chore(stable): release 3.46.10 (#1332)

fix(security): bump sanitize-html to 2.17.7 (stable)

.release-please-manifest.json

@@ -1 +1 @@
-{".":"3.46.8"}
+{".":"3.46.10"}

CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to PicPeak will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.46.10](https://github.com/PicPeak/picpeak/compare/v3.46.9...v3.46.10) (2026-09-07)
+
+
+### Bug Fixes
+
+* **security:** bump sanitize-html to 2.17.7 ([0f426ef](https://github.com/PicPeak/picpeak/commit/0f426ef69968b395c6e3fbd0301fe3a7759a5f44))
+* **security:** bump sanitize-html to 2.17.7 (stable) ([95e3af0](https://github.com/PicPeak/picpeak/commit/95e3af080039f2d31e1cb9c85a3d93b22c80ba7c))
+* **setup:** require Node 22.12 for sanitize-html ([8421b7b](https://github.com/PicPeak/picpeak/commit/8421b7b668484f87cd2bacda8fb4d95a3bc07ab5))
+
+## [3.46.9](https://github.com/PicPeak/picpeak/compare/v3.46.8...v3.46.9) (2026-09-03)
+
+
+### Bug Fixes
+
+* **security:** batch 1 (stable) — zxcvbn DoS, revocation forgery, unlink traversals, stored Content-Type, edge middleware ([3f90221](https://github.com/PicPeak/picpeak/commit/3f90221f40b604dd5cebc016aad9478e84035b97))
+* **security:** bound password input before zxcvbn, and drop the legacy media mounts ([ed08ff8](https://github.com/PicPeak/picpeak/commit/ed08ff84ff014226f1e17cc17167f80afa366f7c))
+* **security:** close three middleware gaps around the API edge ([b136906](https://github.com/PicPeak/picpeak/commit/b1369068ae1327fc29e8aa671029548e2e93d827))
+* **security:** contain logo, favicon and PDF-logo unlinks to their upload directories ([882101b](https://github.com/PicPeak/picpeak/commit/882101b58670e99ac3aea560b83fc4123fe4b359))
+* **security:** enforce the strength-endpoint validators, and stop the generator spinning ([706d402](https://github.com/PicPeak/picpeak/commit/706d402c1e979d8419396c451487fb9be756a449))
+* **security:** harden four smaller gallery and contract paths, drop the unmounted photo auth middleware ([d81cade](https://github.com/PicPeak/picpeak/commit/d81cade7cc9a39179b05ace5ae47b13bbe1d8196))
+* **security:** never serve a photo under its stored MIME, and stop trusting the chunked-upload type ([a8d57f0](https://github.com/PicPeak/picpeak/commit/a8d57f0d696b9e0e92d6ae91beff9f3ad0fa1695))
+* **security:** stop reflecting submitted passwords in validation errors ([6481708](https://github.com/PicPeak/picpeak/commit/6481708def49bc9cdf424752a633e320813cf280))
+* **security:** stop reflecting submitted values in validation errors everywhere, cap credential lengths, close the login timing oracle ([406c638](https://github.com/PicPeak/picpeak/commit/406c6384513da2d7582dc223d799fba7cad56745))
+* **security:** verify the signature before writing a token to the revocation list ([c6d4016](https://github.com/PicPeak/picpeak/commit/c6d401685f4eb4d9fd5fb70636962d73fc631cde))
+
+
+### Documentation
+
+* say the upload allow-list covers every path, video extensions must be added ([c89ce8e](https://github.com/PicPeak/picpeak/commit/c89ce8e1721adfd67598cf35ae307e97ed185827))
+
 ## [3.46.8](https://github.com/PicPeak/picpeak/compare/v3.46.7...v3.46.8) (2026-09-01)
 
 

backend/__tests__/middleware/photoAuth.thumbnailScope.test.js

@@ -1,103 +0,0 @@
-/**
- * Regression test for the cross-event thumbnail enumeration leak.
- *
- * Thumbnails are served flat from /thumbnails/thumb_<name> with
- * deterministic, enumerable filenames. photoAuth previously granted any
- * holder of a gallery token for ANY active event access to ANY thumbnail
- * (it set eventSlug=null and returned next() as long as the token's event
- * existed), so a visitor to one gallery could pull another (password-
- * protected) gallery's entire thumbnail set. The fix scopes thumbnail
- * access to the token's event by matching the requested file against
- * photos.thumbnail_path for that event_id.
- */
-
-process.env.JWT_SECRET = 'test-secret-thumbnail-scope-000000000000';
-
-const jwt = require('jsonwebtoken');
-
-// Two events, each owning one thumbnail. The photos mock resolves a row
-// only when BOTH event_id and thumbnail_path match — i.e. it models the
-// real ownership query.
-const EVENTS = [
-  { id: 10, slug: 'event-a', is_active: 1 },
-  { id: 20, slug: 'event-b', is_active: 1 },
-];
-const PHOTOS = [
-  { id: 1, event_id: 10, thumbnail_path: 'thumbnails/thumb_event-a_ceremony_0001.jpg' },
-  { id: 2, event_id: 20, thumbnail_path: 'thumbnails/thumb_event-b_ceremony_0001.jpg' },
-];
-
-jest.mock('../../src/database/db', () => ({
-  db: (table) => ({
-    _cond: null,
-    where(cond) { this._cond = cond; return this; },
-    first() {
-      if (table === 'events') {
-        return Promise.resolve(EVENTS.find((e) => e.id === this._cond.id) || null);
-      }
-      if (table === 'photos') {
-        return Promise.resolve(
-          PHOTOS.find((p) => p.event_id === this._cond.event_id
-            && p.thumbnail_path === this._cond.thumbnail_path) || null
-        );
-      }
-      return Promise.resolve(null);
-    },
-  }),
-}));
-
-jest.mock('../../src/utils/logger', () => ({
-  info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn(),
-}));
-
-const photoAuth = require('../../src/middleware/photoAuth');
-
-function galleryToken(eventId) {
-  return jwt.sign({ type: 'gallery', eventId }, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
-}
-
-function makeReqRes(token, thumbPath) {
-  const req = { path: thumbPath, headers: { authorization: `Bearer ${token}` }, cookies: {} };
-  const res = {
-    statusCode: null,
-    body: null,
-    status(code) { this.statusCode = code; return this; },
-    json(payload) { this.body = payload; return this; },
-  };
-  return { req, res };
-}
-
-describe('photoAuth — thumbnail ownership scoping', () => {
-  it('denies a gallery token for event A fetching event B\'s thumbnail', async () => {
-    const { req, res } = makeReqRes(galleryToken(10), '/thumb_event-b_ceremony_0001.jpg');
-    const next = jest.fn();
-
-    await photoAuth(req, res, next);
-
-    // Access denied: middleware must not pass the request through.
-    expect(next).not.toHaveBeenCalled();
-    expect(res.statusCode).toBeGreaterThanOrEqual(400);
-    expect(req.event).toBeUndefined();
-  });
-
-  it('allows a gallery token to fetch its own event\'s thumbnail', async () => {
-    const { req, res } = makeReqRes(galleryToken(20), '/thumb_event-b_ceremony_0001.jpg');
-    const next = jest.fn();
-
-    await photoAuth(req, res, next);
-
-    expect(next).toHaveBeenCalled();
-    expect(req.event).toMatchObject({ id: 20 });
-  });
-
-  it('denies a traversal / foreign filename that matches no owned thumbnail', async () => {
-    const { req, res } = makeReqRes(galleryToken(10), '/thumb_../../etc/passwd');
-    const next = jest.fn();
-
-    await photoAuth(req, res, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.statusCode).toBeGreaterThanOrEqual(400);
-    expect(req.event).toBeUndefined();
-  });
-});

backend/__tests__/middleware/securityHardeningBatch2.test.js

@@ -0,0 +1,70 @@
+/**
+ * Second security sweep on the same branch as the password-strength DoS fix
+ * (stable port: the maintenance and admin-preview cases do not apply here).
+ * Each block pins one gap the audit found:
+ *
+ *  - the general rate limiter skipped anyone holding ANY verified JWT,
+ *    including a gallery token minted for free on password-less galleries
+ *  - the multipart branch of the CSRF Content-Type gate accepted cross-site
+ *    form posts
+ */
+const jwt = require('jsonwebtoken');
+
+process.env.JWT_SECRET = 'hardening-batch2-secret';
+
+const fake = { maintenance: 'true', revoked: false, beforeCutoff: false, admin: { id: 1, password_changed_at: null } };
+
+jest.mock('../../src/database/db', () => {
+  const db = jest.fn((table) => {
+    const q = {
+      where: jest.fn().mockReturnThis(),
+      select: jest.fn().mockReturnThis(),
+      first: jest.fn(async () => {
+        if (table === 'app_settings') {
+          return { setting_key: 'general_maintenance_mode', setting_value: fake.maintenance };
+        }
+        if (table === 'admin_users') return fake.admin;
+        return null;
+      }),
+    };
+    return q;
+  });
+  return { db, withRetry: (fn) => fn() };
+});
+jest.mock('../../src/utils/logger', () => ({ error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() }));
+process.env.FRONTEND_URL = 'https://photos.example.com';
+
+const { isAuthenticated } = require('../../src/services/rateLimitService');
+const { multipartOriginAllowed } = require('../../src/utils/requestOrigin');
+
+const iat = Math.floor(Date.now() / 1000) - 10;
+const adminToken = (extra = {}) => jwt.sign({ type: 'admin', id: 1, iat, ...extra }, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+const galleryToken = () => jwt.sign({ type: 'gallery', eventId: 1, iat }, process.env.JWT_SECRET, { issuer: 'picpeak-auth' });
+
+describe('general rate limiter skip', () => {
+  const req = (token) => ({ path: '/api/gallery/x/photos', headers: { authorization: `Bearer ${token}` }, cookies: {} });
+  it('is granted to an admin session', () => {
+    expect(isAuthenticated(req(adminToken()))).toBe(true);
+  });
+  it('is NOT granted to a gallery token', () => {
+    expect(isAuthenticated(req(galleryToken()))).toBe(false);
+  });
+});
+
+describe('multipart origin gate', () => {
+  const req = (headers) => ({ headers: { host: 'photos.example.com', ...headers } });
+  it('accepts same-origin, same-site and non-browser requests', () => {
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'same-origin' }))).toBe(true);
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'same-site' }))).toBe(true);
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'none' }))).toBe(true);
+    expect(multipartOriginAllowed(req({}))).toBe(true);
+    expect(multipartOriginAllowed(req({ origin: 'https://photos.example.com' }))).toBe(true);
+    // Same-origin install without FRONTEND_URL: Origin matches the Host.
+    expect(multipartOriginAllowed({ headers: { host: 'gallery.local', origin: 'http://gallery.local' } })).toBe(true);
+  });
+  it('rejects cross-site form posts', () => {
+    expect(multipartOriginAllowed(req({ 'sec-fetch-site': 'cross-site' }))).toBe(false);
+    expect(multipartOriginAllowed(req({ origin: 'https://evil.example' }))).toBe(false);
+    expect(multipartOriginAllowed(req({ origin: 'null' }))).toBe(false);
+  });
+});

backend/__tests__/routes/passwordStrengthDos.test.js

@@ -0,0 +1,80 @@
+/**
+ * POST /api/auth/password-strength is unauthenticated and feeds its body into
+ * zxcvbn, whose matching is superlinear and runs synchronously on the event
+ * loop. Behind express.json({ limit: '50mb' }) that made a single request a
+ * whole-process denial of service: measured on this codebase, 1,000 characters
+ * blocked for ~5 seconds and 5,000 did not return in two minutes.
+ *
+ * The control is the length cap inside validatePassword(), so it holds for
+ * every caller. These tests pin the cap itself rather than the route, and use
+ * a wall-clock ceiling that only an unbounded zxcvbn call can breach.
+ */
+const { validatePassword, MAX_PASSWORD_LENGTH } = require('../../src/utils/passwordValidation');
+
+describe('password validation length cap (zxcvbn DoS)', () => {
+  it('rejects an over-length password without doing superlinear work', () => {
+    const huge = 'aA1!'.repeat(MAX_PASSWORD_LENGTH); // 4x the cap
+    const started = Date.now();
+    const result = validatePassword(huge);
+    const elapsed = Date.now() - started;
+
+    expect(result.valid).toBe(false);
+    expect(result.errors.join(' ')).toMatch(/at most 128 characters/);
+    // Unbounded, this input would not return for minutes.
+    expect(elapsed).toBeLessThan(250);
+  });
+
+  it('is bounded at the cap itself, the worst input it will still analyse', () => {
+    const atCap = 'aA1!'.repeat(MAX_PASSWORD_LENGTH / 4);
+    expect(atCap).toHaveLength(MAX_PASSWORD_LENGTH);
+
+    // 128 was chosen so the worst input the validator will still analyse costs
+    // about as much as an ordinary request (~41ms measured); 512 cost 1.4s.
+    const started = Date.now();
+    validatePassword(atCap);
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+
+  it('still accepts an ordinary strong password', () => {
+    const result = validatePassword('Tr0ub4dour&3-horse-battery');
+    expect(result.valid).toBe(true);
+  });
+
+  it('does not spin when a caller asks for a length the cap forbids', async () => {
+    // Codex review. generateSecurePassword retried by recursing on any invalid
+    // candidate, so the new cap made every candidate invalid for length > 128
+    // and turned the call into unbounded recursion. It now refuses up front,
+    // and the retry loop is bounded.
+    const { generateSecurePassword } = require('../../src/utils/passwordValidation');
+
+    expect(generateSecurePassword({ length: 16 })).toHaveLength(16);
+    expect(generateSecurePassword({ length: MAX_PASSWORD_LENGTH }))
+      .toHaveLength(MAX_PASSWORD_LENGTH);
+    expect(() => generateSecurePassword({ length: MAX_PASSWORD_LENGTH + 1 }))
+      .toThrow(/at most 128/);
+  });
+
+  it('does not echo the rejected password back in the error body', async () => {
+    // Codex review round 2. express-validator's errors.array() carries the
+    // submitted `value`, so the 400 for an oversized password returned the
+    // password itself -- reflecting a credential, and re-allocating up to the
+    // 50mb body limit on an unauthenticated endpoint, which partly undid the
+    // DoS fix this branch exists for.
+    const src = require('fs').readFileSync(
+      require('path').join(__dirname, '../../src/routes/auth.js'), 'utf8');
+
+    // No route may hand errors.array() straight to the response.
+    expect(src).not.toMatch(/errors:\s*errors\.array\(\)/);
+    // ...and the shared helper that replaces it must drop `value`.
+    const helper = require('fs').readFileSync(
+      require('path').join(__dirname, '../../src/utils/routeHelpers.js'), 'utf8');
+    expect(helper).toMatch(/safeValidationErrors\s*=\s*\(errors\)\s*=>\s*errors\.array\(\)\.map\(\(\{ value, \.\.\.rest \}\)/);
+  });
+
+  it('applies the cap through the context wrapper too', async () => {
+    const { validatePasswordInContext } = require('../../src/utils/passwordValidation');
+    const huge = 'aA1!'.repeat(MAX_PASSWORD_LENGTH);
+    const result = await validatePasswordInContext(huge, 'admin', {});
+    expect(result.valid).toBe(false);
+  });
+});

backend/__tests__/utils/photoContentType.test.js

@@ -0,0 +1,47 @@
+/**
+ * photos.mime_type is client-influenced (chunked uploads stored the declared
+ * type verbatim; the S3 importer stores whatever mime-types derives). Every
+ * serving route must go through resolvePhotoContentType so the header is
+ * always image/* or video/* and never the stored value as given.
+ */
+const fs = require('fs');
+const path = require('path');
+const { resolvePhotoContentType } = require('../../src/utils/photoContentType');
+
+describe('resolvePhotoContentType', () => {
+  it('never echoes a non-media stored MIME', () => {
+    expect(resolvePhotoContentType({ filename: 'a.jpg', mime_type: 'text/html' })).toBe('image/jpeg');
+    expect(resolvePhotoContentType({ filename: 'a', mime_type: 'text/html' })).toBe('image/jpeg');
+    expect(resolvePhotoContentType({ filename: 'a.gif', mime_type: 'application/javascript' })).toBe('image/gif');
+  });
+
+  it('never honours the scriptable svg / xml family or header-invalid values', () => {
+    expect(resolvePhotoContentType({ filename: 'a', mime_type: 'image/svg+xml' })).toBe('image/jpeg');
+    expect(resolvePhotoContentType({ filename: 'a', mime_type: 'image/x\r\nX-Injected: 1' })).toBe('image/jpeg');
+    expect(resolvePhotoContentType({ filename: 'a.mp4', mime_type: 'video/mp4\r\nX: y' })).toBe('video/mp4');
+  });
+
+  it('prefers the mapped extension for images and the stored type for videos', () => {
+    expect(resolvePhotoContentType({ filename: 'a.png', mime_type: 'image/jpeg' })).toBe('image/png');
+    expect(resolvePhotoContentType({ filename: 'a.mov', mime_type: null })).toBe('video/quicktime');
+    expect(resolvePhotoContentType({ filename: 'a.bin', media_type: 'video' })).toBe('video/mp4');
+    expect(resolvePhotoContentType({ filename: 'a', mime_type: 'image/avif' })).toBe('image/avif');
+    expect(resolvePhotoContentType({ filename: 'a.constructor', mime_type: null })).toBe('image/jpeg');
+  });
+});
+
+describe('serving routes use the resolver', () => {
+  const routes = ['gallery.js', 'secureImages.js', 'protectedImages.js', 'adminPhotos.js'];
+  it.each(routes)('%s sets no Content-Type from photo.mime_type directly', (name) => {
+    const src = fs.readFileSync(path.join(__dirname, '../../src/routes', name), 'utf8');
+    expect(src).not.toMatch(/'Content-Type':\s*photo\.mime_type/);
+    expect(src).not.toMatch(/set\('Content-Type',\s*photo\.mime_type\)/);
+    expect(src).toMatch(/resolvePhotoContentType\(photo\)/);
+  });
+
+  it('chunked-upload init derives the MIME from the allow-listed extension', () => {
+    const src = fs.readFileSync(path.join(__dirname, '../../src/routes/adminPhotos.js'), 'utf8');
+    expect(src).not.toMatch(/const \{ filename, fileSize, mimeType, totalChunks \} = req\.body/);
+    expect(src).toMatch(/allowedMimeTypes\.includes\(mimeType\)/);
+  });
+});

backend/__tests__/utils/safePathUploadedAssets.test.js

@@ -0,0 +1,59 @@
+/**
+ * Containment for the two admin-writable "delete the old file" paths.
+ *
+ * Settings → Branding persists logo_url / favicon_url verbatim and, on
+ * clear, unlinked `path.join(storage, url)` after a mere prefix check.
+ * Business profile did the same for logo_path behind a `/pdf-logo-\d+\./`
+ * marker. Both let an admin delete any file the process can reach. The
+ * helpers below only ever name a flat leaf inside the fixed directory.
+ */
+const path = require('path');
+const { uploadedAssetPath, uploadedPdfLogoPath } = require('../../src/utils/safePath');
+
+const root = '/srv/picpeak/storage';
+
+describe('uploadedAssetPath', () => {
+  it('resolves a flat leaf inside the named upload directory', () => {
+    expect(uploadedAssetPath('/uploads/logos/logo-1.png', 'logos', root))
+      .toBe(path.join(root, 'uploads', 'logos', 'logo-1.png'));
+    expect(uploadedAssetPath('/uploads/favicons/fav.ico', 'favicons', root))
+      .toBe(path.join(root, 'uploads', 'favicons', 'fav.ico'));
+  });
+
+  it.each([
+    '/uploads/logos/../../../data/picpeak.db',
+    '/uploads/logos/..',
+    '/uploads/logos/',
+    '/uploads/logos/sub/dir.png',
+    '/uploads/favicons/x.ico', // wrong kind
+    'uploads/logos/logo.png', // not /-rooted
+    'https://example.com/uploads/logos/logo.png',
+    '',
+    null,
+    42,
+  ])('refuses %p', (value) => {
+    expect(uploadedAssetPath(value, 'logos', root)).toBeNull();
+  });
+});
+
+describe('uploadedPdfLogoPath', () => {
+  it('resolves the file the upload route writes', () => {
+    expect(uploadedPdfLogoPath('/uploads/logos/pdf-logo-1700000000000.png', root))
+      .toBe(path.join(root, 'uploads', 'logos', 'pdf-logo-1700000000000.png'));
+    expect(uploadedPdfLogoPath('uploads/logos/pdf-logo-1.svg', root))
+      .toBe(path.join(root, 'uploads', 'logos', 'pdf-logo-1.svg'));
+  });
+
+  it.each([
+    'pdf-logo-1./../../../../etc/target',
+    '/uploads/logos/pdf-logo-1./../../secret',
+    '/etc/pdf-logo-1.x',
+    '/uploads/logos/pdf-logo-1.png/../other',
+    '/uploads/logos/other-logo.png',
+    '/uploads/contracts/signed/pdf-logo-1.pdf',
+    '',
+    null,
+  ])('refuses %p', (value) => {
+    expect(uploadedPdfLogoPath(value, root)).toBeNull();
+  });
+});

backend/__tests__/utils/tokenRevocation.forgery.test.js

@@ -0,0 +1,69 @@
+/**
+ * revokeToken() is reachable from the unauthenticated logout endpoints
+ * (POST /api/auth/logout, /gallery/logout, /customer-auth/logout). It used
+ * to base64-decode the payload without checking the signature and insert a
+ * row keyed on `${id}-${iat}-${type}` -- the same key isTokenRevoked()
+ * matches for real sessions. Anyone could therefore forge a payload naming
+ * another user's id, type and login second and log them out remotely, and
+ * with a far-future `exp` the row was never swept.
+ *
+ * The contract pinned here: only a token whose signature verifies under
+ * JWT_SECRET is written to revoked_tokens. Expired-but-genuine tokens are
+ * still accepted (logout must stay idempotent).
+ */
+const jwt = require('jsonwebtoken');
+
+process.env.JWT_SECRET = 'revocation-forgery-test-secret';
+
+const inserted = [];
+jest.mock('../../src/database/db', () => {
+  const dbFn = () => ({
+    insert(row) {
+      inserted.push(row);
+      return { onConflict: () => ({ ignore: async () => undefined }) };
+    },
+  });
+  return { db: dbFn };
+});
+jest.mock('../../src/utils/logger', () => ({
+  info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn(),
+}));
+
+const { revokeToken } = require('../../src/utils/tokenRevocation');
+
+const iat = Math.floor(Date.now() / 1000) - 60;
+
+describe('revokeToken signature check', () => {
+  beforeEach(() => { inserted.length = 0; });
+
+  it('refuses a forged three-part token and writes nothing', async () => {
+    const forgedPayload = Buffer.from(JSON.stringify({
+      id: 1, iat, type: 'admin', exp: 9e9,
+    })).toString('base64');
+    const forged = `eyJhbGciOiJIUzI1NiJ9.${forgedPayload}.notasignature`;
+
+    const result = await revokeToken(forged, 'user_logout');
+
+    expect(result).toBe(false);
+    expect(inserted).toHaveLength(0);
+  });
+
+  it('refuses a token signed with a different secret', async () => {
+    const other = jwt.sign({ id: 1, iat, type: 'admin' }, 'some-other-secret', { expiresIn: '1h' });
+    expect(await revokeToken(other, 'user_logout')).toBe(false);
+    expect(inserted).toHaveLength(0);
+  });
+
+  it('revokes a genuine token', async () => {
+    const genuine = jwt.sign({ id: 1, iat, type: 'admin' }, process.env.JWT_SECRET, { expiresIn: '1h' });
+    expect(await revokeToken(genuine, 'user_logout')).toBe(true);
+    expect(inserted).toHaveLength(1);
+    expect(inserted[0].token_id).toBe(`1-${iat}-admin`);
+  });
+
+  it('still revokes a genuine token that has already expired', async () => {
+    const expired = jwt.sign({ id: 1, iat, type: 'admin', exp: iat + 1 }, process.env.JWT_SECRET);
+    expect(await revokeToken(expired, 'user_logout')).toBe(true);
+    expect(inserted).toHaveLength(1);
+  });
+});

backend/jest.config.js

@@ -12,5 +12,9 @@ module.exports = {
   testMatch: [
     '**/__tests__/**/*.test.js'
   ],
-  setupFilesAfterEnv: ['<rootDir>/jest.setup.js']
+  setupFilesAfterEnv: ['<rootDir>/jest.setup.js'],
+  // sanitize-html's htmlparser2 12 is ESM-only; see jest.sanitizeHtml.js.
+  moduleNameMapper: {
+    '^sanitize-html$': '<rootDir>/jest.sanitizeHtml.js'
+  }
 };

backend/jest.sanitizeHtml.js

@@ -0,0 +1,18 @@
+/**
+ * sanitize-html 2.17.6+ depends on htmlparser2 12, which ships ESM only.
+ * Node 22.12+ loads it fine through require(esm); Jest 29's CommonJS module
+ * registry cannot evaluate an ESM file and fails every suite that imports a
+ * route or service using the sanitiser. Rather than bolting a Babel
+ * transform onto node_modules for one dependency, hand this single module to
+ * Node's own loader.
+ *
+ * process.getBuiltinModule (Node 22.3+) is the real core `module` even inside
+ * Jest — a plain require('module') here returns Jest's wrapper, whose
+ * createRequire() hands back an empty object for this package. createRequire()
+ * on the real one resolves from backend/node_modules exactly like production.
+ *
+ * Wired in via moduleNameMapper in jest.config.js. The module is stateless,
+ * so sharing one instance across test files changes nothing; it just cannot
+ * be jest.mock()ed, and nothing mocks it.
+ */
+module.exports = process.getBuiltinModule('module').createRequire(__filename)('sanitize-html');

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-backend",
-  "version": "3.46.0",
+  "version": "3.46.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-backend",
-      "version": "3.46.0",
+      "version": "3.46.8",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.850.0",
         "@aws-sdk/lib-storage": "^3.850.0",
@@ -49,7 +49,7 @@
         "postcss": "8.5.23",
         "qrcode": "^1.5.4",
         "react-i18next": "^15.6.0",
-        "sanitize-html": "2.17.5",
+        "sanitize-html": "2.17.7",
         "sharp": "0.35.3",
         "sqlite3": "^5.1.6",
         "swagger-jsdoc": "^6.2.8",
@@ -68,7 +68,7 @@
         "supertest": "^6.3.3"
       },
       "engines": {
-        "node": "^20.19.0 || >=22"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@apidevtools/json-schema-ref-parser": {
@@ -10469,12 +10469,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -10852,18 +10853,122 @@
       "license": "MIT"
     },
     "node_modules/sanitize-html": {
-      "version": "2.17.5",
-      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.5.tgz",
-      "integrity": "sha512-ZmU1joGRrvoyctKIiuwUxqR6moLoU2Wk+2bMccN6f7UwhAmwYDvWziqPxRDDN2Qip62NqnIrVrT9akbL6Wretg==",
+      "version": "2.17.7",
+      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.7.tgz",
+      "integrity": "sha512-PGtEkc9cbnedU3s9TmzDbpsZ8w086g/0Q8k8/oIO1NLNU3i5k9yn835CrjJSajp1KMmkisbO1qPXxNKO3welAg==",
       "license": "MIT",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "escape-string-regexp": "^4.0.0",
-        "htmlparser2": "^10.1.0",
+        "htmlparser2": "^12.0.0",
         "is-plain-object": "^5.0.0",
         "launder": "^1.7.1",
         "parse-srcset": "^1.0.2",
         "postcss": "^8.3.11"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/dom-serializer": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-3.1.1.tgz",
+      "integrity": "sha512-4MEa38/QexBob6gFNwu+EGdWvhJ1OKuNwdYY3Y3NyeWDQfnGeDYQUDfIRzWu5B5gsv03so2Uxd28YC6zrsx3Lw==",
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^3.0.0",
+        "domhandler": "^6.0.0",
+        "entities": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/domelementtype": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-3.0.0.tgz",
+      "integrity": "sha512-umCQid3jKbDmVjx8jGaW7uUykm4DEUeyV21hPxNMo2nV955DhUThwqyOIDtreepP31hl84X7G5U9ZfsWvIB3Pg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/domhandler": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-6.0.1.tgz",
+      "integrity": "sha512-gYzvtM72ZtxQO0T048kd6HWSbbGCNOUwcnfQ01cqIJ4X2IYKFFHZ5mKvrQETcFXxsRObZulDaKmy//R7TPtsBg==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "domelementtype": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/fb55/domhandler?sponsor=1"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/domutils": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-4.0.2.tgz",
+      "integrity": "sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "dom-serializer": "^3.0.0",
+        "domelementtype": "^3.0.0",
+        "domhandler": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/fb55/domutils?sponsor=1"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/entities": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-8.0.0.tgz",
+      "integrity": "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/sanitize-html/node_modules/htmlparser2": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-12.0.0.tgz",
+      "integrity": "sha512-Tz7u1i95/g2x2jz81+x0FBVhBhY5aRTvD3tXXdFaljuNdzDLJ8UGNRrTcj2cgQvAg3iW/h77Fz15nLW0L0CrZw==",
+      "funding": [
+        "https://github.com/fb55/htmlparser2?sponsor=1",
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "domelementtype": "^3.0.0",
+        "domhandler": "^6.0.0",
+        "domutils": "^4.0.2",
+        "entities": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
       }
     },
     "node_modules/selderee": {
@@ -11038,14 +11143,14 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -11057,13 +11162,13 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"

backend/package.json

@@ -1,10 +1,10 @@
 {
   "name": "picpeak-backend",
-  "version": "3.46.8",
+  "version": "3.46.10",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "engines": {
-    "node": "^20.19.0 || >=22"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "start": "node server.js",
@@ -58,7 +58,7 @@
     "postcss": "8.5.23",
     "qrcode": "^1.5.4",
     "react-i18next": "^15.6.0",
-    "sanitize-html": "2.17.5",
+    "sanitize-html": "2.17.7",
     "sharp": "0.35.3",
     "sqlite3": "^5.1.6",
     "swagger-jsdoc": "^6.2.8",

backend/server.js

@@ -206,25 +206,13 @@ app.use((req, res, next) => {
 });
 
 // CORS configuration (apply only to API routes)
+const { isAllowedOrigin, multipartOriginAllowed } = require('./src/utils/requestOrigin');
+
 const corsOptions = {
   origin: function (origin, callback) {
-    const allowedOrigins = [
-      process.env.FRONTEND_URL || 'http://localhost:3005',
-      process.env.ADMIN_URL || 'http://localhost:3005'
-    ];
-
-    // In development, also allow localhost origins
-    if (process.env.NODE_ENV === 'development') {
-      allowedOrigins.push(
-        'http://localhost:5173', // Vite dev server
-        'http://localhost:3002', // Backend server
-        'http://localhost:3001', // For API testing
-        'http://localhost:3000'  // Direct backend access
-      );
-    }
-
+    // Allowlist lives in utils/requestOrigin, shared with the multipart gate.
     // Allow requests with no origin (like curl) and allow-listed origins
-    if (!origin || allowedOrigins.indexOf(origin) !== -1) {
+    if (!origin || isAllowedOrigin(origin)) {
       callback(null, true);
     } else {
       // Do not error globally; just omit CORS headers on disallowed origins
@@ -452,8 +440,14 @@ async function initializeRateLimiters() {
 }
 
 // Note: Rate limiters will be initialized after database connection
-app.use(express.json({ limit: '50mb' }));
-app.use(express.urlencoded({ extended: true, limit: '50mb' }));
+// Body limits. 50mb is only needed by the authenticated admin and API-token
+// surfaces (restore manifests, CMS and email templates, bulk operations);
+// applied globally it let any unauthenticated caller hand JSON.parse a 50mb
+// body and block the event loop. express.json skips a request whose body
+// is already parsed, so the scoped parser must run first.
+app.use(['/api/admin', '/api/v1'], express.json({ limit: '50mb' }));
+app.use(express.json({ limit: '2mb' }));
+app.use(express.urlencoded({ extended: true, limit: '2mb' }));
 
 // CSRF protection: require JSON Content-Type on mutating API requests
 // This blocks cross-origin form submissions which cannot set Content-Type: application/json
@@ -465,6 +459,14 @@ app.use('/api', (req, res, next) => {
     if (contentLength > 0 && !contentType.includes('application/json') && !contentType.includes('multipart/form-data')) {
       return res.status(415).json({ error: 'Unsupported Content-Type. Use application/json or multipart/form-data.' });
     }
+    // multipart is exactly what a cross-site <form> can send without a
+    // preflight, and in a split-origin deployment (SameSite=None) the admin
+    // cookie rides along to the upload routes. Browsers label such a
+    // submission Sec-Fetch-Site: cross-site (and always send Origin on a
+    // cross-origin POST); non-browser clients send neither header and pass.
+    if (contentType.includes('multipart/form-data') && !multipartOriginAllowed(req)) {
+      return res.status(403).json({ error: 'Cross-site multipart request rejected' });
+    }
   }
   next();
 });
@@ -521,14 +523,35 @@ const secureStatic = require('./src/middleware/secureStatic');
 const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
 process.env.EXTERNAL_MEDIA_ROOT = process.env.EXTERNAL_MEDIA_ROOT || '/external-media';
 
-// Static file serving for photos (protected)
-app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'events/active')));
+// The /photos and /thumbnails static mounts are gone.
+//
+// They served the raw originals tree and the thumbnail tree behind photoAuth
+// alone, which authorises on a slug match. A static file server cannot apply
+// the rules the gallery API applies per photo, so everything the API decides
+// was simply absent here: allow_downloads, per-category allow_downloads,
+// watermarking, the resolution cap, reveal-mode windows, visibility='hidden',
+// download logging, and the customer-assignment re-check that lets an admin
+// revoke access immediately. The filenames needed to exercise it are handed to
+// every guest in the photos listing.
+//
+// Nothing builds these URLs: no reference in frontend/src, none in the email
+// templates, and the only backend mentions are the /api/admin/photos/... API
+// routes and a maintenance-mode prefix list. nginx still proxies /photos and
+// /thumbnails; those locations now 404, which is the intended outcome.
+//
+// Serving these safely would mean reimplementing per-photo authorisation and
+// image processing inside a static handler -- i.e. the gallery API, which
+// already exists at /api/gallery/:slug/photo/:id and /thumbnail/:id.
 
-// Static file serving for thumbnails (protected)
-app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'thumbnails')));
-
-// Static file serving for uploads (public - logos, favicons)
-app.use('/uploads', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads')));
+// Static file serving for uploads.
+//
+// Narrowed to the two public asset trees. The mount used to expose the whole
+// uploads/ root with no auth middleware at all, and that root also holds
+// signed contract PDFs (uploads/contracts/signed) and client transfer files
+// (uploads/transfers/<id>) -- both reachable by anyone who learned or guessed
+// a filename. Those are served by their own authorised routes.
+app.use('/uploads/logos', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads/logos')));
+app.use('/uploads/favicons', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads/favicons')));
 
 // Static file serving for self-hosted webfonts (public — gallery visitors
 // load these via @font-face). Replaces the previous Google Fonts CDN
@@ -695,10 +718,15 @@ app.get(
         // whereas Firefox/Chrome do — so a 302 worked everywhere except
         // Safari. sendFile sets the right content-type from the extension.
         const rel = String(url).replace(/^\/+/, '').replace(/^uploads\//, '');
+        // Containment is the two public asset trees, not the whole uploads/
+        // root: that root also holds signed contracts and client transfer
+        // files, and the favicon URL is an admin-writable setting, so the
+        // wider check let `/uploads/contracts/signed/<file>` be served here
+        // unauthenticated with a day of cache.
         const uploadsRoot = path.resolve(path.join(storagePath, 'uploads'));
         const resolved = path.resolve(path.join(uploadsRoot, rel));
-        // Path containment — never serve outside the uploads dir.
-        if (resolved.startsWith(uploadsRoot + path.sep) && fs.existsSync(resolved)) {
+        const servableRoots = ['favicons', 'logos'].map((d) => path.join(uploadsRoot, d) + path.sep);
+        if (servableRoots.some((root) => resolved.startsWith(root)) && fs.existsSync(resolved)) {
           // This route streams the file directly, bypassing the secureStatic
           // middleware — so re-apply its SVG hardening here. An admin-uploaded
           // SVG favicon could contain <script>; served at the top-level

backend/src/middleware/auth.js

@@ -4,7 +4,7 @@ const { formatBoolean } = require('../utils/dbCompat');
 const { isMissingRolesSchema } = require('../utils/dbErrors');
 const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');
-const { getAdminTokenFromRequest, getGalleryTokenFromRequest } = require('../utils/tokenUtils');
+const { getAdminTokenFromRequest } = require('../utils/tokenUtils');
 
 /**
  * Enhanced admin authentication middleware with revocation checking
@@ -136,170 +136,6 @@ async function adminAuth(req, res, next) {
   }
 }
 
-/**
- * Enhanced gallery authentication middleware with revocation checking
- */
-async function galleryAuth(req, res, next) {
-  try {
-    const slug = req.params?.slug || req.requestedSlug;
-    const token = getGalleryTokenFromRequest(req, slug);
-    if (!token) {
-      return res.status(401).json({ error: 'No token provided' });
-    }
-    
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, {
-        algorithms: ['HS256'],
-        issuer: 'picpeak-auth',
-        complete: true
-      });
-      decoded = decoded.payload;
-    } catch (err) {
-      if (err.name === 'TokenExpiredError') {
-        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
-      }
-      return res.status(401).json({ error: 'Invalid session' });
-    }
-    
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      return res.status(401).json({ error: 'Session has been invalidated', code: 'TOKEN_REVOKED' });
-    }
-    
-    // Verify token type
-    if (decoded.type !== 'gallery') {
-      return res.status(403).json({ error: 'Invalid access token' });
-    }
-    
-    // Check if event still exists and is active
-    const event = await db('events')
-      .where({ 
-        id: decoded.eventId, 
-        is_active: true, 
-        is_archived: false 
-      })
-      .first();
-    
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found or expired' });
-    }
-    
-    // Check if gallery has expired (only if expires_at is set)
-    // Galleries with null expires_at never expire
-    if (event.expires_at && new Date(event.expires_at) < new Date()) {
-      return res.status(410).json({
-        error: 'Gallery has expired',
-        code: 'GALLERY_EXPIRED'
-      });
-    }
-    
-    // Add event info to request
-    req.event = event;
-    req.galleryToken = decoded;
-    req.token = token;
-    
-    next();
-  } catch (error) {
-    logger.error('Gallery auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Photo access authentication
- * Validates both admin and gallery tokens for photo access
- */
-async function photoAuth(req, res, next) {
-  try {
-    const slug = req.params?.slug || req.requestedSlug;
-    const token = getAdminTokenFromRequest(req) || getGalleryTokenFromRequest(req, slug);
-    if (!token) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-
-    let decoded;
-    try {
-      decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
-    } catch (err) {
-      return res.status(401).json({ error: 'Invalid token' });
-    }
-
-    // Check if token is revoked
-    if (await isTokenRevoked(decoded)) {
-      return res.status(401).json({ error: 'Token has been revoked', code: 'TOKEN_REVOKED' });
-    }
-
-    // Allow both admin and gallery tokens
-    if (decoded.type === 'admin') {
-      const admin = await db('admin_users')
-        .where({ id: decoded.id, is_active: formatBoolean(true) })
-        .first();
-
-      if (!admin) {
-        return res.status(401).json({ error: 'Invalid token' });
-      }
-
-      req.auth = { type: 'admin', user: admin };
-    } else if (decoded.type === 'gallery') {
-      const event = await db('events')
-        .where({
-          id: decoded.eventId,
-          is_active: true,
-          is_archived: false
-        })
-        .first();
-
-      if (!event) {
-        return res.status(404).json({ error: 'Gallery not found' });
-      }
-
-      // For gallery tokens, ensure they can only access their event's photos
-      req.auth = { type: 'gallery', event: event };
-    } else {
-      return res.status(403).json({ error: 'Invalid token type' });
-    }
-
-    next();
-  } catch (error) {
-    logger.error('Photo auth middleware error:', error);
-    res.status(401).json({ error: 'Authentication failed' });
-  }
-}
-
-/**
- * Verify gallery access for specific operations
- */
-async function verifyGalleryAccess(req, res, next) {
-  try {
-    if (!req.auth) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-
-    const { eventId } = req.params;
-
-    // Admins can access any gallery
-    if (req.auth.type === 'admin') {
-      return next();
-    }
-
-    // Gallery tokens can only access their own event
-    if (req.auth.type === 'gallery') {
-      if (req.auth.event.id !== parseInt(eventId)) {
-        return res.status(403).json({ error: 'Access denied' });
-      }
-      return next();
-    }
-
-    res.status(403).json({ error: 'Access denied' });
-  } catch (error) {
-    res.status(500).json({ error: 'Access verification failed' });
-  }
-}
-
 module.exports = {
-  adminAuth,
-  galleryAuth,
-  photoAuth,
-  verifyGalleryAccess
+  adminAuth
 };

backend/src/middleware/photoAuth.js

@@ -1,176 +0,0 @@
-const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
-const { isTokenRevoked } = require('../utils/tokenRevocation');
-const logger = require('../utils/logger');
-
-async function photoAuth(req, res, next) {
-  try {
-    // Extract event slug from the path
-    let eventSlug;
-    
-    // For thumbnails, we need to parse the filename to get the event info
-    if (req.path.startsWith('/thumb_')) {
-      // For now, we'll rely on JWT token for thumbnail access
-      eventSlug = null;
-    } else {
-      // For regular photos, the slug is the first part of the path
-      eventSlug = req.path.split('/')[1];
-    }
-    
-    // First check for JWT token (from gallery access)
-    const tokenFromRequest = getGalleryTokenFromRequest(req, eventSlug);
-    if (tokenFromRequest) {
-      const token = tokenFromRequest;
-      try {
-        // Try to verify with issuer first, fallback to no issuer for backward compatibility
-        let decoded;
-        try {
-          decoded = jwt.verify(token, process.env.JWT_SECRET, {
-            algorithms: ['HS256'],
-            issuer: 'picpeak-auth'
-          });
-        } catch (issuerError) {
-          // If verification fails with issuer, try without issuer (backward compatibility)
-          if (issuerError.name === 'JsonWebTokenError' && issuerError.message.includes('jwt issuer invalid')) {
-            decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] });
-          } else {
-            throw issuerError;
-          }
-        }
-        
-        // Check if it's a gallery token
-        if (decoded.type === 'gallery') {
-          // For thumbnails, we need to verify the token is for a valid event
-          if (!eventSlug) {
-            // Resolve the token's event (by id, or legacy slug fallback)...
-            let event = null;
-            if (decoded.eventId) {
-              event = await db('events')
-                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
-                .first();
-            }
-            if (!event && decoded.eventSlug) {
-              event = await db('events')
-                .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
-                .first();
-            }
-            // ...then confirm the REQUESTED thumbnail actually belongs to
-            // that event. Thumbnails are stored flat (thumbnails/thumb_<name>)
-            // with deterministic, enumerable filenames derived from the
-            // public event name + a sequential counter. Without this
-            // ownership check any holder of a gallery token for any event
-            // could enumerate and fetch another (password-protected) event's
-            // entire thumbnail set, defeating the gallery password. A
-            // traversal or foreign filename simply fails to match → denied.
-            if (event) {
-              const requestedKey = `thumbnails${req.path}`;
-              const ownsThumbnail = await db('photos')
-                .where({ event_id: event.id, thumbnail_path: requestedKey })
-                .first();
-              if (ownsThumbnail) {
-                req.event = event;
-                return next();
-              }
-            }
-          }
-          // For regular photos, check if token matches the event
-          else if (decoded.eventSlug === eventSlug) {
-            const event = await db('events')
-              .where({ slug: eventSlug, is_active: formatBoolean(true) })
-              .first();
-            if (event) {
-              req.event = event;
-              return next();
-            }
-          }
-        }
-        
-        // Check if it's an admin token (admins can view all photos)
-        if (decoded.type === 'admin') {
-          // Enforce the same revocation / session-cutoff invalidation that
-          // adminAuth does — otherwise a validly-signed admin JWT keeps
-          // serving photos after logout, password change, or explicit
-          // revocation (GHSA-x55x).
-          if (await isTokenRevoked(decoded)) {
-            return res.status(401).json({ error: 'Session expired' });
-          }
-          // adminAuth also (a) rejects tokens for a now-deactivated admin and
-          // (b) rejects any token minted before the admin's last password
-          // change. Token revocation alone doesn't cover those, so without
-          // these two checks a stale or pre-password-change admin token still
-          // fetches every photo.
-          const admin = await db('admin_users')
-            .where({ id: decoded.id, is_active: formatBoolean(true) })
-            .select('id', 'password_changed_at')
-            .first();
-          if (!admin) {
-            return res.status(401).json({ error: 'Session expired' });
-          }
-          if (admin.password_changed_at) {
-            const passwordChangedSeconds = Math.floor(
-              new Date(admin.password_changed_at).getTime() / 1000
-            );
-            if (decoded.iat < passwordChangedSeconds) {
-              return res.status(401).json({ error: 'Session expired' });
-            }
-          }
-          return next();
-        }
-    } catch (err) {
-      // Token invalid, fall through to password check
-      logger.warn('JWT verification failed in photoAuth', { error: err.message });
-      }
-    }
-    
-    // Check for password header (legacy support)
-    const password = req.headers['x-gallery-password'];
-    
-    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
-    if (!eventSlug && !password && !tokenFromRequest) {
-      return res.status(401).json({ error: 'Authentication required for thumbnails' });
-    }
-
-    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Gallery not found' });
-    }
-
-    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
-
-    if (!requiresPassword) {
-      req.event = event;
-      return next();
-    }
-    
-    if (!password && !tokenFromRequest) {
-      return res.status(401).json({ error: 'Authentication required' });
-    }
-
-    if (password) {
-      const validPassword = await bcrypt.compare(password, event.password_hash);
-      if (!validPassword) {
-        await db('access_logs').insert({
-          event_id: event.id,
-          ip_address: req.ip,
-          user_agent: req.headers['user-agent'],
-          action: 'login_fail'
-        });
-        return res.status(401).json({ error: 'Invalid password' });
-      }
-    } else {
-      // No valid authentication
-      return res.status(401).json({ error: 'Invalid authentication' });
-    }
-    
-    req.event = event;
-    next();
-  } catch (error) {
-    logger.error('Photo auth error', { error: error.message, stack: error.stack });
-    res.status(500).json({ error: 'Authentication error' });
-  }
-}
-
-module.exports = photoAuth;

backend/src/routes/adminApiTokens.js

@@ -7,6 +7,7 @@
 
 const express = require('express');
 const { body, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('./../middleware/auth');
 const { requirePermission } = require('./../middleware/permissions');
@@ -65,7 +66,7 @@ router.post(
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
       const { name, scopes, expires_at } = req.body;
       const { plaintext, hashed, preview } = generateApiToken();

backend/src/routes/adminBusinessProfile.js

@@ -22,6 +22,7 @@ const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
 const { getStoragePath } = require('../config/storage');
+const { uploadedPdfLogoPath } = require('../utils/safePath');
 const businessProfileService = require('../services/businessProfileService');
 const { db } = require('../database/db');
 const { validateIban } = require('../utils/iban');
@@ -358,12 +359,8 @@ router.post(
     // a path managed by a different system.
     try {
       const previous = await db('business_profile').where({ id: 1 }).first();
-      const prev = previous?.logo_path;
-      if (prev && typeof prev === 'string' && /pdf-logo-\d+\./.test(prev)) {
-        const stripped = prev.replace(/^\/+/, '');
-        const prevDisk = path.isAbsolute(prev)
-          ? prev
-          : path.join(getStoragePath(), stripped);
+      const prevDisk = uploadedPdfLogoPath(previous?.logo_path, getStoragePath());
+      if (prevDisk) {
         try { await fs.unlink(prevDisk); } catch (_) { /* ignore */ }
       }
     } catch (_) { /* ignore */ }
@@ -383,12 +380,8 @@ router.delete(
   requirePermission('settings.edit'),
   handleAsync(async (req, res) => {
     const existing = await db('business_profile').where({ id: 1 }).first();
-    const prev = existing?.logo_path;
-    if (prev && typeof prev === 'string' && /pdf-logo-\d+\./.test(prev)) {
-      const stripped = prev.replace(/^\/+/, '');
-      const prevDisk = path.isAbsolute(prev)
-        ? prev
-        : path.join(getStoragePath(), stripped);
+    const prevDisk = uploadedPdfLogoPath(existing?.logo_path, getStoragePath());
+    if (prevDisk) {
       try { await fs.unlink(prevDisk); } catch (_) { /* ignore */ }
     }
     await businessProfileService.updateProfile(

backend/src/routes/adminCMS.js

@@ -3,6 +3,7 @@ const path = require('path');
 const fs = require('fs').promises;
 const multer = require('multer');
 const { body, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
@@ -80,7 +81,7 @@ router.put('/pages/:slug', adminAuth, requirePermission('cms.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slug } = req.params;

backend/src/routes/adminCategories.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { body, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { db, logActivity } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth');
@@ -51,7 +52,7 @@ router.post('/', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
     
     const { name, slug, is_global = true, event_id = null } = req.body;
@@ -119,7 +120,7 @@ router.put('/:id', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { id } = req.params;
@@ -191,7 +192,7 @@ router.put('/:id/hero', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { id } = req.params;

backend/src/routes/adminCssTemplates.js

@@ -6,6 +6,7 @@
 const express = require('express');
 const router = express.Router();
 const { body, param, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { db, withRetry } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
@@ -58,7 +59,7 @@ router.get('/:slotNumber', adminAuth, requirePermission('branding.view'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slotNumber } = req.params;
@@ -92,7 +93,7 @@ router.put('/:slotNumber', adminAuth, requirePermission('branding.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slotNumber } = req.params;
@@ -166,7 +167,7 @@ router.post('/:slotNumber/reset', adminAuth, requirePermission('branding.edit'),
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     await withRetry(() =>

backend/src/routes/adminEmail.js

@@ -9,7 +9,7 @@ const { requirePermission } = require('../middleware/permissions');
 const { requireFeatureFlag } = require('../middleware/requireFeatureFlag');
 const messagingGate = requireFeatureFlag('messaging');
 const { wrapEmailHtml, processEmailQueue } = require('../services/emailProcessor');
-const { errorResponse } = require('../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../utils/routeHelpers');
 const logger = require('../utils/logger');
 const router = express.Router();
 
@@ -52,7 +52,7 @@ router.post('/config', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const {
@@ -152,7 +152,7 @@ router.post('/incoming-config', [
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
-    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+    if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
     const { imap_host, imap_port, imap_secure, imap_user, imap_pass, imap_folder } = req.body;
     const { isHostAllowed } = require('../utils/networkValidation');
     if (!(await isHostAllowed(imap_host))) {
@@ -635,7 +635,7 @@ router.get('/queue', adminAuth, requirePermission('email.view'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const page = req.query.page ? parseInt(req.query.page, 10) : 1;

backend/src/routes/adminEventRename.js

@@ -5,6 +5,7 @@
 
 const express = require('express');
 const { body, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { requireEventOwnership } = require('../middleware/ownership');
@@ -29,7 +30,7 @@ router.post('/:eventId/rename', adminAuth, requirePermission('events.edit'), req
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ success: false, errors: errors.array() });
+      return res.status(400).json({ success: false, errors: safeValidationErrors(errors) });
     }
 
     const { eventId } = req.params;
@@ -70,7 +71,7 @@ router.post('/:eventId/validate-rename', adminAuth, requirePermission('events.ed
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ valid: false, errors: errors.array() });
+      return res.status(400).json({ valid: false, errors: safeValidationErrors(errors) });
     }
 
     const { eventId } = req.params;

backend/src/routes/adminEventTypes.js

@@ -7,6 +7,7 @@
 
 const express = require('express');
 const { body, param, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
@@ -57,7 +58,7 @@ router.get('/:id', adminAuth, requirePermission('settings.view'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { id } = req.params;
@@ -94,7 +95,7 @@ router.post('/', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const {
@@ -156,7 +157,7 @@ router.put('/:id', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { id } = req.params;
@@ -196,7 +197,7 @@ router.delete('/:id', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { id } = req.params;
@@ -235,7 +236,7 @@ router.post('/reorder', adminAuth, requirePermission('settings.edit'), [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { orderedIds } = req.body;

backend/src/routes/adminEvents/archiveBulk.js

@@ -9,7 +9,7 @@ const { adminAuth } = require('../../middleware/auth');
 const { requirePermission } = require('../../middleware/permissions');
 const { archiveEvent } = require('../../services/archiveService');
 const logger = require('../../utils/logger');
-const { errorResponse } = require('../../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../../utils/routeHelpers');
 const { requireEventOwnership, filterOwnedEventIds } = require('../../middleware/ownership');
 const { deleteEventCascade } = require('./helpers');
 
@@ -70,7 +70,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { eventIds } = req.body;
@@ -160,7 +160,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { eventIds } = req.body;

backend/src/routes/adminEvents/crud.js

@@ -17,7 +17,7 @@ const { escapeLikePattern } = require('../../utils/sqlSecurity');
 const { validatePasswordInContext, getBcryptRounds } = require('../../utils/passwordValidation');
 const logger = require('../../utils/logger');
 const { sanitizeForLog, sanitizeValidationErrors } = require('../../utils/sanitizeForLog');
-const { errorResponse } = require('../../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../../utils/routeHelpers');
 const { buildShareLinkVariants } = require('../../services/shareLinkService');
 const { parseBooleanInput } = require('../../utils/parsers');
 const eventTypeService = require('../../services/eventTypeService');
@@ -157,7 +157,7 @@ module.exports = (router) => {
         // errors.array() embeds the SUBMITTED value per field — including a
         // rejected plaintext password (GHSA-r794).
         logger.error('Validation errors:', sanitizeValidationErrors(errors.array()));
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       // Get field requirements from settings
@@ -856,7 +856,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { id } = req.params;
@@ -1017,7 +1017,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { id } = req.params;
@@ -1295,7 +1295,7 @@ module.exports = (router) => {
       if (!errors.isEmpty()) {
         // Redact credentials — an invalid update still logs the whole body (GHSA-pgmp).
         logger.debug('Update event validation errors', { errors: sanitizeValidationErrors(errors.array()), body: sanitizeForLog(req.body) });
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { id } = req.params;
@@ -1695,7 +1695,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ errors: errors.array() });
+        return res.status(400).json({ errors: safeValidationErrors(errors) });
       }
 
       const { id } = req.params;

backend/src/routes/adminEvents/slideshow.js

@@ -8,7 +8,7 @@ const { formatBoolean } = require('../../utils/dbCompat');
 const { adminAuth } = require('../../middleware/auth');
 const { requirePermission } = require('../../middleware/permissions');
 const crypto = require('crypto');
-const { errorResponse } = require('../../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../../utils/routeHelpers');
 const { parseBooleanInput } = require('../../utils/parsers');
 const { requireEventOwnership } = require('../../middleware/ownership');
 const { requireFeatureFlag } = require('../../middleware/requireFeatureFlag');
@@ -110,7 +110,7 @@ module.exports = (router) => {
     try {
       const errors = validationResult(req);
       if (!errors.isEmpty()) {
-        return res.status(400).json({ error: 'Invalid slideshow settings', details: errors.array() });
+        return res.status(400).json({ error: 'Invalid slideshow settings', details: safeValidationErrors(errors) });
       }
 
       const event = await loadOwnedEvent(req);

backend/src/routes/adminPhotoExport.js

@@ -11,7 +11,7 @@ const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { requireEventOwnership } = require('../middleware/ownership');
 const { PhotoFilterBuilder } = require('../utils/photoFilterBuilder');
-const { getPagination } = require('../utils/routeHelpers');
+const { getPagination, safeValidationErrors } = require('../utils/routeHelpers');
 const { PhotoExportService } = require('../services/photoExportService');
 const logger = require('../utils/logger');
 
@@ -39,7 +39,7 @@ router.get('/:eventId/filtered', adminAuth, requirePermission('photos.view'), re
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const eventId = parseInt(req.params.eventId);
@@ -166,7 +166,7 @@ router.post('/:eventId/export', adminAuth, requirePermission('photos.download'),
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const eventId = parseInt(req.params.eventId);

backend/src/routes/adminPhotos.js

@@ -14,7 +14,8 @@ const {
 } = require('../services/downloadFilenameService');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { validateUploadedFiles } = require('../middleware/uploadValidation');
-const { getMaxFilesPerUpload, getAllowedMimeTypes } = require('../services/uploadSettings');
+const { getMaxFilesPerUpload, getAllowedMimeTypes, EXTENSION_TO_MIME } = require('../services/uploadSettings');
+const { resolvePhotoContentType } = require('../utils/photoContentType');
 const { processUploadedPhotos } = require('../services/photoProcessor');
 const chunkedUpload = require('../services/chunkedUploadService');
 const watermarkGeneratorService = require('../services/watermarkGeneratorService');
@@ -958,7 +959,7 @@ router.get('/:eventId/photos/:photoId/download', adminAuth, requirePermission('p
         return res.status(404).json({ error: 'Photo file not found' });
       }
       res.set({
-        'Content-Type': photo.mime_type || 'application/octet-stream',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Length': stat.size,
         'Content-Disposition': contentDisposition,
       });
@@ -975,7 +976,7 @@ router.get('/:eventId/photos/:photoId/download', adminAuth, requirePermission('p
       return res.status(404).json({ error: 'Photo file not found' });
     }
     res.set({
-      'Content-Type': photo.mime_type || 'application/octet-stream',
+      'Content-Type': resolvePhotoContentType(photo),
       'Content-Disposition': contentDisposition,
     });
     res.sendFile(filePath);
@@ -1151,64 +1152,9 @@ router.get('/:eventId/photo/:photoId', adminAuth, requirePermission('photos.view
     const event = await db('events').where('id', eventId).first();
     const storageKey = resolvePhotoStorageKey(event, photo);
 
-    // Content-Type resolution (#908 + external review). Invariant: the
-    // header is ALWAYS image/* or video/*.
-    //  - photos.mime_type is never echoed verbatim unless it is a video/
-    //    type: the chunked-upload path stores the client-sent MIME
-    //    unvalidated, so a stored text/html served inline under the app
-    //    origin would be a same-origin XSS gift.
-    //  - Images ignore the stored value entirely — migration 039
-    //    backfilled image/jpeg onto every legacy row (PNGs included), so
-    //    the extension is the more trustworthy signal; normalized via the
-    //    shared map (image/jpg → image/jpeg), jpeg fallback when unknown.
-    //  - Videos prefer a stored video/ type, then the extension map
-    //    (.mov → video/quicktime, .webm → video/webm, …), then video/mp4.
-    //    The old ext-derived image/<ext> (image/mp4) is what made the
-    //    admin player's blob unplayable (#908).
-    const { EXTENSION_TO_MIME } = require('../services/uploadSettings');
-    const ext = path.extname(photo.filename).slice(1).toLowerCase();
-    // Own-property lookup (review): a client-controlled filename ending in
-    // .constructor / .__proto__ / .toString would otherwise return an
-    // inherited Object.prototype member, and the extMime.startsWith below
-    // would throw — a permanent 500 for that photo instead of the fallback.
-    const extMime = Object.prototype.hasOwnProperty.call(EXTENSION_TO_MIME, ext)
-      ? EXTENSION_TO_MIME[ext]
-      : null;
-    // Full-token validation, not just a prefix check: the stored value is
-    // client-controlled, and header-invalid characters (video/mp4\r\nX: y)
-    // would make setHeader throw — a permanent 500 for that photo. Bare
-    // 'video/' is equally invalid; both fall back to the extension map.
-    const storedVideoMime = photo.mime_type && /^video\/[\w.+-]+$/.test(photo.mime_type)
-      ? photo.mime_type
-      : null;
-    // Honor a stored image MIME for any header-safe RASTER type (#908
-    // review): the S3 auto-importer accepts arbitrary image/* from
-    // mime-types and stores it (avif/bmp/tiff/heic/apng/ico/jxl/…), and a
-    // hand-listed allowlist kept missing formats. Allow image/<token> but
-    // NEVER the scriptable svg / *+xml family (image/svg+xml executes
-    // inline). The strict token + anchors also block header injection
-    // (image/x\r\nY:). Migration 039's blanket image/jpeg backfill on
-    // legacy rows is why the mapped extension still wins ahead of this.
-    const storedImageMime =
-      photo.mime_type &&
-      /^image\/[\w.+-]+$/.test(photo.mime_type) &&
-      !/^image\/svg|xml/i.test(photo.mime_type)
-        ? photo.mime_type
-        : null;
-    const isVideo = photo.media_type === 'video' ||
-      Boolean(storedVideoMime) ||
-      Boolean(extMime && extMime.startsWith('video/'));
-    // Never interpolate the raw extension on the image side: it would
-    // synthesize image/svg+xml (scriptable inline) or header-invalid values
-    // from client-controlled chunked-upload filenames. Precedence is
-    // mapped-extension (also corrects the 039 legacy-jpeg backfill on PNGs)
-    // -> safe stored raster MIME (auto-imported avif/bmp/tiff) -> image/jpeg.
-    // A stored type outside the allowlist degrades to image/jpeg; browsers
-    // sniff image bytes in <img>/blob contexts, so a mislabel is harmless
-    // where an injected type is not.
-    const contentType = isVideo
-      ? storedVideoMime || (extMime && extMime.startsWith('video/') ? extMime : null) || 'video/mp4'
-      : (extMime && extMime.startsWith('image/') ? extMime : null) || storedImageMime || 'image/jpeg';
+    // Content-Type resolution (#908 + external review) lives in
+    // utils/photoContentType so the gallery routes apply the same rule.
+    const contentType = resolvePhotoContentType(photo);
     res.setHeader('Content-Type', contentType);
     res.setHeader('Cache-Control', 'private, max-age=3600');
     res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
@@ -1324,7 +1270,7 @@ router.get('/:eventId/debug', adminAuth, requirePermission('photos.view'), requi
 router.post('/:eventId/chunked-upload/init', adminAuth, requirePermission('photos.upload'), requireEventOwnership, async (req, res) => {
   try {
     const { eventId } = req.params;
-    const { filename, fileSize, mimeType, totalChunks } = req.body;
+    const { filename, fileSize, totalChunks } = req.body;
 
     // Validate event exists
     const event = await db('events').where({ id: eventId }).first();
@@ -1333,8 +1279,23 @@ router.post('/:eventId/chunked-upload/init', adminAuth, requirePermission('photo
     }
 
     // Validate required fields
-    if (!filename || !fileSize || !mimeType) {
-      return res.status(400).json({ error: 'Missing required fields: filename, fileSize, mimeType' });
+    if (!filename || !fileSize) {
+      return res.status(400).json({ error: 'Missing required fields: filename, fileSize' });
+    }
+
+    // The client-declared mimeType is not trusted. It used to be stored on
+    // the photo row verbatim and echoed as Content-Type by the gallery
+    // routes, so a JPEG/HTML polyglot declared as text/html rendered inline
+    // on the app origin. The MIME is derived from the extension instead,
+    // and the extension has to be on the admin's allow-list, which is what
+    // the multipart path enforces through its multer fileFilter.
+    const ext = path.extname(String(filename)).slice(1).toLowerCase();
+    const mimeType = Object.prototype.hasOwnProperty.call(EXTENSION_TO_MIME, ext)
+      ? EXTENSION_TO_MIME[ext]
+      : null;
+    const allowedMimeTypes = await getAllowedMimeTypes();
+    if (!mimeType || !allowedMimeTypes.includes(mimeType)) {
+      return res.status(400).json({ error: 'File type not allowed' });
     }
 
     // Validate file size (max 10GB)

backend/src/routes/adminRestore.js

@@ -5,7 +5,7 @@ const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { body, query, validationResult } = require('express-validator');
 const logger = require('../utils/logger');
-const { getPagination } = require('../utils/routeHelpers');
+const { getPagination, safeValidationErrors } = require('../utils/routeHelpers');
 const { db } = require('../database/db');
 const path = require('path');
 const fs = require('fs').promises;
@@ -86,7 +86,7 @@ router.post('/validate', requirePermission('backup.restore'), [
   if (!errors.isEmpty()) {
     return res.status(400).json({
       success: false,
-      errors: errors.array()
+      errors: safeValidationErrors(errors)
     });
   }
 
@@ -158,7 +158,7 @@ router.post('/start', requirePermission('backup.restore'), [
   if (!errors.isEmpty()) {
     return res.status(400).json({
       success: false,
-      errors: errors.array()
+      errors: safeValidationErrors(errors)
     });
   }
 
@@ -690,7 +690,7 @@ router.put('/settings', requirePermission('backup.restore'), [
   if (!errors.isEmpty()) {
     return res.status(400).json({
       success: false,
-      errors: errors.array()
+      errors: safeValidationErrors(errors)
     });
   }
 

backend/src/routes/adminSettings.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const multer = require('multer');
 const path = require('path');
+const { uploadedAssetPath } = require('../utils/safePath');
 const fs = require('fs').promises;
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
@@ -22,7 +23,7 @@ const { sanitizeCss } = require('../utils/cssSanitizer');
 const { upsertAppSetting } = require('../utils/appSettings');
 const { clearShareLinkSettingsCache } = require('../services/shareLinkService');
 const { resetSecurityConfigCache } = require('../utils/authSecurity');
-const { errorResponse } = require('../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../utils/routeHelpers');
 const logger = require('../utils/logger');
 const { measureLocalStorageUsage } = require('../services/localStorageUsage');
 const router = express.Router();
@@ -567,10 +568,13 @@ router.put('/branding', adminAuth, requirePermission('settings.edit'), async (re
           currentFaviconUrl = currentFaviconSetting.setting_value;
         }
         
-        if (currentFaviconUrl && typeof currentFaviconUrl === 'string' && currentFaviconUrl.startsWith('/uploads/favicons/')) {
-          // Delete the file from filesystem
-          const relativePath = currentFaviconUrl.replace(/^\//, '');
-          const faviconPath = path.join(getStoragePath(), relativePath);
+        // Containment: the stored URL is admin-writable, so only the leaf
+        // name is used and it is joined onto the fixed favicon directory. A
+        // prefix test alone let `/uploads/favicons/../../<anything>` pass
+        // and path.join collapse it -- an arbitrary-file delete for any
+        // holder of settings.edit.
+        const faviconPath = uploadedAssetPath(currentFaviconUrl, 'favicons', getStoragePath());
+        if (faviconPath) {
           try {
             await fs.unlink(faviconPath);
             logger.info('Deleted favicon file:', faviconPath);
@@ -598,10 +602,9 @@ router.put('/branding', adminAuth, requirePermission('settings.edit'), async (re
           currentLogoUrl = currentLogoSetting.setting_value;
         }
         
-        if (currentLogoUrl && typeof currentLogoUrl === 'string' && currentLogoUrl.startsWith('/uploads/logos/')) {
-          // Delete the file from filesystem
-          const relativePath = currentLogoUrl.replace(/^\//, '');
-          const logoPath = path.join(getStoragePath(), relativePath);
+        // Same containment as the favicon branch above.
+        const logoPath = uploadedAssetPath(currentLogoUrl, 'logos', getStoragePath());
+        if (logoPath) {
           try {
             await fs.unlink(logoPath);
             logger.info('Deleted logo file:', logoPath);
@@ -1474,7 +1477,7 @@ router.put('/security/rate-limit', adminAuth, requirePermission('settings.edit')
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const {

backend/src/routes/adminShortUrls.js

@@ -11,6 +11,7 @@
  */
 const express = require('express');
 const { body, param, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
 const { requireEventOwnership } = require('../middleware/ownership');
@@ -32,7 +33,7 @@ router.get(
   requireEventOwnership,
   async (req, res) => {
     const errors = validationResult(req);
-    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+    if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
     try {
       const rows = await galleryShortUrlService.listForEvent(parseInt(req.params.eventId, 10));
       res.json({ shortUrls: rows });
@@ -56,7 +57,7 @@ router.post(
   requireEventOwnership,
   async (req, res) => {
     const errors = validationResult(req);
-    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+    if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
     try {
       const row = await galleryShortUrlService.createShortUrl({
         eventId: parseInt(req.params.eventId, 10),
@@ -96,7 +97,7 @@ router.delete(
   param('id').isInt({ min: 1 }),
   async (req, res) => {
     const errors = validationResult(req);
-    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+    if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
     try {
       const ok = await galleryShortUrlService.softDelete(
         parseInt(req.params.id, 10),

backend/src/routes/adminWebhooks.js

@@ -17,6 +17,7 @@
 
 const express = require('express');
 const { body, query, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
@@ -106,7 +107,7 @@ router.post(
   async (req, res) => {
     try {
       const errors = validationResult(req);
-      if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+      if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
 
       const { name, url, events, active = true, filter, template } = req.body;
       const { plaintext, preview } = webhookService.generateSecret();
@@ -188,7 +189,7 @@ router.put(
   async (req, res) => {
     try {
       const errors = validationResult(req);
-      if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+      if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
 
       const row = await db('webhooks').where({ id: req.params.id }).first();
       if (!row) return res.status(404).json({ error: 'Webhook not found' });
@@ -241,7 +242,7 @@ router.post(
   async (req, res) => {
     try {
       const errors = validationResult(req);
-      if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+      if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
 
       const row = await db('webhooks').where({ id: req.params.id }).first();
       if (!row) return res.status(404).json({ error: 'Webhook not found' });
@@ -293,7 +294,7 @@ router.get(
   async (req, res) => {
     try {
       const errors = validationResult(req);
-      if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+      if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
 
       const webhookId = req.params.id;
       const exists = await db('webhooks').where({ id: webhookId }).first();

backend/src/routes/auth.js

@@ -2,6 +2,16 @@ const express = require('express');
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { body, validationResult } = require('express-validator');
+
+/**
+ * express-validator's errors.array() carries `value` -- the submitted input --
+ * so returning it verbatim reflects the caller's password back in the 400 body.
+ * Five routes in this file validate a password field, and the strength endpoint
+ * is unauthenticated behind a 50mb JSON limit, which also made the rejection
+ * itself an allocation amplifier. Everything except `value` is kept, so the
+ * response shape both frontend consumers rely on (`msg`, `path`) is unchanged.
+ */
+const safeValidationErrors = (errors) => errors.array().map(({ value, ...rest }) => rest);
 const { db, logActivity } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { verifyRecaptcha } = require('../services/recaptcha');
@@ -16,6 +26,9 @@ const {
 const { endSession } = require('../middleware/sessionTimeout');
 const { revokeToken } = require('../utils/tokenRevocation');
 const { timingSafeEqualStr } = require('../utils/timingSafe');
+// Well-formed bcrypt hash that matches nothing; compared against when there is
+// no account so the unknown-user path costs the same as a wrong password.
+const DUMMY_BCRYPT_HASH = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234';
 const logger = require('../utils/logger');
 const { errorResponse } = require('../utils/routeHelpers');
 const {
@@ -30,6 +43,7 @@ const { getEventShareToken, resolveShareIdentifier } = require('../services/shar
 const { getClientIp } = require('../utils/requestIp');
 const {
   validatePasswordInContext,
+  MAX_PASSWORD_LENGTH,
   getBcryptRounds,
   logPasswordValidationFailure
 } = require('../utils/passwordValidation');
@@ -80,13 +94,15 @@ async function completeAdminLogin(req, res, admin, ipAddress, userAgent, lockout
 
 // Admin login with enhanced security
 router.post('/admin/login', [
-  body('username').notEmpty().trim(),
-  body('password').notEmpty()
+  // Length caps: an unbounded username reached the lockout lookup, bcrypt,
+  // the failed-attempt log line and login_attempts.identifier as sent.
+  body('username').isString().trim().notEmpty().isLength({ max: 255 }),
+  body('password').isString().notEmpty().isLength({ max: MAX_PASSWORD_LENGTH })
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
     
     const { username, password, recaptchaToken } = req.body;
@@ -130,7 +146,13 @@ router.post('/admin/login', [
       .first();
 
     // Use generic error to prevent user enumeration
-    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+    // Always run one bcrypt compare so an unknown username costs the same
+    // ~100ms as a wrong password; short-circuiting here was a timing oracle
+    // for username enumeration despite the generic message.
+    const passwordMatches = admin
+      ? await bcrypt.compare(password, admin.password_hash)
+      : await bcrypt.compare(password, DUMMY_BCRYPT_HASH).then(() => false);
+    if (!passwordMatches) {
       await trackFailedAttempt(username, ipAddress, userAgent);
       return res.status(401).json({ error: getGenericAuthError() });
     }
@@ -174,7 +196,7 @@ router.post('/admin/login/mfa', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { mfaToken, code } = req.body;
@@ -309,13 +331,13 @@ router.post('/logout', async (req, res) => {
 
 // Gallery password verification with enhanced security
 router.post('/gallery/verify', [
-  body('slug').notEmpty().trim(),
-  body('password').optional().isString()
+  body('slug').isString().trim().notEmpty().isLength({ max: 255 }),
+  body('password').optional().isString().isLength({ max: MAX_PASSWORD_LENGTH })
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
     
     const { slug, password, recaptchaToken } = req.body;
@@ -327,7 +349,7 @@ router.post('/gallery/verify', [
 
     if (!event) {
       // Perform a dummy bcrypt compare to prevent timing-based slug enumeration
-      await bcrypt.compare(password || '', '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234');
+      await bcrypt.compare(password || '', DUMMY_BCRYPT_HASH);
       await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
       return res.status(401).json({ error: 'Invalid gallery or password' });
     }
@@ -421,12 +443,12 @@ router.post('/gallery/verify', [
 
 // Client access login (PIN-based)
 router.post('/gallery/:slug/client-login', [
-  body('password').notEmpty().isString()
+  body('password').notEmpty().isString().isLength({ max: MAX_PASSWORD_LENGTH })
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slug } = req.params;
@@ -502,7 +524,7 @@ router.post('/gallery/share-login', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slug, token } = req.body;
@@ -760,7 +782,7 @@ router.post('/admin/change-password', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { currentPassword, newPassword } = req.body;
@@ -831,11 +853,27 @@ router.post('/admin/change-password', [
 });
 
 // Password strength check endpoint (for real-time validation)
+//
+// Unauthenticated, and it feeds the request body straight into zxcvbn, whose
+// matching is superlinear and synchronous. Without the length bound a single
+// request stops the event loop for the whole process -- ~5s at 1,000
+// characters and unbounded past that. validatePassword() enforces the same cap
+// for every caller; this one keeps the oversized body from being accepted at
+// the edge at all.
 router.post('/password-strength', [
-  body('password').notEmpty(),
+  body('password').isString().isLength({ min: 1, max: MAX_PASSWORD_LENGTH })
+    .withMessage(`Password must be 1-${MAX_PASSWORD_LENGTH} characters`),
   body('context').isIn(['admin', 'gallery']).optional()
 ], async (req, res) => {
   try {
+    // The validators above only RECORD errors; without this the oversized body
+    // reached zxcvbn anyway and the endpoint answered 200, so the edge cap was
+    // decorative. The cap in validatePassword() is still the real control.
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
+    }
+
     const { password, context = 'gallery' } = req.body;
 
     // Get user data if available (for context-aware validation)
@@ -845,7 +883,9 @@ router.post('/password-strength', [
       userData.email = req.admin.email;
     }
 
-    const validation = validatePasswordInContext(password, context, userData);
+    // validatePasswordInContext is async; unawaited this resolved to a Promise
+    // and every field below came back undefined.
+    const validation = await validatePasswordInContext(password, context, userData);
 
     res.json({
       valid: validation.valid,

backend/src/routes/customer.js

@@ -17,9 +17,10 @@ const jwt = require('jsonwebtoken');
 const { body, param, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
-const { getBcryptRounds } = require('../utils/passwordValidation');
+const { getBcryptRounds, MAX_PASSWORD_LENGTH } = require('../utils/passwordValidation');
+const { assertContractPdfPath } = require('../utils/safePath');
 const logger = require('../utils/logger');
-const { errorResponse } = require('../utils/routeHelpers');
+const { errorResponse, safeValidationErrors } = require('../utils/routeHelpers');
 const { getClientIp } = require('../utils/requestIp');
 const { customerAuth } = require('../middleware/customerAuth');
 const { setGalleryAuthCookies } = require('../utils/tokenUtils');
@@ -147,7 +148,7 @@ router.get('/events/:slug/access-token', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { slug } = req.params;
@@ -284,7 +285,7 @@ router.put('/profile', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     // Normalise incoming values: trim strings, drop empty → null so the DB
@@ -329,14 +330,14 @@ router.put('/profile', [
  */
 router.post('/profile/password', [
   customerAuth,
-  body('currentPassword').isString().isLength({ min: 1 }),
-  body('newPassword').isString().isLength({ min: 8 })
+  body('currentPassword').isString().isLength({ min: 1, max: MAX_PASSWORD_LENGTH }),
+  body('newPassword').isString().isLength({ min: 8, max: MAX_PASSWORD_LENGTH })
     .withMessage('Password must be at least 8 characters'),
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { currentPassword, newPassword } = req.body;
@@ -706,9 +707,13 @@ router.get('/contracts/:id/pdf', customerAuth, async (req, res) => {
       res.set('Content-Disposition', `inline; filename="${contract.contract_number}.pdf"`);
       return res.send(buf);
     }
+    // Same containment the admin and public contract routes apply: the DB
+    // path is written by the service layer today, but a bad row must not
+    // turn this into an arbitrary-file read.
+    const safePath = assertContractPdfPath(filePath);
     res.set('Content-Type', 'application/pdf');
-    res.set('Content-Disposition', `inline; filename="${path.basename(filePath)}"`);
-    fs.createReadStream(filePath).pipe(res);
+    res.set('Content-Disposition', `inline; filename="${path.basename(safePath)}"`);
+    fs.createReadStream(safePath).pipe(res);
   } catch (error) {
     errorResponse(res, error, 500, 'Failed to render contract PDF');
   }

backend/src/routes/customerAuth.js

@@ -16,6 +16,9 @@ const express = require('express');
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { body, param, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
+const { MAX_PASSWORD_LENGTH } = require('../utils/passwordValidation');
+const DUMMY_BCRYPT_HASH = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234';
 const { db, logActivity } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { verifyRecaptcha } = require('../services/recaptcha');
@@ -65,12 +68,12 @@ const TOKEN_TTL_SECONDS = 24 * 60 * 60; // mirrors admin tokens
 //     gallery JWTs (instant per-gallery revocation).
 router.post('/login', [
   body('email').isEmail().normalizeEmail(IDENTITY_PRESERVING_NORMALIZE_EMAIL).withMessage('Valid email is required'),
-  body('password').isString().notEmpty(),
+  body('password').isString().notEmpty().isLength({ max: MAX_PASSWORD_LENGTH }),
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
 
     const { email, password, recaptchaToken } = req.body;
@@ -99,7 +102,12 @@ router.post('/login', [
 
     const customer = await db('customer_accounts').where('email', email).first();
     // Generic error to prevent user enumeration — same wording as admin login.
-    if (!customer || !customer.password_hash || !await bcrypt.compare(password, customer.password_hash)) {
+    // One bcrypt compare on every path so an unknown email is not a timing
+    // oracle (the dummy hash matches nothing).
+    const passwordMatches = customer && customer.password_hash
+      ? await bcrypt.compare(password, customer.password_hash)
+      : await bcrypt.compare(password, DUMMY_BCRYPT_HASH).then(() => false);
+    if (!passwordMatches) {
       await trackFailedAttempt(lockoutKey, ipAddress, userAgent);
       return res.status(401).json({ error: getGenericAuthError() });
     }
@@ -273,7 +281,7 @@ router.post('/accept-invite', [
   // Length floor enforced again here for an early reject; the full
   // policy (uppercase + digit) is checked below so we can surface a
   // specific message rather than a generic validator error.
-  body('password').isString().isLength({ min: 8 })
+  body('password').isString().isLength({ min: 8, max: MAX_PASSWORD_LENGTH })
     .withMessage('Password must be at least 8 characters'),
   // Optional structured profile from the accept-invite form. Mirrors
   // the admin prefill shape — anything the customer types here wins
@@ -296,7 +304,7 @@ router.post('/accept-invite', [
   try {
     const errors = validationResult(req);
     if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
+      return res.status(400).json({ errors: safeValidationErrors(errors) });
     }
     const { token, name, password, profile } = req.body;
 
@@ -355,11 +363,11 @@ router.get('/password-reset/:token', [
  */
 router.post('/password-reset', [
   body('token').isLength({ min: 64, max: 64 }).matches(/^[a-f0-9]+$/i),
-  body('password').isString().isLength({ min: 8 }).withMessage('Password must be at least 8 characters'),
+  body('password').isString().isLength({ min: 8, max: MAX_PASSWORD_LENGTH }).withMessage('Password must be at least 8 characters'),
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
-    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+    if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
     const policyError = validateCustomerPassword(req.body.password);
     if (policyError) {
       return res.status(400).json({

backend/src/routes/gallery.js

@@ -10,6 +10,8 @@ const { parseBooleanInput } = require('../utils/parsers');
 const { getAppSetting } = require('../utils/appSettings');
 const archiver = require('archiver');
 const path = require('path');
+const { resolvePhotoContentType } = require('../utils/photoContentType');
+const { timingSafeEqualStr } = require('../utils/timingSafe');
 const router = express.Router();
 
 // #756: a NULL per-event hero_logo_visible means "inherit the global
@@ -167,7 +169,7 @@ router.get('/:slug/verify-token/:token', handleAsync(async (req, res) => {
   }
 
   const expectedToken = getEventShareToken(event);
-  if (token !== expectedToken) {
+  if (!expectedToken || !timingSafeEqualStr(String(token), expectedToken)) {
     throw new NotFoundError('Gallery', 'Invalid gallery link');
   }
 
@@ -243,7 +245,7 @@ router.get('/:slug/info', async (req, res) => {
     // If token provided, verify it matches the share link
     if (token) {
       const expectedToken = getEventShareToken(event);
-      if (!expectedToken || token !== expectedToken) {
+      if (!expectedToken || !timingSafeEqualStr(String(token), expectedToken)) {
         return res.status(404).json({ error: 'Invalid gallery link' });
       }
     }
@@ -1041,7 +1043,7 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, denySlideshowToken,
     if (req.method === 'HEAD') {
       const headUseOriginal = await getUseOriginalFilenames();
       const headHeaders = {
-        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Disposition': buildContentDisposition(pickRawDownloadName(photo, headUseOriginal)),
         'Accept-Ranges': 'bytes',
       };
@@ -1162,7 +1164,7 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, denySlideshowToken,
       }
 
       res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Disposition': contentDisposition,
         'Content-Length': watermarkedBuffer.length
       });
@@ -1195,7 +1197,7 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, denySlideshowToken,
 
       const lastModified = stat.mtime ? new Date(stat.mtime).toUTCString() : null;
       const headers = {
-        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Disposition': contentDisposition,
         'Accept-Ranges': 'bytes',
       };
@@ -1278,7 +1280,7 @@ router.get('/:slug/download/:photoId', verifyGalleryAccess, denySlideshowToken,
     // their bytes on download. Set the header explicitly and stream the
     // file with res.sendFile-equivalent semantics.
     res.set({
-      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Type': resolvePhotoContentType(photo),
       'Content-Disposition': contentDisposition,
     });
     res.sendFile(filePath, (downloadError) => {
@@ -1817,25 +1819,34 @@ router.get('/:slug/photo/:photoId',
           const parts = range.replace(/bytes=/, '').split('-');
           const start = parseInt(parts[0], 10);
           const end = parts[1] ? parseInt(parts[1], 10) : fileSize - 1;
-          const chunksize = (end - start) + 1;
+          // Validate before writing the 206: a NaN, inverted or out-of-file
+          // range used to be committed to the headers and then throw while
+          // streaming (or read past the end).
+          if (!Number.isInteger(start) || !Number.isInteger(end)
+              || start < 0 || end < start || start >= fileSize) {
+            res.set('Content-Range', `bytes */${fileSize}`);
+            return res.status(416).end();
+          }
+          const boundedEnd = Math.min(end, fileSize - 1);
+          const chunksize = (boundedEnd - start) + 1;
 
           res.writeHead(206, {
-            'Content-Range': `bytes ${start}-${end}/${fileSize}`,
+            'Content-Range': `bytes ${start}-${boundedEnd}/${fileSize}`,
             'Accept-Ranges': 'bytes',
             'Content-Length': chunksize,
-            'Content-Type': photo.mime_type || 'video/mp4',
+            'Content-Type': resolvePhotoContentType(photo),
             'Cache-Control': 'private, max-age=1800',
             'X-Protection-Level': 'basic'
           });
 
           const file = useStorageBackend
-            ? await storage.getRange(storageKey, start, end)
-            : fs.createReadStream(filePath, { start, end });
+            ? await storage.getRange(storageKey, start, boundedEnd)
+            : fs.createReadStream(filePath, { start, end: boundedEnd });
           pipeStreamToResponse(file, res, { context: `video range for photo ${photo.id}` });
         } else {
           res.writeHead(200, {
             'Content-Length': fileSize,
-            'Content-Type': photo.mime_type || 'video/mp4',
+            'Content-Type': resolvePhotoContentType(photo),
             'Accept-Ranges': 'bytes',
             'Cache-Control': 'private, max-age=1800',
             'X-Protection-Level': 'basic'
@@ -1870,7 +1881,7 @@ router.get('/:slug/photo/:photoId',
               const wmStat = await storage.stat(photo.watermark_path);
               if (wmStat) {
                 res.set({
-                  'Content-Type': photo.mime_type || 'image/jpeg',
+                  'Content-Type': resolvePhotoContentType(photo),
                   'Content-Length': wmStat.size,
                   'Cache-Control': 'private, max-age=1800',
                   'ETag': etag,
@@ -1883,7 +1894,7 @@ router.get('/:slug/photo/:photoId',
               const watermarkFilePath = path.join(getStoragePath(), photo.watermark_path);
               if (fs.existsSync(watermarkFilePath)) {
                 res.set({
-                  'Content-Type': photo.mime_type || 'image/jpeg',
+                  'Content-Type': resolvePhotoContentType(photo),
                   'Cache-Control': 'private, max-age=1800',
                   'ETag': etag,
                   'X-Protection-Level': 'basic'
@@ -1909,7 +1920,7 @@ router.get('/:slug/photo/:photoId',
           .catch(err => logger.warn(`Background watermark generation failed for photo ${photo.id}:`, err.message));
 
         res.set({
-          'Content-Type': photo.mime_type || 'image/jpeg',
+          'Content-Type': resolvePhotoContentType(photo),
           'Cache-Control': 'private, max-age=1800',
           'ETag': etag,
           'X-Protection-Level': 'basic'
@@ -1924,7 +1935,7 @@ router.get('/:slug/photo/:photoId',
         });
         if (useStorageBackend) {
           res.set('Content-Length', stat.size);
-          if (photo.mime_type) res.set('Content-Type', photo.mime_type);
+          res.set('Content-Type', resolvePhotoContentType(photo));
           const stream = await storage.get(storageKey);
           pipeStreamToResponse(stream, res, { context: `photo ${photo.id}` });
         } else {

backend/src/routes/protectedImages.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const { resolvePhotoContentType } = require('../utils/photoContentType');
 const { db } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { verifyGalleryAccess } = require('../middleware/gallery');
@@ -165,7 +166,7 @@ router.get('/:slug/photo/:photoId/view', verifyGalleryAccess, async (req, res) =
     
     // Set security headers
     res.set({
-      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Type': resolvePhotoContentType(photo),
       'Content-Length': finalImage.length,
       'Cache-Control': 'private, no-cache, no-store, must-revalidate',
       'Pragma': 'no-cache',
@@ -335,7 +336,7 @@ router.get('/:slug/photo/:photoId/signed/:token', async (req, res) => {
     
     // Set appropriate headers
     res.set({
-      'Content-Type': photo.mime_type || 'image/jpeg',
+      'Content-Type': resolvePhotoContentType(photo),
       'Content-Length': imageBuffer.length,
       'Cache-Control': 'private, max-age=3600',
       'X-Content-Type-Options': 'nosniff'

backend/src/routes/secureImages.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const { resolvePhotoContentType } = require('../utils/photoContentType');
 const { db } = require('../database/db');
 const { verifyGalleryAccess, denySlideshowToken } = require('../middleware/gallery');
 const secureImageService = require('../services/secureImageService');
@@ -236,7 +237,7 @@ router.get('/:slug/secure/:photoId/:token',
 
       // Set content type and security headers
       res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Length': processedImage.length,
         'X-Protection-Level': protectionSettings.protectionLevel,
         'X-Remaining-Uses': tokenValidation.remaining
@@ -425,7 +426,7 @@ router.get('/:slug/secure-download/:photoId/:token',
       const downloadName = pickRawDownloadName(photo, useOriginal);
 
       res.set({
-        'Content-Type': photo.mime_type || 'image/jpeg',
+        'Content-Type': resolvePhotoContentType(photo),
         'Content-Disposition': buildContentDisposition(downloadName),
         'Content-Length': fileBuffer.length,
         'X-Download-Protected': 'true'

backend/src/routes/setup.js

@@ -7,6 +7,8 @@
 // rate-limited at the mount point in server.js (authRateLimiter).
 const express = require('express');
 const { body, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../utils/routeHelpers');
+const { MAX_PASSWORD_LENGTH } = require('../utils/passwordValidation');
 const setupService = require('../services/setupService');
 const { getClientIp } = require('../utils/requestIp');
 const { setAdminAuthCookie } = require('../utils/tokenUtils');
@@ -31,7 +33,7 @@ router.post('/verify-token', [
 ], async (req, res) => {
   const errors = validationResult(req);
   if (!errors.isEmpty()) {
-    return res.status(400).json({ errors: errors.array() });
+    return res.status(400).json({ errors: safeValidationErrors(errors) });
   }
   try {
     const valid = await setupService.verifySetupToken(req.body.token);
@@ -51,11 +53,11 @@ router.post('/verify-token', [
 router.post('/admin', [
   body('token').notEmpty().withMessage('Setup token is required'),
   body('email').isEmail().withMessage('A valid email is required'),
-  body('password').notEmpty().withMessage('Password is required'),
+  body('password').isString().notEmpty().isLength({ max: MAX_PASSWORD_LENGTH }).withMessage('Password is required'),
 ], async (req, res) => {
   const errors = validationResult(req);
   if (!errors.isEmpty()) {
-    return res.status(400).json({ errors: errors.array() });
+    return res.status(400).json({ errors: safeValidationErrors(errors) });
   }
   try {
     const { token, email, password } = req.body;

backend/src/routes/v1/events.js

@@ -18,6 +18,7 @@ const crypto = require('crypto');
 const multer = require('multer');
 const sharp = require('sharp');
 const { body, query, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('../../utils/routeHelpers');
 const { db, logActivity } = require('../../database/db');
 const { apiTokenAuth, requireApiScope } = require('../../middleware/apiTokenAuth');
 const { requireEventOwnership, scopeEventsQuery } = require('../../middleware/ownership');
@@ -146,7 +147,7 @@ router.post(
   async (req, res) => {
     try {
       const errors = validationResult(req);
-      if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+      if (!errors.isEmpty()) return res.status(400).json({ errors: safeValidationErrors(errors) });
       const {
         event_name, event_type, event_date,
         customer_name = null, customer_email = null, customer_phone = null,

backend/src/services/galleryOgService.js

@@ -168,8 +168,19 @@ async function formatEventDate(value) {
   }
 }
 
+// Draft, archived and deactivated galleries are refused by /info; the OG
+// preview must not leak their name, date and welcome message to crawlers.
+function isPubliclyVisible(event) {
+  if (!event) return false;
+  const truthy = (v) => v === true || v === 1 || v === '1' || v === 'true';
+  if (truthy(event.is_draft) || truthy(event.is_archived)) return false;
+  if (event.is_active === false || event.is_active === 0 || event.is_active === '0') return false;
+  return true;
+}
+
 async function buildOgMetadata(slug, requestPath) {
-  const event = await resolveSlug(slug);
+  const resolved = await resolveSlug(slug);
+  const event = isPubliclyVisible(resolved) ? resolved : null;
   const branding = await fetchBranding();
   const base = frontendBase();
   const siteName = branding.companyName || 'PicPeak';

backend/src/services/rateLimitService.js

@@ -106,8 +106,13 @@ function isAuthenticated(req) {
       return false;
     }
 
-    // Valid token found - check type
-    req.tokenType = decoded.type; // 'admin' or 'gallery'
+    // Only an admin session earns the skip. A gallery token is minted for
+    // free on password-less galleries and slideshow links, so treating it as
+    // "authenticated" handed anyone an unlimited budget on every /api route.
+    if (decoded.type !== 'admin') {
+      return false;
+    }
+    req.tokenType = decoded.type;
     req.tokenPayload = decoded;
     
     return true;

backend/src/utils/feedbackValidation.js

@@ -1,4 +1,5 @@
 const { body, param, validationResult } = require('express-validator');
+const { safeValidationErrors } = require('./routeHelpers');
 const validator = require('validator');
 const { IDENTITY_PRESERVING_NORMALIZE_EMAIL } = require('./emailNormalization');
 
@@ -225,7 +226,7 @@ const checkValidation = (req, res, next) => {
   if (!errors.isEmpty()) {
     return res.status(400).json({
       error: 'Validation failed',
-      errors: errors.array()
+      errors: safeValidationErrors(errors)
     });
   }
   next();

backend/src/utils/passwordValidation.js

@@ -7,6 +7,21 @@ const zxcvbn = require('zxcvbn');
 const logger = require('./logger');
 
 // Configuration
+// zxcvbn's matching is superlinear in the input length and runs synchronously
+// on the event loop, so an unbounded password is a denial-of-service primitive
+// rather than a slow request. The reachable caller is
+// POST /api/auth/password-strength, which is unauthenticated and sits behind
+// express.json({ limit: '50mb' }) -- one request stops the whole process.
+//
+// Measured on this codebase (ms of blocked event loop per call):
+//   64 -> 12    128 -> 41    192 -> 105    256 -> 218
+//   384 -> 632  512 -> 1367  1000 -> 5097  5000 -> did not return in 2 min
+//
+// 128 keeps the worst case at the cost of an ordinary request while staying
+// far above any real password: bcrypt consumes only the first 72 bytes, so
+// anything longer already adds no entropy to the stored hash.
+const MAX_PASSWORD_LENGTH = 128;
+
 const PASSWORD_CONFIG = {
   minLength: 8, // Reduced from 12 to 8 for better usability
   requireUppercase: true,
@@ -34,6 +49,18 @@ const COMMON_PASSWORDS = [
 function validatePassword(password, options = {}) {
   const config = { ...PASSWORD_CONFIG, ...options };
   const errors = [];
+
+  // Bail before any superlinear work touches the string. This is the guard for
+  // every caller, including ones added later -- the per-route length validator
+  // is defence in depth, not the control.
+  if (typeof password === 'string' && password.length > MAX_PASSWORD_LENGTH) {
+    return {
+      valid: false,
+      errors: [`Password must be at most ${MAX_PASSWORD_LENGTH} characters`],
+      score: 0,
+      feedback: {},
+    };
+  }
   
   // Check if password exists
   if (!password || typeof password !== 'string') {
@@ -322,24 +349,35 @@ function generateSecurePassword(options = {}) {
   if (charset.length === 0) {
     throw new Error('At least one character type must be included');
   }
-  
-  // Generate password
+
+  // A requested length the validator will always reject makes the retry below
+  // unwinnable, so say so instead of spinning. MAX_PASSWORD_LENGTH is the cap
+  // validatePassword() applies; anything above it fails every candidate.
+  if (config.length > MAX_PASSWORD_LENGTH) {
+    throw new Error(`length must be at most ${MAX_PASSWORD_LENGTH}`);
+  }
+
   const crypto = require('crypto');
-  let password = '';
-  
-  for (let i = 0; i < config.length; i++) {
-    const randomIndex = crypto.randomInt(charset.length);
-    password += charset[randomIndex];
+
+  // Bounded retry rather than unbounded recursion. Every candidate failing is
+  // possible for reasons other than bad luck -- a charset that cannot satisfy
+  // the configured policy (numbers excluded while requireNumbers is on, say)
+  // -- and the previous `return generateSecurePassword(options)` turned that
+  // into a stack overflow rather than an error anyone could act on.
+  const MAX_ATTEMPTS = 100;
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+    let password = '';
+    for (let i = 0; i < config.length; i++) {
+      const randomIndex = crypto.randomInt(charset.length);
+      password += charset[randomIndex];
+    }
+    if (validatePassword(password).valid) return password;
   }
-  
-  // Ensure password meets requirements
-  const validation = validatePassword(password);
-  if (!validation.valid) {
-    // Recursively generate until we get a valid password
-    return generateSecurePassword(options);
-  }
-  
-  return password;
+
+  throw new Error(
+    'Could not generate a password satisfying the configured policy — '
+    + 'check that the selected character types can meet it',
+  );
 }
 
 /**
@@ -366,6 +404,7 @@ function logPasswordValidationFailure(context, errors, metadata = {}) {
 }
 
 module.exports = {
+  MAX_PASSWORD_LENGTH,
   validatePassword,
   validatePasswordInContext,
   generateSecurePassword,

backend/src/utils/photoContentType.js

@@ -0,0 +1,49 @@
+/**
+ * Content-Type for a served photo row. Invariant: the header is ALWAYS
+ * image/* or video/*, never the stored value verbatim.
+ *
+ * photos.mime_type is client-influenced: the chunked-upload path used to
+ * store whatever MIME the browser (or a crafted request) declared, and the
+ * S3 auto-importer stores whatever mime-types derives. Echoing it inline
+ * under the app origin turned a JPEG/HTML polyglot with mime_type text/html
+ * into stored HTML injection for every gallery guest. The admin photo route
+ * (#908 + external review) already resolved this properly; this is that
+ * logic, shared so every serving route applies the same rule.
+ *
+ *  - Images ignore the stored value unless it is a header-safe raster type:
+ *    migration 039 backfilled image/jpeg onto every legacy row (PNGs
+ *    included), so the extension is the more trustworthy signal, normalised
+ *    via the shared map, jpeg fallback when unknown. The scriptable svg /
+ *    *+xml family is never honoured.
+ *  - Videos prefer a stored video/ type, then the extension map (.mov ->
+ *    video/quicktime, .webm -> video/webm, ...), then video/mp4.
+ *  - Full-token validation, not a prefix check: header-invalid characters
+ *    (video/mp4\r\nX: y) would make setHeader throw -- a permanent 500 for
+ *    that photo instead of a safe fallback.
+ */
+const path = require('path');
+const { EXTENSION_TO_MIME } = require('../services/uploadSettings');
+
+function resolvePhotoContentType(photo) {
+  const ext = path.extname(photo?.filename || '').slice(1).toLowerCase();
+  // Own-property lookup: a client-controlled filename ending in .constructor
+  // / .__proto__ would otherwise return an inherited Object.prototype member.
+  const extMime = Object.prototype.hasOwnProperty.call(EXTENSION_TO_MIME, ext)
+    ? EXTENSION_TO_MIME[ext]
+    : null;
+  const stored = typeof photo?.mime_type === 'string' ? photo.mime_type : '';
+  const storedVideoMime = /^video\/[\w.+-]+$/.test(stored) ? stored : null;
+  const storedImageMime =
+    /^image\/[\w.+-]+$/.test(stored) && !/^image\/svg|xml/i.test(stored)
+      ? stored
+      : null;
+  const isVideo = photo?.media_type === 'video' ||
+    Boolean(storedVideoMime) ||
+    Boolean(extMime && extMime.startsWith('video/'));
+
+  return isVideo
+    ? storedVideoMime || (extMime && extMime.startsWith('video/') ? extMime : null) || 'video/mp4'
+    : (extMime && extMime.startsWith('image/') ? extMime : null) || storedImageMime || 'image/jpeg';
+}
+
+module.exports = { resolvePhotoContentType };

backend/src/utils/requestOrigin.js

@@ -0,0 +1,40 @@
+/**
+ * Origin allow-listing shared by the CORS options and the multipart CSRF gate
+ * in server.js. Kept apart from server.js so it can be unit-tested without
+ * booting the app.
+ */
+function isAllowedOrigin(origin) {
+  const allowedOrigins = [
+    process.env.FRONTEND_URL || 'http://localhost:3005',
+    process.env.ADMIN_URL || 'http://localhost:3005'
+  ];
+  if (process.env.NODE_ENV === 'development') {
+    allowedOrigins.push(
+      'http://localhost:5173', // Vite dev server
+      'http://localhost:3002', // Backend server
+      'http://localhost:3001', // For API testing
+      'http://localhost:3000'  // Direct backend access
+    );
+  }
+  return allowedOrigins.indexOf(origin) !== -1;
+}
+
+// Origin check for multipart bodies (see the Content-Type gate below).
+// Same-origin installs proxy /api through nginx and may not have FRONTEND_URL
+// set, so an Origin matching the request Host is accepted alongside the CORS
+// allowlist; Sec-Fetch-Site is authoritative when a browser sends it.
+function multipartOriginAllowed(req) {
+  const site = req.headers['sec-fetch-site'];
+  if (site) return site !== 'cross-site';
+  const origin = req.headers.origin;
+  if (!origin) return true;
+  if (isAllowedOrigin(origin)) return true;
+  try {
+    return new URL(origin).host === req.headers.host;
+  } catch {
+    return false;
+  }
+}
+
+
+module.exports = { isAllowedOrigin, multipartOriginAllowed };

backend/src/utils/routeHelpers.js

@@ -42,6 +42,15 @@ const handleAsync = (fn) => {
  *   // ... rest of handler
  * }));
  */
+
+/**
+ * express-validator's errors.array() carries `value` -- the submitted input.
+ * Returning it verbatim reflects whatever the caller sent (a rejected
+ * password, a 2mb string) back in the 400 body. Everything except `value` is
+ * kept, so consumers that read `msg` / `path` see no change.
+ */
+const safeValidationErrors = (errors) => errors.array().map(({ value, ...rest }) => rest);
+
 const validateRequest = (req) => {
   const errors = validationResult(req);
   if (!errors.isEmpty()) {
@@ -174,6 +183,7 @@ const paginatedResponse = (data, total, page, limit) => {
 module.exports = {
   handleAsync,
   validateRequest,
+  safeValidationErrors,
   successResponse,
   errorResponse,
   withValidation,

backend/src/utils/safePath.js

@@ -171,8 +171,50 @@ function assertZipEntriesWithin(entries, extractRoot) {
   }
 }
 
+/**
+ * Resolve a stored `/uploads/<kind>/<file>` URL to the file it names inside
+ * that upload directory, or null when the value is not one of ours.
+ *
+ * Only the basename is trusted: the URL comes from an admin-writable
+ * setting, and `path.join(storage, url)` after a `startsWith('/uploads/…')`
+ * check still collapses `..` segments, so it could name any file the process
+ * can delete. Restricting to a flat leaf inside the fixed directory is the
+ * whole control -- the upload routes only ever write flat filenames there.
+ *
+ * @param {string} url          stored value, e.g. "/uploads/logos/logo-1.png"
+ * @param {string} kind         "logos" | "favicons"
+ * @param {string} storageRoot  the root the writer used (callers differ)
+ */
+function uploadedAssetPath(url, kind, storageRoot) {
+  if (!url || typeof url !== 'string') return null;
+  const prefix = `/uploads/${kind}/`;
+  if (!url.startsWith(prefix)) return null;
+  const leaf = url.slice(prefix.length);
+  if (!leaf || leaf === '.' || leaf === '..' || path.basename(leaf) !== leaf) return null;
+  return path.join(storageRoot, 'uploads', kind, leaf);
+}
+
+/**
+ * Resolve business_profile.logo_path to the file the PDF-logo upload route
+ * wrote, or null. logo_path is a free-text field on the profile PUT (an
+ * admin may point it at a file managed elsewhere), so it must never be
+ * unlinked as given: a `/pdf-logo-\d+\./` marker test plus path.join let
+ * `pdf-logo-1./../../../<anything>` -- or any absolute path containing the
+ * marker -- delete arbitrary files. Only a flat `pdf-logo-<n>.<ext>` leaf
+ * inside uploads/logos is ever named.
+ */
+function uploadedPdfLogoPath(logoPath, storageRoot) {
+  if (!logoPath || typeof logoPath !== 'string') return null;
+  const normalized = logoPath.replace(/^\/+/, '');
+  const match = /^uploads\/logos\/(pdf-logo-\d+\.[A-Za-z0-9]+)$/.exec(normalized);
+  if (!match) return null;
+  return path.join(storageRoot, 'uploads', 'logos', match[1]);
+}
+
 module.exports = {
   assertPathInside,
   assertContractPdfPath,
   assertZipEntriesWithin,
+  uploadedAssetPath,
+  uploadedPdfLogoPath,
 };

backend/src/utils/tokenRevocation.js

@@ -3,6 +3,7 @@
  * Provides ability to invalidate tokens before expiration
  */
 
+const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
 const logger = require('./logger');
 
@@ -28,15 +29,23 @@ function buildTokenId(payload) {
 
 async function revokeToken(token, reason, metadata = {}) {
   try {
-    // Extract token info without full verification (it might be compromised)
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-      throw new Error('Invalid token format');
+    // The signature MUST be verified before anything is written. The
+    // revocation key is `${id}-${iat}-${type}` (buildTokenId), and the
+    // logout endpoints are unauthenticated, so a raw base64 decode let
+    // anyone forge a three-part string naming another user's id, type and
+    // login second and insert a row that isTokenRevoked() then matched for
+    // that user's real session -- a remote forced logout of any admin,
+    // customer or gallery session, plus never-swept rows when `exp` was set
+    // far in the future. Expiry is ignored on purpose: revoking an already
+    // expired token is harmless and keeps logout idempotent.
+    const payload = jwt.verify(token, process.env.JWT_SECRET, {
+      algorithms: ['HS256'],
+      ignoreExpiration: true,
+    });
+    if (!payload || typeof payload !== 'object') {
+      throw new Error('Invalid token payload');
     }
 
-    // Decode payload
-    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-
     // user_id is integer-typed in revoked_tokens; for non-admin tokens
     // we may not have an integer (customer) or any id at all (gallery
     // tokens use eventId). Coerce to null instead of letting an

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "picpeak-frontend",
-  "version": "3.74.0-beta.0",
+  "version": "3.46.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "picpeak-frontend",
-      "version": "3.74.0-beta.0",
+      "version": "3.46.8",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
         "@fullcalendar/core": "^6.1.20",
@@ -1226,29 +1226,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -2183,9 +2197,9 @@
       "license": "MIT"
     },
     "node_modules/@remix-run/router": {
-      "version": "1.23.3",
-      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
-      "integrity": "sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==",
+      "version": "1.23.4",
+      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.4.tgz",
+      "integrity": "sha512-q7j5geK7xs3UJSdm9/iytUNclBnLmYx1EnSeCFXHPeutdqgIMeFeHtUZgS3EhlKxdBEAu8OwtJCwmLrEzpSs7Q==",
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"
@@ -2956,9 +2970,9 @@
       }
     },
     "node_modules/@tiptap/core": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/core/-/core-2.27.1.tgz",
-      "integrity": "sha512-nkerkl8syHj44ZzAB7oA2GPmmZINKBKCa79FuNvmGJrJ4qyZwlkDzszud23YteFZEytbc87kVd/fP76ROS6sLg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/core/-/core-2.27.2.tgz",
+      "integrity": "sha512-ABL1N6eoxzDzC1bYvkMbvyexHacszsKdVPYqhl5GwHLOvpZcv9VE9QaKwDILTyz5voCA0lGcAAXZp+qnXOk5lQ==",
       "license": "MIT",
       "peer": true,
       "funding": {
@@ -2970,9 +2984,9 @@
       }
     },
     "node_modules/@tiptap/extension-blockquote": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-blockquote/-/extension-blockquote-2.27.1.tgz",
-      "integrity": "sha512-QrUX3muElDrNjKM3nqCSAtm3H3pT33c6ON8kwRiQboOAjT/9D57Cs7XEVY7r6rMaJPeKztrRUrNVF9w/w/6B0A==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-blockquote/-/extension-blockquote-2.27.2.tgz",
+      "integrity": "sha512-oIGZgiAeA4tG3YxbTDfrmENL4/CIwGuP3THtHsNhwRqwsl9SfMk58Ucopi2GXTQSdYXpRJ0ahE6nPqB5D6j/Zw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2983,9 +2997,9 @@
       }
     },
     "node_modules/@tiptap/extension-bold": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-bold/-/extension-bold-2.27.1.tgz",
-      "integrity": "sha512-g4l4p892x/r7mhea8syp3fNYODxsDrimgouQ+q4DKXIgQmm5+uNhyuEPexP3I8TFNXqQ4DlMNFoM9yCqk97etQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-bold/-/extension-bold-2.27.2.tgz",
+      "integrity": "sha512-bR7J5IwjCGQ0s3CIxyMvOCnMFMzIvsc5OVZKscTN5UkXzFsaY6muUAIqtKxayBUucjtUskm5qZowJITCeCb1/A==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2996,9 +3010,9 @@
       }
     },
     "node_modules/@tiptap/extension-bubble-menu": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-bubble-menu/-/extension-bubble-menu-2.27.1.tgz",
-      "integrity": "sha512-ki1R27VsSvY2tT9Q2DIlcATwLOoEjf5DsN+5sExarQ8S/ZxT/tvIjRxB8Dx7lb2a818W5f/NER26YchGtmHfpg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-bubble-menu/-/extension-bubble-menu-2.27.2.tgz",
+      "integrity": "sha512-VkwlCOcr0abTBGzjPXklJ92FCowG7InU8+Od9FyApdLNmn0utRYGRhw0Zno6VgE9EYr1JY4BRnuSa5f9wlR72w==",
       "license": "MIT",
       "dependencies": {
         "tippy.js": "^6.3.7"
@@ -3013,9 +3027,9 @@
       }
     },
     "node_modules/@tiptap/extension-bullet-list": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-bullet-list/-/extension-bullet-list-2.27.1.tgz",
-      "integrity": "sha512-5FmnfXkJ76wN4EbJNzBhAlmQxho8yEMIJLchTGmXdsD/n/tsyVVtewnQYaIOj/Z7naaGySTGDmjVtLgTuQ+Sxw==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-bullet-list/-/extension-bullet-list-2.27.2.tgz",
+      "integrity": "sha512-gmFuKi97u5f8uFc/GQs+zmezjiulZmFiDYTh3trVoLRoc2SAHOjGEB7qxdx7dsqmMN7gwiAWAEVurLKIi1lnnw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3026,9 +3040,9 @@
       }
     },
     "node_modules/@tiptap/extension-character-count": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-character-count/-/extension-character-count-2.27.1.tgz",
-      "integrity": "sha512-PCkPW7lOiIirM7QlzgumRaTQWbkVV+3NZ6e2k+8QnDNDAhT+kIsrXpzka7Uq3mfpJyHbbj1+oNvPhS/VIavQbA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-character-count/-/extension-character-count-2.27.2.tgz",
+      "integrity": "sha512-EcQRIvbLbMDDzo7uFqXYgh1CfgedS9sYX4BllktY2OlXLPdNpwo9t8WMK/a7soESNv0Le3WZ5pNvnNhv7Z2YdA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3040,9 +3054,9 @@
       }
     },
     "node_modules/@tiptap/extension-code": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-code/-/extension-code-2.27.1.tgz",
-      "integrity": "sha512-i65wUGJevzBTIIUBHBc1ggVa27bgemvGl/tY1/89fEuS/0Xmre+OQjw8rCtSLevoHSiYYLgLRlvjtUSUhE4kgg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-code/-/extension-code-2.27.2.tgz",
+      "integrity": "sha512-7X9AgwqiIGXoZX7uvdHQsGsjILnN/JaEVtqfXZnPECzKGaWHeK/Ao4sYvIIIffsyZJA8k5DC7ny2/0sAgr2TuA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3053,9 +3067,9 @@
       }
     },
     "node_modules/@tiptap/extension-code-block": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-code-block/-/extension-code-block-2.27.1.tgz",
-      "integrity": "sha512-wCI5VIOfSAdkenCWFvh4m8FFCJ51EOK+CUmOC/PWUjyo2Dgn8QC8HMi015q8XF7886T0KvYVVoqxmxJSUDAYNg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-code-block/-/extension-code-block-2.27.2.tgz",
+      "integrity": "sha512-KgvdQHS4jXr79aU3wZOGBIZYYl9vCB7uDEuRFV4so2rYrfmiYMw3T8bTnlNEEGe4RUeAms1i4fdwwvQp9nR1Dw==",
       "license": "MIT",
       "peer": true,
       "funding": {
@@ -3068,9 +3082,9 @@
       }
     },
     "node_modules/@tiptap/extension-code-block-lowlight": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-code-block-lowlight/-/extension-code-block-lowlight-2.27.1.tgz",
-      "integrity": "sha512-Ijg9724uX/l4LXLELEeztZIgg+bDE/jJCkgS1+mavkRA/qtidpQkHo7L/Ry22fmj/ktCtZLjPXE5JAPAoRU6zA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-code-block-lowlight/-/extension-code-block-lowlight-2.27.2.tgz",
+      "integrity": "sha512-v6NKStBbQ/XCc1NnCi3ObsL1DsxadSIBtUQNA/B+urkPgn5LEy72HAGlf0xwjRaNkAGSaTASLKmc84L5q5zlGQ==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3085,9 +3099,9 @@
       }
     },
     "node_modules/@tiptap/extension-document": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-document/-/extension-document-2.27.1.tgz",
-      "integrity": "sha512-NtJzJY7Q/6XWjpOm5OXKrnEaofrcc1XOTYlo/SaTwl8k2bZo918Vl0IDBWhPVDsUN7kx767uHwbtuQZ+9I82hA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-document/-/extension-document-2.27.2.tgz",
+      "integrity": "sha512-CFhAYsPnyYnosDC4639sCJnBUnYH4Cat9qH5NZWHVvdgtDwu8GZgZn2eSzaKSYXWH1vJ9DSlCK+7UyC3SNXIBA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3098,9 +3112,9 @@
       }
     },
     "node_modules/@tiptap/extension-dropcursor": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-dropcursor/-/extension-dropcursor-2.27.1.tgz",
-      "integrity": "sha512-3MBQRGHHZ0by3OT0CWbLKS7J3PH9PpobrXjmIR7kr0nde7+bHqxXiVNuuIf501oKU9rnEUSedipSHkLYGkmfsA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-dropcursor/-/extension-dropcursor-2.27.2.tgz",
+      "integrity": "sha512-oEu/OrktNoQXq1x29NnH/GOIzQZm8ieTQl3FK27nxfBPA89cNoH4mFEUmBL5/OFIENIjiYG3qWpg6voIqzswNw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3112,9 +3126,9 @@
       }
     },
     "node_modules/@tiptap/extension-floating-menu": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-floating-menu/-/extension-floating-menu-2.27.1.tgz",
-      "integrity": "sha512-nUk/8DbiXO69l6FDwkWso94BTf52IBoWALo+YGWT6o+FO6cI9LbUGghEX2CdmQYXCvSvwvISF2jXeLQWNZvPZQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-floating-menu/-/extension-floating-menu-2.27.2.tgz",
+      "integrity": "sha512-GUN6gPIGXS7ngRJOwdSmtBRBDt9Kt9CM/9pSwKebhLJ+honFoNA+Y6IpVyDvvDMdVNgBchiJLs6qA5H97gAePQ==",
       "license": "MIT",
       "dependencies": {
         "tippy.js": "^6.3.7"
@@ -3129,9 +3143,9 @@
       }
     },
     "node_modules/@tiptap/extension-gapcursor": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-gapcursor/-/extension-gapcursor-2.27.1.tgz",
-      "integrity": "sha512-A9e1jr+jGhDWzNSXtIO6PYVYhf5j/udjbZwMja+wCE/3KvZU9V3IrnGKz1xNW+2Q2BDOe1QO7j5uVL9ElR6nTA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-gapcursor/-/extension-gapcursor-2.27.2.tgz",
+      "integrity": "sha512-/c9VF1HBxj+AP54XGVgCmD9bEGYc5w5OofYCFQgM7l7PB1J00A4vOke0oPkHJnqnOOyPlFaxO/7N6l3XwFcnKA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3143,9 +3157,9 @@
       }
     },
     "node_modules/@tiptap/extension-hard-break": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-hard-break/-/extension-hard-break-2.27.1.tgz",
-      "integrity": "sha512-W4hHa4Io6QCTwpyTlN6UAvqMIQ7t56kIUByZhyY9EWrg/+JpbfpxE1kXFLPB4ZGgwBknFOw+e4bJ1j3oAbTJFw==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-hard-break/-/extension-hard-break-2.27.2.tgz",
+      "integrity": "sha512-kSRVGKlCYK6AGR0h8xRkk0WOFGXHIIndod3GKgWU49APuIGDiXd8sziXsSlniUsWmqgDmDXcNnSzPcV7AQ8YNg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3156,9 +3170,9 @@
       }
     },
     "node_modules/@tiptap/extension-heading": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-heading/-/extension-heading-2.27.1.tgz",
-      "integrity": "sha512-6xoC7igZlW1EmnQ5WVH9IL7P1nCQb3bBUaIDLvk7LbweEogcTUECI4Xg1vxMOVmj9tlDe1I4BsgfcKpB5KEsZw==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-heading/-/extension-heading-2.27.2.tgz",
+      "integrity": "sha512-iM3yeRWuuQR/IRQ1djwNooJGfn9Jts9zF43qZIUf+U2NY8IlvdNsk2wTOdBgh6E0CamrStPxYGuln3ZS4fuglw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3169,9 +3183,9 @@
       }
     },
     "node_modules/@tiptap/extension-history": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-history/-/extension-history-2.27.1.tgz",
-      "integrity": "sha512-K8PHC9gegSAt0wzSlsd4aUpoEyIJYOmVVeyniHr1P1mIblW1KYEDbRGbDlrLALTyUEfMcBhdIm8zrB9X2Nihvg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-history/-/extension-history-2.27.2.tgz",
+      "integrity": "sha512-+hSyqERoFNTWPiZx4/FCyZ/0eFqB9fuMdTB4AC/q9iwu3RNWAQtlsJg5230bf/qmyO6bZxRUc0k8p4hrV6ybAw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3183,9 +3197,9 @@
       }
     },
     "node_modules/@tiptap/extension-horizontal-rule": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-horizontal-rule/-/extension-horizontal-rule-2.27.1.tgz",
-      "integrity": "sha512-WxXWGEEsqDmGIF2o9av+3r9Qje4CKrqrpeQY6aRO5bxvWX9AabQCfasepayBok6uwtvNzh3Xpsn9zbbSk09dNA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-horizontal-rule/-/extension-horizontal-rule-2.27.2.tgz",
+      "integrity": "sha512-WGWUSgX+jCsbtf9Y9OCUUgRZYuwjVoieW5n6mAUohJ9/6gc6sGIOrUpBShf+HHo6WD+gtQjRd+PssmX3NPWMpg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3197,9 +3211,9 @@
       }
     },
     "node_modules/@tiptap/extension-italic": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-italic/-/extension-italic-2.27.1.tgz",
-      "integrity": "sha512-rcm0GyniWW0UhcNI9+1eIK64GqWQLyIIrWGINslvqSUoBc+WkfocLvv4CMpRkzKlfsAxwVIBuH2eLxHKDtAREA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-italic/-/extension-italic-2.27.2.tgz",
+      "integrity": "sha512-1OFsw2SZqfaqx5Fa5v90iNlPRcqyt+lVSjBwTDzuPxTPFY4Q0mL89mKgkq2gVHYNCiaRkXvFLDxaSvBWbmthgg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3210,9 +3224,9 @@
       }
     },
     "node_modules/@tiptap/extension-link": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-link/-/extension-link-2.27.1.tgz",
-      "integrity": "sha512-cCwWPZsnVh9MXnGOqSIRXPPuUixRDK8eMN2TvqwbxUBb1TU7b/HtNvfMU4tAOqAuMRJ0aJkFuf3eB0Gi8LVb1g==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-link/-/extension-link-2.27.2.tgz",
+      "integrity": "sha512-bnP61qkr0Kj9Cgnop1hxn2zbOCBzNtmawxr92bVTOE31fJv6FhtCnQiD6tuPQVGMYhcmAj7eihtvuEMFfqEPcQ==",
       "license": "MIT",
       "dependencies": {
         "linkifyjs": "^4.3.2"
@@ -3227,9 +3241,9 @@
       }
     },
     "node_modules/@tiptap/extension-list-item": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-list-item/-/extension-list-item-2.27.1.tgz",
-      "integrity": "sha512-dtsxvtzxfwOJP6dKGf0vb2MJAoDF2NxoiWzpq0XTvo7NGGYUHfuHjX07Zp0dYqb4seaDXjwsi5BIQUOp3+WMFQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-list-item/-/extension-list-item-2.27.2.tgz",
+      "integrity": "sha512-eJNee7IEGXMnmygM5SdMGDC8m/lMWmwNGf9fPCK6xk0NxuQRgmZHL6uApKcdH6gyNcRPHCqvTTkhEP7pbny/fg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3240,9 +3254,9 @@
       }
     },
     "node_modules/@tiptap/extension-ordered-list": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-ordered-list/-/extension-ordered-list-2.27.1.tgz",
-      "integrity": "sha512-U1/sWxc2TciozQsZjH35temyidYUjvroHj3PUPzPyh19w2fwKh1NSbFybWuoYs6jS3XnMSwnM2vF52tOwvfEmA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-ordered-list/-/extension-ordered-list-2.27.2.tgz",
+      "integrity": "sha512-M7A4tLGJcLPYdLC4CI2Gwl8LOrENQW59u3cMVa+KkwG1hzSJyPsbDpa1DI6oXPC2WtYiTf22zrbq3gVvH+KA2w==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3253,9 +3267,9 @@
       }
     },
     "node_modules/@tiptap/extension-paragraph": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-paragraph/-/extension-paragraph-2.27.1.tgz",
-      "integrity": "sha512-R3QdrHcUdFAsdsn2UAIvhY0yWyHjqGyP/Rv8RRdN0OyFiTKtwTPqreKMHKJOflgX4sMJl/OpHTpNG1Kaf7Lo2A==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-paragraph/-/extension-paragraph-2.27.2.tgz",
+      "integrity": "sha512-elYVn2wHJJ+zB9LESENWOAfI4TNT0jqEN34sMA/hCtA4im1ZG2DdLHwkHIshj/c4H0dzQhmsS/YmNC5Vbqab/A==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3266,9 +3280,9 @@
       }
     },
     "node_modules/@tiptap/extension-placeholder": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-placeholder/-/extension-placeholder-2.27.1.tgz",
-      "integrity": "sha512-UbXaibHHFE+lOTlw/vs3jPzBoj1sAfbXuTAhXChjgYIcTTY5Cr6yxwcymLcimbQ79gf04Xkua2FCN3YsJxIFmw==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-placeholder/-/extension-placeholder-2.27.2.tgz",
+      "integrity": "sha512-IjsgSVYJRjpAKmIoapU0E2R4E2FPY3kpvU7/1i7PUYisylqejSJxmtJPGYw0FOMQY9oxnEEvfZHMBA610tqKpg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3280,9 +3294,9 @@
       }
     },
     "node_modules/@tiptap/extension-strike": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-strike/-/extension-strike-2.27.1.tgz",
-      "integrity": "sha512-S9I//K8KPgfFTC5I5lorClzXk0g4lrAv9y5qHzHO5EOWt7AFl0YTg2oN8NKSIBK4bHRnPIrjJJKv+dDFnUp5jQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-strike/-/extension-strike-2.27.2.tgz",
+      "integrity": "sha512-HHIjhafLhS2lHgfAsCwC1okqMsQzR4/mkGDm4M583Yftyjri1TNA7lzhzXWRFWiiMfJxKtdjHjUAQaHuteRTZw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3293,9 +3307,9 @@
       }
     },
     "node_modules/@tiptap/extension-text": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-text/-/extension-text-2.27.1.tgz",
-      "integrity": "sha512-a4GCT+GZ9tUwl82F4CEum9/+WsuW0/De9Be/NqrMmi7eNfAwbUTbLCTFU0gEvv25WMHCoUzaeNk/qGmzeVPJ1Q==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-text/-/extension-text-2.27.2.tgz",
+      "integrity": "sha512-Xk7nYcigljAY0GO9hAQpZ65ZCxqOqaAlTPDFcKerXmlkQZP/8ndx95OgUb1Xf63kmPOh3xypurGS2is3v0MXSA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3306,9 +3320,9 @@
       }
     },
     "node_modules/@tiptap/extension-text-align": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-text-align/-/extension-text-align-2.27.1.tgz",
-      "integrity": "sha512-D7dLPk7y5mDn9ZNANQ4K2gCq4vy+Emm5AdeWOGzNeqJsYrBotiQYXd9rb1QYjdup2kzAoKduMTUXV92ujo5cEg==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-text-align/-/extension-text-align-2.27.2.tgz",
+      "integrity": "sha512-0Pyks6Hu+Q/+9+5/osoSv0SP6jIerdWMYbi13aaZLsJoj3lBj5WNaE11JtAwSFN5sx0IbqhDSlp1zkvRnzgZ8g==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3319,9 +3333,9 @@
       }
     },
     "node_modules/@tiptap/extension-text-style": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/extension-text-style/-/extension-text-style-2.27.1.tgz",
-      "integrity": "sha512-NagQ9qLk0Ril83gfrk+C65SvTqPjL3WVnLF2arsEVnCrxcx3uDOvdJW67f/K5HEwEHsoqJ4Zq9Irco/koXrOXA==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/extension-text-style/-/extension-text-style-2.27.2.tgz",
+      "integrity": "sha512-Omk+uxjJLyEY69KStpCw5fA9asvV+MGcAX2HOxyISDFoLaL49TMrNjhGAuz09P1L1b0KGXo4ml7Q3v/Lfy4WPA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3332,9 +3346,9 @@
       }
     },
     "node_modules/@tiptap/pm": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/pm/-/pm-2.27.1.tgz",
-      "integrity": "sha512-ijKo3+kIjALthYsnBmkRXAuw2Tswd9gd7BUR5OMfIcjGp8v576vKxOxrRfuYiUM78GPt//P0sVc1WV82H5N0PQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/pm/-/pm-2.27.2.tgz",
+      "integrity": "sha512-kaEg7BfiJPDQMKbjVIzEPO3wlcA+pZb2tlcK9gPrdDnEFaec2QTF1sXz2ak2IIb2curvnIrQ4yrfHgLlVA72wA==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -3363,13 +3377,13 @@
       }
     },
     "node_modules/@tiptap/react": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/react/-/react-2.27.1.tgz",
-      "integrity": "sha512-leJximSjYJuhLJQv9azOP9R7w6zuxVgKOHYT4w83Gte7GhWMpNL6xRWzld280vyq/YW/cSYjPb/8ESEOgKNBdQ==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/react/-/react-2.27.2.tgz",
+      "integrity": "sha512-0EAs8Cpkfbvben1PZ34JN2Nd79Dhioynm2jML27DBbf1VWPk+FFWFGTMLUT0bu+Np5iVxio8fqV9t0mc4D6thA==",
       "license": "MIT",
       "dependencies": {
-        "@tiptap/extension-bubble-menu": "^2.27.1",
-        "@tiptap/extension-floating-menu": "^2.27.1",
+        "@tiptap/extension-bubble-menu": "^2.27.2",
+        "@tiptap/extension-floating-menu": "^2.27.2",
         "@types/use-sync-external-store": "^0.0.6",
         "fast-deep-equal": "^3",
         "use-sync-external-store": "^1"
@@ -3386,32 +3400,32 @@
       }
     },
     "node_modules/@tiptap/starter-kit": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/@tiptap/starter-kit/-/starter-kit-2.27.1.tgz",
-      "integrity": "sha512-uQQlP0Nmn9eq19qm8YoOeloEfmcGbPpB1cujq54Q6nPgxaBozR7rE7tXbFTinxRW2+Hr7XyNWhpjB7DMNkdU2Q==",
+      "version": "2.27.2",
+      "resolved": "https://registry.npmjs.org/@tiptap/starter-kit/-/starter-kit-2.27.2.tgz",
+      "integrity": "sha512-bb0gJvPoDuyRUQ/iuN52j1//EtWWttw+RXAv1uJxfR0uKf8X7uAqzaOOgwjknoCIDC97+1YHwpGdnRjpDkOBxw==",
       "license": "MIT",
       "dependencies": {
-        "@tiptap/core": "^2.27.1",
-        "@tiptap/extension-blockquote": "^2.27.1",
-        "@tiptap/extension-bold": "^2.27.1",
-        "@tiptap/extension-bullet-list": "^2.27.1",
-        "@tiptap/extension-code": "^2.27.1",
-        "@tiptap/extension-code-block": "^2.27.1",
-        "@tiptap/extension-document": "^2.27.1",
-        "@tiptap/extension-dropcursor": "^2.27.1",
-        "@tiptap/extension-gapcursor": "^2.27.1",
-        "@tiptap/extension-hard-break": "^2.27.1",
-        "@tiptap/extension-heading": "^2.27.1",
-        "@tiptap/extension-history": "^2.27.1",
-        "@tiptap/extension-horizontal-rule": "^2.27.1",
-        "@tiptap/extension-italic": "^2.27.1",
-        "@tiptap/extension-list-item": "^2.27.1",
-        "@tiptap/extension-ordered-list": "^2.27.1",
-        "@tiptap/extension-paragraph": "^2.27.1",
-        "@tiptap/extension-strike": "^2.27.1",
-        "@tiptap/extension-text": "^2.27.1",
-        "@tiptap/extension-text-style": "^2.27.1",
-        "@tiptap/pm": "^2.27.1"
+        "@tiptap/core": "^2.27.2",
+        "@tiptap/extension-blockquote": "^2.27.2",
+        "@tiptap/extension-bold": "^2.27.2",
+        "@tiptap/extension-bullet-list": "^2.27.2",
+        "@tiptap/extension-code": "^2.27.2",
+        "@tiptap/extension-code-block": "^2.27.2",
+        "@tiptap/extension-document": "^2.27.2",
+        "@tiptap/extension-dropcursor": "^2.27.2",
+        "@tiptap/extension-gapcursor": "^2.27.2",
+        "@tiptap/extension-hard-break": "^2.27.2",
+        "@tiptap/extension-heading": "^2.27.2",
+        "@tiptap/extension-history": "^2.27.2",
+        "@tiptap/extension-horizontal-rule": "^2.27.2",
+        "@tiptap/extension-italic": "^2.27.2",
+        "@tiptap/extension-list-item": "^2.27.2",
+        "@tiptap/extension-ordered-list": "^2.27.2",
+        "@tiptap/extension-paragraph": "^2.27.2",
+        "@tiptap/extension-strike": "^2.27.2",
+        "@tiptap/extension-text": "^2.27.2",
+        "@tiptap/extension-text-style": "^2.27.2",
+        "@tiptap/pm": "^2.27.2"
       },
       "funding": {
         "type": "github",
@@ -3854,9 +3868,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4300,16 +4314,42 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
-      "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz",
+      "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
-        "form-data": "^4.0.5",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
         "proxy-from-env": "^2.1.0"
       }
     },
+    "node_modules/axios/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/axios/node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -4318,13 +4358,16 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.12",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.12.tgz",
-      "integrity": "sha512-Mij6Lij93pTAIsSYy5cyBQ975Qh9uLEc5rwGTpomiZeXZL9yIS6uORJakb3ScHgfs0serMMfIbXzokPMuEiRyw==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/binary-extensions": {
@@ -4341,9 +4384,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4365,9 +4408,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "dev": true,
       "funding": [
         {
@@ -4386,11 +4429,11 @@
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -4443,9 +4486,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001762",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001762.tgz",
-      "integrity": "sha512-PxZwGNvH7Ak8WX5iXzoK1KPZttBXNPuaOvI2ZYU7NrlM+d9Ov+TUvlLOBNGzVXAntMSMMlJPd+jY6ovrVjSmUw==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -4928,7 +4971,6 @@
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -5007,9 +5049,9 @@
       "license": "MIT"
     },
     "node_modules/dompurify": {
-      "version": "3.4.11",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
-      "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
+      "version": "3.4.14",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz",
+      "integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -5030,9 +5072,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.267",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.267.tgz",
-      "integrity": "sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==",
+      "version": "1.5.420",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
       "dev": true,
       "license": "ISC"
     },
@@ -5856,16 +5898,16 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/glob/node_modules/minimatch": {
@@ -6137,16 +6179,16 @@
       }
     },
     "node_modules/i18next-cli/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/i18next-cli/node_modules/chokidar": {
@@ -6588,9 +6630,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
@@ -6793,9 +6835,9 @@
       "license": "MIT"
     },
     "node_modules/linkify-it": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.1.tgz",
-      "integrity": "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz",
+      "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==",
       "funding": [
         {
           "type": "github",
@@ -7144,7 +7186,6 @@
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/mute-stream": {
@@ -7170,9 +7211,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -7216,11 +7257,14 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -7577,9 +7621,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.10",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
-      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
+      "version": "8.5.27",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.27.tgz",
+      "integrity": "sha512-79Iho8QeYyooJ8e9lCRyTVlyTAkS/kXBYKff6TMzS3kEWGQ8Ds5UEtXpGrSUDLUWok6QTvxeYy0GO8fopHnaSA==",
       "dev": true,
       "funding": [
         {
@@ -7598,7 +7642,7 @@
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.18",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -7720,9 +7764,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8223,12 +8267,12 @@
       }
     },
     "node_modules/react-router": {
-      "version": "6.30.4",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.4.tgz",
-      "integrity": "sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==",
+      "version": "6.30.6",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.6.tgz",
+      "integrity": "sha512-5HfK7k5im7LTOB0EqCQmfvy4C13G92Ssj1VTmouTK3AJvyjKTnFuCV0vcMAD/JS+JC4DvDIBRrlAeJIFjh5VWg==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.3"
+        "@remix-run/router": "1.23.4"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -8238,13 +8282,13 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "6.30.4",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.4.tgz",
-      "integrity": "sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==",
+      "version": "6.30.6",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.6.tgz",
+      "integrity": "sha512-0RHKZz7wwffvkU+2MFVT2NnjK44ssLEV+m0CAJaS2Ksmorrwj7WxH00jO0SOCW26/tINUnJHToXblDs33I38YQ==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.3",
-        "react-router": "6.30.4"
+        "@remix-run/router": "1.23.4",
+        "react-router": "6.30.6"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -9116,9 +9160,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "dev": true,
       "funding": [
         {

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "3.46.8",
+  "version": "3.46.10",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/i18n/locales/de.json

@@ -1328,7 +1328,7 @@
       "maxUploadBatchSize": "Max. Upload-Paketgröße (MB)",
       "maxUploadBatchSizeHelp": "Maximale Größe pro Upload-Anfrage. Reduzieren Sie diesen Wert bei Nutzung eines Reverse-Proxys mit Größenbeschränkung (z.B. Cloudflare: 100MB).",
       "allowedFileTypes": "Erlaubte Dateitypen",
-      "allowedFileTypesHelp": "Kommagetrennte Liste von Dateierweiterungen",
+      "allowedFileTypesHelp": "Kommagetrennte Liste von Dateierweiterungen, z. B. jpg,jpeg,png,webp. Gilt für alle Upload-Wege, auch Gast-Uploads und die Chunked-API für große Dateien. Videos sind standardmäßig aus: mp4, mov oder webm hinzufügen, um sie zuzulassen.",
       "featureToggles": "Funktionsschalter",
       "enableAnalytics": "Analytics-Tracking aktivieren",
       "enableRegistration": "Selbstregistrierung für Admins erlauben",

frontend/src/i18n/locales/en.json

@@ -869,7 +869,7 @@
       "maxUploadBatchSize": "Max Upload Batch Size (MB)",
       "maxUploadBatchSizeHelp": "Maximum size per upload request. Lower this if behind a reverse proxy with request size limits (e.g. Cloudflare: 100MB).",
       "allowedFileTypes": "Allowed File Types",
-      "allowedFileTypesHelp": "Comma-separated list of file extensions",
+      "allowedFileTypesHelp": "Comma-separated list of file extensions, e.g. jpg,jpeg,png,webp. Applies to every upload path, including guest uploads and the chunked (large-file) API. Videos are off by default: add mp4, mov or webm to accept them.",
       "featureToggles": "Feature Toggles",
       "enableAnalytics": "Enable analytics tracking",
       "enableRegistration": "Allow self-registration for admins",

scripts/picpeak-setup.sh

@@ -14,8 +14,8 @@ IFS=$'\n\t'
 readonly SCRIPT_VERSION="2.1.0"
 readonly APP_NAME="PicPeak"
 readonly REPO_URL="https://github.com/PicPeak/picpeak.git"
-readonly NODE_VERSION="20"
-readonly NODE_MIN_VERSION="20.19.0"  # backend engines: ^20.19.0 || >=22 (sharp 0.35, html-to-text 10)
+readonly NODE_VERSION="22"
+readonly NODE_MIN_VERSION="22.12.0"  # backend engines: >=22.12.0 (sanitize-html 2.17.7)
 readonly MIN_RAM_DOCKER=2048
 readonly MIN_RAM_NATIVE=1024
 readonly MIN_DISK_GB=2
@@ -721,6 +721,13 @@ EOF
 # Native Installation
 ################################################################################
 
+# True when a Node.js version satisfies the backend's engines range (>=22.12.0).
+node_version_supported() {
+    local ver="$1"
+    [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+    [[ "$(printf '%s\n' "$NODE_MIN_VERSION" "$ver" | sort -V | head -1)" == "$NODE_MIN_VERSION" ]]
+}
+
 install_nodejs() {
     # --update dispatches here before main() runs detect_os, so detect on demand
     if [[ -z "$PACKAGE_MANAGER" ]]; then
@@ -729,8 +736,8 @@ install_nodejs() {
 
     local node_ver
     node_ver=$(command_exists node && node -v | cut -d'v' -f2 || echo "0")
-    # backend engines range is ^20.19.0 || >=22 (Node 21 is excluded by the glob/minimatch family)
-    if [[ "$(printf '%s\n' "$NODE_MIN_VERSION" "$node_ver" | sort -V | head -1)" == "$NODE_MIN_VERSION" && "${node_ver%%.*}" != "21" ]]; then
+    # Match sanitize-html's declared Node minimum, including strict npm installs.
+    if node_version_supported "$node_ver"; then
         log_success "Node.js $(node -v) is already installed"
         return
     fi
@@ -748,10 +755,10 @@ install_nodejs() {
             ;;
     esac
 
-    # Package managers won't downgrade a newer Node (e.g. 21), so re-verify before continuing
+    # Re-verify in case the package manager did not replace an unsupported Node.
     node_ver=$(command_exists node && node -v | cut -d'v' -f2 || echo "0")
-    if [[ "$(printf '%s\n' "$NODE_MIN_VERSION" "$node_ver" | sort -V | head -1)" != "$NODE_MIN_VERSION" || "${node_ver%%.*}" == "21" ]]; then
-        die "Node.js v$node_ver does not satisfy the backend requirement (^$NODE_MIN_VERSION || >=22); remove the current Node.js, install a supported version, then re-run this script"
+    if ! node_version_supported "$node_ver"; then
+        die "Node.js v$node_ver does not satisfy the backend requirement (>=$NODE_MIN_VERSION); remove the current Node.js, install a supported version, then re-run this script"
     fi
     log_success "Node.js installed: $(node -v)"
 }