest != null)] | @tsv')
-          if [ "$state" = "MERGED" ]; then
-            echo "Stable release PR #$pr merged immediately (checks were already green)."
-          elif [ "$automerge" = "true" ]; then
-            echo "Auto-merge enabled on stable release PR #$pr — merges when checks are green."
-          else
-            echo "::error::stable release PR #$pr is still open with no auto-merge — check RELEASE_PLEASE_TOKEN scope/expiry."
-            exit 1
-          fi

.github/workflows/tests.yml

@@ -17,9 +17,9 @@ name: Tests
 
 on:
   push:
-    branches: [main, beta, stable]
+    branches: [main, beta]
   pull_request:
-    branches: [main, beta, stable]
+    branches: [main, beta]
   workflow_dispatch:
 
 permissions:

.release-please-manifest-beta.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.83.0-beta.0"
+  ".": "3.81.0-beta.0"
 }

.release-please-manifest.json

@@ -1 +1,3 @@
-{".":"3.45.15"}
+{
+  ".": "2.6.1"
+}

README.md

@@ -111,15 +111,10 @@ docker compose up -d
 On first start with no `ADMIN_PASSWORD` set, PicPeak has **no admin account yet** and greets you with an in-browser setup screen — no credentials in `.env`:
 
 1. Open **http://localhost:3000/admin** — you'll be redirected to `/setup`.
-2. Read the **one-time setup token** from the 0600 file the backend writes it to
-   (it is deliberately *not* printed to the logs — that would leave a live
-   bootstrap credential in `docker logs`):
+2. Grab the **one-time setup token** from the backend logs (it's also saved to `data/SETUP_TOKEN`):
    ```bash
-   docker compose exec backend cat /app/data/SETUP_TOKEN
+   docker compose logs backend | grep -i "setup token"
    ```
-   It is bind-mounted, so `sudo cat data/SETUP_TOKEN` on the host works too. Only
-   if that file could not be written does the backend fall back to logging the
-   token (`docker compose logs backend | grep -i "setup token"`).
 3. Paste the token, set your admin **email + password**, and you're in. The token is single-use, and the setup screen closes permanently once an admin exists.
 
 > Prefer the old behaviour? Set `ADMIN_PASSWORD` in `.env` and PicPeak auto-creates the admin on first boot instead (credentials written to `data/ADMIN_CREDENTIALS.txt`).

SIMPLE_SETUP.md

@@ -170,12 +170,10 @@ If you installed with `picpeak-setup.sh` and gave an `--admin-password`, your ad
 If you started PicPeak **without** setting `ADMIN_PASSWORD` (e.g. a plain `docker compose up`), there's **no admin yet** and you create it in the browser:
 
 1. Open `http://your-server:3000/admin` — you'll land on a setup screen.
-2. Read the **one-time setup token** from the 0600 file the backend writes it to
-   (it is not logged — that would leave a live credential in `docker logs`):
+2. Get the **one-time setup token** from the backend logs (also saved to `data/SETUP_TOKEN`):
    ```bash
-   docker compose exec backend cat /app/data/SETUP_TOKEN
+   docker compose logs backend | grep -i "setup token"
    ```
-   Only if that write fails does the backend log the token instead.
 3. Paste it, set your admin email + password. The token is single-use and the screen closes once an admin exists.
 
 ## 🌐 Access Methods

backend/Dockerfile

@@ -27,26 +27,17 @@ FROM node:22-alpine
 
 WORKDIR /app
 
-# Redeclare CACHEBUST — ARGs don't cross stage boundaries, so the builder
-# stage's declaration never reached this stage. Consuming it in the RUN below
-# busts that layer's cache every CI run (CACHEBUST=github.run_number), so the
-# image always picks up current Alpine security updates instead of reusing a
-# stale cached upgrade layer.
-ARG CACHEBUST=1
-
 # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
-RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
+RUN apk upgrade --no-cache
 
-# Remove the npm CLI from the final image. Nothing runs npm here: the
-# entrypoint is node, runtime deps are COPY'd from the builder stage, and
-# wait-for-db.sh invokes the migration runners via node directly. npm's
-# bundled node_modules kept tripping Trivy (sigstore, tar 7.5.19,
-# brace-expansion 5.0.7 — even npm 12.0.1 still ships the vulnerable
-# copies), so shipping no npm ends that alert class instead of chasing
-# per-release patches. Note: `docker exec … npm run <script>` no longer
-# works in the container — use `node migrations/run-migrations-safe.js`
-# and friends instead.
-RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# Upgrade the npm CLI in the final image so its bundled deps are patched
+# (sigstore 4.x, tar) — closes CVE-2026-48815 and the older @sigstore/core / tar
+# Trivy alerts. Safe here: only the CLI present in the image changes. Runtime
+# dependencies come from the builder stage (COPY --from=builder node_modules
+# below) and the entrypoint runs node, not npm — so npm 11's install behaviour
+# (the reason 10.x was pinned) never executes in this stage. npm 11 needs
+# Node >=22.9, satisfied by node:22-alpine.
+RUN npm install -g npm@11
 
 # Install dumb-init for proper signal handling, postgresql-client for database
 # checks, ffmpeg for video upload support, and su-exec for the root → nodejs

backend/__tests__/integration/adminBackupCoverage.test.js

@@ -40,7 +40,7 @@ jest.mock('../../src/middleware/permissions', () => ({
   requirePermission: () => (_req, _res, next) => next(),
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('GET /api/admin/system-health/backup-coverage', () => {
   let db;

backend/__tests__/integration/adminBackupIntegrity.test.js

@@ -29,7 +29,7 @@ jest.mock('../../src/middleware/permissions', () => ({
   requirePermission: () => (_req, _res, next) => next(),
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('GET /api/admin/system-health/backup-integrity', () => {
   let cleanup;

backend/__tests__/integration/backupService.configurableWalker.test.js

@@ -23,7 +23,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — configurable walker (backup_paths)', () => {
   let db;
@@ -177,203 +177,4 @@ describe('backupService — configurable walker (backup_paths)', () => {
     const filesOn = await backupService.getFilesToBackup(true);
     expect(filesOn.map((f) => f.relativePath)).toContain('events/archived/E3/legacy.jpg');
   });
-
-  // Issue #871 — the "What to Backup" checkboxes were stored but never read.
-  describe('UI opt-out toggles (issue #871)', () => {
-    it('unchecking Thumbnails excludes thumbnails/', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_thumbnails: false,
-      });
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('events/active/E1/photo.jpg');
-      expect(rels).not.toContain('thumbnails/E1/thumb.jpg');
-    });
-
-    it('unchecking Photos excludes events/active', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_photos: false,
-      });
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('thumbnails/E1/thumb.jpg');
-      expect(rels).not.toContain('events/active/E1/photo.jpg');
-    });
-
-    it('defaults to including everything when the keys were never saved', async () => {
-      seedFile('thumbnails/E1/thumb.jpg');
-      seedFile('events/active/E1/photo.jpg');
-
-      const files = await backupService.getFilesToBackup({});
-      const rels = files.map((f) => f.relativePath);
-
-      expect(rels).toContain('thumbnails/E1/thumb.jpg');
-      expect(rels).toContain('events/active/E1/photo.jpg');
-    });
-
-    it("accepts the UI's plural backup_include_archives for the archived gate", async () => {
-      seedFile('events/archived/E4/archived.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_archives: true,
-      });
-      expect(files.map((f) => f.relativePath)).toContain('events/archived/E4/archived.jpg');
-    });
-
-    it('the UI plural key beats the migration-seeded singular key', async () => {
-      // Migration seeds backup_include_archived=true on every install; the
-      // form only ever writes the plural key, so unchecking Archives must
-      // win over the stale seeded value.
-      seedFile('events/archived/E5/archived.jpg');
-
-      const files = await backupService.getFilesToBackup({
-        backup_include_archived: true,   // seeded default
-        backup_include_archives: false,  // what the admin actually chose
-      });
-      expect(files.map((f) => f.relativePath)).not.toContain('events/archived/E5/archived.jpg');
-    });
-
-    it('rsync gets the de-selected paths and noise filters as --exclude args', async () => {
-      const excluded = await backupService.resolveExcludedBackupPaths({
-        backup_include_thumbnails: false,
-        backup_include_archives: false,
-      });
-      expect(excluded.map((r) => r.path)).toEqual(
-        expect.arrayContaining(['thumbnails', 'events/archived'])
-      );
-
-      const args = backupService.buildRsyncArgs(
-        { backup_rsync_host: 'backup.example.com', backup_rsync_path: '/srv/backups' },
-        excluded.map((r) => `/${r.path}/`)
-      );
-      const excludes = args
-        .map((a, i) => (a === '--exclude' ? args[i + 1] : null))
-        .filter(Boolean);
-      expect(excludes).toEqual(expect.arrayContaining([
-        '.nfs*',
-        '/thumbnails/',
-        '/events/archived/',
-      ]));
-    });
-
-    it('rows toggled off via include_in_default also become rsync excludes', async () => {
-      // The enabled-only loader hides these rows from the walker, but rsync
-      // syncs the whole storage root, so they must still appear as excludes.
-      await db('backup_paths').where('path', 'previews').update({
-        include_in_default: false,
-      });
-
-      const excluded = await backupService.resolveExcludedBackupPaths({});
-      expect(excluded.map((r) => r.path)).toContain('previews');
-    });
-  });
-
-  // Issue #871 — .nfs* silly-rename artifacts were uploaded to S3.
-  it('never backs up filesystem noise (.nfs*, .DS_Store)', async () => {
-    seedFile('thumbnails/E1/.nfs000000000000006600000008');
-    seedFile('events/active/E1/.DS_Store');
-    seedFile('events/active/E1/photo.jpg');
-
-    const files = await backupService.getFilesToBackup({});
-    const rels = files.map((f) => f.relativePath);
-
-    expect(rels).toContain('events/active/E1/photo.jpg');
-    expect(rels.some((r) => r.includes('.nfs'))).toBe(false);
-    expect(rels.some((r) => r.includes('.DS_Store'))).toBe(false);
-  });
-
-  it('the walker honors backup_exclude_patterns (previously rsync-only)', async () => {
-    seedFile('events/active/E1/photo.jpg');
-    seedFile('events/active/E1/scratch.tmp');
-
-    const files = await backupService.getFilesToBackup({
-      backup_exclude_patterns: ['*.tmp'],
-    });
-    const rels = files.map((f) => f.relativePath);
-
-    expect(rels).toContain('events/active/E1/photo.jpg');
-    expect(rels).not.toContain('events/active/E1/scratch.tmp');
-  });
-
-  it('glob patterns are literal outside the star (.nfs* must not eat anfs-…)', async () => {
-    seedFile('events/active/E1/anfs-photo.jpg');
-    seedFile('events/active/E1/notes-tmp');
-
-    const files = await backupService.getFilesToBackup({
-      backup_exclude_patterns: ['*.tmp'],
-    });
-    const rels = files.map((f) => f.relativePath);
-
-    // '.nfs*' used to compile to /^.nfs.*$/ whose dot matched any char;
-    // '*.tmp' used to compile to /^.*.tmp$/ which also matched 'notes-tmp'.
-    expect(rels).toContain('events/active/E1/anfs-photo.jpg');
-    expect(rels).toContain('events/active/E1/notes-tmp');
-  });
-
-  // Issue #871 — weekly schedules silently ran daily, and the dashboard's
-  // "next backup" was a hardcoded "tomorrow 02:00".
-  describe('schedule resolution + next run (issue #871)', () => {
-    it('a named label beats the stray default cron the UI used to send', () => {
-      expect(backupService.resolveScheduleCron({
-        backup_schedule: 'weekly',
-        backup_schedule_cron: '0 3 * * *', // old UI default, sent unconditionally
-      })).toBe('0 3 * * 0');
-    });
-
-    it('custom schedules use the cron field', () => {
-      expect(backupService.resolveScheduleCron({
-        backup_schedule: 'custom',
-        backup_schedule_cron: '15 5 * * 2',
-      })).toBe('15 5 * * 2');
-    });
-
-    it('falls back to the default daily cron', () => {
-      expect(backupService.resolveScheduleCron({})).toBe('0 2 * * *');
-    });
-
-    it('getNextScheduledRun is null when backups are disabled', () => {
-      expect(backupService.getNextScheduledRun(null)).toBeNull();
-      expect(backupService.getNextScheduledRun({ backup_enabled: false })).toBeNull();
-    });
-
-    it('getNextScheduledRun returns the real next weekly fire time', () => {
-      const iso = backupService.getNextScheduledRun({
-        backup_enabled: true,
-        backup_schedule: 'weekly',
-        backup_schedule_cron: '0 3 * * *',
-      });
-      const next = new Date(iso);
-      expect(Number.isNaN(next.getTime())).toBe(false);
-      expect(next.getTime()).toBeGreaterThan(Date.now());
-      expect(next.getDay()).toBe(0);   // Sunday
-      expect(next.getHours()).toBe(3); // 03:00
-    });
-  });
-
-  // Issue #871 — "Backup Size: 167.6 TB": file_size_bytes is a bigInteger
-  // column, node-postgres returns int8 as a string, and the S3 path did
-  // `backedUpSize += size` — string concatenation.
-  it('getDatabaseBackupInfo coerces file_size_bytes to a number', async () => {
-    await db('database_backup_runs').del();
-    await db('database_backup_runs').insert({
-      backup_type: 'full',
-      status: 'completed',
-      file_path: '/backups/db/dump.sql.gz',
-      // Simulate the PG int8-as-string driver behaviour (sqlite stores
-      // whatever it is handed, so the string round-trips).
-      file_size_bytes: '421988',
-      started_at: new Date().toISOString(),
-      completed_at: new Date().toISOString(),
-    });
-
-    const info = await backupService.getDatabaseBackupInfo();
-    expect(typeof info.size).toBe('number');
-    expect(info.size).toBe(421988);
-  });
 });

backend/__tests__/integration/backupService.inlineDbDump.test.js

@@ -34,7 +34,7 @@ jest.mock('../../src/services/databaseBackup', () => ({
   DatabaseBackupService: class {},
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — inline DB dump + fail-loud guard', () => {
   let db;

backend/__tests__/integration/backupService.perPathStats.test.js

@@ -23,7 +23,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — per-Stage-B-path statistics', () => {
   let db;

backend/__tests__/integration/backupService.smoke.test.js

@@ -14,7 +14,7 @@ const path = require('path');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupService — config + file collection + manifest (smoke)', () => {
   let db;

backend/__tests__/integration/bookingCutover.test.js

@@ -7,7 +7,7 @@
 const crypto = require('crypto');
 const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('booking cutover — draft invoices on hold', () => {
   let db; let cleanup; let adminId; let customerId; let quoteService;

backend/__tests__/integration/discountLineItems.test.js

@@ -14,7 +14,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 // Service-level CRM calls cold-require heavy modules (pdfService,
 // nodemailer, etc.) on first use; the global 5 s per-test budget is
 // too tight for that. Bump it for this file only.
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('discount line items (negative unit_price_minor)', () => {
   let db;

backend/__tests__/integration/eventTypeRename.test.js

@@ -6,7 +6,7 @@
 const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
 // bootCrmDb runs the full core-migration set in beforeAll.
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('event type slug rename cascade', () => {
   let db;

backend/__tests__/integration/galleryShortUrlRoute.test.js

@@ -17,7 +17,7 @@ const request = require('supertest');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db; let cleanup; let service; let app;
 

backend/__tests__/integration/galleryShortUrls.test.js

@@ -19,7 +19,7 @@
  */
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db; let cleanup; let service; let adminId;
 

backend/__tests__/integration/incomingInvoiceRebill.test.js

@@ -13,7 +13,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 
 // Service-level CRM calls cold-require heavy modules (pdfService, nodemailer)
 // on first use; bump the budget for this file.
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 describe('incoming-invoice categorise / re-bill chain', () => {
   let db;

backend/__tests__/integration/installFromBackupBoot.test.js

@@ -32,7 +32,7 @@ jest.mock('../../src/services/restoreService', () => ({
   },
 }));
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('installFromBackupBoot', () => {
   let db;

backend/__tests__/integration/invoiceDunning.test.js

@@ -13,7 +13,7 @@ const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;

backend/__tests__/integration/picpeakExport.test.js

@@ -21,7 +21,7 @@ beforeAll(async () => {
   ({ db, cleanup, tmpDir } = await bootCrmDb());
   process.env.STORAGE_PATH = tmpDir; // isolate file collection to the temp dir
   ({ createPicpeak } = require('../../src/services/picpeakExportService'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/picpeakRoundtrip.test.js

@@ -28,7 +28,7 @@ beforeAll(async () => {
   ({ importFromPicpeak, validateManifest } = require('../../src/services/picpeakImportService'));
   const role = await db('roles').where({ name: 'super_admin' }).first();
   superAdminRoleId = role.id;
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/resetAdminMfaCli.test.js

@@ -13,14 +13,14 @@ const { execFileSync } = require('child_process');
 
 const { bootCrmDb } = require('./helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db;
 let cleanup;
 
 beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   if (cleanup) await cleanup();

backend/__tests__/integration/restoreService.pgBranch.test.js

@@ -183,24 +183,22 @@ describe('restoreService — PG branch scope contract (PR #596 review)', () => {
     expect(window).toMatch(/was_successful:\s*true/);
   });
 
-  it('the safe migration runner is invoked after the replay in restore()', () => {
+  it('npm run migrate:safe is invoked after the replay in restore()', () => {
     // Contract from PR #596 round 4: backups taken on older picpeak
     // versions must restore COMPLETELY on a newer image — even if new
     // migrations have been added since the backup was taken. The
-    // restore() flow shells out to the safe migration runner AFTER the
+    // restore() flow shells out to `npm run migrate:safe` AFTER the
     // operator-meta replay so the schema catches up to the running
     // code WITHIN the restore boundary (not on the next container
-    // restart). Invoked as `node migrations/run-migrations-safe.js` —
-    // the runtime image ships no npm, so the former `npm run
-    // migrate:safe` would ENOENT into the non-fatal catch.
+    // restart).
     //
     // Contract:
-    //   1. A run-migrations-safe shell-out exists somewhere in restoreService
+    //   1. A `migrate:safe` shell-out exists somewhere in restoreService
     //   2. It sits AFTER the replay drain — verification → replay →
     //      migrations is the documented order
     //   3. It does NOT sit inside performDatabaseRestore (must run
     //      against the reinit'd pool from the parent restore())
-    const migrateLine = findFirst(/run-migrations-safe\.js/);
+    const migrateLine = findFirst(/['"]migrate:safe['"]/);
     expect(migrateLine).toBeGreaterThan(0);
 
     const replayLine = findLast(/this\.preservedMetaSnapshot\.length\s*>\s*0/);

backend/__tests__/integration/setupService.test.js

@@ -27,7 +27,7 @@ beforeAll(async () => {
   setupService = require('../../src/services/setupService');
   ({ getAppSetting, upsertAppSetting } = require('../../src/utils/appSettings'));
   app = buildRouteApp('/api/setup', require('../../src/routes/setup'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   await cleanup();

backend/__tests__/integration/slideshowPhotoSource.test.js

@@ -1,150 +0,0 @@
-/**
- * Slideshow photo source (#1015).
- *
- * The bug: with `lightbox_preview_enabled` off (the default), /photos emitted
- * `preview_url: null`, so the slideshow's `preview_url || hero_url || url`
- * chain fell through to `hero_url` — a 1920x1080 `fit: 'cover'` centre crop
- * meant for gallery header banners. With the "Black Bars (No crop)" fit the
- * show then letterboxed an already-cropped frame: portrait photos lost their
- * top and bottom and the setting looked broken.
- *
- * The contract pinned here: `slideshow_url` points at the aspect-preserved
- * preview tier and is emitted for image photos REGARDLESS of the lightbox
- * toggle, so the slideshow never has a reason to reach for `hero_url`.
- * `preview_url` itself must stay gated — the lightbox opt-in is unchanged.
- */
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('./helpers/crmDb');
-
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'slideshow-src-test-secret';
-
-const SLUG = 'slideshow-source-event';
-
-describe('Slideshow photo source (#1015)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let imagePhotoId;
-  let videoPhotoId;
-
-  const galleryToken = () => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery' },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-
-  const setLightboxPreview = async (on) => {
-    await db('app_settings').where({ setting_key: 'lightbox_preview_enabled' }).del();
-    await db('app_settings').insert({
-      setting_key: 'lightbox_preview_enabled',
-      setting_value: JSON.stringify(on),
-      setting_type: 'general',
-      updated_at: new Date().toISOString(),
-    });
-  };
-
-  const fetchPhotos = async () => {
-    const res = await request(app)
-      .get(`/api/gallery/${SLUG}/photos`)
-      .set('Authorization', `Bearer ${galleryToken()}`)
-      .expect(200);
-    return res.body.photos;
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Slideshow Source Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'slideshow-source-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const img = await db('photos').insert({
-      event_id: eventId,
-      filename: 'portrait.jpg',
-      path: 'events/slideshow-source/portrait.jpg',
-      type: 'individual',
-      mime_type: 'image/jpeg',
-      uploaded_at: new Date().toISOString(),
-    }).returning('id');
-    imagePhotoId = img[0]?.id ?? img[0];
-
-    const vid = await db('photos').insert({
-      event_id: eventId,
-      filename: 'clip.mp4',
-      path: 'events/slideshow-source/clip.mp4',
-      type: 'individual',
-      media_type: 'video',
-      mime_type: 'video/mp4',
-      uploaded_at: new Date().toISOString(),
-    }).returning('id');
-    videoPhotoId = vid[0]?.id ?? vid[0];
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-  }, 120000);
-
-  afterAll(async () => {
-    if (cleanup) await cleanup();
-  });
-
-  it('emits slideshow_url for image photos even when lightbox previews are OFF', async () => {
-    await setLightboxPreview(false);
-    const photos = await fetchPhotos();
-    const image = photos.find((p) => p.id === imagePhotoId);
-
-    expect(image.slideshow_url).toBe(`/api/gallery/${SLUG}/preview/${imagePhotoId}`);
-    // The regression: this is what used to be null, pushing the show to hero.
-    expect(image.preview_url).toBeNull();
-  });
-
-  it('leaves preview_url gated so the lightbox opt-in is unchanged', async () => {
-    await setLightboxPreview(true);
-    const photos = await fetchPhotos();
-    const image = photos.find((p) => p.id === imagePhotoId);
-
-    expect(image.preview_url).toBe(`/api/gallery/${SLUG}/preview/${imagePhotoId}`);
-    expect(image.slideshow_url).toBe(image.preview_url);
-  });
-
-  it('never points the slideshow at the cover-cropped hero tier', async () => {
-    await setLightboxPreview(false);
-    const photos = await fetchPhotos();
-    const image = photos.find((p) => p.id === imagePhotoId);
-
-    // hero_url still ships (the gallery header uses it) — it just must not be
-    // what the slideshow resolves to.
-    expect(image.hero_url).toBe(`/api/gallery/${SLUG}/hero/${imagePhotoId}`);
-    expect(image.slideshow_url).not.toBe(image.hero_url);
-  });
-
-  it('emits slideshow_url: null for videos, which have no preview tier', async () => {
-    await setLightboxPreview(false);
-    const photos = await fetchPhotos();
-    const video = photos.find((p) => p.id === videoPhotoId);
-
-    expect(video.slideshow_url).toBeNull();
-  });
-});

backend/__tests__/integration/workflowEngine.test.js

@@ -10,7 +10,7 @@ const { bootCrmDb } = require('./helpers/crmDb');
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;
@@ -239,7 +239,7 @@ describe('workflow engine', () => {
     expect(again.already).toBe(true);
   });
 
-  test('seeds the invoice-dunning built-in as the delegation graph (disabled for first beta)', async () => {
+  test('seeds the invoice-dunning built-in as the delegation graph (v6, disabled for first beta)', async () => {
     const { seedBuiltinWorkflowsAtBoot, DUNNING_KEY } = require('../../src/services/_workflowSeedBoot');
     const noopLogger = { info() {}, warn() {} };
     await seedBuiltinWorkflowsAtBoot(db, noopLogger);
@@ -248,7 +248,7 @@ describe('workflow engine', () => {
     expect(wf).toBeTruthy();
     expect(!!wf.is_builtin).toBe(true);
     expect(!!wf.enabled).toBe(false); // first beta: ships disabled; legacy ladder runs until enabled
-    expect(JSON.parse(wf.trigger_config).seedVersion).toBe(7);
+    expect(JSON.parse(wf.trigger_config).seedVersion).toBe(6);
 
     const nodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: wf.version });
     expect(nodes.filter((n) => n.type === 'trigger')).toHaveLength(1);
@@ -273,7 +273,7 @@ describe('workflow engine', () => {
     await seedBuiltinWorkflowsAtBoot(db, noopLogger);
     const reseeded = await db('workflows').where({ id: wf.id }).first();
     expect(reseeded.version).toBe(wf.version + 1); // bumped
-    expect(JSON.parse(reseeded.trigger_config).seedVersion).toBe(7);
+    expect(JSON.parse(reseeded.trigger_config).seedVersion).toBe(6);
     expect(!!reseeded.enabled).toBe(false); // seed default re-applied (not admin-owned → flips enabled→disabled)
     const newNodes = await db('workflow_nodes').where({ workflow_id: wf.id, version: reseeded.version });
     expect(newNodes.some((n) => n.type === 'gate')).toBe(false); // legacy graph replaced

backend/__tests__/integration/workflowRoutes.test.js

@@ -9,7 +9,7 @@ const {
 // bootCrmDb runs the full core-migration set in beforeAll; under full-suite
 // parallel load on a small CI runner that can exceed the 5s default. Match the
 // other migration-heavy CRM suites (discountLineItems, incomingInvoiceRebill).
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 let db;
 let cleanup;

backend/__tests__/middleware/adminAuthRoleFallback.test.js

@@ -1,111 +0,0 @@
-/**
- * The roles-join fallback in adminAuth fabricates `role_name = 'super_admin'`
- * to keep existing sessions working across the RBAC upgrade window. The catch
- * around it used to be unconditional, so ANY transient database failure —
- * connection reset, deadlock, statement timeout, pool exhaustion — took the
- * same branch and handed the caller super_admin for the duration of the fault.
- *
- * `roleName` is the sole discriminator for every ownership check (ownership.js,
- * adminProjects, adminUsers, adminApiTokens, projectService, ...), so that
- * inverted the whole authorization model rather than failing the request.
- * Issue #968. Same treatment apiTokenAuth already got for the v1 surface.
- */
-
-const jwt = require('jsonwebtoken');
-
-jest.mock('../../src/utils/tokenRevocation', () => ({ isTokenRevoked: jest.fn().mockResolvedValue(false) }));
-jest.mock('../../src/utils/logger', () => ({ warn: jest.fn(), error: jest.fn(), debug: jest.fn(), info: jest.fn() }));
-
-// The joined query throws whatever the test stages; the role-less fallback
-// query (no .leftJoin) always succeeds, which is what made the original bug
-// reachable — it is the cheaper single-table read.
-// `mock`-prefixed so jest's module-factory hoisting allows the reference.
-let mockJoinError = null;
-const mockAdminRow = { id: 7, username: 'scoped', email: 's@example.com', password_changed_at: null };
-
-jest.mock('../../src/database/db', () => ({
-  db: () => ({
-    _joined: false,
-    leftJoin() { this._joined = true; return this; },
-    where() { return this; },
-    select() { return this; },
-    first() {
-      if (this._joined && mockJoinError) return Promise.reject(mockJoinError);
-      return Promise.resolve({ ...mockAdminRow });
-    },
-  }),
-}));
-
-const { adminAuth } = require('../../src/middleware/auth');
-
-const SECRET = 'test-secret-for-admin-auth-fallback';
-
-function makeReq() {
-  const token = jwt.sign(
-    { id: mockAdminRow.id, type: 'admin' },
-    SECRET,
-    { algorithm: 'HS256', issuer: 'picpeak-auth' },
-  );
-  return { headers: { authorization: `Bearer ${token}` }, ip: '127.0.0.1', connection: {} };
-}
-
-function makeRes() {
-  return {
-    statusCode: null,
-    body: null,
-    status(code) { this.statusCode = code; return this; },
-    json(payload) { this.body = payload; return this; },
-  };
-}
-
-describe('adminAuth roles-join fallback (#968)', () => {
-  const OLD_SECRET = process.env.JWT_SECRET;
-  beforeAll(() => { process.env.JWT_SECRET = SECRET; });
-  afterAll(() => { process.env.JWT_SECRET = OLD_SECRET; });
-  beforeEach(() => { mockJoinError = null; });
-
-  it('grants the upgrade-window fallback only for a genuinely missing roles table', async () => {
-    mockJoinError = new Error('SQLITE_ERROR: no such table: roles');
-    const req = makeReq();
-    const res = makeRes();
-    const next = jest.fn();
-
-    await adminAuth(req, res, next);
-
-    expect(next).toHaveBeenCalled();
-    expect(req.admin.roleName).toBe('super_admin');
-  });
-
-  it.each([
-    ['connection reset', new Error('Connection terminated unexpectedly')],
-    ['deadlock', new Error('deadlock detected')],
-    ['pool exhaustion', new Error('Knex: Timeout acquiring a connection')],
-    ['statement timeout', new Error('canceling statement due to statement timeout')],
-  ])('does NOT fabricate super_admin on a transient failure (%s)', async (_label, err) => {
-    mockJoinError = err;
-    const req = makeReq();
-    const res = makeRes();
-    const next = jest.fn();
-
-    await adminAuth(req, res, next);
-
-    // Fails closed: request rejected, req.admin never populated. The specific
-    // status is 401 (adminAuth's blanket outer catch) — what matters is that
-    // the caller is not elevated and does not reach the route.
-    expect(next).not.toHaveBeenCalled();
-    expect(req.admin).toBeUndefined();
-    expect(res.statusCode).toBe(401);
-  });
-
-  it('does NOT fabricate super_admin when an unrelated table is missing', async () => {
-    mockJoinError = new Error('SQLITE_ERROR: no such table: admin_sessions');
-    const req = makeReq();
-    const res = makeRes();
-    const next = jest.fn();
-
-    await adminAuth(req, res, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(req.admin).toBeUndefined();
-  });
-});

backend/__tests__/middleware/apiTokenRoleFallback.test.js

@@ -1,72 +0,0 @@
-/**
- * The roles-join fallback in apiTokenAuth grants `super_admin` (upgrade-path
- * parity with adminAuth). It must therefore fire ONLY when the roles schema is
- * genuinely absent — a catch-all turns any transient database failure into a
- * privilege escalation that reopens GHSA-9697 for a demoted token owner.
- */
-
-const { isMissingRolesSchema } = require('../../src/middleware/apiTokenAuth');
-
-describe('apiTokenAuth roles-schema fallback predicate (GHSA-9697)', () => {
-  it('accepts a genuinely missing roles table on both engines', () => {
-    expect(isMissingRolesSchema(new Error('SQLITE_ERROR: no such table: roles'))).toBe(true);
-    expect(isMissingRolesSchema(
-      Object.assign(new Error('relation "roles" does not exist'), { code: '42P01' }),
-    )).toBe(true);
-    expect(isMissingRolesSchema(
-      Object.assign(new Error('column roles.name does not exist'), { code: '42703' }),
-    )).toBe(true);
-  });
-
-  it('rejects transient failures that must not elevate the caller', () => {
-    expect(isMissingRolesSchema(new Error('Connection terminated unexpectedly'))).toBe(false);
-    expect(isMissingRolesSchema(new Error('deadlock detected'))).toBe(false);
-    expect(isMissingRolesSchema(new Error('Knex: Timeout acquiring a connection'))).toBe(false);
-    expect(isMissingRolesSchema(new Error('canceling statement due to statement timeout'))).toBe(false);
-    expect(isMissingRolesSchema(undefined)).toBe(false);
-  });
-
-  it('rejects a missing-table error for an unrelated table', () => {
-    expect(isMissingRolesSchema(new Error('SQLITE_ERROR: no such table: api_tokens'))).toBe(false);
-  });
-
-  // knex prefixes the failing SQL to err.message, and that SQL always names
-  // `roles` on this join — so the message substring proves nothing about the
-  // error, and only an exact driver phrase (or a SQLSTATE) may be trusted.
-  // These are real knex message shapes, captured from the actual query.
-  describe('with knex\'s SQL prefix on the message (#968)', () => {
-    const withSql = (driverMessage) => new Error(
-      'select `roles`.`name` as `role_name` from `admin_users` '
-      + 'left join `roles` on `roles`.`id` = `admin_users`.`role_id` '
-      + `where \`admin_users\`.\`id\` = 1 limit 1 - ${driverMessage}`,
-    );
-
-    it('accepts both legitimate upgrade-window states', () => {
-      // pre-054: the roles table does not exist yet
-      expect(isMissingRolesSchema(
-        Object.assign(withSql('SQLITE_ERROR: no such table: roles'), { code: 'SQLITE_ERROR' }),
-      )).toBe(true);
-      // post-054, pre-057: roles exists, admin_users.role_id not added yet
-      expect(isMissingRolesSchema(
-        Object.assign(withSql('SQLITE_ERROR: no such column: admin_users.role_id'), { code: 'SQLITE_ERROR' }),
-      )).toBe(true);
-    });
-
-    it('rejects an unrelated "does not exist" fault despite the SQL naming roles', () => {
-      // pgbouncer transaction pooling loses a named prepared statement
-      // (SQLSTATE 26000). Transient — the fallback query would succeed on a
-      // fresh connection, so accepting this would fabricate super_admin.
-      expect(isMissingRolesSchema(
-        Object.assign(withSql('prepared statement "S_1" does not exist'), { code: '26000' }),
-      )).toBe(false);
-      // The DB role/user, not the roles table.
-      expect(isMissingRolesSchema(
-        Object.assign(withSql('role "picpeak" does not exist'), { code: '28000' }),
-      )).toBe(false);
-      expect(isMissingRolesSchema(
-        Object.assign(withSql('database "picpeak" does not exist'), { code: '3D000' }),
-      )).toBe(false);
-      expect(isMissingRolesSchema(withSql('Connection terminated unexpectedly'))).toBe(false);
-    });
-  });
-});

backend/__tests__/migrations/167_projects_created_by.test.js

@@ -1,35 +0,0 @@
-/**
- * Migration 167 (projects.created_by) — idempotent on re-run, reversible,
- * and backfills the owner from a project's single linked event (GHSA-wrg5).
- */
-const path=require('path'), fs=require('fs'), os=require('os');
-process.env.NODE_ENV='test';
-process.env.TEST_DATABASE_PATH=path.join(fs.mkdtempSync(path.join(os.tmpdir(),'picpeak-mig167-')),'db.sqlite');
-process.env.JWT_SECRET='mig';
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-const mig = require('../../migrations/core/167_add_projects_created_by');
-describe('migration 167', () => {
-  let db, cleanup;
-  beforeAll(async()=>{ ({db,cleanup}=await bootCrmDb()); await seedMinimal(db); },120000);
-  afterAll(async()=>{ if(cleanup) await cleanup(); });
-  it('is idempotent on re-run and reversible', async () => {
-    await mig.up(db);            // already applied by boot; must no-op
-    await mig.up(db);            // and again
-    expect(await db.schema.hasColumn('projects','created_by')).toBe(true);
-    await mig.down(db);
-    expect(await db.schema.hasColumn('projects','created_by')).toBe(false);
-    await mig.up(db);            // re-apply cleanly
-    expect(await db.schema.hasColumn('projects','created_by')).toBe(true);
-  });
-  it('backfills created_by from a single linked event owner', async () => {
-    const p = await db('projects').insert({name:'bf',status:'active',created_at:new Date(),updated_at:new Date()}).returning('id');
-    const pid = p[0]?.id ?? p[0];
-    await db('events').insert({slug:'bf-ev',event_type:'wedding',event_name:'bf',event_date:'2026-08-01',
-      host_email:'h@e.com',admin_email:'a@e.com',password_hash:'x',share_token:'t1',share_link:'/g/bf-ev/t1',
-      created_by: 4242, project_id: pid, expires_at:new Date(Date.now()+864e5).toISOString(),
-      is_active:1,is_archived:0,is_draft:0,created_at:new Date().toISOString()});
-    await mig.up(db);
-    const row = await db('projects').where({id:pid}).first();
-    expect(row.created_by).toBe(4242);
-  });
-});

backend/__tests__/migrations/168_fix_expense_activity_event_id.test.js

@@ -1,83 +0,0 @@
-/**
- * GHSA-jhcf round 3: scoping the activity feed does nothing about the rows
- * already on disk. expenseService used to pass adminId into logActivity's
- * `eventId` slot, so upgraded instances carry accounting rows whose event_id
- * is an ADMIN id — and the scope predicate happily matches those against a
- * same-numbered event the caller owns.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-mig168-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'mig168-test-secret';
-
-const { bootCrmDb } = require('../integration/helpers/crmDb');
-const migration = require('../../migrations/core/168_fix_expense_activity_event_id');
-
-describe('migration 168 — legacy accounting activity rows (GHSA-jhcf)', () => {
-  let db; let cleanup;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('re-attributes the admin id and clears event_id, leaving real rows alone', async () => {
-    await db('activity_logs').insert([
-      // Legacy shape: event_id is really admin #7, no actor recorded.
-      {
-        activity_type: 'expense_created',
-        actor_type: 'system',
-        actor_id: null,
-        event_id: 7,
-        metadata: JSON.stringify({ expenseId: 1 }),
-        created_at: new Date().toISOString(),
-      },
-      {
-        activity_type: 'incoming_invoice_captured',
-        actor_type: 'system',
-        actor_id: null,
-        event_id: 9,
-        metadata: JSON.stringify({ inboundDocumentId: 2 }),
-        created_at: new Date().toISOString(),
-      },
-      // A genuine event-scoped row from another subsystem must survive intact.
-      {
-        activity_type: 'photo_uploaded',
-        actor_type: 'admin',
-        actor_id: 3,
-        event_id: 7,
-        metadata: JSON.stringify({}),
-        created_at: new Date().toISOString(),
-      },
-    ]);
-
-    await migration.up(db);
-
-    const expense = await db('activity_logs').where({ activity_type: 'expense_created' }).first();
-    expect(expense.event_id == null).toBe(true);
-    expect(Number(expense.actor_id)).toBe(7);
-    expect(expense.actor_type).toBe('admin');
-
-    const captured = await db('activity_logs').where({ activity_type: 'incoming_invoice_captured' }).first();
-    expect(captured.event_id == null).toBe(true);
-    expect(Number(captured.actor_id)).toBe(9);
-
-    const photo = await db('activity_logs').where({ activity_type: 'photo_uploaded' }).first();
-    expect(Number(photo.event_id)).toBe(7);
-    expect(Number(photo.actor_id)).toBe(3);
-  });
-
-  it('is idempotent on re-run', async () => {
-    await expect(migration.up(db)).resolves.toBeUndefined();
-    const expense = await db('activity_logs').where({ activity_type: 'expense_created' }).first();
-    expect(Number(expense.actor_id)).toBe(7);
-    expect(expense.event_id == null).toBe(true);
-  });
-});

backend/__tests__/routes/adminCrmAuth.test.js

@@ -83,7 +83,7 @@ describe('admin CRM routes — auth + permission gate', () => {
     // Invalid: signed with a different secret. adminAuth must reject.
     const jwt = require('jsonwebtoken');
     invalidToken = jwt.sign({ id: adminId, type: 'admin' }, 'WRONG-SECRET', { issuer: 'picpeak-auth' });
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/adminEvents.smoke.test.js

@@ -180,27 +180,6 @@ describe('admin events CRUD endpoints (smoke)', () => {
       });
       expect(res.status).toBe(404);
     });
-
-    // #822 — hero_logo_visible/position are nullable (null = "inherit the global
-    // branding toggle"), but the validator used .optional() without
-    // { nullable: true }, so an explicit null was rejected with 400.
-    it('accepts hero_logo_visible: null and stores NULL (inherit)', async () => {
-      const id = await insertEvent(db, adminId, { hero_logo_visible: 1 });
-      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
-        hero_logo_visible: null,
-      });
-      expect(res.status).toBe(200);
-      const row = await db('events').where({ id }).first();
-      expect(row.hero_logo_visible).toBeNull();
-    });
-
-    it('still rejects a non-boolean hero_logo_visible', async () => {
-      const id = await insertEvent(db, adminId);
-      const res = await auth(request(app).put(`/api/admin/events/${id}`)).send({
-        hero_logo_visible: 'maybe',
-      });
-      expect(res.status).toBe(400);
-    });
   });
 
   describe('DELETE /:id', () => {

backend/__tests__/routes/adminMfa.test.js

@@ -39,7 +39,7 @@ const {
   bootCrmDb, mintAdminToken, buildRouteApp,
 } = require('../integration/helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(60000);
 
 let db;
 let cleanup;
@@ -95,7 +95,7 @@ beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
   adminApp = buildRouteApp('/api/admin/auth', require('../../src/routes/adminAuth'));
   authApp = buildRouteApp('/api/auth', require('../../src/routes/auth'));
-}, 120000);
+}, 60000);
 
 afterAll(async () => {
   if (cleanup) await cleanup();

backend/__tests__/routes/adminPhotoContentType.test.js

@@ -1,238 +0,0 @@
-/**
- * Admin photo view route Content-Type (#908).
- *
- * The route built `image/<ext>` from the filename, producing invalid
- * types like image/mp4 for videos. AdminAuthenticatedVideo fetches this
- * URL into a blob whose type inherits the header, and browsers refuse to
- * play a <video> blob labeled image/* — blank/grey admin video preview.
- *
- * Pins (incl. external-review hardening):
- *  - the header is ALWAYS image/* or video/*: a stored non-media MIME
- *    (chunked uploads store the client-sent type unvalidated) is never
- *    echoed — text/html inline under the app origin would be XSS
- *  - stored video/ MIME wins; MIME-less videos map from the extension
- *    (.mov → video/quicktime), unknown video extensions get video/mp4
- *  - images IGNORE the stored MIME (migration 039 backfilled image/jpeg
- *    onto every legacy row, PNGs included) and use the extension,
- *    normalized (jpg → image/jpeg); extensionless files get image/jpeg
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'admin-ct-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-admin-ct-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'admin-ct-test-event';
-
-describe('admin photo view Content-Type (#908)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let adminToken;
-
-  const addPhoto = async (filename, extra = {}) => {
-    const dir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, filename), Buffer.from(`bytes-${filename}`));
-    const r = await db('photos').insert({
-      event_id: eventId,
-      filename,
-      path: `${SLUG}/${filename}`,
-      type: 'individual',
-      uploaded_at: new Date().toISOString(),
-      ...extra,
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const getPhotoRes = (photoId) => request(app)
-    .get(`/api/admin/photos/${eventId}/photo/${photoId}`)
-    .set('Authorization', `Bearer ${adminToken}`);
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Admin CT Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'admin-ct-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const superRole = await db('roles').where({ name: 'super_admin' }).first();
-    const [rootId] = await db('admin_users').insert({
-      username: 'admin-ct-admin',
-      email: 'admin-ct-admin@example.com',
-      password_hash: await bcrypt.hash('AdminCt123', 4),
-      role_id: superRole.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id').then((r) => [r[0]?.id || r[0]]);
-    adminToken = jwt.sign(
-      { id: rootId, username: 'admin-ct-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' }
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('serves a video with its stored mime_type, not image/<ext>', async () => {
-    const id = await addPhoto('clip.mp4', { media_type: 'video', mime_type: 'video/mp4' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('maps MIME-less videos from their extension (.mov → video/quicktime)', async () => {
-    const id = await addPhoto('clip-nomime.mov', { media_type: 'video' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/quicktime');
-  });
-
-  it('falls back to video/mp4 for a video with an unknown extension', async () => {
-    const id = await addPhoto('clip-unknown.xyz', { media_type: 'video' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('rejects malformed video/ MIME values that would break setHeader', async () => {
-    // Header-invalid chars in the stored value must not 500 the route —
-    // fall back to the extension map instead.
-    const id = await addPhoto('crlf.mp4', {
-      media_type: 'video',
-      mime_type: 'video/mp4\r\nX-Evil: 1',
-    });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('video/mp4');
-    expect(res.headers['x-evil']).toBeUndefined();
-
-    const bare = await addPhoto('bare.webm', { media_type: 'video', mime_type: 'video/' });
-    const res2 = await getPhotoRes(bare);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('video/webm');
-  });
-
-  it('preserves an auto-imported avif via the safe stored-MIME allowlist', async () => {
-    // .avif isn't in EXTENSION_TO_MIME; s3AutoImporter stores image/avif.
-    // Map-only would mislabel it image/jpeg — the allowlist keeps it.
-    const id = await addPhoto('imported.avif', { mime_type: 'image/avif' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/avif');
-  });
-
-  it('preserves other importer raster types too (apng, x-icon)', async () => {
-    const apng = await addPhoto('anim.apng', { mime_type: 'image/apng' });
-    expect((await getPhotoRes(apng)).headers['content-type']).toBe('image/apng');
-    const ico = await addPhoto('fav.ico', { mime_type: 'image/x-icon' });
-    expect((await getPhotoRes(ico)).headers['content-type']).toBe('image/x-icon');
-  });
-
-  it('does NOT honor a stored scriptable image type (image/svg+xml)', async () => {
-    // svg is inline-scriptable and must never be echoed — allowlist excludes it.
-    const id = await addPhoto('vector.svg', { mime_type: 'image/svg+xml' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('never echoes a stored non-media MIME type (inline XSS guard)', async () => {
-    const id = await addPhoto('evil.png', { mime_type: 'text/html' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('ignores the migration-039 image/jpeg backfill on legacy PNG rows', async () => {
-    const id = await addPhoto('legacy.png', { mime_type: 'image/jpeg' });
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('normalizes jpg to the canonical image/jpeg', async () => {
-    const id = await addPhoto('shot.jpg');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('keeps the extension fallback for images without a stored mime_type', async () => {
-    const id = await addPhoto('shot.png');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/png');
-  });
-
-  it('handles Object.prototype key extensions without a 500 (.constructor)', async () => {
-    // The extension-to-MIME lookup must be own-property only — a raw
-    // index access returns an inherited function for these keys and the
-    // downstream startsWith throws. Serve image/jpeg instead of 500.
-    const id = await addPhoto('payload.constructor');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-
-    const id2 = await addPhoto('payload.__proto__', { media_type: 'video' });
-    const res2 = await getPhotoRes(id2);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('video/mp4');
-  });
-
-  it('does not synthesize types from unmapped image extensions', async () => {
-    // Raw interpolation would produce image/svg+xml (scriptable inline)
-    // or arbitrary strings from client-controlled filenames — the shared
-    // map is the allowlist, everything else is served as image/jpeg.
-    const svg = await addPhoto('vector.svg+xml');
-    const res = await getPhotoRes(svg);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-
-    const weird = await addPhoto('weird.xyz');
-    const res2 = await getPhotoRes(weird);
-    expect(res2.status).toBe(200);
-    expect(res2.headers['content-type']).toBe('image/jpeg');
-  });
-
-  it('extensionless files get image/jpeg, never a bare image/', async () => {
-    const id = await addPhoto('noext');
-    const res = await getPhotoRes(id);
-    expect(res.status).toBe(200);
-    expect(res.headers['content-type']).toBe('image/jpeg');
-  });
-});

backend/__tests__/routes/authShareLoginPassword.test.js

@@ -1,127 +0,0 @@
-/**
- * Regression test for GHSA-9hmx-68vc-qpqw — share-link login must not bypass
- * the gallery password.
- *
- * POST /auth/gallery/share-login validates only the share token. For a
- * password-protected gallery it previously minted a full `type:'gallery'`
- * access token on the share token alone, letting anyone holding the share URL
- * read the gallery without the password. The fix: when the gallery requires a
- * password, return `{ requires_password: true }` with NO token and NO cookie.
- */
-
-const express = require('express');
-const request = require('supertest');
-
-process.env.JWT_SECRET = 'share-login-test-secret';
-
-const events = [];
-
-jest.mock('../../src/database/db', () => {
-  function dbFn(table) {
-    if (table === 'events') {
-      let filter = () => true;
-      return {
-        where(criteria) {
-          filter = (row) => Object.entries(criteria).every(([k, v]) => {
-            if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
-            if (k === 'is_archived') return Boolean(row.is_archived) === Boolean(v);
-            return row[k] === v;
-          });
-          return this;
-        },
-        async first() { return events.find(filter); },
-      };
-    }
-    return { where() { return this; }, async first() { return undefined; } };
-  }
-  dbFn.raw = async () => {};
-  return { db: dbFn, logActivity: async () => {} };
-});
-
-// Share token is stored plainly on the fake event row.
-jest.mock('../../src/services/shareLinkService', () => ({
-  getEventShareToken: (event) => event.share_token,
-  resolveShareIdentifier: async () => ({ event: null }),
-}));
-
-const mockSetGalleryAuthCookies = jest.fn();
-jest.mock('../../src/utils/tokenUtils', () => ({
-  setGalleryAuthCookies: (...args) => mockSetGalleryAuthCookies(...args),
-  clearGalleryAuthCookies: jest.fn(),
-  getGalleryTokenFromRequest: jest.fn(),
-  setAdminAuthCookies: jest.fn(),
-}));
-
-jest.mock('../../src/utils/authSecurity', () => ({
-  trackFailedAttempt: jest.fn(async () => {}),
-  trackSuccessfulLogin: jest.fn(async () => {}),
-  checkAccountLockout: jest.fn(async () => ({ isLocked: false })),
-  resetLockout: jest.fn(async () => {}),
-}));
-
-// Collaborators the router imports at load but the share-login path doesn't hit.
-jest.mock('../../src/services/recaptcha', () => ({ verifyRecaptcha: async () => true }));
-jest.mock('../../src/services/mfaService', () => ({}));
-jest.mock('../../src/middleware/sessionTimeout', () => ({ endSession: jest.fn(), sessionTimeoutMiddleware: (req, res, next) => next() }));
-jest.mock('../../src/utils/tokenRevocation', () => ({ revokeToken: jest.fn(async () => {}), isTokenRevoked: async () => false }));
-
-const authRouter = require('../../src/routes/auth');
-
-function makeApp() {
-  const app = express();
-  app.use(express.json());
-  app.use('/auth', authRouter);
-  return app;
-}
-
-const SHARE_TOKEN = 'a'.repeat(64);
-
-beforeEach(() => {
-  events.length = 0;
-  mockSetGalleryAuthCookies.mockClear();
-});
-
-describe('POST /auth/gallery/share-login password enforcement', () => {
-  it('does NOT mint a token for a password-protected gallery', async () => {
-    events.push({
-      id: 1, slug: 'private-gallery', is_active: 1, is_archived: 0,
-      require_password: 1, share_token: SHARE_TOKEN, event_name: 'Private',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'private-gallery', token: SHARE_TOKEN });
-
-    expect(res.status).toBe(200);
-    expect(res.body.requires_password).toBe(true);
-    expect(res.body.token).toBeUndefined();
-    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
-  });
-
-  it('mints a token for a public (no-password) gallery', async () => {
-    events.push({
-      id: 2, slug: 'public-gallery', is_active: 1, is_archived: 0,
-      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'public-gallery', token: SHARE_TOKEN });
-
-    expect(res.status).toBe(200);
-    expect(typeof res.body.token).toBe('string');
-    expect(res.body.event).toBeDefined();
-    expect(mockSetGalleryAuthCookies).toHaveBeenCalledTimes(1);
-  });
-
-  it('rejects a wrong share token regardless of password setting', async () => {
-    events.push({
-      id: 3, slug: 'public-gallery', is_active: 1, is_archived: 0,
-      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
-    });
-    const res = await request(makeApp())
-      .post('/auth/gallery/share-login')
-      .send({ slug: 'public-gallery', token: 'b'.repeat(64) });
-
-    expect(res.status).toBe(401);
-    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
-  });
-});

backend/__tests__/routes/authzPermissionGaps.test.js

@@ -1,211 +0,0 @@
-/**
- * Authorization / ownership gaps (GHSA permission cluster):
- *  - jm7j: API-token list must scope to the caller (non-super sees only own)
- *  - gprq: API-token revoke must be owner-or-super_admin
- *  - 3rqx: event update must not mass-assign identity/secret columns
- *  - j2f4: category hero must belong to that category
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'authz-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-authz-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const bcrypt = require('bcrypt');
-const {
-  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken,
-} = require('../integration/helpers/crmDb');
-
-describe('authorization / ownership gaps', () => {
-  let db; let cleanup; let app;
-  let superId; let superTok; let adminId; let adminTok;
-
-  const grantPermissionToRole = async (roleName, permName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const perm = await db('permissions').where({ name: permName }).first();
-    const exists = await db('role_permissions')
-      .where({ role_id: role.id, permission_id: perm.id }).first();
-    if (!exists) {
-      await db('role_permissions').insert({ role_id: role.id, permission_id: perm.id });
-    }
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    ({ adminId: superId } = await seedMinimal(db));
-    await assignAdminRole(db, superId, 'super_admin');
-    superTok = mintAdminToken(superId);
-
-    const pass = await bcrypt.hash('x', 4);
-    const ins = await db('admin_users').insert({
-      username: 'plain-admin', email: 'plain@example.com',
-      password_hash: pass, must_change_password: false, created_at: new Date(),
-    }).returning('id');
-    adminId = ins[0]?.id ?? ins[0];
-    await assignAdminRole(db, adminId, 'admin');
-    // Grant settings.edit to the admin role BEFORE any request populates the
-    // 60s permission cache, so the revoke test exercises the ownership check
-    // (404) rather than the missing-permission gate (403). This models a
-    // custom role that carries settings.edit — the scenario GHSA-gprq needs.
-    await grantPermissionToRole('admin', 'settings.edit');
-    adminTok = mintAdminToken(adminId);
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/admin/api-tokens', require('../../src/routes/adminApiTokens'));
-    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-    app.use('/api/admin/categories', require('../../src/routes/adminCategories'));
-    // eslint-disable-next-line no-unused-vars
-    app.use((err, req, res, next) => {
-      res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
-    });
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  const auth = (req, tok) => req.set('Authorization', `Bearer ${tok}`);
-
-  describe('API tokens (jm7j / gprq)', () => {
-    let superTokenId;
-
-    beforeAll(async () => {
-      const res = await auth(request(app).post('/api/admin/api-tokens'), superTok)
-        .send({ name: 'super-token', scopes: ['read'] });
-      expect(res.status).toBe(201);
-      superTokenId = res.body.id;
-    });
-
-    it('non-super admin does not see another admin\'s tokens in the list', async () => {
-      const res = await auth(request(app).get('/api/admin/api-tokens'), adminTok);
-      expect(res.status).toBe(200);
-      expect(res.body.find((t) => t.id === superTokenId)).toBeUndefined();
-    });
-
-    it('super_admin sees all tokens', async () => {
-      const res = await auth(request(app).get('/api/admin/api-tokens'), superTok);
-      expect(res.status).toBe(200);
-      expect(res.body.find((t) => t.id === superTokenId)).toBeDefined();
-    });
-
-    it('a non-owner (with settings.edit) cannot revoke another admin\'s token', async () => {
-      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), adminTok);
-      expect(res.status).toBe(404);
-      const row = await db('api_tokens').where({ id: superTokenId }).first();
-      expect(row.revoked_at).toBeFalsy();
-    });
-
-    it('the owner can revoke their own token', async () => {
-      const res = await auth(request(app).delete(`/api/admin/api-tokens/${superTokenId}`), superTok);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('event update mass-assignment (3rqx)', () => {
-    it('ignores identity/secret columns in the request body', async () => {
-      const seedShareToken = 'orig-share-token';
-      const ins = await db('events').insert({
-        slug: 'authz-mass-assign', event_type: 'wedding', event_name: 'Before',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'orig-hash', share_link: '/gallery/authz/share', share_token: seedShareToken, expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const eventId = ins[0]?.id ?? ins[0];
-
-      const res = await auth(request(app).put(`/api/admin/events/${eventId}`), superTok).send({
-        event_name: 'After',
-        created_by: 99999,
-        slug: 'hijacked-slug',
-        share_token: 'hijacked-token',
-        password_hash: 'hijacked-hash',
-        is_archived: 1,
-        archive_path: '/hijacked/archive/path',
-        hero_logo_path: '/etc/passwd',
-        is_draft: 1,
-        project_id: 99999,
-        // Case-variant keys — SQLite matches columns case-insensitively.
-        Password_Hash: 'case-hijack-hash',
-        Created_By: 88888,
-      });
-      expect(res.status).toBe(200);
-
-      const row = await db('events').where({ id: eventId }).first();
-      expect(row.event_name).toBe('After');        // legit field applied
-      expect(row.created_by).toBe(superId);         // ownership untouched (+ case-variant)
-      expect(row.slug).toBe('authz-mass-assign');   // routing identity untouched
-      expect(row.share_token).toBe(seedShareToken); // secret untouched
-      expect(row.password_hash).toBe('orig-hash');  // secret untouched (+ case-variant)
-      expect(row.is_archived).toBeFalsy();          // archive lifecycle untouched
-      expect(row.archive_path).toBeFalsy();         // forged archive path rejected
-      expect(row.hero_logo_path).toBeFalsy();       // fs.unlink primitive blocked
-      expect(row.is_draft).toBeFalsy();             // publish workflow not bypassed
-      expect(row.project_id).toBeFalsy();           // server-managed relationship untouched
-    });
-
-    it('returns 200 (no-op) when the body contains only protected fields', async () => {
-      const ins = await db('events').insert({
-        slug: 'authz-empty-update', event_type: 'wedding', event_name: 'Keep',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'x', share_link: '/gallery/authz-empty/share', share_token: 'authz-empty-share',
-        expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const id = ins[0]?.id ?? ins[0];
-      // Body reduces to {} after the denylist — must not 500 (Knex rejects
-      // .update({})).
-      const res = await auth(request(app).put(`/api/admin/events/${id}`), superTok)
-        .send({ created_by: 1, slug: 'x', is_archived: 1 });
-      expect(res.status).toBe(200);
-      const row = await db('events').where({ id }).first();
-      expect(row.event_name).toBe('Keep');
-    });
-  });
-
-  describe('category hero cross-category (j2f4)', () => {
-    it('rejects a hero photo that is not in the category', async () => {
-      const evIns = await db('events').insert({
-        slug: 'authz-cat', event_type: 'wedding', event_name: 'Cat Event',
-        event_date: '2026-08-01', host_email: 'h@example.com', admin_email: 'a@example.com',
-        password_hash: 'x', share_link: '/gallery/authz-cat/share', share_token: 'authz-cat-share', expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-        is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const evId = evIns[0]?.id ?? evIns[0];
-
-      const mkCat = async (name) => {
-        const c = await db('photo_categories').insert({
-          event_id: evId, name, slug: name.toLowerCase(), created_at: new Date().toISOString(),
-        }).returning('id');
-        return c[0]?.id ?? c[0];
-      };
-      const cat1 = await mkCat('Cat1');
-      const cat2 = await mkCat('Cat2');
-
-      const pIns = await db('photos').insert({
-        event_id: evId, filename: 'p.jpg', path: 'authz-cat/p.jpg', type: 'individual',
-        category_id: cat1, uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      const photoInCat1 = pIns[0]?.id ?? pIns[0];
-
-      // Pointing cat2's hero at a photo that lives in cat1 must be refused.
-      const bad = await auth(request(app).put(`/api/admin/categories/${cat2}/hero`), superTok)
-        .send({ hero_photo_id: photoInCat1 });
-      expect(bad.status).toBe(404);
-
-      // The photo's own category accepts it.
-      const ok = await auth(request(app).put(`/api/admin/categories/${cat1}/hero`), superTok)
-        .send({ hero_photo_id: photoInCat1 });
-      expect(ok.status).toBe(200);
-    });
-  });
-});

backend/__tests__/routes/backupExportSuperadmin.test.js

@@ -1,95 +0,0 @@
-/**
- * Full-instance export is super_admin only (GHSA-pv6w-rj34-wj9v).
- *
- * GET /api/admin/backup/picpeak/export dumps every table unredacted (bcrypt
- * hashes, 2FA, SMTP/SSO/WhatsApp/webhook/S3 secrets). It was gated only by
- * requirePermission('backup.create'), which the built-in `admin` role holds —
- * so any non-super_admin admin could download the whole database. Pins that
- * `admin` now gets 403 and `super_admin` passes the gate.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-bkexport-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'bkexport-test-secret';
-
-// The export otherwise walks the whole DB and writes a zip — stub it so the
-// super_admin happy path is fast and deterministic; the gate is what's tested.
-// The route deletes path.dirname(filePath) recursively after download, so the
-// stub MUST live in its own dir — a bare os.tmpdir() file would make the route
-// wipe the whole temp root (and other jest workers' DB files).
-const mockExportDir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-export-stub-'));
-const mockExportPath = path.join(mockExportDir, 'export.picpeak');
-fs.writeFileSync(mockExportPath, 'stub');
-jest.mock('../../src/services/picpeakExportService', () => ({
-  createPicpeak: jest.fn(async () => ({ filePath: mockExportPath })),
-}));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('backup export super_admin gate (GHSA-pv6w)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let adminToken; let superToken;
-
-  const mkUser = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username,
-      email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    return jwt.sign(
-      { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' },
-    );
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    adminToken = await mkUser('limited-admin', 'admin');
-    superToken = await mkUser('root-admin', 'super_admin');
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/backup', require('../../src/routes/adminBackup'));
-  }, 120000);
-
-  afterAll(async () => {
-    if (cleanup) await cleanup();
-    fs.rmSync(mockExportDir, { recursive: true, force: true });
-  });
-
-  it('denies the built-in admin role (was: full DB dump)', async () => {
-    const res = await request(app)
-      .get('/api/admin/backup/picpeak/export')
-      .set('Authorization', `Bearer ${adminToken}`);
-    expect(res.status).toBe(403);
-  });
-
-  it('allows super_admin', async () => {
-    const res = await request(app)
-      .get('/api/admin/backup/picpeak/export')
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(res.status).not.toBe(403);
-    expect(res.status).toBeLessThan(500);
-  });
-});

backend/__tests__/routes/dashboardScope.test.js

@@ -1,196 +0,0 @@
-/**
- * Dashboard endpoints must not leak other admins' data to event-scoped
- * editors — GHSA-c2jj (/stats), GHSA-gqx7 (/analytics), GHSA-jhcf (/activity).
- *
- * All three are gated only by `analytics.view`, which the `editor` role holds.
- * But the events LIST restricts editors to their own rows
- * (adminEvents/crud.js: roleName === 'editor' → created_by = admin.id), so an
- * editor saw instance-wide totals — and, via /analytics topGalleries, other
- * admins' gallery names and SLUGS (the public gallery URL component) — for
- * events invisible to them everywhere else.
- *
- * Scoping deliberately keys on `editor` to mirror the events list exactly, so
- * the `admin` role's dashboard is unchanged.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dashscope-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'dashscope-test-secret';
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('dashboard scoping (GHSA-c2jj / gqx7 / jhcf)', () => {
-  let db; let cleanup; let app;
-  let editorToken; let superToken;
-  let ownEventId; let foreignEventId;
-
-  const mkAdmin = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username,
-      email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    const token = jwt.sign(
-      { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' },
-    );
-    return { id, token };
-  };
-
-  const mkEvent = async (slug, createdBy) => {
-    const r = await db('events').insert({
-      slug,
-      event_type: 'wedding',
-      event_name: `${slug}-name`,
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      share_token: `tok-${slug}`,
-      share_link: `/gallery/${slug}/tok-${slug}`,
-      created_by: createdBy,
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const editor = await mkAdmin('scoped-editor', 'editor');
-    const sup = await mkAdmin('root-admin', 'super_admin');
-    editorToken = editor.token;
-    superToken = sup.token;
-
-    ownEventId = await mkEvent('own-gallery', editor.id);
-    foreignEventId = await mkEvent('foreign-gallery', sup.id);
-
-    // One photo + one view per event so the aggregates are non-zero.
-    for (const [eventId, name] of [[ownEventId, 'own'], [foreignEventId, 'foreign']]) {
-      await db('photos').insert({
-        event_id: eventId,
-        filename: `${name}.jpg`,
-        path: `events/active/${name}.jpg`,
-        type: 'individual',
-        size_bytes: 1000,
-        uploaded_at: new Date().toISOString(),
-      });
-      await db('access_logs').insert({
-        event_id: eventId,
-        action: 'view',
-        ip_address: `10.0.0.${eventId}`,
-        user_agent: 'Mozilla/5.0',
-        timestamp: new Date().toISOString(),
-      });
-      await db('activity_logs').insert({
-        activity_type: 'photo_viewed',
-        actor_type: 'admin',
-        actor_name: `${name}-actor`,
-        event_id: eventId,
-        created_at: new Date().toISOString(),
-      });
-    }
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/dashboard', require('../../src/routes/adminDashboard'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('/stats counts only the editor\'s own events and photos', async () => {
-    const res = await request(app)
-      .get('/api/admin/dashboard/stats')
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect(res.status).toBe(200);
-    expect(Number(res.body.totalEvents)).toBe(1);
-    expect(Number(res.body.totalPhotos)).toBe(1);
-    expect(Number(res.body.storageUsed)).toBe(1000);
-  });
-
-  it('/analytics does not expose a foreign gallery name or slug', async () => {
-    const res = await request(app)
-      .get('/api/admin/dashboard/analytics?days=7')
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect(res.status).toBe(200);
-    const body = JSON.stringify(res.body);
-    expect(body).not.toContain('foreign-gallery');
-    expect(body).not.toContain('foreign-gallery-name');
-    expect(res.body.topGalleries.map((g) => g.slug)).toEqual(['own-gallery']);
-  });
-
-  it('/activity does not surface a foreign event\'s entries', async () => {
-    const res = await request(app)
-      .get('/api/admin/dashboard/activity')
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect(res.status).toBe(200);
-    const actors = res.body.map((a) => a.actorName);
-    expect(actors).toContain('own-actor');
-    expect(actors).not.toContain('foreign-actor');
-  });
-
-  it('leaves super_admin unscoped across all three', async () => {
-    const stats = await request(app)
-      .get('/api/admin/dashboard/stats')
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(Number(stats.body.totalEvents)).toBe(2);
-
-    const analytics = await request(app)
-      .get('/api/admin/dashboard/analytics?days=7')
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(analytics.body.topGalleries.map((g) => g.slug).sort())
-      .toEqual(['foreign-gallery', 'own-gallery']);
-
-    const activity = await request(app)
-      .get('/api/admin/dashboard/activity')
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(activity.body.map((a) => a.actorName)).toContain('foreign-actor');
-  });
-});
-
-/**
- * Codex round 2: the /activity filter trusts `activity_logs.event_id`, but
- * expenseService was passing `adminId` into logActivity's third positional
- * parameter — which is `eventId`. Admin and event id sequences overlap, so a
- * foreign admin's expense metadata could surface under an editor's event.
- * Those writers now pass the actor instead, leaving event_id NULL.
- */
-describe('activity writers do not put admin ids in event_id (GHSA-jhcf)', () => {
-  it('expenseService passes the actor, not adminId, as the event id', () => {
-    const fs2 = require('fs');
-    const src = fs2.readFileSync(
-      require('path').join(__dirname, '../../src/services/expenseService.js'), 'utf8',
-    );
-    // No logActivity call may end with a bare `, adminId)` — that slot is eventId.
-    const offenders = src.split('\n').filter(
-      (l) => l.includes('logActivity(') && /,\s*adminId\s*\)/.test(l),
-    );
-    expect(offenders).toEqual([]);
-    // And the actor form must actually be in use.
-    expect(src).toContain("{ type: 'admin', id: adminId }");
-  });
-});

backend/__tests__/routes/databaseBackupDestination.test.js

@@ -1,120 +0,0 @@
-/**
- * Manual database backup must not honour a caller-supplied destination
- * (GHSA-jw8m-43r2-jqrm).
- *
- * POST /api/admin/database-backup/backup forwarded req.body straight into
- * databaseBackupService.backup(), which merges options over its config:
- *   const { destinationPath = '/backup/database', ... } = { ...config, ...options }
- * `destinationPath` is not a persistable setting (the /config allowlist only
- * accepts `database_backup_*` keys), so the request body was its ONLY source.
- *
- * The `admin` role holds backup.create but neither settings.edit nor
- * backup.restore — so it could aim a full DB dump (bcrypt hashes, gallery
- * password hashes, encrypted SMTP creds) at the PUBLIC /uploads static mount
- * (server.js mounts it with no auth middleware) and fetch it unauthenticated.
- *
- * Pins that destinationPath from the body is ignored, while the legitimate
- * knobs still pass through.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-dbbackup-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'dbbackup-test-secret';
-
-// Capture what the route hands the service; never run a real backup.
-const mockBackup = jest.fn(async () => ({ success: true }));
-jest.mock('../../src/services/databaseBackup', () => ({
-  databaseBackupService: {
-    get isRunning() { return false; },
-    backup: (...args) => mockBackup(...args),
-  },
-}));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('manual database backup destination (GHSA-jw8m)', () => {
-  let db; let cleanup; let app; let adminToken;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const role = await db('roles').where({ name: 'admin' }).first();
-    const r = await db('admin_users').insert({
-      username: 'limited-admin',
-      email: 'limited-admin@example.com',
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    adminToken = jwt.sign(
-      { id, username: 'limited-admin', type: 'admin', role: 'admin', loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' },
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/database-backup', require('../../src/routes/adminDatabaseBackup'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  beforeEach(() => mockBackup.mockClear());
-
-  it('ignores a caller-supplied destinationPath', async () => {
-    const res = await request(app)
-      .post('/api/admin/database-backup/backup')
-      .set('Authorization', `Bearer ${adminToken}`)
-      .send({ destinationPath: '/app/storage/uploads' });
-
-    expect(res.status).toBe(200);
-    // Give the fire-and-forget call a tick to land.
-    await new Promise((resolve) => setImmediate(resolve));
-    expect(mockBackup).toHaveBeenCalled();
-    const opts = mockBackup.mock.calls[0][0];
-    expect(opts).not.toHaveProperty('destinationPath');
-    expect(JSON.stringify(opts)).not.toContain('uploads');
-  });
-
-  it('still forwards the legitimate backup knobs', async () => {
-    const res = await request(app)
-      .post('/api/admin/database-backup/backup')
-      .set('Authorization', `Bearer ${adminToken}`)
-      .send({ compress: false, validateIntegrity: false, destinationPath: '/tmp/evil' });
-
-    expect(res.status).toBe(200);
-    await new Promise((resolve) => setImmediate(resolve));
-    const opts = mockBackup.mock.calls[0][0];
-    expect(opts.compress).toBe(false);
-    expect(opts.validateIntegrity).toBe(false);
-    expect(opts).not.toHaveProperty('destinationPath');
-  });
-
-  it('omits absent knobs entirely so service/config defaults still apply', async () => {
-    const res = await request(app)
-      .post('/api/admin/database-backup/backup')
-      .set('Authorization', `Bearer ${adminToken}`)
-      .send({});
-
-    expect(res.status).toBe(200);
-    await new Promise((resolve) => setImmediate(resolve));
-    // An explicit `{compress: undefined}` would override config on spread —
-    // absent keys must simply not be present.
-    expect(mockBackup.mock.calls[0][0]).toEqual({});
-  });
-});

backend/__tests__/routes/feedbackOwnership.test.js

@@ -1,101 +0,0 @@
-/**
- * GHSA-2qc2 / GHSA-32h4 / GHSA-3335 — feedback moderation, deletion, and the
- * pending-moderation list are by-feedback-id (or global) and lacked ownership
- * scoping, so a restricted editor could act on / enumerate feedback for events
- * it does not own. super_admin keeps global access.
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-fbown-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'fbown-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-fbown-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const bcrypt = require('bcrypt');
-const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
-
-describe('feedback ownership scoping', () => {
-  let db; let cleanup; let app;
-  let superTok; let editorTok; let editorId;
-  let foreignFeedbackId;
-
-  const auth = (req, tok) => req.set('Authorization', `Bearer ${tok}`);
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    const { adminId: superId } = await seedMinimal(db);
-    await assignAdminRole(db, superId, 'super_admin');
-    superTok = mintAdminToken(superId);
-
-    const ins = await db('admin_users').insert({
-      username: 'editor', email: 'editor@example.com',
-      password_hash: await bcrypt.hash('x', 4), must_change_password: false, created_at: new Date(),
-    }).returning('id');
-    editorId = ins[0]?.id ?? ins[0];
-    await assignAdminRole(db, editorId, 'editor');
-    editorTok = mintAdminToken(editorId);
-
-    // Event owned by super_admin (NOT the editor).
-    const ev = await db('events').insert({
-      slug: 'fbown-foreign', event_type: 'wedding', event_name: 'Foreign',
-      event_date: '2026-08-01', host_email: 'h@e.com', admin_email: 'a@e.com',
-      password_hash: 'x', share_link: '/g/fbown/s', share_token: 'fbown-share',
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0, created_by: superId,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    const eventId = ev[0]?.id ?? ev[0];
-    const ph = await db('photos').insert({
-      event_id: eventId, filename: 'p.jpg', path: 'fbown-foreign/p.jpg', type: 'individual',
-      uploaded_at: new Date().toISOString(),
-    }).returning('id');
-    const photoId = ph[0]?.id ?? ph[0];
-    const fb = await db('photo_feedback').insert({
-      photo_id: photoId, event_id: eventId, feedback_type: 'comment',
-      comment_text: 'hi', is_approved: 0, is_hidden: 0, created_at: new Date().toISOString(),
-    }).returning('id');
-    foreignFeedbackId = fb[0]?.id ?? fb[0];
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/admin/feedback', require('../../src/routes/adminFeedback'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('editor cannot moderate feedback on an event it does not own (404)', async () => {
-    const res = await auth(request(app).put(`/api/admin/feedback/feedback/${foreignFeedbackId}/approve`), editorTok);
-    expect(res.status).toBe(404);
-    const row = await db('photo_feedback').where({ id: foreignFeedbackId }).first();
-    expect([false, 0]).toContain(row.is_approved); // untouched
-  });
-
-  it('editor cannot delete foreign feedback, row survives', async () => {
-    const res = await auth(request(app).delete(`/api/admin/feedback/feedback/${foreignFeedbackId}`), editorTok);
-    // Denied either at the events.delete permission layer (editor lacks it →
-    // 403) or the ownership layer (404) — both must leave the row intact.
-    expect([403, 404]).toContain(res.status);
-    expect(await db('photo_feedback').where({ id: foreignFeedbackId }).first()).toBeDefined();
-  });
-
-  it('editor sees no foreign feedback in pending-moderation', async () => {
-    const res = await auth(request(app).get('/api/admin/feedback/feedback/pending-moderation'), editorTok);
-    expect(res.status).toBe(200);
-    expect(res.body.find((f) => f.id === foreignFeedbackId)).toBeUndefined();
-  });
-
-  it('super_admin CAN moderate and see it', async () => {
-    const pending = await auth(request(app).get('/api/admin/feedback/feedback/pending-moderation'), superTok);
-    expect(pending.body.find((f) => f.id === foreignFeedbackId)).toBeDefined();
-    const res = await auth(request(app).put(`/api/admin/feedback/feedback/${foreignFeedbackId}/approve`), superTok);
-    expect(res.status).toBe(200);
-  });
-});

backend/__tests__/routes/galleryResolveShareToken.test.js

@@ -1,87 +0,0 @@
-/**
- * GHSA-rh8r-7x3h-36rv — the unauthenticated GET /api/gallery/resolve/:identifier
- * must NOT return a gallery's secret share_token (nor the share links that
- * embed it) for a bare *slug* lookup. Slugs appear in gallery URLs and are
- * guessable; handing back the secret turns a known slug into share-link
- * access to a no-password gallery. The token is only returned when the caller
- * resolved via the token / full share link (i.e. already holds it).
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-resolve-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'resolve-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-resolve-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'resolve-test-event';
-const SHARE_TOKEN = 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6';
-
-describe('GET /api/gallery/resolve/:identifier (GHSA-rh8r)', () => {
-  let db; let cleanup; let app;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Resolve Test',
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/${SHARE_TOKEN}`,
-      share_token: SHARE_TOKEN,
-      require_password: 0, // no-password → the token IS the access credential
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    });
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('does NOT leak the share_token (or share links) for a bare slug lookup', async () => {
-    const res = await request(app).get(`/api/gallery/resolve/${SLUG}`);
-    expect(res.status).toBe(200);
-    expect(res.body.slug).toBe(SLUG);
-    expect(res.body.matchType).toBe('slug');
-    // The secret must be absent — and must not sneak out via the share links.
-    expect(res.body.token).toBeUndefined();
-    expect(res.body.share_link).toBeUndefined();
-    expect(res.body.share_url).toBeUndefined();
-    expect(JSON.stringify(res.body)).not.toContain(SHARE_TOKEN);
-  });
-
-  it('DOES return the token when the caller already resolved via the token', async () => {
-    const res = await request(app).get(`/api/gallery/resolve/${SHARE_TOKEN}`);
-    expect(res.status).toBe(200);
-    expect(res.body.token).toBe(SHARE_TOKEN);
-    expect(res.body.matchType).toMatch(/token/);
-  });
-
-  it('does NOT leak the token via SQL LIKE wildcards in the link_partial fallback', async () => {
-    // Before the escaping fix, an anonymous request of 32 underscores matched
-    // any share_link ending in a 32-char token (`_` = single-char wildcard),
-    // resolved as matchType 'link_partial', and handed back the bearer token.
-    // The share_token here has no underscores, so an escaped LIKE must miss.
-    const res = await request(app).get(`/api/gallery/resolve/${'_'.repeat(SHARE_TOKEN.length)}`);
-    expect(res.status).toBe(404);
-    expect(res.body.token).toBeUndefined();
-    expect(JSON.stringify(res.body)).not.toContain(SHARE_TOKEN);
-  });
-});

backend/__tests__/routes/hiddenPhotoAccessControl.test.js

@@ -1,240 +0,0 @@
-/**
- * Hidden/client-only photo access control across the bulk + secure photo
- * routes (GHSA cluster: fpwq / ghf8 / 3jvw / 9cc4 / 2hqg / jc22).
- *
- * A photo with visibility='hidden' is client-only. The main photo-list and
- * single-photo download/view routes enforced this, but the bulk-download,
- * protected-image, and secure-image routes shipped without the check —
- * letting an ordinary guest reach hidden photos. These tests pin that
- * guests are refused and PIN-clients (accessLevel='client') still succeed.
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-hidden-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'hidden-photo-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-hidden-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'hidden-photo-test-event';
-
-describe('hidden-photo access control (GHSA cluster)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let visibleId;
-  let hiddenId;
-
-  const guestToken = () => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery' },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-  const clientToken = () => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery', accessLevel: 'client' },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Hidden Photo Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'hidden-photo-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0, allow_downloads: 1,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const photoDir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(photoDir, { recursive: true });
-
-    // A real 1x1 PNG so the protected /view route's Sharp processing path
-    // succeeds (fake bytes 500 on metadata()). Content, not extension,
-    // drives Sharp's format detection.
-    const PNG_1x1 = Buffer.from(
-      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M8AAAMCAQGV2rY9AAAAAElFTkSuQmCC',
-      'base64'
-    );
-    const mkPhoto = async (filename, visibility) => {
-      fs.writeFileSync(path.join(photoDir, filename), PNG_1x1);
-      const p = await db('photos').insert({
-        event_id: eventId,
-        filename,
-        path: `${SLUG}/${filename}`,
-        type: 'individual',
-        visibility,
-        uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      return p[0]?.id ?? p[0];
-    };
-    visibleId = await mkPhoto('visible.jpg', 'visible');
-    hiddenId = await mkPhoto('hidden.jpg', 'hidden');
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-    app.use('/api/images', require('../../src/routes/protectedImages'));
-    app.use('/api/secure-images', require('../../src/routes/secureImages'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  describe('download-selected (GHSA-ghf8, medium)', () => {
-    it('omits a hidden photo for a guest even when its id is requested', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photo_ids: [visibleId, hiddenId] });
-      // The visible photo still zips; the hidden one is filtered out. If
-      // only the hidden id were requested, the filter empties the set → 404.
-      expect(res.status).toBe(200);
-      const solo = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photo_ids: [hiddenId] });
-      expect(solo.status).toBe(404);
-    });
-
-    it('includes the hidden photo for a client', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${clientToken()}`)
-        .send({ photo_ids: [hiddenId] });
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('download-all (GHSA-fpwq, medium)', () => {
-    it('streams for a guest without erroring (hidden photos filtered)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download-all`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('protected-image view (GHSA-9cc4)', () => {
-    it('403s a hidden photo for a guest', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${hiddenId}/view`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('serves a visible photo for a guest', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${visibleId}/view`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(200);
-    });
-    it('serves a hidden photo for a client', async () => {
-      const res = await request(app)
-        .get(`/api/images/${SLUG}/photo/${hiddenId}/view`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe('signed-URL mint (GHSA-3jvw)', () => {
-    it('403s minting a signed URL for a hidden photo as a guest', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-url`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-url`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-      expect(res.body.url).toContain('/signed/');
-    });
-  });
-
-  describe('legacy secure-token mint (protectedImages generate-secure-token)', () => {
-    it('403s a hidden photo for a guest', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-secure-token`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/images/${SLUG}/photo/${hiddenId}/generate-secure-token`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(res.status).toBe(200);
-      expect(res.body.token).toBeDefined();
-    });
-  });
-
-  describe('secure-token mint (GHSA-2hqg)', () => {
-    it('403s minting a secure token for a hidden photo as a guest', async () => {
-      const res = await request(app)
-        .post(`/api/secure-images/${SLUG}/generate-token`)
-        .set('Authorization', `Bearer ${guestToken()}`)
-        .send({ photoId: hiddenId });
-      expect(res.status).toBe(403);
-    });
-    it('mints for a client', async () => {
-      const res = await request(app)
-        .post(`/api/secure-images/${SLUG}/generate-token`)
-        .set('Authorization', `Bearer ${clientToken()}`)
-        .send({ photoId: hiddenId });
-      expect(res.status).toBe(200);
-      expect(res.body.token).toBeDefined();
-    });
-  });
-
-  // A capability minted while a photo is visible must stop serving once the
-  // photo is hidden — unless minted by a client (clientBypass in the token).
-  describe('signed-URL TOCTOU (hidden AFTER minting)', () => {
-    afterEach(async () => {
-      await db('photos').where({ id: visibleId }).update({ visibility: 'visible' });
-    });
-
-    it("a guest's pre-minted signed URL stops serving once the photo is hidden", async () => {
-      const mint = await request(app)
-        .post(`/api/images/${SLUG}/photo/${visibleId}/generate-url`)
-        .set('Authorization', `Bearer ${guestToken()}`);
-      expect(mint.status).toBe(200);
-      const url = mint.body.url;
-      // Still visible → serves.
-      expect((await request(app).get(url)).status).toBe(200);
-      // Hide it → the guest token (no clientBypass) must now be refused.
-      await db('photos').where({ id: visibleId }).update({ visibility: 'hidden' });
-      expect((await request(app).get(url)).status).toBe(403);
-    });
-
-    it("a client's pre-minted signed URL keeps serving after the photo is hidden", async () => {
-      const mint = await request(app)
-        .post(`/api/images/${SLUG}/photo/${visibleId}/generate-url`)
-        .set('Authorization', `Bearer ${clientToken()}`);
-      expect(mint.status).toBe(200);
-      const url = mint.body.url;
-      await db('photos').where({ id: visibleId }).update({ visibility: 'hidden' });
-      expect((await request(app).get(url)).status).toBe(200);
-    });
-  });
-});

backend/__tests__/routes/legacyEventsRouterRemoved.test.js

@@ -1,119 +0,0 @@
-/**
- * Regression test for GHSA-4j34-x562-5vfq — broken access control in the legacy
- * /api/events router.
- *
- * The legacy router exposed create/list/update/delete/extend guarded by
- * adminAuth ALONE (no requirePermission, no requireEventOwnership), so any
- * back-office account — down to a read-only viewer — could read every gallery's
- * password_hash/share_token and take over any gallery. The fix removes that
- * router entirely and migrates its one UI-used route (POST /:id/extend) to the
- * canonical /api/admin/events mount, where it inherits the permission +
- * ownership guards.
- *
- * This test pins two invariants:
- *   1. The legacy source file is gone (nothing can re-mount it).
- *   2. The migrated extend route enforces ownership — a non-owning editor gets
- *      403, the owner succeeds.
- */
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-legacy-acl-')), 'db.sqlite'
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'legacy-acl-test-secret';
-
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const request = require('supertest');
-const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
-
-async function insertEvent(db, ownerId, over = {}) {
-  const base = {
-    slug: `ev-${Math.random().toString(16).slice(2)}`,
-    event_type: 'wedding',
-    event_name: 'Owner Gallery',
-    event_date: '2026-05-29',
-    host_email: 'host@example.com',
-    admin_email: 'admin@example.com',
-    password_hash: 'x',
-    share_link: `/gallery/share-${Math.random().toString(16).slice(2)}`,
-    share_token: `st-${Math.random().toString(16).slice(2)}`,
-    expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-    is_active: 1, is_archived: 0, is_draft: 0,
-    created_by: ownerId,
-    created_at: new Date().toISOString(),
-    ...over,
-  };
-  const r = await db('events').insert(base).returning('id');
-  return r[0]?.id ?? r[0];
-}
-
-describe('GHSA-4j34: legacy /api/events router removed + extend guarded', () => {
-  it('the legacy events router source file no longer exists', () => {
-    expect(fs.existsSync(path.join(__dirname, '../../src/routes/events.js'))).toBe(false);
-  });
-
-  describe('POST /api/admin/events/:id/extend ownership enforcement', () => {
-    let db; let cleanup; let app;
-    let ownerId; let ownerToken;
-    let editorId; let editorToken;
-
-    beforeAll(async () => {
-      ({ db, cleanup } = await bootCrmDb());
-      ({ adminId: ownerId } = await seedMinimal(db));
-      await assignAdminRole(db, ownerId, 'super_admin');
-      ownerToken = mintAdminToken(ownerId);
-
-      // A second, non-owning account with the low-trust editor role.
-      [editorId] = await db('admin_users').insert({
-        username: 'editor1', email: 'editor1@example.com',
-        password_hash: 'x', is_active: 1,
-      }).returning('id');
-      editorId = editorId?.id ?? editorId;
-      await assignAdminRole(db, editorId, 'editor');
-      editorToken = mintAdminToken(editorId);
-
-      app = express();
-      app.use(express.json());
-      app.use(cookieParser());
-      app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-      // eslint-disable-next-line no-unused-vars
-      app.use((err, req, res, next) => {
-        res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
-      });
-    }, 120000);
-
-    afterAll(async () => { await cleanup(); });
-
-    it('lets the owner extend their own gallery', async () => {
-      const id = await insertEvent(db, ownerId, { expires_at: '2026-06-01T00:00:00.000Z' });
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${ownerToken}`)
-        .send({ days: 10 });
-      expect(res.status).toBe(200);
-      expect(new Date(res.body.expires_at).toISOString()).toBe('2026-06-11T00:00:00.000Z');
-    });
-
-    it('403s a non-owning editor trying to extend someone else\'s gallery', async () => {
-      const id = await insertEvent(db, ownerId); // owned by the super_admin
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${editorToken}`)
-        .send({ days: 30 });
-      expect(res.status).toBe(403); // requireEventOwnership blocks it
-    });
-
-    it('validates the days field', async () => {
-      const id = await insertEvent(db, ownerId);
-      const res = await request(app)
-        .post(`/api/admin/events/${id}/extend`)
-        .set('Authorization', `Bearer ${ownerToken}`)
-        .send({ days: 9999 });
-      expect(res.status).toBe(400);
-    });
-  });
-});

backend/__tests__/routes/logoDiagnostic.test.js

@@ -1,123 +0,0 @@
-/**
- * Logo diagnostic must not leak the filesystem layout, and must mirror what
- * resolveLogoFile actually tries (GHSA-29vm, codex round 2).
- *
- * Round 1 relativised `resolvedTo` and the candidate paths but still echoed
- * `sources[].value` verbatim — and branding_logo_path is stored ABSOLUTE by
- * multer, so the layout went out anyway. It also dropped the raw-absolute
- * candidate, which the resolver retains (subject to containment), making the
- * diagnostic report every candidate as missing for a legitimately contained
- * absolute logo while `resolvedTo` named the file.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-logodiag-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'logodiag-test-secret';
-
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('logo diagnostic disclosure (GHSA-29vm)', () => {
-  let db; let cleanup; let app; let token;
-  // bootCrmDb() sets STORAGE_PATH itself, so resolve these AFTER it runs.
-  let STORAGE; let logoDir; let logoPath;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    // A legitimately contained absolute logo in a NON-standard storage subdir.
-    STORAGE = process.env.STORAGE_PATH;
-    logoDir = path.join(STORAGE, 'custom');
-    logoPath = path.join(logoDir, 'logo.png');
-    fs.mkdirSync(logoDir, { recursive: true });
-    fs.writeFileSync(logoPath, 'png');
-
-    const setting = { setting_key: 'branding_logo_path', setting_value: JSON.stringify(logoPath), setting_type: 'branding' };
-    const existing = await db('app_settings').where({ setting_key: 'branding_logo_path' }).first();
-    if (existing) await db('app_settings').where({ setting_key: 'branding_logo_path' }).update(setting);
-    else await db('app_settings').insert(setting);
-
-    const role = await db('roles').where({ name: 'super_admin' }).first();
-    const r = await db('admin_users').insert({
-      username: 'diag-admin', email: 'diag@example.com',
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id, is_active: 1,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    token = jwt.sign(
-      { id, username: 'diag-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
-      process.env.JWT_SECRET, { expiresIn: '1h', issuer: 'picpeak-auth' },
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/business-profile', require('../../src/routes/adminBusinessProfile'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('does not leak absolute paths, cwd or storage root anywhere in the payload', async () => {
-    const res = await request(app)
-      .get('/api/admin/business-profile/logo-diagnostic')
-      .set('Authorization', `Bearer ${token}`);
-
-    expect(res.status).toBe(200);
-    const body = JSON.stringify(res.body);
-    expect(body).not.toContain(STORAGE);
-    expect(body).not.toContain(process.cwd());
-    expect(res.body.storageRoot).toBeUndefined();
-    expect(res.body.cwd).toBeUndefined();
-  });
-
-  it('still finds a contained absolute logo outside the standard subdirs', async () => {
-    const res = await request(app)
-      .get('/api/admin/business-profile/logo-diagnostic')
-      .set('Authorization', `Bearer ${token}`);
-
-    const source = res.body.sources.find((s) => s.label === 'app_settings.branding_logo_path');
-    expect(source).toBeTruthy();
-    // The resolver keeps the contained absolute candidate, so the diagnostic
-    // must show it existing rather than reporting everything missing.
-    expect(source.candidates.some((c) => c.exists)).toBe(true);
-    expect(res.body.resolvedTo).toMatch(/^<STORAGE>\//);
-  });
-
-  it('shows the <STORAGE>/<value> candidate for a ROOT-RELATIVE logo URL (round 3)', async () => {
-    // `/custom/logo.png` is a URL, not a disk path, but path.isAbsolute() says
-    // true for both. Gating the stripped joins on isAbsolute() therefore hid
-    // `<STORAGE>/custom/logo.png` — a candidate resolveLogoFile does try and
-    // can resolve — so the diagnostic claimed nothing existed for a logo that
-    // renders fine, and collapsed the configured value to its basename.
-    await db('app_settings').where({ setting_key: 'branding_logo_path' })
-      .update({ setting_value: JSON.stringify('/custom/logo.png') });
-
-    const res = await request(app)
-      .get('/api/admin/business-profile/logo-diagnostic')
-      .set('Authorization', `Bearer ${token}`);
-
-    expect(res.status).toBe(200);
-    const source = res.body.sources.find((s) => s.label === 'app_settings.branding_logo_path');
-    expect(source.candidates.some((c) => c.path === '<STORAGE>/custom/logo.png' && c.exists)).toBe(true);
-
-    // …and the disclosure guarantee still holds for this shape.
-    const body = JSON.stringify(res.body);
-    expect(body).not.toContain(STORAGE);
-    expect(body).not.toContain(process.cwd());
-
-    await db('app_settings').where({ setting_key: 'branding_logo_path' })
-      .update({ setting_value: JSON.stringify(logoPath) });
-  });
-});

backend/__tests__/routes/photoEngagementCounters.test.js

@@ -1,312 +0,0 @@
-/**
- * Per-photo engagement counters (#895).
- *
- * Pins the contract that the admin EVENT > IMAGES table depends on:
- *  - photos.view_count increments when the full-size photo is served
- *    (it existed in the schema + admin UI but had NO writer at all)
- *  - the slideshow kiosk never increments views (migration 138 design)
- *  - single-photo downloads increment download_count (regression pin)
- *  - zip downloads (download-all, download-selected) increment
- *    download_count for the contained photos — previously they didn't,
- *    so zip-heavy galleries showed 0 per-photo downloads forever
- *  - the admin event-detail total_downloads counts singles AND zips
- *    (it counted action='download' only, disagreeing with the dashboard)
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-engagement-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'engagement-test-secret';
-// Real files on disk so /photo and the zip routes actually stream bytes.
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-engagement-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const cookieParser = require('cookie-parser');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-const SLUG = 'engagement-test-event';
-
-describe('photo engagement counters (#895)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let eventId;
-  let photoIds;
-  let adminToken;
-
-  const galleryToken = (extra = {}) => jwt.sign(
-    { eventId, eventSlug: SLUG, type: 'gallery', ...extra },
-    process.env.JWT_SECRET,
-    { expiresIn: '1h', issuer: 'picpeak-auth' }
-  );
-
-  const getPhoto = async (id) => db('photos').where('id', id).first();
-  // The counter writes are fire-and-forget on purpose — give the event
-  // loop a beat before asserting.
-  const settle = () => new Promise((r) => setTimeout(r, 400));
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const inserted = await db('events').insert({
-      slug: SLUG,
-      event_type: 'wedding',
-      event_name: 'Engagement Test',
-      event_date: '2026-08-01',
-      host_email: 'host@example.com',
-      admin_email: 'admin@example.com',
-      password_hash: 'x',
-      share_link: `/gallery/${SLUG}/share`,
-      share_token: 'engagement-test-share',
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      allow_downloads: 1,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    eventId = inserted[0]?.id ?? inserted[0];
-
-    const photoDir = path.join(process.env.STORAGE_PATH, 'events/active', SLUG);
-    fs.mkdirSync(photoDir, { recursive: true });
-
-    photoIds = [];
-    for (let i = 0; i < 3; i++) {
-      const filename = `photo-${i}.jpg`;
-      fs.writeFileSync(path.join(photoDir, filename), Buffer.from(`fake-jpeg-bytes-${i}`));
-      const p = await db('photos').insert({
-        event_id: eventId,
-        filename,
-        path: `${SLUG}/${filename}`,
-        type: 'individual',
-        uploaded_at: new Date().toISOString(),
-      }).returning('id');
-      photoIds.push(p[0]?.id ?? p[0]);
-    }
-
-    const superRole = await db('roles').where({ name: 'super_admin' }).first();
-    const [rootId] = await db('admin_users').insert({
-      username: 'engagement-admin',
-      email: 'engagement-admin@example.com',
-      password_hash: await bcrypt.hash('EngagementAdmin123', 4),
-      role_id: superRole.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id').then((r) => [r[0]?.id || r[0]]);
-    adminToken = jwt.sign(
-      { id: rootId, username: 'engagement-admin', type: 'admin', role: 'super_admin', loginTime: Date.now() },
-      process.env.JWT_SECRET,
-      { expiresIn: '1h', issuer: 'picpeak-auth' }
-    );
-
-    app = express();
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use('/api/gallery', require('../../src/routes/gallery'));
-    app.use('/api/admin/events', require('../../src/routes/adminEvents'));
-    app.use('/api/admin/photos', require('../../src/routes/adminPhotos'));
-  }, 120000);
-
-  afterAll(async () => {
-    if (cleanup) await cleanup();
-  });
-
-  beforeEach(async () => {
-    await db('photos').where('event_id', eventId).update({ view_count: 0, download_count: 0 });
-    await db('access_logs').where('event_id', eventId).del();
-  });
-
-  describe('view_count via the view beacon (#895 — previously never written)', () => {
-    const beacon = (photoId, token = galleryToken()) => request(app)
-      .post(`/api/gallery/${SLUG}/photo/${photoId}/view`)
-      .set('Authorization', `Bearer ${token}`);
-
-    it('increments exactly the beaconed photo', async () => {
-      expect((await beacon(photoIds[0])).status).toBe(204);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(1);
-
-      expect((await beacon(photoIds[0])).status).toBe(204);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(2);
-      // Other photos untouched
-      expect((await getPhoto(photoIds[1])).view_count).toBe(0);
-    });
-
-    it('serving the image bytes does NOT count (preloads must not inflate)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/photo/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).view_count).toBe(0);
-    });
-
-    it('rejects the slideshow kiosk (migration 138 design)', async () => {
-      const res = await beacon(photoIds[0], galleryToken({ accessLevel: 'slideshow' }));
-      expect(res.status).toBeGreaterThanOrEqual(400);
-      expect((await getPhoto(photoIds[0])).view_count).toBe(0);
-    });
-
-    it("404s a photo that isn't in the event", async () => {
-      const res = await beacon(999999);
-      expect(res.status).toBe(404);
-    });
-  });
-
-  describe('download_count', () => {
-    it('single-photo download increments (regression pin)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[1])).download_count).toBe(0);
-    });
-
-    it('download-selected increments exactly the selected photos (#895)', async () => {
-      const res = await request(app)
-        .post(`/api/gallery/${SLUG}/download-selected`)
-        .set('Authorization', `Bearer ${galleryToken()}`)
-        .send({ photo_ids: [photoIds[0], photoIds[1]] });
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await getPhoto(photoIds[0])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[1])).download_count).toBe(1);
-      expect((await getPhoto(photoIds[2])).download_count).toBe(0);
-    });
-
-    it('download-all increments every downloadable photo (#895)', async () => {
-      const res = await request(app)
-        .get(`/api/gallery/${SLUG}/download-all`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      expect(res.status).toBe(200);
-      await settle();
-      for (const id of photoIds) {
-        expect((await getPhoto(id)).download_count).toBe(1);
-      }
-    });
-
-    it('skipped archive entries do not count (missing source file)', async () => {
-      // Own event so the on-the-fly archiver path is guaranteed — the
-      // main event may have a cached zip from the previous test's
-      // background generation, and racing its build/invalidate hangs.
-      // The route also fires a background pre-zip build after streaming;
-      // against this event's intentionally missing file it crashes with
-      // an async ENOENT that jest attributes to whatever test is running
-      // by then — neutralize it, it's not under test here.
-      const downloadZipService = require('../../src/services/downloadZipService');
-      const generateZipSpy = jest.spyOn(downloadZipService, 'generateZip')
-        .mockResolvedValue({ success: false, error: 'disabled in test' });
-      const slug2 = `${SLUG}-skip`;
-      const ev = await db('events').insert({
-        slug: slug2,
-        event_type: 'wedding',
-        event_name: 'Engagement Skip Test',
-        event_date: '2026-08-01',
-        host_email: 'host@example.com',
-        admin_email: 'admin@example.com',
-        password_hash: 'x',
-        share_link: `/gallery/${slug2}/share`,
-        share_token: 'engagement-skip-share',
-        expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-        is_active: 1,
-        is_archived: 0,
-        is_draft: 0,
-        allow_downloads: 1,
-        created_at: new Date().toISOString(),
-      }).returning('id');
-      const eventId2 = ev[0]?.id ?? ev[0];
-      const dir2 = path.join(process.env.STORAGE_PATH, 'events/active', slug2);
-      fs.mkdirSync(dir2, { recursive: true });
-      const ids2 = [];
-      for (let i = 0; i < 2; i++) {
-        // Only photo 0 gets a real file — photo 1's source is missing.
-        if (i === 0) fs.writeFileSync(path.join(dir2, `photo-${i}.jpg`), Buffer.from('skip-test-bytes'));
-        const p = await db('photos').insert({
-          event_id: eventId2,
-          filename: `photo-${i}.jpg`,
-          path: `${slug2}/photo-${i}.jpg`,
-          type: 'individual',
-          uploaded_at: new Date().toISOString(),
-        }).returning('id');
-        ids2.push(p[0]?.id ?? p[0]);
-      }
-      const token2 = jwt.sign(
-        { eventId: eventId2, eventSlug: slug2, type: 'gallery' },
-        process.env.JWT_SECRET,
-        { expiresIn: '1h', issuer: 'picpeak-auth' }
-      );
-
-      const res = await request(app)
-        .get(`/api/gallery/${slug2}/download-all`)
-        .set('Authorization', `Bearer ${token2}`);
-      expect(res.status).toBe(200);
-      await settle();
-      expect((await db('photos').where('id', ids2[0]).first()).download_count).toBe(1);
-      // photo-1's source was missing → skipped from the zip → not counted
-      expect((await db('photos').where('id', ids2[1]).first()).download_count).toBe(0);
-      generateZipSpy.mockRestore();
-    });
-  });
-
-  describe('admin photos list exposes the counters (#895 follow-up)', () => {
-    it('returns view_count and download_count so the Engagement column can render them', async () => {
-      // The list mapper builds an explicit object — before this fix it
-      // omitted both fields, so the admin table showed 0 forever even
-      // though the DB counted correctly.
-      await request(app)
-        .post(`/api/gallery/${SLUG}/photo/${photoIds[0]}/view`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      await request(app)
-        .get(`/api/gallery/${SLUG}/download/${photoIds[0]}`)
-        .set('Authorization', `Bearer ${galleryToken()}`);
-      await settle();
-
-      const res = await request(app)
-        .get(`/api/admin/photos/${eventId}/photos`)
-        .set('Authorization', `Bearer ${adminToken}`);
-      expect(res.status).toBe(200);
-      const row = res.body.photos.find((p) => p.id === photoIds[0]);
-      expect(row.view_count).toBe(1);
-      expect(row.download_count).toBe(1);
-      const untouched = res.body.photos.find((p) => p.id === photoIds[1]);
-      expect(untouched.view_count).toBe(0);
-      expect(untouched.download_count).toBe(0);
-    });
-  });
-
-  describe('admin event-detail total_downloads (#895 — one definition everywhere)', () => {
-    it('counts singles and every zip variant, one row each', async () => {
-      const row = (action) => ({
-        event_id: eventId,
-        ip_address: '127.0.0.1',
-        user_agent: 'jest',
-        action,
-      });
-      await db('access_logs').insert([
-        row('download'),
-        row('download_all'),
-        row('download_all_presigned'),
-        row('download_selected'),
-        row('view'), // not a download
-      ]);
-
-      const res = await request(app)
-        .get(`/api/admin/events/${eventId}`)
-        .set('Authorization', `Bearer ${adminToken}`);
-      expect(res.status).toBe(200);
-      expect(res.body.total_downloads).toBe(4);
-    });
-  });
-});

backend/__tests__/routes/projectOwnership.test.js

@@ -1,181 +0,0 @@
-/**
- * Project ownership — GHSA-wrg5 (project routes) and GHSA-93x4 (project email
- * endpoints).
- *
- * Project routes authorized on generic events.view / events.edit with NO
- * ownership check, so an editor could enumerate, read, update and aggregate
- * projects belonging to other admins' events. The email endpoints keyed on an
- * email_queue id alone, so any id could be previewed/resent/cancelled.
- *
- * `projects` had no owner column. It was added in migration 167 (backfilled
- * from linked events) rather than relying only on the transitive
- * events.project_id -> events.created_by path, because a brand-new EMPTY
- * project has no linked event to infer an owner from — which is exactly where
- * the create -> attach flow begins.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-projown-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'projown-test-secret';
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('project ownership (GHSA-wrg5 / GHSA-93x4)', () => {
-  let db; let cleanup; let app;
-  let editorToken; let superToken; let editorId; let superId;
-  let ownProjectId; let foreignProjectId; let foreignEventId; let foreignEmailId;
-
-  const mkAdmin = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username,
-      email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const id = r[0]?.id ?? r[0];
-    return {
-      id,
-      token: jwt.sign(
-        { id, username, type: 'admin', role: roleName, loginTime: Date.now() },
-        process.env.JWT_SECRET, { expiresIn: '1h', issuer: 'picpeak-auth' },
-      ),
-    };
-  };
-
-  const mkProject = async (name, createdBy) => {
-    const r = await db('projects').insert({
-      name, status: 'active', created_by: createdBy,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    await db('feature_flags').insert({ key: 'projects', value: 1 })
-      .onConflict('key').merge({ value: 1 });
-
-    const editor = await mkAdmin('proj-editor', 'editor');
-    const sup = await mkAdmin('proj-super', 'super_admin');
-    editorToken = editor.token; editorId = editor.id;
-    superToken = sup.token; superId = sup.id;
-
-    ownProjectId = await mkProject('own-project', editorId);
-    foreignProjectId = await mkProject('foreign-project', superId);
-
-    // A foreign event linked to the foreign project, plus a queued email on it.
-    const ev = await db('events').insert({
-      slug: 'foreign-ev',
-      event_type: 'wedding',
-      event_name: 'Foreign Event',
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      share_token: 'ftok', share_link: '/gallery/foreign-ev/ftok',
-      created_by: superId,
-      project_id: foreignProjectId,
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    foreignEventId = ev[0]?.id ?? ev[0];
-
-    const em = await db('email_queue').insert({
-      event_id: foreignEventId,
-      recipient_email: 'client@example.com',
-      email_type: 'gallery_created',
-      status: 'sent',
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    foreignEmailId = em[0]?.id ?? em[0];
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/admin/projects', require('../../src/routes/adminProjects'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('lists only the editor\'s own projects', async () => {
-    const res = await request(app)
-      .get('/api/admin/projects')
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect(res.status).toBe(200);
-    const names = (res.body.projects || res.body.data?.projects || []).map((p) => p.name);
-    expect(names).toContain('own-project');
-    expect(names).not.toContain('foreign-project');
-  });
-
-  it('refuses to read a foreign project', async () => {
-    const res = await request(app)
-      .get(`/api/admin/projects/${foreignProjectId}`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect([403, 404]).toContain(res.status);
-  });
-
-  it('refuses to update or aggregate a foreign project', async () => {
-    const update = await request(app)
-      .put(`/api/admin/projects/${foreignProjectId}`)
-      .set('Authorization', `Bearer ${editorToken}`)
-      .send({ name: 'hijacked' });
-    expect([403, 404]).toContain(update.status);
-
-    const overview = await request(app)
-      .get(`/api/admin/projects/${foreignProjectId}/overview`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect([403, 404]).toContain(overview.status);
-
-    // And the name must not have changed.
-    const row = await db('projects').where({ id: foreignProjectId }).first();
-    expect(row.name).toBe('foreign-project');
-  });
-
-  it('refuses to attach a FOREIGN event to an owned project', async () => {
-    const res = await request(app)
-      .post(`/api/admin/projects/${ownProjectId}/events`)
-      .set('Authorization', `Bearer ${editorToken}`)
-      .send({ eventId: foreignEventId });
-
-    expect([403, 404]).toContain(res.status);
-    const ev = await db('events').where({ id: foreignEventId }).first();
-    expect(ev.project_id).toBe(foreignProjectId); // still attached to its own
-  });
-
-  it('refuses to preview or act on a foreign queued email (GHSA-93x4)', async () => {
-    const preview = await request(app)
-      .get(`/api/admin/projects/email/${foreignEmailId}/preview`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect([403, 404]).toContain(preview.status);
-
-    const cancel = await request(app)
-      .post(`/api/admin/projects/email/${foreignEmailId}/cancel`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect([403, 404]).toContain(cancel.status);
-  });
-
-  it('leaves super_admin unrestricted', async () => {
-    const res = await request(app)
-      .get(`/api/admin/projects/${foreignProjectId}`)
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(res.status).toBe(200);
-  });
-});

backend/__tests__/routes/projectOwnershipEdgeCases.test.js

@@ -1,115 +0,0 @@
-/**
- * Project ownership edge cases (GHSA-wrg5, codex round 2).
- *
- * The first predicate union'd "any linked event I can see" with the stored
- * owner, which opened two holes:
- *   - a project owned by B containing ONE legacy ownerless event became
- *     readable by everyone (and /overview aggregates B's other events,
- *     invoices and emails);
- *   - migration 167 deliberately leaves multi-owner projects NULL, and a NULL
- *     owner was treated as "everyone's".
- * The stored owner is now authoritative, and a NULL owner only derives access
- * when EVERY linked event is accessible.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-projedge-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'projedge-test-secret';
-
-const bcrypt3 = require('bcrypt');
-const { bootCrmDb: boot3, seedMinimal: seed3 } = require('../integration/helpers/crmDb');
-
-describe('project ownership edge cases (GHSA-wrg5, round 2)', () => {
-  let db3; let cleanup3; let ownership; let editorA; let editorB;
-
-  const mkAdmin3 = async (username, roleName) => {
-    const role = await db3('roles').where({ name: roleName }).first();
-    const r = await db3('admin_users').insert({
-      username, email: `${username}@example.com`,
-      password_hash: await bcrypt3.hash('Passw0rd!', 4),
-      role_id: role.id, is_active: 1,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-  const mkProject3 = async (name, createdBy) => {
-    const r = await db3('projects').insert({
-      name, status: 'active', created_by: createdBy,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-  const mkEvent3 = async (slug, createdBy, projectId) => {
-    const r = await db3('events').insert({
-      slug, event_type: 'wedding', event_name: slug, event_date: '2026-08-01',
-      host_email: 'h@e.com', admin_email: 'a@e.com', password_hash: 'x',
-      share_token: `t-${slug}`, share_link: `/g/${slug}/t-${slug}`,
-      created_by: createdBy, project_id: projectId,
-      expires_at: new Date(Date.now() + 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db: db3, cleanup: cleanup3 } = await boot3());
-    await seed3(db3);
-    ownership = require('../../src/middleware/ownership');
-    editorA = await mkAdmin3('edge-a', 'editor');
-    editorB = await mkAdmin3('edge-b', 'editor');
-  }, 120000);
-
-  afterAll(async () => { if (cleanup3) await cleanup3(); });
-
-  it('one ownerless event in B\'s project does not expose it to A', async () => {
-    const pid = await mkProject3('b-project', editorB);
-    await mkEvent3('b-owned-ev', editorB, pid);
-    await mkEvent3('legacy-ev', null, pid); // ownerless legacy event
-
-    const idsA = await ownership.ownedProjectIds({ id: editorA, roleName: 'editor' });
-    expect(idsA).not.toContain(Number(pid));
-
-    const idsB = await ownership.ownedProjectIds({ id: editorB, roleName: 'editor' });
-    expect(idsB).toContain(Number(pid));
-  });
-
-  it('a mixed-owner project left NULL by migration 167 is not global', async () => {
-    const pid = await mkProject3('ambiguous', null);
-    await mkEvent3('mix-a-ev', editorA, pid);
-    await mkEvent3('mix-b-ev', editorB, pid);
-
-    for (const who of [editorA, editorB]) {
-      const ids = await ownership.ownedProjectIds({ id: who, roleName: 'editor' });
-      expect(ids).not.toContain(Number(pid));
-    }
-  });
-
-  it('a NULL-owner project whose events are all mine IS mine', async () => {
-    const pid = await mkProject3('legacy-mine', null);
-    await mkEvent3('mine-ev', editorA, pid);
-
-    const ids = await ownership.ownedProjectIds({ id: editorA, roleName: 'editor' });
-    expect(ids).toContain(Number(pid));
-  });
-
-  it('a project whose creator was deleted falls back to its events', async () => {
-    const ghost = await mkAdmin3('ghost-admin', 'editor');
-    const pid = await mkProject3('orphaned', ghost);
-    await mkEvent3('orphan-ev', editorA, pid);
-    await db3('admin_users').where({ id: ghost }).del();
-
-    const ids = await ownership.ownedProjectIds({ id: editorA, roleName: 'editor' });
-    expect(ids).toContain(Number(pid));
-  });
-
-  it('super_admin stays unrestricted', async () => {
-    expect(await ownership.ownedProjectIds({ id: 1, roleName: 'super_admin' })).toBeNull();
-  });
-});

backend/__tests__/routes/publicContracts.test.js

@@ -51,7 +51,7 @@ describe('publicContracts routes', () => {
     contractId = inserted[0]?.id ?? inserted[0];
 
     app = buildRouteApp('/api/public/contracts', require('../../src/routes/publicContracts'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/publicPaymentCheck.test.js

@@ -33,7 +33,7 @@ describe('publicPaymentCheck routes', () => {
     ({ db, cleanup } = await bootCrmDb());
     await seedMinimal(db);
     app = buildRouteApp('/api/public/payment-check', require('../../src/routes/publicPaymentCheck'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/publicQuotes.test.js

@@ -60,7 +60,7 @@ describe('publicQuotes routes', () => {
     quoteId = inserted[0]?.id ?? inserted[0];
 
     app = buildRouteApp('/api/public/quotes', require('../../src/routes/publicQuotes'));
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/routes/restorePathAllowlist.test.js

@@ -1,86 +0,0 @@
-/**
- * Restore path containment must not break the normal restore wizard
- * (GHSA-fw4c, codex round 2).
- *
- * `source` is usually a SOURCE TYPE, not a path: RestoreWizard posts
- * 'local' | 's3' | 'upload', and restoreService.restore() branches on those
- * literals before deriving a directory. The first version of the containment
- * check treated `source` as a path, so path.resolve('local') landed outside
- * the configured backup roots and BOTH /validate and /start returned 400 —
- * blocking every normal restore.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-restorepath-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'restorepath-test-secret';
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('restore path allowlist (GHSA-fw4c)', () => {
-  let db; let cleanup; let checkRestorePathsAllowed;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    // Configure a backup root so the allowlist is actually active.
-    for (const [key, value] of [['backup_destination_path', '/backup']]) {
-      const existing = await db('app_settings').where({ setting_key: key }).first();
-      if (existing) {
-        await db('app_settings').where({ setting_key: key }).update({ setting_value: JSON.stringify(value) });
-      } else {
-        await db('app_settings').insert({
-          setting_key: key, setting_value: JSON.stringify(value), setting_type: 'backup',
-        });
-      }
-    }
-
-    ({ checkRestorePathsAllowed } = require('../../src/routes/adminRestore')._internal);
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('allows the wizard\'s source TYPE tokens', async () => {
-    for (const source of ['local', 's3', 'upload']) {
-      const err = await checkRestorePathsAllowed({
-        source, manifestPath: '/backup/manifests/backup-manifest-1.json',
-      });
-      expect(err).toBeNull();
-    }
-  });
-
-  it('allows an s3:// source URL', async () => {
-    const err = await checkRestorePathsAllowed({
-      source: 's3://bucket/key/backup.tar.gz',
-      manifestPath: '/backup/manifests/backup-manifest-1.json',
-    });
-    expect(err).toBeNull();
-  });
-
-  it('still rejects a manifestPath outside the configured roots', async () => {
-    const err = await checkRestorePathsAllowed({
-      source: 'local', manifestPath: '/etc/passwd',
-    });
-    expect(err).toMatch(/inside a configured backup location/i);
-  });
-
-  it('still rejects a traversal manifestPath', async () => {
-    const err = await checkRestorePathsAllowed({
-      source: 'local', manifestPath: '/backup/../etc/shadow',
-    });
-    expect(err).toBeTruthy();
-  });
-
-  it('accepts a real path source inside the roots', async () => {
-    const err = await checkRestorePathsAllowed({
-      source: '/backup/run-1', manifestPath: '/backup/run-1/manifest.json',
-    });
-    expect(err).toBeNull();
-  });
-});

backend/__tests__/routes/secureImageTokenBinding.test.js

@@ -1,136 +0,0 @@
-/**
- * Secure-image view route token binding (GHSA-g94x-8vv8-3c9f).
- *
- * The view route GET /api/secure-images/:slug/secure/:photoId/:token serves
- * via <img src> with the token in the URL, so it can't carry a gallery-token
- * header like the download sibling. Before the fix it validated only the
- * token signature and took the gallery/photo from the URL — so a token minted
- * on any PUBLIC gallery read every other gallery's photos with no password.
- *
- * Pins that the route now enforces the scope inside the token:
- *  - the URL photoId must equal the token's minted photoId
- *  - the gallery embedded in the token's sessionId must equal the URL gallery
- * A token minted on gallery A cannot read gallery B under either check; a
- * token used on its own gallery+photo passes the binding.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-secimg-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'secimg-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-secimg-storage-'));
-
-// Stub the anti-bot/rate-limit middleware so the fingerprint is deterministic
-// — the token below is minted with the same fingerprint, so verifySecureToken
-// passes and the binding logic under test is what decides the outcome.
-jest.mock('../../src/middleware/secureImageMiddleware', () => ({
-  secureImageAccess: (req, _res, next) => {
-    req.clientInfo = { fingerprint: 'test-fp', ip: '127.0.0.1', userAgent: 'jest' };
-    next();
-  },
-  getSecurityStatus: (_req, res) => res.json({ ok: true }),
-}));
-
-const request = require('supertest');
-const express = require('express');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-const secureImageService = require('../../src/services/secureImageService');
-
-describe('secure-image view route token binding (GHSA-g94x)', () => {
-  let db;
-  let cleanup;
-  let app;
-  let galleryA; let galleryB;
-  let photoA; let photoB;
-
-  const mkEvent = async (slug, requirePassword) => {
-    const r = await db('events').insert({
-      slug,
-      event_type: 'wedding',
-      event_name: slug,
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      require_password: requirePassword ? 1 : 0,
-      share_link: `/gallery/${slug}/share`,
-      share_token: `${slug}-share`,
-      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
-      is_active: 1,
-      is_archived: 0,
-      is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const mkPhoto = async (eventId, slug, filename) => {
-    const dir = path.join(process.env.STORAGE_PATH, 'events/active', slug);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, filename), Buffer.from('img'));
-    const r = await db('photos').insert({
-      event_id: eventId,
-      filename,
-      path: `${slug}/${filename}`,
-      type: 'individual',
-      uploaded_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  // Mint a token exactly as the mint route does — bound to (photoId, gallery
-  // sessionId, fingerprint) — bypassing the anti-bot HTTP path.
-  const mint = (photoId, eventId) => secureImageService.generateSecureToken(
-    photoId,
-    `gallery_public_${eventId}_${Date.now()}`,
-    { clientFingerprint: 'test-fp', maxUses: 100, expiresIn: 3600 },
-  );
-
-  const view = (slug, photoId, token) => request(app)
-    .get(`/api/secure-images/${slug}/secure/${photoId}/${token}`);
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    galleryA = await mkEvent('secimg-public-a', false);   // public — token source
-    galleryB = await mkEvent('secimg-private-b', true);   // password-protected — victim
-    photoA = await mkPhoto(galleryA, 'secimg-public-a', 'a.jpg');
-    photoB = await mkPhoto(galleryB, 'secimg-private-b', 'b.jpg');
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/secure-images', require('../../src/routes/secureImages'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('rejects a gallery-A token used against gallery B (cross-photo)', async () => {
-    const token = mint(photoA, galleryA);
-    const res = await view('secimg-private-b', photoB, token);
-    expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/not valid for this photo/i);
-  });
-
-  it('rejects a gallery-A token replayed on gallery B with A\'s photoId', async () => {
-    const token = mint(photoA, galleryA);
-    // URL photoId matches the token, so the photo check passes — the gallery
-    // check (sessionId gallery A != URL gallery B) must catch it.
-    const res = await view('secimg-private-b', photoA, token);
-    expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/not valid for this gallery/i);
-  });
-
-  it('lets a token read its own gallery + photo (binding passes)', async () => {
-    const token = mint(photoA, galleryA);
-    const res = await view('secimg-public-a', photoA, token);
-    // Binding passes; serving may 200/404/500 depending on the pipeline, but
-    // it must NOT be rejected as a token mismatch.
-    expect(res.status).not.toBe(403);
-  });
-});

backend/__tests__/routes/slideshowAdmin.test.js

@@ -75,7 +75,7 @@ describe('admin Live Slideshow endpoints', () => {
     app.use((err, req, res, next) => {
       res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
     });
-  }, 120000);
+  }, 30000);
 
   afterAll(async () => { await cleanup(); });
 

backend/__tests__/routes/slideshowPublic.test.js

@@ -67,10 +67,11 @@ async function insertEvent(db, over = {}) {
 describe('public Live Slideshow routes', () => {
   let db; let cleanup; let app;
 
-  // bootCrmDb runs the full migration set against a fresh SQLite file and the
-  // chain keeps growing via backports. Hook-argument timeouts OVERRIDE the
-  // 120s jest.config default (same trap as the jest.setTimeout pins) — keep
-  // this at 120000, matching the config.
+  // bootCrmDb runs the full migration set against a fresh SQLite file, which
+  // takes <2s locally but has been observed to exceed Jest's default 5s
+  // `beforeAll` timeout on slower GitHub Actions runners (~5.4s — runner-to-
+  // runner I/O variance). Raise the hook timeout so this doesn't intermittently
+  // block PRs on CI; doesn't affect happy-path local runs.
   beforeAll(async () => {
     ({ db, cleanup } = await bootCrmDb());
     await seedMinimal(db);
@@ -85,7 +86,7 @@ describe('public Live Slideshow routes', () => {
     app.use((err, req, res, next) => {
       res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
     });
-  }, 120000);
+  }, 30000);
 
   afterAll(async () => { await cleanup(); });
 

backend/__tests__/routes/v1EventOwnership.test.js

@@ -1,155 +0,0 @@
-/**
- * v1 API tokens must respect event ownership (GHSA-9697).
- *
- * migration 081 documents the intent — "the token's effective permissions are
- * the intersection of the user's role permissions and the token's own scope
- * flags" — but it was never implemented:
- *
- *   - apiTokenAuth selected only id/username/email/role_id, so
- *     req.admin.roleName was undefined and every ownership helper (which all
- *     key on roleName) could not distinguish a super_admin from a viewer.
- *   - No v1 route applied requirePermission or a created_by predicate, so any
- *     valid token listed every event and — worst — GET /events/:id/share-link
- *     returned ANY event's share_token, which is the gallery access credential.
- *
- * Scenario pinned here: a token owned by a restricted (non-super_admin) admin
- * must see only its owner's events, and must not obtain a foreign share_token.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-v1own-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'v1own-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-v1own-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-const { generateApiToken } = require('../../src/middleware/apiTokenAuth');
-
-describe('v1 event ownership (GHSA-9697)', () => {
-  let db; let cleanup; let app;
-  let editorToken; let superToken;
-  let ownEventId; let foreignEventId;
-  const FOREIGN_SHARE_TOKEN = 'f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0';
-
-  const mkAdmin = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username,
-      email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const mkToken = async (adminId, scopes = 'admin') => {
-    const { plaintext, hashed } = generateApiToken();
-    await db('api_tokens').insert({
-      name: `tok-${adminId}`,
-      hashed_token: hashed,
-      scopes,
-      created_by: adminId,
-      created_at: new Date().toISOString(),
-    });
-    return plaintext;
-  };
-
-  const mkEvent = async (slug, createdBy, shareToken) => {
-    const r = await db('events').insert({
-      slug,
-      event_type: 'wedding',
-      event_name: slug,
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      share_token: shareToken,
-      share_link: `/gallery/${slug}/${shareToken}`,
-      created_by: createdBy,
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const editorId = await mkAdmin('restricted-editor', 'editor');
-    const superId = await mkAdmin('root-admin', 'super_admin');
-    editorToken = await mkToken(editorId);
-    superToken = await mkToken(superId);
-
-    ownEventId = await mkEvent('own-event', editorId, 'a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1');
-    foreignEventId = await mkEvent('foreign-event', superId, FOREIGN_SHARE_TOKEN);
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/v1', require('../../src/routes/v1/events'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('lists only the token owner\'s events', async () => {
-    const res = await request(app)
-      .get('/api/v1/events')
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect(res.status).toBe(200);
-    const slugs = res.body.events.map((e) => e.slug);
-    expect(slugs).toContain('own-event');
-    expect(slugs).not.toContain('foreign-event');
-  });
-
-  it('refuses to read a foreign event', async () => {
-    const res = await request(app)
-      .get(`/api/v1/events/${foreignEventId}`)
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect([403, 404]).toContain(res.status);
-  });
-
-  it('does NOT hand out a foreign event\'s share_token', async () => {
-    const res = await request(app)
-      .get(`/api/v1/events/${foreignEventId}/share-link`)
-      .set('Authorization', `Bearer ${editorToken}`);
-
-    expect([403, 404]).toContain(res.status);
-    expect(JSON.stringify(res.body)).not.toContain(FOREIGN_SHARE_TOKEN);
-  });
-
-  it('still allows the owner to read their own event and share link', async () => {
-    const detail = await request(app)
-      .get(`/api/v1/events/${ownEventId}`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect(detail.status).toBe(200);
-
-    const share = await request(app)
-      .get(`/api/v1/events/${ownEventId}/share-link`)
-      .set('Authorization', `Bearer ${editorToken}`);
-    expect(share.status).toBe(200);
-    expect(share.body.share_token).toBe('a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1');
-  });
-
-  it('leaves super_admin tokens unrestricted', async () => {
-    const res = await request(app)
-      .get(`/api/v1/events/${foreignEventId}/share-link`)
-      .set('Authorization', `Bearer ${superToken}`);
-    expect(res.status).toBe(200);
-    expect(res.body.share_token).toBe(FOREIGN_SHARE_TOKEN);
-  });
-});

backend/__tests__/routes/v1TokenPermissions.test.js

@@ -1,108 +0,0 @@
-/**
- * v1 token scopes must intersect the owner's CURRENT role permissions
- * (GHSA-9697, codex round 2).
- *
- * Migration 081 documents effective permissions as the intersection of the
- * owner's role permissions and the token's scope flags. requireApiScope only
- * ever checked the scope half, so a token minted while its owner was
- * super_admin kept full write access after the owner was demoted to viewer —
- * userManagementService never touches api_tokens, so the token outlives the
- * demotion. Ownership scoping alone does not close this: the demoted owner
- * still *owns* their events.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-v1perm-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'v1perm-test-secret';
-process.env.STORAGE_PATH = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-v1perm-storage-'));
-
-const request = require('supertest');
-const express = require('express');
-const bcrypt = require('bcrypt');
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-const { generateApiToken } = require('../../src/middleware/apiTokenAuth');
-
-describe('v1 token scopes intersect role permissions (GHSA-9697)', () => {
-  let db; let cleanup; let app; let viewerToken; let viewerEventId;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    const role = await db('roles').where({ name: 'viewer' }).first();
-    const r = await db('admin_users').insert({
-      username: 'demoted-owner',
-      email: 'demoted@example.com',
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id,
-      is_active: 1,
-      created_at: new Date(),
-      updated_at: new Date(),
-    }).returning('id');
-    const ownerId = r[0]?.id ?? r[0];
-
-    // A token still carrying the broad 'admin' scope from before demotion.
-    const { plaintext, hashed } = generateApiToken();
-    await db('api_tokens').insert({
-      name: 'stale-token',
-      hashed_token: hashed,
-      scopes: 'admin',
-      created_by: ownerId,
-      created_at: new Date().toISOString(),
-    });
-    viewerToken = plaintext;
-
-    const ev = await db('events').insert({
-      slug: 'viewer-ev',
-      event_type: 'wedding',
-      event_name: 'Viewer Event',
-      event_date: '2026-08-01',
-      host_email: 'h@example.com',
-      admin_email: 'a@example.com',
-      password_hash: 'x',
-      share_token: 'vtok',
-      share_link: '/gallery/viewer-ev/vtok',
-      created_by: ownerId,
-      expires_at: new Date(Date.now() + 7 * 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    viewerEventId = ev[0]?.id ?? ev[0];
-
-    app = express();
-    app.use(express.json());
-    app.use('/api/v1', require('../../src/routes/v1/events'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('denies event creation to a demoted viewer despite an admin-scope token', async () => {
-    const res = await request(app)
-      .post('/api/v1/events')
-      .set('Authorization', `Bearer ${viewerToken}`)
-      .send({ event_name: 'Nope', event_type: 'wedding' });
-    expect(res.status).toBe(403);
-  });
-
-  it('denies photo upload to a demoted viewer on their OWN event', async () => {
-    const res = await request(app)
-      .post(`/api/v1/events/${viewerEventId}/photos`)
-      .set('Authorization', `Bearer ${viewerToken}`)
-      .attach('photo', Buffer.from('x'), 'a.jpg');
-    expect(res.status).toBe(403);
-  });
-
-  it('still allows the viewer to READ their own event', async () => {
-    const res = await request(app)
-      .get(`/api/v1/events/${viewerEventId}`)
-      .set('Authorization', `Bearer ${viewerToken}`);
-    expect(res.status).toBe(200);
-  });
-});

backend/__tests__/services/backupIntegrityService.test.js

@@ -22,7 +22,7 @@ const crypto = require('crypto');
 
 const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
 
-jest.setTimeout(120000);
+jest.setTimeout(30000);
 
 describe('backupIntegrityService.verifyDocumentArtefacts', () => {
   let db;

backend/__tests__/services/backupRestoreHardening.test.js

@@ -1,241 +0,0 @@
-/**
- * Backup/restore hardening — GHSA-h652 (unbounded gunzip) and GHSA-hgp8
- * (unkeyed manifest checksum).
- *
- * h652: decompressFile() piped gunzip straight to disk with no expanded-size
- * bound, so a small crafted .gz could fill the volume.
- *
- * hgp8: the manifest checksum is a plain SHA-256 — it proves the manifest was
- * not corrupted, not that it is authentic. BACKUP_MANIFEST_KEY upgrades new
- * manifests to a keyed HMAC. It is deliberately OPT-IN and verify-if-present:
- * the key cannot live in the database (the database is inside the backup), so
- * a mandatory HMAC would lock an operator out of the exact disaster-recovery
- * case this system exists for.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const zlib = require('zlib');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-bkharden-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'bkharden-test-secret';
-
-const { restoreService } = require('../../src/services/restoreService');
-const backupManifest = require('../../src/services/backupManifest');
-
-describe('decompressFile expanded-size bound (GHSA-h652)', () => {
-  let dir;
-
-  beforeAll(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-gz-')); });
-  afterAll(() => { fs.rmSync(dir, { recursive: true, force: true }); });
-  afterEach(() => { delete process.env.RESTORE_MAX_DECOMPRESSED_BYTES; });
-
-  it('aborts when the decompressed stream exceeds the limit', async () => {
-    // 5 MB of zeroes compresses to a few KB — the classic shape of the attack.
-    const gzPath = path.join(dir, 'bomb.gz');
-    fs.writeFileSync(gzPath, zlib.gzipSync(Buffer.alloc(5 * 1024 * 1024, 0)));
-
-    process.env.RESTORE_MAX_DECOMPRESSED_BYTES = String(64 * 1024); // 64 KB
-    await expect(
-      restoreService.decompressFile(gzPath, path.join(dir, 'out-bomb'))
-    ).rejects.toThrow(/exceeds limit/i);
-  });
-
-  it('still decompresses a normal file within the limit', async () => {
-    const payload = Buffer.from('SELECT 1;\n'.repeat(100));
-    const gzPath = path.join(dir, 'ok.gz');
-    fs.writeFileSync(gzPath, zlib.gzipSync(payload));
-
-    const outPath = path.join(dir, 'out-ok');
-    await restoreService.decompressFile(gzPath, outPath);
-    expect(fs.readFileSync(outPath)).toEqual(payload);
-  });
-});
-
-describe('manifest checksum keying (GHSA-hgp8)', () => {
-  // validateManifest requires all of these sections to be present.
-  const baseManifest = () => ({
-    manifest: { version: '1.0', id: 'test' },
-    backup: { type: 'full' },
-    system: { platform: 'linux' },
-    application: { version: '1.0.0' },
-    files: { count: 1, manifest: [{ path: 'a.jpg', size: 1 }] },
-    database: { type: 'sqlite' },
-    verification: { total_checksum: null, checksum_algorithm: null },
-  });
-
-  afterEach(() => { delete process.env.BACKUP_MANIFEST_KEY; });
-
-  it('produces a different digest when a key is set', () => {
-    const m = baseManifest();
-    const unkeyed = backupManifest.calculateManifestChecksum(m, { keyed: false });
-    const keyed = backupManifest.calculateManifestChecksum(m, { keyed: 'secret-key' });
-    expect(keyed).not.toBe(unkeyed);
-  });
-
-  it('validates a legacy unkeyed manifest even when a key IS configured', () => {
-    // Disaster recovery: manifests written before keying must not become
-    // un-restorable the moment the operator sets a key.
-    const m = baseManifest();
-    m.verification.checksum_algorithm = 'sha256';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: false });
-
-    process.env.BACKUP_MANIFEST_KEY = 'secret-key';
-    expect(() => backupManifest.validateManifest(m)).not.toThrow();
-  });
-
-  it('accepts a keyed manifest when the matching key is configured', () => {
-    process.env.BACKUP_MANIFEST_KEY = 'secret-key';
-    const m = baseManifest();
-    m.verification.checksum_algorithm = 'hmac-sha256';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: 'secret-key' });
-
-    expect(() => backupManifest.validateManifest(m)).not.toThrow();
-  });
-
-  it('rejects a keyed manifest whose body was tampered with', () => {
-    process.env.BACKUP_MANIFEST_KEY = 'secret-key';
-    const m = baseManifest();
-    m.verification.checksum_algorithm = 'hmac-sha256';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: 'secret-key' });
-
-    m.files.manifest[0].path = '../../etc/passwd';
-    expect(() => backupManifest.validateManifest(m)).toThrow(/checksum verification failed/i);
-  });
-
-  it('does NOT brick restore when a keyed manifest meets a missing key', () => {
-    // Key lost with the host — the precise moment a restore is needed.
-    const m = baseManifest();
-    m.verification.checksum_algorithm = 'hmac-sha256';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: 'secret-key' });
-
-    delete process.env.BACKUP_MANIFEST_KEY;
-    expect(() => backupManifest.validateManifest(m)).not.toThrow();
-  });
-});
-
-describe('manifest checksum coverage (canonicalization)', () => {
-  const fullManifest = () => ({
-    manifest: { version: '1.0', id: 'test' },
-    backup: { type: 'full' },
-    system: { platform: 'linux' },
-    application: { version: '1.0.0' },
-    files: { count: 1, manifest: [{ path: 'a.jpg', size: 1 }] },
-    database: { type: 'sqlite' },
-    verification: { total_checksum: null, checksum_algorithm: 'sha256' },
-  });
-
-  afterEach(() => { delete process.env.BACKUP_MANIFEST_KEY; });
-
-  it('covers nested file entries (the old replacer dropped them)', () => {
-    const m = fullManifest();
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: false });
-    // Tampering a file path must now change the digest.
-    m.files.manifest[0].path = '../../etc/passwd';
-    expect(() => backupManifest.validateManifest(m)).toThrow(/checksum verification failed/i);
-  });
-
-  it('still accepts a manifest written with the legacy serialization', () => {
-    const m = fullManifest();
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(
-      m, { keyed: false, legacy: true }
-    );
-    expect(() => backupManifest.validateManifest(m)).not.toThrow();
-  });
-});
-
-describe('checksum verification is shared and downgrade-aware (codex round 2)', () => {
-  const fullManifest = () => ({
-    manifest: { version: '1.0', id: 'test' },
-    backup: { type: 'full' },
-    system: { platform: 'linux' },
-    application: { version: '1.0.0' },
-    files: { count: 1, manifest: [{ path: 'a.jpg', size: 1 }] },
-    database: { type: 'sqlite' },
-    verification: { total_checksum: null, checksum_algorithm: 'sha256' },
-  });
-
-  afterEach(() => {
-    delete process.env.BACKUP_MANIFEST_KEY;
-    delete process.env.BACKUP_MANIFEST_REQUIRE_KEYED;
-  });
-
-  it('accepts a legacy-serialized manifest through the SHARED verifier', () => {
-    // restoreService recomputed the digest itself with the canonical
-    // serializer, which rejected every pre-existing backup.
-    const m = fullManifest();
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(
-      m, { keyed: false, legacy: true },
-    );
-    const res = backupManifest.verifyManifestChecksum(m);
-    expect(res.valid).toBe(true);
-    expect(res.warnings.join(' ')).toMatch(/legacy checksum serialization/i);
-  });
-
-  it('warns but accepts an unkeyed manifest when a key is configured', () => {
-    const m = fullManifest();
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: false });
-    process.env.BACKUP_MANIFEST_KEY = 'secret-key';
-
-    const res = backupManifest.verifyManifestChecksum(m);
-    expect(res.valid).toBe(true);
-    expect(res.warnings.join(' ')).toMatch(/authenticity NOT established/i);
-  });
-
-  it('REJECTS the algorithm downgrade once REQUIRE_KEYED is on', () => {
-    // Attacker rewrites the manifest, strips checksum_algorithm and recomputes
-    // a plain SHA-256. With the strict flag set that must not verify.
-    const m = fullManifest();
-    m.files.manifest[0].path = '../../etc/passwd';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: false });
-
-    process.env.BACKUP_MANIFEST_KEY = 'secret-key';
-    process.env.BACKUP_MANIFEST_REQUIRE_KEYED = 'true';
-
-    const res = backupManifest.verifyManifestChecksum(m);
-    expect(res.valid).toBe(false);
-    expect(res.error).toMatch(/downgrade/i);
-  });
-
-  it('rejects a keyed manifest with no key when REQUIRE_KEYED is on', () => {
-    const m = fullManifest();
-    m.verification.checksum_algorithm = 'hmac-sha256';
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: 'k' });
-    process.env.BACKUP_MANIFEST_REQUIRE_KEYED = 'true';
-
-    expect(backupManifest.verifyManifestChecksum(m).valid).toBe(false);
-  });
-
-  it('REJECTS a manifest whose checksum was stripped entirely', () => {
-    // The cheapest bypass of every rule above: delete the field instead of
-    // forging it. Both the helper's early return and restoreService's
-    // `if (…total_checksum)` guard used to wave that through.
-    const m = fullManifest();
-    delete m.verification.total_checksum;
-
-    const res = backupManifest.verifyManifestChecksum(m);
-    expect(res.valid).toBe(false);
-    expect(res.error).toMatch(/no checksum/i);
-
-    delete m.verification;
-    expect(backupManifest.verifyManifestChecksum(m).valid).toBe(false);
-  });
-
-  it('REJECTS an unkeyed manifest under REQUIRE_KEYED even with no key configured', () => {
-    // Strict mode is a claim about the manifests, not about this host — so a
-    // fresh disaster-recovery box that lost BACKUP_MANIFEST_KEY must not
-    // silently start accepting plain SHA-256 manifests again.
-    const m = fullManifest();
-    m.verification.total_checksum = backupManifest.calculateManifestChecksum(m, { keyed: false });
-    process.env.BACKUP_MANIFEST_REQUIRE_KEYED = 'true';
-    delete process.env.BACKUP_MANIFEST_KEY;
-
-    const res = backupManifest.verifyManifestChecksum(m);
-    expect(res.valid).toBe(false);
-    expect(res.error).toMatch(/downgrade/i);
-  });
-});

backend/__tests__/services/chunkedUploadFilename.test.js

@@ -1,52 +0,0 @@
-const path = require('path');
-const os = require('os');
-const fs = require('fs').promises;
-
-// Point storage at a throwaway temp dir before requiring the service so the
-// module-level getStoragePath() picks it up if evaluated.
-process.env.STORAGE_PATH = path.join(os.tmpdir(), `picpeak-chunk-test-${process.pid}`);
-
-const chunkedUpload = require('../../src/services/chunkedUploadService');
-
-describe('chunkedUploadService.initializeUpload filename sanitisation (GHSA-pc72-jf53-w28j)', () => {
-  afterAll(async () => {
-    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true }).catch(() => {});
-  });
-
-  it('strips directory-traversal components from the stored filename', async () => {
-    const { uploadId } = await chunkedUpload.initializeUpload({
-      filename: '../../uploads/logos/evil.svg',
-      fileSize: 10,
-      mimeType: 'video/mp4',
-      eventId: 1,
-      totalChunks: 1,
-    });
-    const meta = chunkedUpload.getUploadStatus(uploadId);
-    // basename('../../uploads/logos/evil.svg') === 'evil.svg' — the traversal
-    // is gone, so path.join(tempDir, filename) can no longer escape tempDir.
-    expect(meta.filename).toBe('evil.svg');
-  });
-
-  it('keeps a normal filename intact', async () => {
-    const { uploadId } = await chunkedUpload.initializeUpload({
-      filename: 'clip.mp4',
-      fileSize: 10,
-      mimeType: 'video/mp4',
-      eventId: 1,
-      totalChunks: 1,
-    });
-    expect(uploadId).toBeTruthy();
-  });
-
-  it('rejects a filename that collapses to nothing', async () => {
-    await expect(
-      chunkedUpload.initializeUpload({
-        filename: '../',
-        fileSize: 10,
-        mimeType: 'video/mp4',
-        eventId: 1,
-        totalChunks: 1,
-      })
-    ).rejects.toThrow(/Invalid filename/);
-  });
-});

backend/__tests__/services/emailIntakeCaps.test.js

@@ -1,127 +0,0 @@
-/**
- * Inbound-mail resource caps (GHSA-2qf9).
- *
- * emailIntakeService downloaded, parsed and persisted every message with no
- * size, attachment-count or attachment-byte limit. Anyone who can email the
- * operator's mailbox reaches this path unauthenticated.
- *
- * The teeth were in the dedup key: on failure the service wrote an error row
- * keyed `err-<uid>-<Date.now()>`, which can never match the envelope-derived
- * `messageId` the dedup pass compares against. So the same oversized message
- * was re-downloaded every poll interval forever — and an OOM-kill/restart just
- * resumed the loop. This pins that an over-limit message is (a) never
- * downloaded and (b) recorded under its REAL message id so it dedups.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-intake-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'intake-test-secret';
-process.env.EMAIL_INTAKE_MAX_MESSAGE_BYTES = '1000';
-
-const OVERSIZED_UID = 11;
-const NORMAL_UID = 12;
-const OVERSIZED_MSGID = '<huge@example.com>';
-
-const fetchOneCalls = [];
-
-jest.mock('imapflow', () => ({
-  ImapFlow: class {
-    async connect() {}
-    async logout() {}
-    async getMailboxLock() { return { release() {} }; }
-    async search() { return [OVERSIZED_UID, NORMAL_UID]; }
-    // Envelope pass now also returns `size`.
-    async *fetch() {
-      yield { uid: OVERSIZED_UID, size: 50_000, envelope: { messageId: OVERSIZED_MSGID } };
-      yield { uid: NORMAL_UID, size: 500, envelope: { messageId: '<ok@example.com>' } };
-    }
-    async fetchOne(uid) {
-      fetchOneCalls.push(String(uid));
-      return { source: Buffer.from('Subject: ok\r\n\r\nbody') };
-    }
-    async messageFlagsAdd() { return true; }
-  },
-}));
-
-jest.mock('mailparser', () => ({
-  simpleParser: async () => ({
-    messageId: '<ok@example.com>',
-    subject: 'ok',
-    date: new Date(),
-    attachments: [],
-    text: 'body',
-    html: null,
-  }),
-}));
-
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('email intake caps (GHSA-2qf9)', () => {
-  let db; let cleanup; let intake;
-
-  let pollResult;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-
-    // pollOnce short-circuits unless the feature flag is on AND an IMAP
-    // account is configured — without both, this suite would pass vacuously.
-    await db('feature_flags')
-      .insert({ key: 'incomingMail', value: 1 })
-      .onConflict('key').merge({ value: 1 });
-    // getImapConfig() reads email_configs.first() — seedMinimal may already
-    // have inserted a row, so update that one rather than adding a second
-    // (the first row would win and report "unconfigured").
-    const imapFields = {
-      imap_host: 'imap.example.com',
-      imap_user: 'intake@example.com',
-      imap_pass: 'x',
-      imap_folder: 'INBOX',
-    };
-    const existingCfg = await db('email_configs').first();
-    if (existingCfg) {
-      await db('email_configs').where({ id: existingCfg.id }).update(imapFields);
-    } else {
-      await db('email_configs').insert({
-        smtp_host: 'smtp.example.com',
-        smtp_port: 587,
-        from_email: 'intake@example.com',
-        ...imapFields,
-      });
-    }
-
-    intake = require('../../src/services/emailIntakeService');
-    pollResult = await intake.pollOnce().catch((e) => ({ thrown: e.message }));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it('actually ran the poll (guards against a vacuous suite)', () => {
-    expect(pollResult).toBeDefined();
-    expect(pollResult.skipped).toBeUndefined();
-  });
-
-  it('never downloads a message whose envelope size exceeds the cap', () => {
-    // The oversized uid must never reach fetchOne (the source download) —
-    // that download is the DoS. The normal one must still be processed.
-    expect(fetchOneCalls).not.toContain(String(OVERSIZED_UID));
-    expect(fetchOneCalls).toContain(String(NORMAL_UID));
-  });
-
-  it('records the skip under the REAL message id so it dedups next poll', async () => {
-    const row = await db('received_emails').where({ message_id: OVERSIZED_MSGID }).first();
-    expect(row).toBeTruthy();
-    expect(row.status).toBe('error');
-    expect(String(row.error)).toMatch(/too large/i);
-    // The whole point: keyed by messageId, NOT err-<uid>-<timestamp>, which
-    // could never match the dedup pass and so looped forever.
-    expect(row.message_id).not.toMatch(/^err-/);
-  });
-});

backend/__tests__/services/environmentUpdateInstructions.test.js

@@ -1,58 +0,0 @@
-/**
- * Regression tests for the Docker update instructions (environmentService).
- *
- * A production install (docker-compose.production.yml) must get `-f
- * docker-compose.production.yml` in every update command — bare `docker compose`
- * targets docker-compose.yml, a different build-based stack that also starts the
- * dev-only mailhog, which left production users stranded on the old version
- * (reported against 3.44.0 → 3.45.2).
- */
-const { detectEnvironment, generateUpdateInstructions } = require('../../src/services/environmentService');
-
-describe('detectEnvironment — production compose detection', () => {
-  const orig = process.env.PICPEAK_RELEASE_CHANNEL;
-  afterEach(() => {
-    if (orig === undefined) delete process.env.PICPEAK_RELEASE_CHANNEL;
-    else process.env.PICPEAK_RELEASE_CHANNEL = orig;
-  });
-
-  it('flags isProductionCompose when PICPEAK_RELEASE_CHANNEL is set', async () => {
-    process.env.PICPEAK_RELEASE_CHANNEL = 'stable';
-    const env = await detectEnvironment();
-    expect(env.isProductionCompose).toBe(true);
-  });
-
-  it('does not flag it when the var is absent (default docker-compose.yml)', async () => {
-    delete process.env.PICPEAK_RELEASE_CHANNEL;
-    const env = await detectEnvironment();
-    expect(env.isProductionCompose).toBe(false);
-  });
-});
-
-describe('generateUpdateInstructions — Docker commands', () => {
-  const cmds = (env) => generateUpdateInstructions(env, '3.45.2').steps.map((s) => s.command);
-
-  it('targets docker-compose.production.yml for a production install', () => {
-    const commands = cmds({ isDocker: true, isProductionCompose: true });
-    expect(commands).toEqual([
-      'docker compose -f docker-compose.production.yml pull',
-      'docker compose -f docker-compose.production.yml up -d',
-      'docker compose -f docker-compose.production.yml logs -f backend',
-    ]);
-    // And the warning tells them where to run it.
-    const { warnings } = generateUpdateInstructions({ isDocker: true, isProductionCompose: true }, '3.45.2');
-    expect(warnings.join(' ')).toMatch(/docker-compose\.production\.yml/);
-  });
-
-  it('uses bare commands + a hint when not a production compose', () => {
-    const commands = cmds({ isDocker: true, isProductionCompose: false });
-    expect(commands).toEqual([
-      'docker compose pull',
-      'docker compose up -d',
-      'docker compose logs -f backend',
-    ]);
-    const { warnings } = generateUpdateInstructions({ isDocker: true, isProductionCompose: false }, '3.45.2');
-    // Still nudges production users to add -f in case detection missed.
-    expect(warnings.join(' ')).toMatch(/-f docker-compose\.production\.yml/);
-  });
-});

backend/__tests__/services/picpeakReinjectAdmin.test.js

@@ -1,111 +0,0 @@
-/**
- * Regression tests for reinjectCurrentAdmin — the operator-preservation step of
- * the .picpeak restore (GHSA-qxfx-4493-4v8f follow-up). Runs against a real
- * in-memory SQLite DB so the UNIQUE(email)/UNIQUE(username) constraints behave
- * as in production. Reconciliation is non-destructive (update-in-place / rename,
- * never delete) so restored rows referenced by FKs keep their ids.
- */
-const knex = require('knex');
-
-let db;
-let reinjectCurrentAdmin;
-
-beforeAll(() => {
-  jest.doMock('../../knexfile', () => ({ client: 'sqlite3' }), { virtual: false });
-  reinjectCurrentAdmin = require('../../src/services/picpeakImportService').reinjectCurrentAdmin;
-});
-
-beforeEach(async () => {
-  db = knex({ client: 'sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true });
-  await db.schema.createTable('admin_users', (t) => {
-    t.increments('id');
-    t.string('username').notNullable().unique();
-    t.string('email').notNullable().unique();
-    t.string('password_hash');
-    t.boolean('is_active').defaultTo(true);
-    t.boolean('must_change_password').defaultTo(false);
-    t.integer('role_id');
-    t.integer('created_by');
-    t.boolean('two_factor_enabled').defaultTo(false);
-    t.string('two_factor_secret');
-    t.text('two_factor_recovery_codes');
-  });
-});
-
-afterEach(async () => { await db.destroy(); });
-
-const operator = {
-  id: 1, username: 'admin', email: 'op@example.com',
-  password_hash: 'OP_HASH', is_active: 1, must_change_password: 0, role_id: 1, created_by: 99,
-  two_factor_enabled: 1, two_factor_secret: 'OP_SECRET', two_factor_recovery_codes: '["a","b"]',
-};
-
-test('restores login + MFA in place, keeping the row id and its FK columns (FK-safe)', async () => {
-  await db('admin_users').insert({
-    id: 7, username: 'someoneelse', email: 'OP@example.com',
-    password_hash: 'ATTACKER', is_active: 1, must_change_password: 0, role_id: 4, created_by: 5,
-    two_factor_enabled: 0, two_factor_secret: 'ATTACKER_SECRET', two_factor_recovery_codes: null,
-  });
-  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
-
-  const rows = await db('admin_users');
-  expect(rows).toHaveLength(1);
-  const row = rows[0];
-  expect(row.id).toBe(7);                            // id preserved → FK refs hold
-  expect(row.username).toBe('admin');
-  expect(row.password_hash).toBe('OP_HASH');
-  expect(Boolean(row.two_factor_enabled)).toBe(true);
-  expect(row.two_factor_secret).toBe('OP_SECRET');   // attacker MFA secret gone
-  expect(row.two_factor_recovery_codes).toBe('["a","b"]');
-  // Relationship/audit FKs are NOT forced from the operator snapshot (avoids
-  // dangling role_id/created_by on a cross-instance restore) — the restored
-  // row keeps its own already-valid values.
-  expect(row.role_id).toBe(4);
-  expect(row.created_by).toBe(5);
-});
-
-test('renames (not deletes) a different row holding the operator username', async () => {
-  await db('admin_users').insert({
-    id: 3, username: 'admin', email: 'other@instance.test',
-    password_hash: 'OTHER', is_active: 1, role_id: 4,
-  });
-  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // the other admin survives (FK-safe)
-  const other = rows.find((r) => r.id === 3);
-  expect(other.username).toBe('admin__restored_3');  // renamed, id kept
-  expect(other.email).toBe('other@instance.test');
-  const op = rows.find((r) => r.username === 'admin');
-  expect(op.password_hash).toBe('OP_HASH');
-});
-
-test('reconciles email and username colliding with DIFFERENT rows without deleting either', async () => {
-  await db('admin_users').insert([
-    { id: 4, username: 'someoneelse', email: 'op@example.com', password_hash: 'A', role_id: 4 },
-    { id: 5, username: 'admin', email: 'other@instance.test', password_hash: 'B', role_id: 4 },
-  ]);
-  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // both rows survive
-  const opRow = rows.find((r) => r.id === 4);         // email match updated in place
-  expect(opRow.username).toBe('admin');
-  expect(opRow.password_hash).toBe('OP_HASH');
-  const renamed = rows.find((r) => r.id === 5);       // username holder renamed, not deleted
-  expect(renamed.username).toBe('admin__restored_5');
-});
-
-test('inserts the operator with a non-colliding id when neither key exists in the backup', async () => {
-  await db('admin_users').insert({
-    id: 9, username: 'backupadmin', email: 'backup@instance.test', password_hash: 'B', role_id: 1,
-  });
-  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
-
-  const rows = await db('admin_users').orderBy('id');
-  expect(rows).toHaveLength(2);                       // backup admin untouched
-  const opRow = rows.find((r) => r.username === 'admin');
-  expect(opRow.password_hash).toBe('OP_HASH');
-  expect(opRow.id).toBe(10);                          // max(9)+1, no collision
-  expect(opRow.created_by).toBeNull();                // self-ref FK nulled so the insert can't dangle
-});

backend/__tests__/services/projectDealLineageOwnership.test.js

@@ -1,229 +0,0 @@
-/**
- * Deal-lineage ownership on project attach (GHSA-wrg5, codex round 3).
- *
- * requireProjectOwnership vets only the DESTINATION project. Attaching a quote
- * cascades through linkDealToProject, which re-points every event the deal
- * produced into that project — so an editor could create an empty project of
- * their own, attach another admin's quote, and pull that admin's events (and
- * the invoices, emails and gallery that roll up with them) into a project they
- * own and can read via /:id/overview. An unassigned project offered no
- * resistance either: it ADOPTS the deal's customer rather than rejecting it.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-deallineage-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'deallineage-test-secret';
-
-const bcrypt = require('bcrypt');
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('linkDealToProject enforces lineage ownership (GHSA-wrg5, round 3)', () => {
-  let db; let cleanup; let projectService;
-  let editorA; let editorB; let superAdmin;
-  let customerId;
-
-  const mkAdmin = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username, email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id, is_active: 1,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-  const mkProject = async (name, createdBy) => {
-    const r = await db('projects').insert({
-      name, status: 'active', created_by: createdBy,
-      created_at: new Date(), updated_at: new Date(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-  const mkEvent = async (slug, createdBy) => {
-    const r = await db('events').insert({
-      slug, event_type: 'wedding', event_name: slug, event_date: '2026-08-01',
-      host_email: 'h@e.com', admin_email: 'a@e.com', password_hash: 'x',
-      share_token: `t-${slug}`, share_link: `/g/${slug}/t-${slug}`,
-      created_by: createdBy,
-      expires_at: new Date(Date.now() + 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-  const mkQuote = async (dealUuid, convertedEventId) => {
-    const r = await db('quotes').insert({
-      quote_number: `Q-${dealUuid}`,
-      customer_account_id: customerId,
-      deal_uuid: dealUuid,
-      converted_event_id: convertedEventId,
-      status: 'accepted',
-      currency: 'EUR',
-      issue_date: '2026-08-01',
-      total_amount_minor: 1000,
-      created_at: new Date().toISOString(),
-      updated_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    projectService = require('../../src/services/projectService');
-    editorA = await mkAdmin('deal-a', 'editor');
-    editorB = await mkAdmin('deal-b', 'editor');
-    superAdmin = await mkAdmin('deal-root', 'super_admin');
-    const c = await db('customer_accounts').first('id');
-    customerId = c.id;
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  it("refuses to move another admin's event into the caller's project", async () => {
-    const victimEvent = await mkEvent('victim-gala', editorB);
-    const quoteId = await mkQuote('deal-foreign', victimEvent);
-    const attackerProject = await mkProject('attacker-empty', editorA);
-
-    await expect(
-      projectService.assignQuote(attackerProject, quoteId, { id: editorA, roleName: 'editor' }),
-    ).rejects.toMatchObject({ code: 'DEAL_EVENT_FORBIDDEN' });
-
-    // Nothing may be half-applied: neither the event nor the quote moved.
-    const ev = await db('events').where({ id: victimEvent }).first('project_id');
-    expect(ev.project_id == null).toBe(true);
-    const q = await db('quotes').where({ id: quoteId }).first('project_id');
-    expect(q.project_id == null).toBe(true);
-  });
-
-  it("allows the caller's own event through the same path", async () => {
-    const ownEvent = await mkEvent('own-gala', editorA);
-    const quoteId = await mkQuote('deal-own', ownEvent);
-    const project = await mkProject('attacker-own', editorA);
-
-    await projectService.assignQuote(project, quoteId, { id: editorA, roleName: 'editor' });
-
-    const ev = await db('events').where({ id: ownEvent }).first('project_id');
-    expect(Number(ev.project_id)).toBe(Number(project));
-  });
-
-  it('leaves super_admin unrestricted', async () => {
-    const victimEvent = await mkEvent('root-gala', editorB);
-    const quoteId = await mkQuote('deal-root', victimEvent);
-    const project = await mkProject('root-project', superAdmin);
-
-    await projectService.assignQuote(project, quoteId, { id: superAdmin, roleName: 'super_admin' });
-
-    const ev = await db('events').where({ id: victimEvent }).first('project_id');
-    expect(Number(ev.project_id)).toBe(Number(project));
-  });
-
-  it('resolves the role from a bare admin id (quote/contract create+update paths)', async () => {
-    // Those services thread `adminId`, not req.admin — the lookup must still
-    // scope them, and must fail closed rather than assume super_admin.
-    const victimEvent = await mkEvent('bare-gala', editorB);
-    const quoteId = await mkQuote('deal-bare', victimEvent);
-    const project = await mkProject('bare-project', editorA);
-
-    await expect(
-      projectService.assignQuote(project, quoteId, { id: editorA }),
-    ).rejects.toMatchObject({ code: 'DEAL_EVENT_FORBIDDEN' });
-  });
-
-  // The lineage guard above only fires once a deal has produced an event. The
-  // quote/contract create+update paths call linkDealToProject with a
-  // body-supplied projectId and NO route-level ownership guard, so a brand-new
-  // deal (eventIds empty) skipped every check and wrote into a foreign project.
-  describe('destination ownership (codex review follow-up)', () => {
-    it('refuses a foreign project even when the deal has no events yet', async () => {
-      const victimProject = await mkProject('victim-destination', editorB);
-      const quoteId = await mkQuote('deal-no-events', null);
-
-      await expect(
-        projectService.linkDealToProject('deal-no-events', victimProject, db, { id: editorA }),
-      ).rejects.toMatchObject({ code: 'PROJECT_NOT_FOUND' });
-
-      const q = await db('quotes').where({ id: quoteId }).first('project_id');
-      expect(q.project_id == null).toBe(true);
-    });
-
-    it('refuses an OWNERLESS project with no events (the escalation path)', async () => {
-      // created_by NULL + no linked events is exactly the shape that would let
-      // the caller claim the project via ownedProjectsSubquery's second branch
-      // once their quote converts to an event.
-      const orphan = await mkProject('orphan-destination', null);
-      await mkQuote('deal-orphan', null);
-
-      await expect(
-        projectService.linkDealToProject('deal-orphan', orphan, db, { id: editorA }),
-      ).rejects.toMatchObject({ code: 'PROJECT_NOT_FOUND' });
-    });
-
-    it("still allows the caller's own project with no events", async () => {
-      const own = await mkProject('own-destination', editorA);
-      const quoteId = await mkQuote('deal-own-dest', null);
-
-      await projectService.linkDealToProject('deal-own-dest', own, db, { id: editorA });
-
-      const q = await db('quotes').where({ id: quoteId }).first('project_id');
-      expect(Number(q.project_id)).toBe(Number(own));
-    });
-
-    it('refuses a foreign project when the deal_uuid is NULL (codex round 1)', async () => {
-      // deal_uuid is nullable (migration 107) and quoteService.update passes the
-      // EXISTING row's value, so a legacy quote reaches linkDealToProject with
-      // null. The old `if (!dealUuid || !projectId) return` bailed before the
-      // guard — while the caller had already written project_id onto its row.
-      const victimProject = await mkProject('victim-nulldeal', editorB);
-
-      await expect(
-        projectService.linkDealToProject(null, victimProject, db, { id: editorA }),
-      ).rejects.toMatchObject({ code: 'PROJECT_NOT_FOUND' });
-    });
-
-    it('still no-ops on a NULL deal_uuid pointed at the caller-s own project', async () => {
-      // The destination is vetted, then it returns without cascading — there is
-      // no lineage to move.
-      const own = await mkProject('own-nulldeal', editorA);
-      await expect(
-        projectService.linkDealToProject(null, own, db, { id: editorA }),
-      ).resolves.toBeUndefined();
-    });
-
-    it('does not leak customer association through the error code', async () => {
-      // The customer check used to run first, so a foreign project whose
-      // customer differed answered 422 PROJECT_CUSTOMER_MISMATCH while an
-      // unknown id answered 404 — enough to enumerate projects and infer their
-      // customer. Both must now be indistinguishable to a scoped caller.
-      const foreignWithCustomer = await mkProject('victim-customer', editorB);
-      await db('projects').where({ id: foreignWithCustomer }).update({ customer_account_id: customerId });
-      await mkQuote('deal-oracle', null);
-
-      await expect(
-        projectService.linkDealToProject('deal-oracle', foreignWithCustomer, db, { id: editorA }),
-      ).rejects.toMatchObject({ code: 'PROJECT_NOT_FOUND' });
-
-      await expect(
-        projectService.linkDealToProject('deal-oracle', 999999, db, { id: editorA }),
-      ).rejects.toMatchObject({ code: 'PROJECT_NOT_FOUND' });
-    });
-
-    it('leaves super_admin unrestricted on a foreign destination', async () => {
-      const victimProject = await mkProject('root-destination', editorB);
-      const quoteId = await mkQuote('deal-root-dest', null);
-
-      await projectService.linkDealToProject('deal-root-dest', victimProject, db, {
-        id: superAdmin, roleName: 'super_admin',
-      });
-
-      const q = await db('quotes').where({ id: quoteId }).first('project_id');
-      expect(Number(q.project_id)).toBe(Number(victimProject));
-    });
-  });
-});

backend/__tests__/services/projectOverviewEmailCanAct.test.js

@@ -1,149 +0,0 @@
-/**
- * getProjectOverview stamps each email with `canAct` — whether the queued-mail
- * routes (requireOwnedQueuedEmail) would actually accept an action on it.
- *
- * The cockpit used to derive this client-side from `event_id != null`, which is
- * weaker than the backend rule in a way that still produced dead controls:
- * requireOwnedQueuedEmail ALSO requires ownership of that event, while
- * getProjectOverview lists the project's events by project_id alone. Project
- * ownership does not imply event ownership — ownedProjectsSubquery's
- * `projects.created_by = admin.id` branch places no constraint on the linked
- * events' owners, so a super_admin can attach admin B's event to admin A's
- * project. See #969 / codex review round 1.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-canact-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'canact-test-secret';
-
-const bcrypt = require('bcrypt');
-const { bootCrmDb, seedMinimal } = require('../integration/helpers/crmDb');
-
-describe('getProjectOverview email canAct (#969)', () => {
-  let db; let cleanup; let projectService;
-  let adminA; let adminB; let superAdmin;
-  let projectId; let ownEventId; let foreignEventId; let ownerlessEventId;
-
-  const mkAdmin = async (username, roleName) => {
-    const role = await db('roles').where({ name: roleName }).first();
-    const r = await db('admin_users').insert({
-      username, email: `${username}@example.com`,
-      password_hash: await bcrypt.hash('Passw0rd!', 4),
-      role_id: role.id, is_active: 1,
-      created_at: new Date().toISOString(), updated_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const mkEvent = async (slug, createdBy, project) => {
-    const r = await db('events').insert({
-      slug, event_type: 'wedding', event_name: slug, event_date: '2026-08-01',
-      host_email: 'h@e.com', admin_email: 'a@e.com', password_hash: 'x',
-      share_token: `t-${slug}`, share_link: `/g/${slug}/t-${slug}`,
-      created_by: createdBy, project_id: project,
-      expires_at: new Date(Date.now() + 864e5).toISOString(),
-      is_active: 1, is_archived: 0, is_draft: 0,
-      created_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  const mkMail = async (eventId, type) => {
-    const r = await db('email_queue').insert({
-      recipient_email: 'kunde@example.com', email_type: type, status: 'sent',
-      event_id: eventId,
-      created_at: new Date().toISOString(), sent_at: new Date().toISOString(),
-    }).returning('id');
-    return r[0]?.id ?? r[0];
-  };
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    await seedMinimal(db);
-    projectService = require('../../src/services/projectService');
-
-    adminA = await mkAdmin('canact-a', 'editor');
-    adminB = await mkAdmin('canact-b', 'editor');
-    superAdmin = await mkAdmin('canact-root', 'super_admin');
-
-    const p = await db('projects').insert({
-      name: 'Cockpit canAct', status: 'active', created_by: adminA,
-      created_at: new Date().toISOString(), updated_at: new Date().toISOString(),
-    }).returning('id');
-    projectId = p[0]?.id ?? p[0];
-
-    // All three hang off adminA's project. Only the first is adminA's; the
-    // third is an ownerless legacy row, which filterOwnedEventIds treats as
-    // owned by whoever asks — but only once we know who is asking.
-    ownEventId = await mkEvent('canact-own', adminA, projectId);
-    foreignEventId = await mkEvent('canact-foreign', adminB, projectId);
-    ownerlessEventId = await mkEvent('canact-legacy', null, projectId);
-
-    await mkMail(ownEventId, 'gallery_ready');
-    await mkMail(foreignEventId, 'gallery_ready');
-    await mkMail(ownerlessEventId, 'gallery_ready');
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  const byEvent = (overview) => {
-    const m = new Map();
-    for (const e of overview.emails) m.set(e.eventId, e);
-    return m;
-  };
-
-  it('clears mail on an event the caller owns', async () => {
-    const overview = await projectService.getProjectOverview(
-      projectId, {}, { id: adminA, roleName: 'editor' },
-    );
-    expect(byEvent(overview).get(ownEventId).canAct).toBe(true);
-  });
-
-  it('denies mail on a foreign admin\'s event inside the caller\'s own project', async () => {
-    const overview = await projectService.getProjectOverview(
-      projectId, {}, { id: adminA, roleName: 'editor' },
-    );
-    // event_id is non-null here — the old client-side rule would have offered
-    // controls, and requireOwnedQueuedEmail would have 404'd them.
-    const row = byEvent(overview).get(foreignEventId);
-    expect(row.eventId).not.toBeNull();
-    expect(row.canAct).toBe(false);
-  });
-
-  it('clears everything for a super_admin', async () => {
-    const overview = await projectService.getProjectOverview(
-      projectId, {}, { id: superAdmin, roleName: 'super_admin' },
-    );
-    expect(overview.emails.every((e) => e.canAct === true)).toBe(true);
-  });
-
-  it('clears mail on an ownerless legacy event for an identified caller', async () => {
-    // Parity with filterOwnedEventIds, which allows created_by IS NULL.
-    const overview = await projectService.getProjectOverview(
-      projectId, {}, { id: adminA, roleName: 'editor' },
-    );
-    expect(byEvent(overview).get(ownerlessEventId).canAct).toBe(true);
-  });
-
-  it('denies everything when no admin context is supplied', async () => {
-    // Including the ownerless event: `created_by == null` must not read as
-    // "owned" when we do not know who is asking (codex review round 2).
-    const overview = await projectService.getProjectOverview(projectId, {});
-    expect(overview.emails.length).toBe(3);
-    expect(overview.emails.every((e) => e.canAct === false)).toBe(true);
-  });
-
-  it('does not leak event ownership to the client', async () => {
-    const overview = await projectService.getProjectOverview(
-      projectId, {}, { id: adminA, roleName: 'editor' },
-    );
-    expect(overview.events.length).toBe(3);
-    for (const e of overview.events) expect(e).not.toHaveProperty('created_by');
-  });
-});

backend/__tests__/services/publicSiteBrandTokens.test.js

@@ -1,91 +0,0 @@
-/**
- * Brand-token substitution must not reintroduce markup after sanitization
- * (GHSA-j347).
- *
- * buildCachedPayload sanitizes the operator's HTML and THEN calls
- * applyBrandTokens on the result, which did a plain `String.replace` with no
- * escaping. The default templates interpolate tokens into text and into quoted
- * attributes (`<img src="{{brand_logo_url}}" alt="{{company_name}} logo">`,
- * `href="mailto:{{support_email}}"`), so a token value could close the
- * attribute and inject markup into the public origin.
- *
- * The writer is settings.edit (super_admin only) and the CSP blocks inline
- * script, so this is defence-in-depth rather than a live RCE — but the
- * sanitize-then-substitute ordering is a real bug either way.
- */
-
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-process.env.NODE_ENV = 'test';
-process.env.TEST_DATABASE_PATH = path.join(
-  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-brandtok-')), 'db.sqlite',
-);
-process.env.JWT_SECRET = process.env.JWT_SECRET || 'brandtok-test-secret';
-
-const { _internal } = require('../../src/services/publicSiteService');
-
-// applyBrandTokens / sanitizeBrandUrl are module-private; the service exports
-// them under _internal for testing (see publicSiteService module.exports).
-const { applyBrandTokens, sanitizeBrandUrl } = _internal || {};
-
-const maybe = applyBrandTokens ? describe : describe.skip;
-
-maybe('applyBrandTokens escaping (GHSA-j347)', () => {
-  it('escapes markup in a text-position token', () => {
-    const out = applyBrandTokens('<p>{{company_name}}</p>', {
-      companyName: '<script>alert(1)</script>',
-    });
-    expect(out).not.toContain('<script>');
-    expect(out).toContain('&lt;script&gt;');
-  });
-
-  it('escapes a quote that would break out of an attribute', () => {
-    const out = applyBrandTokens(
-      '<img src="/x.png" alt="{{company_name}} logo">',
-      { companyName: '" onerror="alert(1)' },
-    );
-    // The injected quotes must be entity-encoded, so the payload stays INSIDE
-    // the alt value as text instead of terminating it and forming a real
-    // onerror attribute. (`onerror=` still appears as literal characters —
-    // that is inert; what matters is that no raw `"` closed the attribute.)
-    expect(out).not.toContain('" onerror="');
-    expect(out).toContain('&quot; onerror=&quot;');
-  });
-
-  it('escapes the logo url token used inside src="..."', () => {
-    const out = applyBrandTokens('<img src="{{brand_logo_url}}">', {
-      logoUrl: '" onerror="alert(1)',
-    });
-    expect(out).not.toContain('" onerror="');
-    expect(out).toContain('&quot;');
-  });
-
-  it('leaves ordinary values readable', () => {
-    const out = applyBrandTokens('<p>{{company_name}}</p>', { companyName: 'Acme Photos' });
-    expect(out).toContain('Acme Photos');
-  });
-});
-
-const maybeUrl = sanitizeBrandUrl ? describe : describe.skip;
-
-maybeUrl('sanitizeBrandUrl scheme allowlist (GHSA-j347)', () => {
-  it('rejects javascript: regardless of case', () => {
-    expect(sanitizeBrandUrl('javascript:alert(1)')).toBeNull();
-    // The old check was a case-sensitive startsWith and missed these.
-    expect(sanitizeBrandUrl('JavaScript:alert(1)')).toBeNull();
-    expect(sanitizeBrandUrl('  JAVASCRIPT:alert(1)')).toBeNull();
-  });
-
-  it('rejects other non-http schemes', () => {
-    expect(sanitizeBrandUrl('data:text/html;base64,PHN2Zz4=')).toBeNull();
-    expect(sanitizeBrandUrl('vbscript:msgbox(1)')).toBeNull();
-  });
-
-  it('keeps http(s) and relative logo paths working', () => {
-    expect(sanitizeBrandUrl('https://cdn.example.com/logo.png'))
-      .toBe('https://cdn.example.com/logo.png');
-    expect(sanitizeBrandUrl('/uploads/logos/logo.png')).toBe('/uploads/logos/logo.png');
-  });
-});

backend/__tests__/services/trackerFactory.test.js

@@ -27,7 +27,7 @@ let db; let cleanup;
 
 beforeAll(async () => {
   ({ db, cleanup } = await bootCrmDb());
-}, 120000);
+}, 30000);
 
 afterAll(async () => { if (cleanup) await cleanup(); });
 

backend/__tests__/services/userManagementService.activateDelete.test.js

@@ -48,7 +48,7 @@ describe('userManagementService — activate + delete (#574 follow-up)', () => {
       is_active: 1, created_at: new Date(),
     }).returning('id');
     targetId = targetInsert[0]?.id ?? targetInsert[0];
-  }, 120000);
+  }, 60000);
 
   afterAll(async () => {
     if (cleanup) await cleanup();

backend/__tests__/utils/feedbackPerGuestLimit.test.js

@@ -115,7 +115,7 @@ beforeAll(async () => {
     }).returning('id');
     photoIds.push(r[0]?.id ?? r[0]);
   }
-}, 120000);
+}, 30000);
 
 afterAll(async () => { if (cleanup) await cleanup(); });
 

backend/__tests__/utils/networkValidation.dns.test.js

@@ -1,128 +0,0 @@
-/**
- * DNS-resolving SSRF guard (GHSA SSRF cluster: webhook / S3 / rsync / SMTP /
- * IMAP). The literal isPrivateIP check can't see that a public-looking
- * hostname resolves to an internal/metadata IP; isHostAllowed resolves the
- * name and vets every A/AAAA record.
- */
-jest.mock('dns', () => {
-  const actual = jest.requireActual('dns');
-  return { ...actual, promises: { ...actual.promises, lookup: jest.fn() } };
-});
-const dns = require('dns');
-const {
-  isHostAllowed,
-  validateExternalUrlAsync,
-  classifyHost,
-} = require('../../src/utils/networkValidation');
-
-const lookup = dns.promises.lookup;
-
-describe('classifyHost', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('distinguishes private, unresolved, ok, and invalid', async () => {
-    lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
-    expect(await classifyHost('evil.example')).toBe('private');
-
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect(await classifyHost('example.com')).toBe('ok');
-
-    lookup.mockRejectedValue(new Error('EAI_AGAIN'));
-    expect(await classifyHost('blip.example')).toBe('unresolved');
-
-    lookup.mockResolvedValue([]);
-    expect(await classifyHost('empty.example')).toBe('unresolved');
-
-    expect(await classifyHost('')).toBe('invalid');
-    expect(await classifyHost('10.0.0.1')).toBe('private'); // literal, no lookup
-  });
-});
-
-describe('isHostAllowed', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('rejects a public hostname that resolves to a private IP', async () => {
-    lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
-    expect(await isHostAllowed('evil.example.com')).toBe(false);
-  });
-
-  it('rejects when the hostname resolves to the cloud metadata IP', async () => {
-    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
-    expect(await isHostAllowed('metadata-rebind.example')).toBe(false);
-  });
-
-  it('rejects when ANY resolved address is private (rebinding / mixed records)', async () => {
-    lookup.mockResolvedValue([
-      { address: '93.184.216.34', family: 4 },
-      { address: '169.254.169.254', family: 4 },
-    ]);
-    expect(await isHostAllowed('rebind.example')).toBe(false);
-  });
-
-  it('allows a hostname that resolves only to public IPs', async () => {
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect(await isHostAllowed('example.com')).toBe(true);
-  });
-
-  it('fails closed when resolution errors', async () => {
-    lookup.mockRejectedValue(new Error('ENOTFOUND'));
-    expect(await isHostAllowed('nxdomain.invalid')).toBe(false);
-  });
-
-  it('fails closed on an empty resolution', async () => {
-    lookup.mockResolvedValue([]);
-    expect(await isHostAllowed('empty.example')).toBe(false);
-  });
-
-  it('rejects literal private IPs and blocked names without resolving', async () => {
-    expect(await isHostAllowed('127.0.0.1')).toBe(false);
-    expect(await isHostAllowed('10.0.0.1')).toBe(false);
-    expect(await isHostAllowed('localhost')).toBe(false);
-    expect(await isHostAllowed('metadata.google.internal')).toBe(false);
-    expect(await isHostAllowed('foo.internal')).toBe(false);
-    expect(lookup).not.toHaveBeenCalled();
-  });
-
-  it('allows a public IP literal without resolving', async () => {
-    expect(await isHostAllowed('93.184.216.34')).toBe(true);
-    expect(lookup).not.toHaveBeenCalled();
-  });
-
-  it('rejects empty / non-string input', async () => {
-    expect(await isHostAllowed('')).toBe(false);
-    expect(await isHostAllowed(null)).toBe(false);
-  });
-});
-
-describe('validateExternalUrlAsync', () => {
-  beforeEach(() => lookup.mockReset());
-
-  it('rejects a URL whose host resolves to a private address', async () => {
-    lookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }]);
-    const r = await validateExternalUrlAsync('https://evil.example/hook');
-    expect(r.valid).toBe(false);
-  });
-
-  it('accepts a URL whose host resolves public', async () => {
-    lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
-    expect((await validateExternalUrlAsync('https://example.com/hook')).valid).toBe(true);
-  });
-
-  it('rejects a malformed URL', async () => {
-    expect((await validateExternalUrlAsync('not a url')).valid).toBe(false);
-  });
-
-  it('reports reason=unresolved for a transient lookup failure (retryable)', async () => {
-    lookup.mockRejectedValue(new Error('EAI_AGAIN'));
-    const r = await validateExternalUrlAsync('https://blip.example/hook');
-    expect(r.valid).toBe(false);
-    expect(r.reason).toBe('unresolved');
-  });
-
-  it('reports reason=private for a resolved-private host (permanent)', async () => {
-    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
-    const r = await validateExternalUrlAsync('https://rebind.example/hook');
-    expect(r.valid).toBe(false);
-    expect(r.reason).toBe('private');
-  });
-});

backend/__tests__/utils/passwordValidation.complexityKey.test.js

@@ -1,61 +0,0 @@
-/**
- * Regression tests for the password-complexity setting read path.
- *
- * Bug 1 (key mismatch): the settings UI saves the admin's choice as
- * `security_password_complexity` (useSettingsState.ts prefixes every
- * security field with `security_`), but getPasswordComplexitySettings()
- * queried `security_password_complexity_level` — a key nothing writes —
- * so the configured level was silently ignored.
- *
- * Bug 2 (driver shape, codex review of #843): on SQLite the TEXT column
- * returns the JSON-stringified value ('"very_strong"'), but on Postgres
- * (production default) `setting_value` is a json column and comes back
- * already decoded ('very_strong'). A bare JSON.parse throws on the
- * decoded shape and the outer catch fell back to 'moderate' — the
- * setting stayed unenforced on Postgres even with the right key.
- */
-
-const mockQueriedKeys = [];
-let mockStoredValue;
-
-jest.mock('../../src/database/db', () => ({
-  db: () => ({
-    where(_col, key) {
-      mockQueriedKeys.push(key);
-      return this;
-    },
-    first() {
-      return Promise.resolve(
-        mockQueriedKeys[mockQueriedKeys.length - 1] === 'security_password_complexity'
-          ? { setting_key: 'security_password_complexity', setting_value: mockStoredValue }
-          : undefined
-      );
-    },
-  }),
-  withRetry: (fn) => fn(),
-}));
-
-const { getPasswordComplexitySettings } = require('../../src/utils/passwordValidation');
-
-describe('getPasswordComplexitySettings', () => {
-  beforeEach(() => { mockQueriedKeys.length = 0; });
-
-  it('reads the key the settings UI actually writes (SQLite shape: JSON-stringified)', async () => {
-    mockStoredValue = JSON.stringify('very_strong'); // '"very_strong"'
-    const level = await getPasswordComplexitySettings();
-    expect(mockQueriedKeys).toContain('security_password_complexity');
-    expect(level).toBe('very_strong');
-  });
-
-  it('accepts the Postgres json-column shape (already decoded, no quotes)', async () => {
-    mockStoredValue = 'very_strong'; // pg driver auto-parses the json column
-    const level = await getPasswordComplexitySettings();
-    expect(level).toBe('very_strong');
-  });
-
-  it('falls back to moderate on an empty value', async () => {
-    mockStoredValue = '';
-    const level = await getPasswordComplexitySettings();
-    expect(level).toBe('moderate');
-  });
-});

backend/__tests__/utils/photoVisibility.test.js

@@ -1,40 +0,0 @@
-/**
- * Unit tests for the shared hidden-photo access-control helper.
- *
- * Pins the rule that ordinary gallery guests never receive photos with
- * visibility='hidden' (NULL = visible), while PIN-clients see everything.
- */
-const {
-  canSeeHiddenPhotos,
-  isPhotoHiddenFromViewer,
-} = require('../../src/utils/photoVisibility');
-
-describe('canSeeHiddenPhotos', () => {
-  it('is true only for the client access level', () => {
-    expect(canSeeHiddenPhotos('client')).toBe(true);
-    expect(canSeeHiddenPhotos('guest')).toBe(false);
-    expect(canSeeHiddenPhotos('slideshow')).toBe(false);
-    expect(canSeeHiddenPhotos(undefined)).toBe(false);
-  });
-});
-
-describe('isPhotoHiddenFromViewer', () => {
-  it('blocks a hidden photo from guests', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'guest')).toBe(true);
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'slideshow')).toBe(true);
-  });
-
-  it('lets clients see hidden photos', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'hidden' }, 'client')).toBe(false);
-  });
-
-  it('treats visible and NULL visibility as viewable by everyone', () => {
-    expect(isPhotoHiddenFromViewer({ visibility: 'visible' }, 'guest')).toBe(false);
-    expect(isPhotoHiddenFromViewer({ visibility: null }, 'guest')).toBe(false);
-    expect(isPhotoHiddenFromViewer({}, 'guest')).toBe(false);
-  });
-
-  it('is null-safe', () => {
-    expect(isPhotoHiddenFromViewer(null, 'guest')).toBe(false);
-  });
-});

backend/__tests__/utils/resolveLogoFile.test.js

@@ -99,22 +99,10 @@ describe('resolveLogoFile', () => {
     }
   });
 
-  it('rejects an absolute path OUTSIDE the storage roots (GHSA-c7x5)', async () => {
-    // The raw-absolute candidate was an arbitrary-file-read primitive
-    // (logo_path: '/etc/passwd' → rasterised into a PDF). Absolute paths
-    // outside the storage roots are now dropped even if they exist.
+  it('treats absolute paths as-is when they exist', async () => {
     existsSpy.mockImplementation((p) => p === '/abs/path/logo.png');
     getAppSetting.mockResolvedValue(null);
     const out = await resolveLogoFile({ logo_path: '/abs/path/logo.png' });
-    expect(out).toBeNull();
-  });
-
-  it('still accepts an absolute path INSIDE the storage root', async () => {
-    // The legitimate case: multer stores the uploaded logo under
-    // storage/uploads/logos with an absolute path — that stays resolvable.
-    existsSpy.mockImplementation((p) => p === '/app/storage/uploads/logos/logo.png');
-    getAppSetting.mockResolvedValue(null);
-    const out = await resolveLogoFile({ logo_path: '/app/storage/uploads/logos/logo.png' });
-    expect(out).toBe('/app/storage/uploads/logos/logo.png');
+    expect(out).toBe('/abs/path/logo.png');
   });
 });

backend/__tests__/utils/safePathZipEntries.test.js

@@ -1,41 +0,0 @@
-const path = require('path');
-const { assertZipEntriesWithin } = require('../../src/utils/safePath');
-
-describe('assertZipEntriesWithin (ZIP-slip guard, GHSA-jfhw-fj23-fx6x)', () => {
-  const root = path.join('/tmp', 'picpeak-extract-root');
-
-  it('accepts entries that stay within the extraction root', () => {
-    const entries = [
-      { name: 'photo.jpg' },
-      { name: 'category/nested/photo.png' },
-      { name: 'photos_manifest.json' },
-      { name: 'subdir/' },
-    ];
-    expect(() => assertZipEntriesWithin(entries, root)).not.toThrow();
-  });
-
-  it('rejects a parent-traversal entry', () => {
-    const entries = [{ name: '../../uploads/logos/evil.svg' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('rejects an absolute-path entry', () => {
-    const entries = [{ name: '/etc/cron.d/evil' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('rejects when a safe entry is mixed with a traversal entry', () => {
-    const entries = [{ name: 'ok.jpg' }, { name: '../escape.txt' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-
-  it('tolerates empty / nameless entries', () => {
-    expect(() => assertZipEntriesWithin([{}, { name: '' }, null], root)).not.toThrow();
-  });
-
-  it('does not treat a sibling prefix directory as inside the root', () => {
-    // root is .../picpeak-extract-root; ../picpeak-extract-root-evil must not pass
-    const entries = [{ name: '../picpeak-extract-root-evil/x' }];
-    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
-  });
-});

backend/__tests__/utils/sanitizeForLog.test.js

@@ -1,96 +0,0 @@
-/**
- * Credential redaction for log payloads (GHSA-pgmp / GHSA-r794).
- *
- * Event create/update logged the whole request body. Beyond the plaintext
- * gallery password named in the advisories, the update path also logged
- * `client_share_token` — a LIVE bearer credential for client gallery access,
- * freshly minted by `regenerate_client_token` — and `client_password_hash`.
- */
-
-const { sanitizeForLog, isSensitiveKey } = require('../../src/utils/sanitizeForLog');
-
-describe('sanitizeForLog', () => {
-  it('redacts the credentials an event body actually carries', () => {
-    const out = sanitizeForLog({
-      event_name: 'Wedding',
-      password: 'FAKE-PLAINTEXT-PASSWORD',
-      client_password: 'FAKE-CLIENT-PASSWORD',
-      client_password_hash: 'FAKE-BCRYPT-HASH-PLACEHOLDER',
-      client_share_token: 'FAKE-CLIENT-SHARE-TOKEN',
-      share_token: 'FAKE-SHARE-TOKEN',
-    });
-
-    expect(out.event_name).toBe('Wedding');
-    for (const key of ['password', 'client_password', 'client_password_hash',
-      'client_share_token', 'share_token']) {
-      expect(out[key]).toBe('[redacted]');
-    }
-    expect(JSON.stringify(out)).not.toContain('FAKE-PLAINTEXT-PASSWORD');
-    expect(JSON.stringify(out)).not.toContain('FAKE-CLIENT-SHARE-TOKEN');
-  });
-
-  it('redacts nested and array-nested secrets', () => {
-    const out = sanitizeForLog({
-      smtp: { host: 'mail.example.com', smtp_password: 'p' },
-      users: [{ name: 'a', api_key: 'k' }],
-    });
-    expect(out.smtp.host).toBe('mail.example.com');
-    expect(out.smtp.smtp_password).toBe('[redacted]');
-    expect(out.users[0].name).toBe('a');
-    expect(out.users[0].api_key).toBe('[redacted]');
-  });
-
-  it('passes non-objects through and survives cycles', () => {
-    expect(sanitizeForLog('plain')).toBe('plain');
-    expect(sanitizeForLog(42)).toBe(42);
-    expect(sanitizeForLog(null)).toBeNull();
-
-    const cyclic = { name: 'x' };
-    cyclic.self = cyclic;
-    expect(() => sanitizeForLog(cyclic)).not.toThrow();
-    expect(sanitizeForLog(cyclic).self).toBe('[circular]');
-  });
-
-  it('matches key names case-insensitively and by fragment', () => {
-    expect(isSensitiveKey('Authorization')).toBe(true);
-    expect(isSensitiveKey('CLIENT_SHARE_TOKEN')).toBe(true);
-    expect(isSensitiveKey('event_name')).toBe(false);
-  });
-});
-
-/**
- * Codex round 2: sanitizing req.body was not enough. express-validator's
- * errors.array() embeds the SUBMITTED value per field, so a password rejected
- * for being too short was still logged in plaintext.
- */
-describe('sanitizeValidationErrors', () => {
-  const { sanitizeValidationErrors } = require('../../src/utils/sanitizeForLog');
-
-  it('redacts the submitted value for a password field', () => {
-    const out = sanitizeValidationErrors([
-      { type: 'field', path: 'password', msg: 'too short', value: 'FAKE-PLAINTEXT-PASSWORD' },
-      { type: 'field', path: 'event_name', msg: 'required', value: '' },
-    ]);
-    expect(out[0].value).toBe('[redacted]');
-    expect(out[0].msg).toBe('too short');
-    expect(JSON.stringify(out)).not.toContain('FAKE-PLAINTEXT-PASSWORD');
-    expect(out[1].value).toBe('');
-  });
-
-  it('handles the legacy `param` field name', () => {
-    const out = sanitizeValidationErrors([{ param: 'client_password', value: 'FAKE-SECRET' }]);
-    expect(out[0].value).toBe('[redacted]');
-  });
-
-  it('recurses into object values on non-sensitive fields', () => {
-    const out = sanitizeValidationErrors([
-      { path: 'config', value: { host: 'h', api_key: 'k' } },
-    ]);
-    expect(out[0].value.host).toBe('h');
-    expect(out[0].value.api_key).toBe('[redacted]');
-  });
-
-  it('passes non-arrays through untouched', () => {
-    expect(sanitizeValidationErrors(undefined)).toBeUndefined();
-  });
-});

backend/jest.config.js

@@ -1,9 +1,5 @@
 module.exports = {
   testEnvironment: 'node',
-  // bootCrmDb() runs EVERY core migration in beforeAll and the chain keeps
-  // growing (134 migrations and counting via backports). 120s matches the
-  // beta-branch convention from #860.
-  testTimeout: 120000,
   coverageDirectory: 'coverage',
   collectCoverageFrom: [
     'src/**/*.js',

backend/migrations/core/152_hero_logo_visible_inherit.js

@@ -1,52 +0,0 @@
-/**
- * Migration 152: make events.hero_logo_visible NULL-able so NULL means
- * "inherit the global branding_logo_display_hero setting" (#756).
- *
- * Before: hero_logo_visible was `boolean NOT NULL DEFAULT true`, and every
- * event got a concrete true/false snapshotted at creation. The global
- * "Show logo in hero section" toggle (branding_logo_display_hero) was only a
- * creation-time default and never affected existing galleries — so disabling
- * it did nothing to already-published galleries.
- *
- * After: NULL = inherit. gallery read-resolution falls back to the global
- * setting when the per-event value is NULL, so the global toggle controls
- * every gallery that hasn't been deliberately overridden per-event.
- *
- * Data backfill: NULL out the DEFAULTED `true` rows so they start inheriting
- * the global. A deliberate per-gallery hide (`false`) is kept — we can't tell a
- * defaulted-true from a chosen-true, but `false` is almost always a conscious
- * "hide it here", and nulling it could silently re-show a hidden logo.
- */
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_visible'))) return;
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible DROP DEFAULT');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible DROP NOT NULL');
-  } else {
-    // SQLite (and others): knex recreates the table without the NOT NULL/default.
-    await knex.schema.alterTable('events', (t) => {
-      t.boolean('hero_logo_visible').nullable().alter();
-    });
-  }
-
-  // Existing defaulted-`true` galleries now inherit the global toggle.
-  await knex('events').where('hero_logo_visible', true).update({ hero_logo_visible: null });
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_visible'))) return;
-  // Re-materialise NULLs as the old default (true) before restoring NOT NULL.
-  await knex('events').whereNull('hero_logo_visible').update({ hero_logo_visible: true });
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible SET DEFAULT true');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_visible SET NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.boolean('hero_logo_visible').notNullable().defaultTo(true).alter();
-    });
-  }
-};

backend/migrations/core/153_hero_logo_size_inherit.js

@@ -1,51 +0,0 @@
-/**
- * Migration 153: make events.hero_logo_size NULL-able so NULL means "inherit
- * the global branding_logo_size" (#756 follow-up — the size counterpart of 152).
- *
- * Before: hero_logo_size was `varchar NOT NULL DEFAULT 'medium'`, snapshotted
- * from the global branding_logo_size at creation. The two gallery render paths
- * then disagreed — GalleryLayout read the global size live, while the
- * hero-header path used the per-event snapshot — so a hero logo could render at
- * different sizes on different layouts, and changing the global size didn't
- * update hero-header galleries.
- *
- * After: NULL = inherit. gallery read-resolution falls back to
- * branding_logo_size when the per-event value is NULL, and both render paths
- * consume that resolved size.
- *
- * Data backfill: NULL out ALL existing hero_logo_size so every gallery inherits
- * the global size going forward. Unlike a boolean we can't tell a defaulted
- * value from a chosen one — but nulling is the safe choice here: it restores the
- * live-global behaviour GalleryLayout already had, and the per-event size can be
- * re-set from the event's edit page.
- */
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_size'))) return;
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size DROP DEFAULT');
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size DROP NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.string('hero_logo_size', 20).nullable().alter();
-    });
-  }
-
-  await knex('events').update({ hero_logo_size: null });
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasColumn('events', 'hero_logo_size'))) return;
-  await knex('events').whereNull('hero_logo_size').update({ hero_logo_size: 'medium' });
-
-  const client = (knex.client.config.client || '').toLowerCase();
-  if (client === 'pg' || client === 'postgresql') {
-    await knex.raw("ALTER TABLE events ALTER COLUMN hero_logo_size SET DEFAULT 'medium'");
-    await knex.raw('ALTER TABLE events ALTER COLUMN hero_logo_size SET NOT NULL');
-  } else {
-    await knex.schema.alterTable('events', (t) => {
-      t.string('hero_logo_size', 20).notNullable().defaultTo('medium').alter();
-    });
-  }
-};

backend/migrations/core/154_mail_accounts_and_bodies.js

@@ -1,52 +0,0 @@
-/**
- * Messages Phase 2 — additional inbound mailboxes + captured message bodies.
- *
- * `mail_accounts` holds inbound mailboxes BEYOND the primary accounting IMAP
- * that already lives in `email_configs` (e.g. the customer `hello@` mailbox).
- * The intake poller (emailIntakeService) polls the accounting mailbox AND every
- * enabled row here; customer mail is logged with its body but not routed to the
- * accounting inbox.
- *
- * The new `received_emails` columns capture the parsed message so the Messages
- * reading pane can show it: `account_key` tags which mailbox it came from,
- * `body_html`/`body_text` hold the (server-sanitized) body, `to_address` the
- * envelope recipient. All additive + guarded.
- */
-exports.up = async function up(knex) {
-  const hasAccounts = await knex.schema.hasTable('mail_accounts');
-  if (!hasAccounts) {
-    await knex.schema.createTable('mail_accounts', (t) => {
-      t.increments('id').primary();
-      t.string('account_key', 64).notNullable().unique(); // e.g. 'customers'
-      t.string('label', 120);
-      t.string('imap_host', 255);
-      t.integer('imap_port').defaultTo(993);
-      t.boolean('imap_secure').defaultTo(true);
-      t.string('imap_user', 255);
-      t.string('imap_pass', 512);
-      t.string('imap_folder', 255).defaultTo('INBOX');
-      t.boolean('enabled').defaultTo(false);
-      t.timestamp('created_at').defaultTo(knex.fn.now());
-      t.timestamp('updated_at').defaultTo(knex.fn.now());
-    });
-  }
-
-  const cols = [
-    ['account_key', (t) => t.string('account_key', 64)],
-    ['to_address', (t) => t.string('to_address', 512)],
-    ['body_html', (t) => t.text('body_html')],
-    ['body_text', (t) => t.text('body_text')],
-  ];
-  for (const [name, add] of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('received_emails', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) await knex.schema.alterTable('received_emails', add);
-  }
-};
-
-exports.down = async function down(knex) {
-  // Non-destructive on the audit log: leave the added columns in place (they're
-  // nullable and harmless). Only drop the new table.
-  await knex.schema.dropTableIfExists('mail_accounts');
-};

backend/migrations/core/155_email_queue_origin.js

@@ -1,25 +0,0 @@
-/**
- * Messages Phase 3 — distinguish human-composed sends from system mail.
- *
- * `origin` is 'system' for everything the app queues automatically (invoices,
- * reminders, gallery notices — the Automated stream) and 'manual' for emails an
- * admin composed/edited in the Messages composer (replies + document messages —
- * the Customers ▸ Sent stream). Existing rows default to 'system'.
- */
-exports.up = async function up(knex) {
-  const has = await knex.schema.hasColumn('email_queue', 'origin');
-  if (!has) {
-    await knex.schema.alterTable('email_queue', (t) => {
-      t.string('origin', 16).defaultTo('system');
-    });
-  }
-};
-
-exports.down = async function down(knex) {
-  const has = await knex.schema.hasColumn('email_queue', 'origin');
-  if (has) {
-    await knex.schema.alterTable('email_queue', (t) => {
-      t.dropColumn('origin');
-    });
-  }
-};

backend/migrations/core/156_mail_accounts_smtp.js

@@ -1,34 +0,0 @@
-/**
- * Messages Phase 3 follow-up — outgoing (SMTP) settings per mail account.
- *
- * The customer mailbox (hello@) needs BOTH incoming (IMAP, migration 154) and
- * outgoing (SMTP) config, so replies to customers send from hello@ instead of
- * the global no-reply@ identity. All additive/guarded.
- */
-exports.up = async function up(knex) {
-  const cols = [
-    ['smtp_host', (t) => t.string('smtp_host', 255)],
-    ['smtp_port', (t) => t.integer('smtp_port')],
-    ['smtp_secure', (t) => t.boolean('smtp_secure').defaultTo(false)],
-    ['smtp_user', (t) => t.string('smtp_user', 255)],
-    ['smtp_pass', (t) => t.string('smtp_pass', 512)],
-    ['from_email', (t) => t.string('from_email', 255)],
-    ['from_name', (t) => t.string('from_name', 120)],
-  ];
-  for (const [name, add] of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('mail_accounts', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) await knex.schema.alterTable('mail_accounts', add);
-  }
-};
-
-exports.down = async function down(knex) {
-  const cols = ['smtp_host', 'smtp_port', 'smtp_secure', 'smtp_user', 'smtp_pass', 'from_email', 'from_name'];
-  for (const name of cols) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn('mail_accounts', name);
-    // eslint-disable-next-line no-await-in-loop
-    if (has) await knex.schema.alterTable('mail_accounts', (t) => t.dropColumn(name));
-  }
-};

backend/migrations/core/157_mailbox_state.js

@@ -1,33 +0,0 @@
-/**
- * Messages — Archive / Delete (trash) support.
- *
- * `mailbox_state` on both mail tables: 'active' (normal folders), 'archived'
- * (Archived folder), or 'deleted' (Deleted/trash folder). Delete is soft — the
- * row moves to 'deleted' and is only removed for good when purged FROM the
- * Deleted folder. Legacy rows have NULL, treated as 'active'. Additive/guarded.
- */
-exports.up = async function up(knex) {
-  for (const table of ['email_queue', 'received_emails']) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn(table, 'mailbox_state');
-    // eslint-disable-next-line no-await-in-loop
-    if (!has) {
-      // eslint-disable-next-line no-await-in-loop
-      await knex.schema.alterTable(table, (t) => {
-        t.string('mailbox_state', 16).defaultTo('active');
-      });
-    }
-  }
-};
-
-exports.down = async function down(knex) {
-  for (const table of ['email_queue', 'received_emails']) {
-    // eslint-disable-next-line no-await-in-loop
-    const has = await knex.schema.hasColumn(table, 'mailbox_state');
-    // eslint-disable-next-line no-await-in-loop
-    if (has) {
-      // eslint-disable-next-line no-await-in-loop
-      await knex.schema.alterTable(table, (t) => { t.dropColumn('mailbox_state'); });
-    }
-  }
-};

backend/migrations/core/167_add_projects_created_by.js

@@ -1,71 +0,0 @@
-/**
- * Migration 167: give `projects` a first-class owner (GHSA-wrg5).
- *
- * Project routes authorize on generic `events.view` / `events.edit` only, with
- * no ownership check, so an editor-like admin could enumerate, read, update
- * and aggregate projects belonging to other admins' events.
- *
- * Ownership IS derivable transitively — `events.project_id` (migration 117)
- * plus `events.created_by` (migration 060) — but only for projects that have
- * at least one linked event. A freshly created, still-empty project has no
- * derivable owner, which would leave a hole exactly where the create → attach
- * flow starts. Storing the creator removes that ambiguity: projectService
- * already receives `adminId` in createProject() and simply discarded it.
- *
- * Backfill uses the transitive path, which is well-defined here: migration 117
- * created exactly one auto-project per pre-existing event, so those projects
- * map 1:1 to an owning event. Projects with no linked event (or whose events
- * are themselves ownerless legacy rows) stay NULL and are treated as
- * unowned//legacy by the ownership helper — same convention the events table
- * already uses for `created_by IS NULL`.
- *
- * down() drops the column; the derived data is reconstructible by re-running
- * the same backfill, so nothing is lost irreversibly.
- */
-
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasTable('projects'))) return;
-
-  if (!(await knex.schema.hasColumn('projects', 'created_by'))) {
-    await knex.schema.alterTable('projects', (t) => {
-      // No FK constraint: admin_users rows can be removed, and orphaning a
-      // project would be worse than a dangling id (which reads as unowned).
-      t.integer('created_by').nullable();
-    });
-  }
-
-  // Backfill from the linked events, only where we can determine it
-  // unambiguously (every owning event agrees on a single non-null creator).
-  if (await knex.schema.hasColumn('events', 'project_id')
-    && await knex.schema.hasColumn('events', 'created_by')) {
-    const rows = await knex('events')
-      .whereNotNull('project_id')
-      .whereNotNull('created_by')
-      .select('project_id', 'created_by')
-      .groupBy('project_id', 'created_by');
-
-    const byProject = new Map();
-    for (const row of rows) {
-      const list = byProject.get(row.project_id) || [];
-      list.push(row.created_by);
-      byProject.set(row.project_id, list);
-    }
-
-    for (const [projectId, creators] of byProject) {
-      // Ambiguous (events from two different admins) → leave NULL rather than
-      // guess an owner and hand one admin authority over another's work.
-      if (creators.length !== 1) continue;
-      await knex('projects')
-        .where({ id: projectId })
-        .whereNull('created_by')
-        .update({ created_by: creators[0] });
-    }
-  }
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasTable('projects'))) return;
-  if (await knex.schema.hasColumn('projects', 'created_by')) {
-    await knex.schema.alterTable('projects', (t) => t.dropColumn('created_by'));
-  }
-};

backend/migrations/core/168_fix_expense_activity_event_id.js

@@ -1,64 +0,0 @@
-/**
- * GHSA-jhcf — data correction for legacy accounting activity rows.
- *
- * expenseService called `logActivity(type, metadata, adminId)`, but the third
- * positional parameter of logActivity is `eventId`, not the actor. Every
- * expense / incoming-invoice entry therefore stored the ACTING ADMIN'S ID in
- * `activity_logs.event_id` (and no actor at all).
- *
- * That is not merely cosmetic. The dashboard activity feed now scopes rows via
- * `WHERE activity_logs.event_id IN (SELECT id FROM events WHERE created_by = me)`.
- * Admin ids and event ids are both small integers drawn from the same range, so
- * on any upgraded instance an editor who happens to own the event whose id
- * equals another admin's id is served that admin's accounting activity —
- * verbatim metadata included. Scoping new writes correctly does nothing for the
- * rows already on disk, so they are corrected here.
- *
- * The stored value is exactly the actor id we lost, so this re-attributes
- * rather than discards: event_id → actor_id (when no actor was recorded), then
- * event_id is cleared so the scope predicate can no longer match it.
- *
- * All ten activity types below are emitted by expenseService and nothing else,
- * so no row with a genuine event_id is touched.
- */
-
-const AFFECTED_TYPES = [
-  'incoming_invoice_captured',
-  'incoming_invoice_updated',
-  'incoming_invoice_categorized',
-  'incoming_invoice_rebilled',
-  'incoming_invoices_rebilled_bundle',
-  'incoming_invoice_supplier_payment',
-  'expense_created',
-  'expense_updated',
-  'expense_invoiced',
-  'expense_paid',
-];
-
-exports.up = async function up(knex) {
-  if (!(await knex.schema.hasTable('activity_logs'))) return;
-  if (!(await knex.schema.hasColumn('activity_logs', 'event_id'))) return;
-
-  const hasActorId = await knex.schema.hasColumn('activity_logs', 'actor_id');
-  const hasActorType = await knex.schema.hasColumn('activity_logs', 'actor_type');
-
-  if (hasActorId) {
-    const patch = { actor_id: knex.ref('event_id') };
-    if (hasActorType) patch.actor_type = 'admin';
-    await knex('activity_logs')
-      .whereIn('activity_type', AFFECTED_TYPES)
-      .whereNotNull('event_id')
-      .whereNull('actor_id')
-      .update(patch);
-  }
-
-  await knex('activity_logs')
-    .whereIn('activity_type', AFFECTED_TYPES)
-    .whereNotNull('event_id')
-    .update({ event_id: null });
-};
-
-// Irreversible by design: this is a data correction, and the pre-migration
-// state is a cross-admin disclosure. Re-planting admin ids in event_id would
-// reopen GHSA-jhcf.
-exports.down = async function down() {};

backend/package.json

@@ -1,11 +1,8 @@
 {
   "name": "picpeak-backend",
-  "version": "3.45.15",
+  "version": "3.81.0-beta.0",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
-  "engines": {
-    "node": "^20.19.0 || >=22"
-  },
   "scripts": {
     "start": "node server.js",
     "dev": "nodemon server.js",
@@ -21,12 +18,11 @@
     "@aws-sdk/lib-storage": "^3.850.0",
     "@aws-sdk/s3-request-presigner": "^3.850.0",
     "archiver": "^5.3.1",
-    "axios": "1.18.1",
+    "axios": "1.16.0",
     "bcrypt": "6.0.0",
     "chokidar": "4.0.3",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "cron-parser": "^4.9.0",
     "dotenv": "^16.0.3",
     "exifr": "^7.1.3",
     "express": "^4.18.2",
@@ -51,20 +47,19 @@
     "node-stream-zip": "^1.15.0",
     "nodemailer": "^9.0.1",
     "otplib": "^12.0.1",
-    "p-limit": "^3.1.0",
     "pdf-lib": "^1.17.1",
     "pdfkit": "^0.17.2",
     "pg": "^8.16.3",
-    "postcss": "8.5.23",
+    "postcss": "8.5.10",
     "qrcode": "^1.5.4",
     "react-i18next": "^15.6.0",
-    "sanitize-html": "2.17.5",
-    "sharp": "0.35.3",
+    "sanitize-html": "^2.17.0",
+    "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",
     "swissqrbill": "^4.3.0",
-    "tar": ">=7.5.21",
+    "tar": ">=7.5.16",
     "uuid": "^11.1.1",
     "winston": "^3.8.2",
     "zxcvbn": "^4.4.2"
@@ -84,14 +79,14 @@
     "js-yaml": "^4.2.0",
     "fast-xml-parser": ">=5.7.0",
     "qs": ">=6.15.2",
-    "tar": ">=7.5.21",
-    "brace-expansion": ">=5.0.9",
+    "tar": ">=7.5.16",
+    "brace-expansion": ">=5.0.6",
     "minimatch": ">=9.0.7",
     "path-to-regexp": "0.1.13",
     "lodash": ">=4.18.1",
     "follow-redirects": ">=1.16.0",
     "@tootallnate/once": ">=3.0.1",
-    "ip-address": ">=10.3.1",
+    "ip-address": ">=10.1.1",
     "uuid": "^11.1.1",
     "nodemailer": "^9.0.1"
   }

backend/server.js

@@ -38,6 +38,7 @@ const {
 
 // Import routes
 const authRoutes = require('./src/routes/auth');
+const eventRoutes = require('./src/routes/events');
 const galleryRoutes = require('./src/routes/gallery');
 const adminRoutes = require('./src/routes/admin');
 const adminAuthRoutes = require('./src/routes/adminAuth');
@@ -694,7 +695,8 @@ app.get('/health', async (req, res) => {
 // Routes
 app.use('/api/setup', setupRoutes); // public first-run bootstrap (self-closes after setup)
 app.use('/api/auth', authRoutes);
-app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
+  app.use('/api/events', eventRoutes);
+  app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
 // Gallery routes - main routes first, then feedback routes
 app.use('/api/gallery', galleryRoutes);
 app.use('/api/gallery', require('./src/routes/galleryFeedback'));
@@ -1005,15 +1007,8 @@ async function startServer() {
     // Runs AFTER install-from-backup so a restored instance (which repopulates
     // admin_users) never prints a throwaway token. Best-effort — never blocks boot.
     let setupToken = null;
-    let setupTokenFile = null;
     try {
-      const setupSvc = require('./src/services/setupService');
-      setupToken = await setupSvc.ensureSetupToken();
-      // The path the write ACTUALLY produced (null when it failed). existsSync
-      // on the candidate answered a different question and reported success
-      // for a stale, read-only or directory-shaped SETUP_TOKEN — suppressing
-      // the token here while pointing the operator at content that is not it.
-      setupTokenFile = setupSvc.writtenSetupTokenFile();
+      setupToken = await require('./src/services/setupService').ensureSetupToken();
     } catch (err) {
       logger.warn(`[setup] ensureSetupToken skipped: ${err.message}`);
     }
@@ -1033,17 +1028,12 @@ async function startServer() {
       logger.info(`Server running on port ${PORT}`);
       logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);
       logger.info(`Frontend: ${process.env.FRONTEND_URL || 'http://localhost:3001'}`);
-      // First-run banner. Print the TOKEN ITSELF only when the 0600 token file
-      // could not be written — otherwise this lands a live first-admin
-      // credential in `docker logs` / journald, which is the leak GHSA-r794's
-      // sweep turned up. When the file exists we point at it instead.
+      // First-run: print the one-time setup token to STDOUT (the file logger
+      // doesn't reach `docker logs`), as the last + most visible thing at boot.
       if (setupToken) {
         const url = `${process.env.ADMIN_URL || 'http://localhost:3000'}/admin`;
         const line = '='.repeat(64);
-        const secretLine = setupTokenFile
-          ? `  Setup token saved to:  ${setupTokenFile}\n  (read it there — deliberately not printed)`
-          : `  One-time setup token:  ${setupToken}\n  (could not write the token file, so it is shown here)`;
-        console.log(`\n${line}\n  PicPeak first-run setup — no admin account yet.\n  Open:                  ${url}\n${secretLine}\n${line}\n`);
+        console.log(`\n${line}\n  PicPeak first-run setup — no admin account yet.\n  Open:                  ${url}\n  One-time setup token:  ${setupToken}\n  (also saved to data/SETUP_TOKEN)\n${line}\n`);
       }
     });
   } catch (error) {

backend/src/__tests__/galleryOgService.shareImage.test.js

@@ -343,34 +343,12 @@ describe('isSocialCrawler — extended bot coverage (#521)', () => {
       // 3rd-party preview services used by business-messaging stacks
       'LinkPreview/1.0',
       'Slack-ImgProxy/1.0',
-      // Viber + broader crawler set (#699 follow-up)
-      'Mozilla/5.0 (compatible; Viber)',
-      'Mozilla/5.0 (compatible; Bluesky Cardyb/1.1)',
-      'facebookcatalog/1.0',
-      'kakaotalk-scrap/1.0',
-      'Mozilla/5.0 (compatible; Synapse/1.98)',
-      'Rocket.Chat/6.0',
     ];
     for (const ua of knownBots) {
       expect(isSocialCrawler(ua)).toBe(true);
     }
   });
 
-  it('does NOT match human in-app-browser UAs (our OG response is meta-only, no redirect)', () => {
-    // These share a token with a preview bot but are also sent by real users
-    // browsing inside the app's webview — matching them would serve a human
-    // the bare OG stub. Deliberately excluded; guard against re-adding them.
-    const inAppBrowsers = [
-      'Mozilla/5.0 (iPhone) AppleWebKit MicroMessenger/8.0.0',        // WeChat in-app
-      'Mozilla/5.0 (iPhone) AppleWebKit Line/13.0.0',                // LINE in-app
-      'Mozilla/5.0 (Linux; Android) Zalo',                          // Zalo in-app
-      'Mozilla/5.0 (Macintosh) Chrome/120.0 Safari/537.36 boxing',  // "XING" substring trap
-    ];
-    for (const ua of inAppBrowsers) {
-      expect(isSocialCrawler(ua)).toBe(false);
-    }
-  });
-
   it('does not match a regular browser UA', () => {
     const browsers = [
       'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36',

backend/src/__tests__/publicSiteService.test.js

@@ -52,11 +52,7 @@ describe('publicSiteService', () => {
     const payload = await getPublicSitePayload({ bypassCache: true });
 
     expect(payload.enabled).toBe(true);
-    // Brand tokens are HTML-escaped on substitution now (GHSA-j347), so a bare
-    // `&` in the company name is emitted as the `&` entity. That renders
-    // identically in a browser — it is the correctly-encoded form — but the raw
-    // payload string differs from the pre-fix output.
-    expect(payload.html).toContain('<h1>Willow &amp; Pine Studio</h1>');
+    expect(payload.html).toContain('<h1>Willow & Pine Studio</h1>');
     expect(payload.html).not.toContain('<script');
     expect(payload.baseCss.length).toBeGreaterThan(0);
     expect(payload.branding.companyName).toBe('Willow & Pine Studio');

backend/src/middleware/apiTokenAuth.js

@@ -1,7 +1,5 @@
 const crypto = require('crypto');
 const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const { isMissingRolesSchema } = require('../utils/dbErrors');
 const logger = require('../utils/logger');
 
 const TOKEN_PREFIX = 'pp_live_';
@@ -65,36 +63,10 @@ async function apiTokenAuth(req, res, next) {
       return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
     }
 
-    // Load the owner WITH their role name (GHSA-9697). Without it,
-    // req.admin.roleName was undefined — and every ownership check keys on
-    // roleName — so the v1 surface could not tell a super_admin from a
-    // demoted viewer. Mirrors adminAuth's shape, including the
-    // roles-table-missing fallback used during upgrades.
-    let admin;
-    try {
-      admin = await db('admin_users')
-        .leftJoin('roles', 'roles.id', 'admin_users.role_id')
-        .where({ 'admin_users.id': row.created_by, 'admin_users.is_active': formatBoolean(true) })
-        .select(
-          'admin_users.id',
-          'admin_users.username',
-          'admin_users.email',
-          'roles.id as role_id',
-          'roles.name as role_name'
-        )
-        .first();
-    } catch (joinError) {
-      // Fail CLOSED on anything that isn't a genuinely missing roles schema:
-      // the fallback fabricates super_admin, so a transient query failure must
-      // not become a free privilege upgrade. Rethrow → outer catch → 500.
-      if (!isMissingRolesSchema(joinError)) throw joinError;
-      logger.debug('Roles table not available in apiTokenAuth', { error: joinError.message });
-      admin = await db('admin_users')
-        .where({ id: row.created_by, is_active: formatBoolean(true) })
-        .select('id', 'username', 'email', 'role_id')
-        .first();
-      if (admin) admin.role_name = 'super_admin'; // upgrade-path parity with adminAuth
-    }
+    const admin = await db('admin_users')
+      .where({ id: row.created_by, is_active: true })
+      .select('id', 'username', 'email', 'role_id')
+      .first();
     if (!admin) {
       return res.status(401).json({ error: 'Token owner unavailable', code: 'OWNER_INACTIVE' });
     }
@@ -103,15 +75,7 @@ async function apiTokenAuth(req, res, next) {
     db('api_tokens').where({ id: row.id }).update({ last_used_at: new Date() })
       .catch((err) => logger.debug('api_tokens last_used update failed', { err: err.message }));
 
-    // Same shape adminAuth produces, so requirePermission / ownership helpers
-    // behave identically whether the caller used a session or an API token.
-    req.admin = {
-      id: admin.id,
-      username: admin.username,
-      email: admin.email,
-      roleId: admin.role_id,
-      roleName: admin.role_name
-    };
+    req.admin = admin;
     req.apiToken = {
       id: row.id,
       name: row.name,
@@ -154,7 +118,6 @@ module.exports = {
   generateApiToken,
   hashToken,
   parseScopes,
-  isMissingRolesSchema,
   TOKEN_PREFIX,
   VALID_SCOPES
 };

backend/src/middleware/auth.js

@@ -1,7 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { isMissingRolesSchema } = require('../utils/dbErrors');
 const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
 const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
@@ -76,14 +75,6 @@ async function adminAuth(req, res, next) {
         )
         .first();
     } catch (joinError) {
-      // Fail CLOSED on anything that isn't a genuinely missing roles schema:
-      // the fallback below fabricates super_admin, so a transient query failure
-      // (connection reset, deadlock, statement timeout, pool exhaustion) must
-      // not become a free privilege upgrade for every scoped admin. Rethrow →
-      // outer catch → 401, which is already how a transient DB fault in this
-      // try block behaves (isTokenRevoked hits the DB here). apiTokenAuth takes
-      // the same posture on the v1 surface, differing only in its 500.
-      if (!isMissingRolesSchema(joinError)) throw joinError;
       // Fallback: roles table may not exist yet during upgrade
       // Query without role join - user will have no role info but can still authenticate
       logger.debug('Roles table not available, falling back to basic auth', { error: joinError.message });

backend/src/middleware/ownership.js

@@ -32,20 +32,6 @@ function requireEventOwnership(req, res, next) {
     });
 }
 
-/**
- * Apply the ownership predicate to a knex query over `events`, for list
- * endpoints that can't use requireEventOwnership (no :id to check).
- * super_admin is unrestricted; everyone else sees ownerless (legacy/system)
- * events plus their own — the same rule requireEventOwnership enforces
- * per-row.
- */
-function scopeEventsQuery(query, admin, column = 'created_by') {
-  if (admin?.roleName === 'super_admin') {
-    return query;
-  }
-  return query.where((q) => q.whereNull(column).orWhere(column, admin.id));
-}
-
 /**
  * Return the subset of `eventIds` the admin may act on, mirroring
  * requireEventOwnership for bulk routes that can't use it (they take an
@@ -78,88 +64,4 @@ async function filterOwnedEventIds(admin, eventIds) {
   return { allowed, denied };
 }
 
-/**
- * Knex subquery selecting the ids of projects `admin` may act on, or `null`
- * when the caller is unrestricted (GHSA-wrg5).
- *
- * Rules, in priority order:
- *   1. A project's STORED owner is authoritative. If `projects.created_by` is
- *      set to a live admin, only that admin (and super_admin) may act on it.
- *      Earlier this union'd in "any linked event I can see", which meant one
- *      legacy ownerless event inside another admin's project exposed the whole
- *      project — its other events, invoices and emails — through the overview.
- *   2. Only when there is NO usable stored owner (NULL, or pointing at a
- *      deleted admin) do we derive from linked events, and then EVERY linked
- *      event must be accessible: a project the old unrestricted routes filled
- *      with several admins' events is ambiguous, and migration 167 deliberately
- *      leaves those NULL. Granting on "any" would have made exactly those
- *      mixed projects readable by everyone.
- *   3. A project with no usable owner AND no linked events (an orphan — not
- *      creatable since createProject stamps created_by) stays super_admin-only.
- *      Failing closed beats failing open; a super_admin can reassign it.
- *
- * Returned as a subquery so callers avoid materialising an id list.
- */
-function ownedProjectsSubquery(admin) {
-  if (admin?.roleName === 'super_admin') return null;
-
-  const linkedEvents = () => db('events').select(db.raw('1')).whereRaw('events.project_id = projects.id');
-
-  return db('projects').select('projects.id').where((w) => {
-    w.where('projects.created_by', admin.id)
-      .orWhere((noOwner) => {
-        noOwner
-          // No usable stored owner: NULL, or a creator that no longer exists
-          // (hard-deleted admin) — otherwise that project would be locked away
-          // from everyone but super_admin forever.
-          .where((c) => c
-            .whereNull('projects.created_by')
-            .orWhereNotIn('projects.created_by', db('admin_users').select('id')))
-          .whereExists(linkedEvents())
-          .whereNotExists(
-            linkedEvents().whereNotNull('events.created_by').whereNot('events.created_by', admin.id),
-          );
-      });
-  });
-}
-
-/**
- * Materialised form of ownedProjectsSubquery, for callers that need the ids
- * themselves. `null` = unrestricted.
- *
- * @returns {Promise<number[]|null>}
- */
-async function ownedProjectIds(admin) {
-  const sub = ownedProjectsSubquery(admin);
-  if (sub === null) return null;
-  const rows = await sub;
-  return rows.map((r) => Number(r.id));
-}
-
-/**
- * Middleware enforcing ownedProjectIds() on a :id project route. 404 (not 403)
- * on a foreign project so the endpoint isn't an existence oracle — same
- * posture filterOwnedEventIds takes for foreign-vs-missing ids.
- */
-function requireProjectOwnership(req, res, next) {
-  const sub = ownedProjectsSubquery(req.admin);
-  if (sub === null) return next();
-  const projectId = Number(req.params.id);
-  sub.clone()
-    .where('projects.id', projectId)
-    .first()
-    .then((row) => {
-      if (!row) return res.status(404).json({ error: 'Project not found' });
-      next();
-    })
-    .catch(() => res.status(500).json({ error: 'Failed to verify project ownership' }));
-}
-
-module.exports = {
-  requireEventOwnership,
-  filterOwnedEventIds,
-  scopeEventsQuery,
-  ownedProjectIds,
-  ownedProjectsSubquery,
-  requireProjectOwnership,
-};
+module.exports = { requireEventOwnership, filterOwnedEventIds };

backend/src/middleware/photoAuth.js

@@ -3,7 +3,6 @@ const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
-const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
 
 async function photoAuth(req, res, next) {
@@ -90,33 +89,7 @@ async function photoAuth(req, res, next) {
         
         // Check if it's an admin token (admins can view all photos)
         if (decoded.type === 'admin') {
-          // Enforce the same revocation / session-cutoff invalidation that
-          // adminAuth does — otherwise a validly-signed admin JWT keeps
-          // serving photos after logout, password change, or explicit
-          // revocation (GHSA-x55x).
-          if (await isTokenRevoked(decoded)) {
-            return res.status(401).json({ error: 'Session expired' });
-          }
-          // adminAuth also (a) rejects tokens for a now-deactivated admin and
-          // (b) rejects any token minted before the admin's last password
-          // change. Token revocation alone doesn't cover those, so without
-          // these two checks a stale or pre-password-change admin token still
-          // fetches every photo.
-          const admin = await db('admin_users')
-            .where({ id: decoded.id, is_active: formatBoolean(true) })
-            .select('id', 'password_changed_at')
-            .first();
-          if (!admin) {
-            return res.status(401).json({ error: 'Session expired' });
-          }
-          if (admin.password_changed_at) {
-            const passwordChangedSeconds = Math.floor(
-              new Date(admin.password_changed_at).getTime() / 1000
-            );
-            if (decoded.iat < passwordChangedSeconds) {
-              return res.status(401).json({ error: 'Session expired' });
-            }
-          }
+          // For both thumbnails and photos with admin token, allow access
           return next();
         }
     } catch (err) {

backend/src/middleware/uploadValidation.js

@@ -23,7 +23,7 @@ async function validateUploadedFile(filePath) {
       let metadata;
       try {
         metadata = await sharp(filePath, {
-          failOn: 'none', // Don't fail on recoverable errors
+          failOnError: false, // Don't fail on recoverable errors
           limitInputPixels: 268402689 // ~16k x 16k max
         }).metadata();
       } catch (metadataError) {
@@ -43,7 +43,7 @@ async function validateUploadedFile(filePath) {
       // Additional check: verify we can actually decode a small portion of the image
       try {
         await sharp(filePath, {
-          failOn: 'none',
+          failOnError: false,
           limitInputPixels: 268402689
         })
         .resize(10, 10) // Try to resize to very small size