chore(stable): release 3.45.2 (#819)

fix(security): remove unguarded legacy /api/events router on stable (GHSA-4j34-x562-5vfq)

.github/workflows/docker-build.yml

@@ -282,10 +282,6 @@ jobs:
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
-          # #668/#783: publish the git-tag name verbatim (v3.45.0 / v3.84.0-beta.0)
-          # so users can pin the same string as the GitHub release. metadata-action's
-          # `pattern=v{{version}}` silently dropped it on prereleases, so use type=ref.
-          type=ref,event=tag
           type=sha,format=short
           # `:latest` + `:stable` follow the stable channel (the `stable` branch +
           # stable release tags). The default branch is now `main` (active dev),
@@ -503,10 +499,6 @@ jobs:
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
           type=semver,pattern={{major}},enable=${{ steps.context.outputs.is_prerelease == 'false' }}
-          # #668/#783: publish the git-tag name verbatim (v3.45.0 / v3.84.0-beta.0)
-          # so users can pin the same string as the GitHub release. metadata-action's
-          # `pattern=v{{version}}` silently dropped it on prereleases, so use type=ref.
-          type=ref,event=tag
           type=sha,format=short
           # `:latest` + `:stable` follow the stable channel (the `stable` branch +
           # stable release tags). The default branch is now `main` (active dev),

.release-please-manifest-beta.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.86.0-beta.0"
+  ".": "3.83.0-beta.0"
 }

.release-please-manifest.json

@@ -1 +1 @@
-{".":"3.44.0"}
+{".":"3.45.2"}

RELEASING.md

@@ -52,19 +52,13 @@ The actual mechanics, in order:
    - **`.release-please-manifest.json`** — keep `stable`'s; release-please owns this file.
    - Any other auto-merged file — spot-check that the auto-merge produced something sensible, especially for security-sensitive files (`backend/src/middleware/`, `backend/src/utils/tokenUtils.js`).
 
-5. **Pin the stable version to match `main` (number alignment — see Versioning).** Determine `X.Y.Z` = the `main` tip's **base** version (its `vX.Y.Z-beta.N`, dropping the `-beta.N` suffix), and add an empty commit on the release branch:
-   ```bash
-   git commit --allow-empty -m "chore: release X.Y.Z" -m "Release-As: X.Y.Z"
-   ```
-   The `Release-As:` footer forces release-please to cut exactly `X.Y.Z`. Without it, release-please computes the next MINOR from the *previous stable* tag (e.g. `3.45.0` → `3.46.0`) while `main` is already at `3.84.x`, so the stable number drifts ever further behind for the same code.
+5. **Wait for CI on the PR.** All ten checks (the original eight plus `merge-backend` and `merge-frontend`) must be green. If anything fails, fix on the release branch (NOT on `main` — `main` has already moved on).
 
-6. **Wait for CI on the PR.** All ten checks (the original eight plus `merge-backend` and `merge-frontend`) must be green. If anything fails, fix on the release branch (NOT on `main` — `main` has already moved on).
+6. **Merge.** Standard merge commit, not squash — the PR's history (the individual feature commits) carries forward into `stable`'s log.
 
-7. **Merge.** Standard merge commit, not squash — the PR's history (the individual feature commits) carries forward into `stable`'s log.
+7. **release-please picks it up.** Within minutes, release-please will open a new `chore(stable): release X.Y.Z` PR proposing the stable release. Review the auto-generated CHANGELOG.md entries for accuracy, edit if needed, and merge. That merge creates the `vX.Y.Z` git tag, publishes Docker images on the `:stable` and `:latest` tags, and creates the GitHub Release page.
 
-8. **release-please picks it up.** Within minutes, release-please will open a new `chore(stable): release X.Y.Z` PR proposing the stable release. Review the auto-generated CHANGELOG.md entries for accuracy, edit if needed, and merge. That merge creates the `vX.Y.Z` git tag, publishes Docker images on the `:stable` and `:latest` tags, and creates the GitHub Release page.
-
-9. **Close the loop.** Bulk-close any `bug` issues that were fixed-but-not-closed and now appear in the released changelog. Reference the merge commit so reporters know which version contains the fix.
+8. **Close the loop.** Bulk-close any `bug` issues that were fixed-but-not-closed and now appear in the released changelog. Reference the merge commit so reporters know which version contains the fix.
 
 ## Hotfix path (backport to current stable)
 
@@ -89,14 +83,6 @@ PicPeak follows [Semantic Versioning](https://semver.org/) with one project-spec
 
 release-please derives all of this from conventional commit prefixes (`feat:`, `fix:`, `BREAKING CHANGE:`, etc.) automatically.
 
-### Stable ↔ pre-release number alignment
-
-The two channels run **independent** release-please counters: `main` bumps on every merge (racing ahead), while `stable` only bumps on a promotion. Left to itself, `stable` computes each promotion as the next MINOR from the *previous stable tag*, so the two drift far apart — e.g. `main` at `v3.83.x-beta.0` while `stable` sat at `v3.45.0` for the **same code**, which reads as "stable is 38 versions behind" when it isn't.
-
-To keep the numbers legible, **a promotion sets the stable version to the current `main` base version** (the `X.Y.Z` of the `main` tip's `vX.Y.Z-beta.N`, minus the suffix). Promoting a `main` at `v3.84.2-beta.0` therefore cuts stable `v3.84.2`, and the stable number tracks `main` instead of lagging. This is forced with the `Release-As:` commit in step 5 of the cut procedure — the one-time catch-up jump (e.g. `3.45.0 → 3.84.x`) is expected and happens only on the first aligned promotion.
-
-> **Release-engineering note (2026-07):** `release-please.yml` (the stable workflow) *must* keep `target-branch: stable`. Without it, release-please defaults to the repo's default branch (`main`), reads `main`'s stale `.release-please-manifest.json`, and cuts a wrong/regressed version — this is what produced a bogus `v2.7.0` once. If a promotion ever yields an unexpected version, check that first.
-
 ## Things that don't go through this process
 
 - **Documentation-only changes** can land on either `stable` or `main` directly (no release cut needed); release-please will pick them up on the next regular release.

backend/Dockerfile

@@ -27,8 +27,15 @@ FROM node:22-alpine
 
 WORKDIR /app
 
+# Redeclare CACHEBUST — ARGs don't cross stage boundaries, so the builder
+# stage's declaration never reached this stage. Consuming it in the RUN below
+# busts that layer's cache every CI run (CACHEBUST=github.run_number), so the
+# image always picks up current Alpine security updates instead of reusing a
+# stale cached upgrade layer.
+ARG CACHEBUST=1
+
 # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
-RUN apk upgrade --no-cache
+RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
 
 # Upgrade the npm CLI in the final image so its bundled deps are patched
 # (sigstore 4.x, tar) — closes CVE-2026-48815 and the older @sigstore/core / tar

backend/__tests__/integration/categoryReorder.test.js

@@ -1,211 +0,0 @@
-/**
- * Layered per-event category ordering (#782).
- *
- * Two ordering layers, resolved per event:
- *   - GLOBAL default   — photo_categories.display_order (migration 159),
- *                        set via POST /reorder-global; applies everywhere.
- *   - PER-EVENT override — event_category_order (migration 160), set via
- *                        POST /reorder; overrides the default for one gallery.
- *   - DELETE /reorder/:eventId clears an event's override.
- *
- * Verified against a real SQLite DB with the full core-migration set applied.
- */
-const request = require('supertest');
-const {
-  bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken, buildRouteApp,
-} = require('./helpers/crmDb');
-
-jest.setTimeout(30000);
-
-describe('category ordering (#782)', () => {
-  let db;
-  let cleanup;
-  let token;
-  let app;
-
-  beforeAll(async () => {
-    ({ db, cleanup } = await bootCrmDb());
-    const { adminId } = await seedMinimal(db);
-    await assignAdminRole(db, adminId, 'super_admin');
-    token = mintAdminToken(adminId);
-    app = buildRouteApp('/api/admin/categories', require('../../src/routes/adminCategories'));
-  }, 120000);
-
-  afterAll(async () => { if (cleanup) await cleanup(); });
-
-  const auth = (r) => r.set('Authorization', `Bearer ${token}`);
-
-  async function insertEvent(slug) {
-    await db('events').insert({
-      event_type: 'wedding', password_hash: 'x',
-      expires_at: new Date(Date.now() + 9e9).toISOString(),
-      is_active: true, is_archived: false, slug, share_link: slug,
-      event_name: slug, event_date: '2026-01-01',
-    });
-    return (await db('events').where({ slug }).first()).id;
-  }
-
-  async function insertCat(name, { is_global = false, event_id = null, display_order = 0 } = {}) {
-    const res = await db('photo_categories').insert({
-      name,
-      slug: name.toLowerCase().replace(/\s+/g, '-'),
-      is_global: is_global ? 1 : 0,
-      event_id,
-      display_order,
-    }).returning('id');
-    return res[0]?.id ?? res[0];
-  }
-
-  const getEvent = (eventId) => auth(request(app).get(`/api/admin/categories/event/${eventId}`)).expect(200);
-
-  describe('migration 159 backfill', () => {
-    it('seeds display_order from alphabetical order, scoped per event', async () => {
-      const eventId = await insertEvent('backfill-ev');
-      await insertCat('Reception', { event_id: eventId });
-      await insertCat('Ceremony', { event_id: eventId });
-      await insertCat('Pre-Ceremony', { event_id: eventId });
-
-      // Re-run the migration: addColumn is guarded (no-op); the backfill loop
-      // re-runs and assigns per-scope alphabetical order — what an upgrade does.
-      await require('../../migrations/core/159_add_category_display_order').up(db);
-
-      const evCats = await db('photo_categories').where({ event_id: eventId }).orderBy('display_order', 'asc');
-      expect(evCats.map((c) => c.name)).toEqual(['Ceremony', 'Pre-Ceremony', 'Reception']);
-      expect(evCats.map((c) => c.display_order)).toEqual([1, 2, 3]);
-    });
-  });
-
-  describe('global default order (POST /reorder-global)', () => {
-    it('reverses the global order and every non-customised event follows it', async () => {
-      const before = (await auth(request(app).get('/api/admin/categories/global')).expect(200)).body;
-      expect(before.length).toBeGreaterThan(1);
-      const reversedIds = before.map((c) => c.id).reverse();
-
-      const res = await auth(request(app).post('/api/admin/categories/reorder-global'))
-        .send({ orderedIds: reversedIds })
-        .expect(200);
-      expect(res.body.map((c) => c.id)).toEqual(reversedIds);
-
-      // A fresh event (no override) shows globals in the new global order.
-      const eventId = await insertEvent('follows-global');
-      const globalsInEvent = (await getEvent(eventId)).body.filter((c) => c.is_global).map((c) => c.id);
-      expect(globalsInEvent).toEqual(reversedIds);
-    });
-  });
-
-  describe('per-event override (POST /reorder)', () => {
-    it('pins a custom order for one event without affecting another', async () => {
-      const eventA = await insertEvent('override-a');
-      const eventB = await insertEvent('override-b');
-      const a1 = await insertCat('A-Ceremony', { event_id: eventA });
-      const a2 = await insertCat('A-Reception', { event_id: eventA });
-
-      // Current resolved list for A (globals + A's two categories).
-      const listA = (await getEvent(eventA)).body;
-      // Put A-Reception first, then A-Ceremony, then the globals in their order.
-      const globalsA = listA.filter((c) => c.is_global).map((c) => c.id);
-      const desired = [a2, a1, ...globalsA];
-
-      const res = await auth(request(app).post('/api/admin/categories/reorder'))
-        .send({ event_id: eventA, orderedIds: desired })
-        .expect(200);
-      expect(res.body.map((c) => c.id)).toEqual(desired);
-      // override_position is set on every row for a customised event.
-      expect(res.body.every((c) => c.override_position != null)).toBe(true);
-
-      // Event B is untouched — no override, follows the global default.
-      const listB = (await getEvent(eventB)).body;
-      expect(listB.every((c) => c.override_position == null)).toBe(true);
-    });
-
-    it('accepts global ids but rejects another event’s category', async () => {
-      const eventId = await insertEvent('scope-ev');
-      const own = await insertCat('Own', { event_id: eventId });
-      const global = (await db('photo_categories').where('is_global', 1).first()).id;
-      const foreign = await insertCat('Foreign', { event_id: await insertEvent('other-ev') });
-
-      // A global id is allowed (globals can be arranged per event).
-      await auth(request(app).post('/api/admin/categories/reorder'))
-        .send({ event_id: eventId, orderedIds: [own, global] })
-        .expect(200);
-
-      // A foreign event's category is out of scope.
-      await auth(request(app).post('/api/admin/categories/reorder'))
-        .send({ event_id: eventId, orderedIds: [own, foreign] })
-        .expect(400);
-    });
-  });
-
-  describe('reset (DELETE /reorder/:eventId)', () => {
-    it('clears the override and reverts to the global default', async () => {
-      const eventId = await insertEvent('reset-ev');
-      const c1 = await insertCat('R-One', { event_id: eventId });
-      const list = (await getEvent(eventId)).body;
-      const globals = list.filter((c) => c.is_global).map((c) => c.id);
-
-      await auth(request(app).post('/api/admin/categories/reorder'))
-        .send({ event_id: eventId, orderedIds: [c1, ...globals] })
-        .expect(200);
-      expect((await getEvent(eventId)).body.some((c) => c.override_position != null)).toBe(true);
-
-      const res = await auth(request(app).delete(`/api/admin/categories/reorder/${eventId}`)).expect(200);
-      expect(res.body.every((c) => c.override_position == null)).toBe(true);
-      expect(await db('event_category_order').where({ event_id: eventId }).first()).toBeUndefined();
-    });
-  });
-
-  describe('event ownership (PR #790 review)', () => {
-    let limitedToken;
-    let foreignEventId;
-
-    beforeAll(async () => {
-      const bcrypt = require('bcrypt');
-      // A non-super_admin role that DOES hold settings.view + settings.edit —
-      // the exact case the review flagged (settings.edit is grantable).
-      const roleRes = await db('roles').insert({ name: 'gallery-mgr', display_name: 'Gallery Mgr' }).returning('id');
-      const roleId = roleRes[0]?.id ?? roleRes[0];
-      const permIds = await db('permissions').whereIn('name', ['settings.view', 'settings.edit']).pluck('id');
-      await db('role_permissions').insert(permIds.map((permission_id) => ({ role_id: roleId, permission_id })));
-
-      const a2 = await db('admin_users').insert({
-        username: 'limited', email: 'limited@example.com',
-        password_hash: await bcrypt.hash('x', 4), role_id: roleId,
-        must_change_password: false, created_at: new Date(),
-      }).returning('id');
-      limitedToken = mintAdminToken(a2[0]?.id ?? a2[0]);
-
-      // An event owned by a DIFFERENT admin (the seeded super_admin).
-      const owner = (await db('admin_users').where({ username: 'tester' }).first()).id;
-      await db('events').insert({
-        event_type: 'wedding', password_hash: 'x',
-        expires_at: new Date(Date.now() + 9e9).toISOString(),
-        is_active: true, is_archived: false, slug: 'owned-ev', share_link: 'owned-ev',
-        event_name: 'Owned', event_date: '2026-01-01', created_by: owner,
-      });
-      foreignEventId = (await db('events').where({ slug: 'owned-ev' }).first()).id;
-    });
-
-    const limitedAuth = (r) => r.set('Authorization', `Bearer ${limitedToken}`);
-
-    it('blocks a non-owner from reading, reordering or resetting another event', async () => {
-      await limitedAuth(request(app).get(`/api/admin/categories/event/${foreignEventId}`)).expect(403);
-      await limitedAuth(request(app).post('/api/admin/categories/reorder'))
-        .send({ event_id: foreignEventId, orderedIds: [1] }).expect(403);
-      await limitedAuth(request(app).delete(`/api/admin/categories/reorder/${foreignEventId}`)).expect(403);
-    });
-  });
-
-  describe('POST / (create) appends to the end of its scope', () => {
-    it('assigns display_order = max + 1 within the event', async () => {
-      const eventId = await insertEvent('append-ev');
-      await insertCat('First', { event_id: eventId, display_order: 1 });
-      await insertCat('Second', { event_id: eventId, display_order: 2 });
-
-      const res = await auth(request(app).post('/api/admin/categories'))
-        .send({ name: 'Third', is_global: false, event_id: eventId })
-        .expect(200);
-
-      expect(res.body.display_order).toBe(3);
-    });
-  });
-});

backend/__tests__/routes/authShareLoginPassword.test.js

@@ -0,0 +1,127 @@
+/**
+ * Regression test for GHSA-9hmx-68vc-qpqw — share-link login must not bypass
+ * the gallery password.
+ *
+ * POST /auth/gallery/share-login validates only the share token. For a
+ * password-protected gallery it previously minted a full `type:'gallery'`
+ * access token on the share token alone, letting anyone holding the share URL
+ * read the gallery without the password. The fix: when the gallery requires a
+ * password, return `{ requires_password: true }` with NO token and NO cookie.
+ */
+
+const express = require('express');
+const request = require('supertest');
+
+process.env.JWT_SECRET = 'share-login-test-secret';
+
+const events = [];
+
+jest.mock('../../src/database/db', () => {
+  function dbFn(table) {
+    if (table === 'events') {
+      let filter = () => true;
+      return {
+        where(criteria) {
+          filter = (row) => Object.entries(criteria).every(([k, v]) => {
+            if (k === 'is_active') return Boolean(row.is_active) === Boolean(v);
+            if (k === 'is_archived') return Boolean(row.is_archived) === Boolean(v);
+            return row[k] === v;
+          });
+          return this;
+        },
+        async first() { return events.find(filter); },
+      };
+    }
+    return { where() { return this; }, async first() { return undefined; } };
+  }
+  dbFn.raw = async () => {};
+  return { db: dbFn, logActivity: async () => {} };
+});
+
+// Share token is stored plainly on the fake event row.
+jest.mock('../../src/services/shareLinkService', () => ({
+  getEventShareToken: (event) => event.share_token,
+  resolveShareIdentifier: async () => ({ event: null }),
+}));
+
+const mockSetGalleryAuthCookies = jest.fn();
+jest.mock('../../src/utils/tokenUtils', () => ({
+  setGalleryAuthCookies: (...args) => mockSetGalleryAuthCookies(...args),
+  clearGalleryAuthCookies: jest.fn(),
+  getGalleryTokenFromRequest: jest.fn(),
+  setAdminAuthCookies: jest.fn(),
+}));
+
+jest.mock('../../src/utils/authSecurity', () => ({
+  trackFailedAttempt: jest.fn(async () => {}),
+  trackSuccessfulLogin: jest.fn(async () => {}),
+  checkAccountLockout: jest.fn(async () => ({ isLocked: false })),
+  resetLockout: jest.fn(async () => {}),
+}));
+
+// Collaborators the router imports at load but the share-login path doesn't hit.
+jest.mock('../../src/services/recaptcha', () => ({ verifyRecaptcha: async () => true }));
+jest.mock('../../src/services/mfaService', () => ({}));
+jest.mock('../../src/middleware/sessionTimeout', () => ({ endSession: jest.fn(), sessionTimeoutMiddleware: (req, res, next) => next() }));
+jest.mock('../../src/utils/tokenRevocation', () => ({ revokeToken: jest.fn(async () => {}), isTokenRevoked: async () => false }));
+
+const authRouter = require('../../src/routes/auth');
+
+function makeApp() {
+  const app = express();
+  app.use(express.json());
+  app.use('/auth', authRouter);
+  return app;
+}
+
+const SHARE_TOKEN = 'a'.repeat(64);
+
+beforeEach(() => {
+  events.length = 0;
+  mockSetGalleryAuthCookies.mockClear();
+});
+
+describe('POST /auth/gallery/share-login password enforcement', () => {
+  it('does NOT mint a token for a password-protected gallery', async () => {
+    events.push({
+      id: 1, slug: 'private-gallery', is_active: 1, is_archived: 0,
+      require_password: 1, share_token: SHARE_TOKEN, event_name: 'Private',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'private-gallery', token: SHARE_TOKEN });
+
+    expect(res.status).toBe(200);
+    expect(res.body.requires_password).toBe(true);
+    expect(res.body.token).toBeUndefined();
+    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
+  });
+
+  it('mints a token for a public (no-password) gallery', async () => {
+    events.push({
+      id: 2, slug: 'public-gallery', is_active: 1, is_archived: 0,
+      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'public-gallery', token: SHARE_TOKEN });
+
+    expect(res.status).toBe(200);
+    expect(typeof res.body.token).toBe('string');
+    expect(res.body.event).toBeDefined();
+    expect(mockSetGalleryAuthCookies).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects a wrong share token regardless of password setting', async () => {
+    events.push({
+      id: 3, slug: 'public-gallery', is_active: 1, is_archived: 0,
+      require_password: false, share_token: SHARE_TOKEN, event_name: 'Public',
+    });
+    const res = await request(makeApp())
+      .post('/auth/gallery/share-login')
+      .send({ slug: 'public-gallery', token: 'b'.repeat(64) });
+
+    expect(res.status).toBe(401);
+    expect(mockSetGalleryAuthCookies).not.toHaveBeenCalled();
+  });
+});

backend/__tests__/routes/legacyEventsRouterRemoved.test.js

@@ -0,0 +1,119 @@
+/**
+ * Regression test for GHSA-4j34-x562-5vfq — broken access control in the legacy
+ * /api/events router.
+ *
+ * The legacy router exposed create/list/update/delete/extend guarded by
+ * adminAuth ALONE (no requirePermission, no requireEventOwnership), so any
+ * back-office account — down to a read-only viewer — could read every gallery's
+ * password_hash/share_token and take over any gallery. The fix removes that
+ * router entirely and migrates its one UI-used route (POST /:id/extend) to the
+ * canonical /api/admin/events mount, where it inherits the permission +
+ * ownership guards.
+ *
+ * This test pins two invariants:
+ *   1. The legacy source file is gone (nothing can re-mount it).
+ *   2. The migrated extend route enforces ownership — a non-owning editor gets
+ *      403, the owner succeeds.
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+process.env.NODE_ENV = 'test';
+process.env.TEST_DATABASE_PATH = path.join(
+  fs.mkdtempSync(path.join(os.tmpdir(), 'picpeak-legacy-acl-')), 'db.sqlite'
+);
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'legacy-acl-test-secret';
+
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const request = require('supertest');
+const { bootCrmDb, seedMinimal, assignAdminRole, mintAdminToken } = require('../integration/helpers/crmDb');
+
+async function insertEvent(db, ownerId, over = {}) {
+  const base = {
+    slug: `ev-${Math.random().toString(16).slice(2)}`,
+    event_type: 'wedding',
+    event_name: 'Owner Gallery',
+    event_date: '2026-05-29',
+    host_email: 'host@example.com',
+    admin_email: 'admin@example.com',
+    password_hash: 'x',
+    share_link: `/gallery/share-${Math.random().toString(16).slice(2)}`,
+    share_token: `st-${Math.random().toString(16).slice(2)}`,
+    expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+    is_active: 1, is_archived: 0, is_draft: 0,
+    created_by: ownerId,
+    created_at: new Date().toISOString(),
+    ...over,
+  };
+  const r = await db('events').insert(base).returning('id');
+  return r[0]?.id ?? r[0];
+}
+
+describe('GHSA-4j34: legacy /api/events router removed + extend guarded', () => {
+  it('the legacy events router source file no longer exists', () => {
+    expect(fs.existsSync(path.join(__dirname, '../../src/routes/events.js'))).toBe(false);
+  });
+
+  describe('POST /api/admin/events/:id/extend ownership enforcement', () => {
+    let db; let cleanup; let app;
+    let ownerId; let ownerToken;
+    let editorId; let editorToken;
+
+    beforeAll(async () => {
+      ({ db, cleanup } = await bootCrmDb());
+      ({ adminId: ownerId } = await seedMinimal(db));
+      await assignAdminRole(db, ownerId, 'super_admin');
+      ownerToken = mintAdminToken(ownerId);
+
+      // A second, non-owning account with the low-trust editor role.
+      [editorId] = await db('admin_users').insert({
+        username: 'editor1', email: 'editor1@example.com',
+        password_hash: 'x', is_active: 1,
+      }).returning('id');
+      editorId = editorId?.id ?? editorId;
+      await assignAdminRole(db, editorId, 'editor');
+      editorToken = mintAdminToken(editorId);
+
+      app = express();
+      app.use(express.json());
+      app.use(cookieParser());
+      app.use('/api/admin/events', require('../../src/routes/adminEvents'));
+      // eslint-disable-next-line no-unused-vars
+      app.use((err, req, res, next) => {
+        res.status(err.statusCode || err.status || 500).json({ error: err.message, code: err.code });
+      });
+    }, 120000);
+
+    afterAll(async () => { await cleanup(); });
+
+    it('lets the owner extend their own gallery', async () => {
+      const id = await insertEvent(db, ownerId, { expires_at: '2026-06-01T00:00:00.000Z' });
+      const res = await request(app)
+        .post(`/api/admin/events/${id}/extend`)
+        .set('Authorization', `Bearer ${ownerToken}`)
+        .send({ days: 10 });
+      expect(res.status).toBe(200);
+      expect(new Date(res.body.expires_at).toISOString()).toBe('2026-06-11T00:00:00.000Z');
+    });
+
+    it('403s a non-owning editor trying to extend someone else\'s gallery', async () => {
+      const id = await insertEvent(db, ownerId); // owned by the super_admin
+      const res = await request(app)
+        .post(`/api/admin/events/${id}/extend`)
+        .set('Authorization', `Bearer ${editorToken}`)
+        .send({ days: 30 });
+      expect(res.status).toBe(403); // requireEventOwnership blocks it
+    });
+
+    it('validates the days field', async () => {
+      const id = await insertEvent(db, ownerId);
+      const res = await request(app)
+        .post(`/api/admin/events/${id}/extend`)
+        .set('Authorization', `Bearer ${ownerToken}`)
+        .send({ days: 9999 });
+      expect(res.status).toBe(400);
+    });
+  });
+});

backend/__tests__/services/chunkedUploadFilename.test.js

@@ -0,0 +1,52 @@
+const path = require('path');
+const os = require('os');
+const fs = require('fs').promises;
+
+// Point storage at a throwaway temp dir before requiring the service so the
+// module-level getStoragePath() picks it up if evaluated.
+process.env.STORAGE_PATH = path.join(os.tmpdir(), `picpeak-chunk-test-${process.pid}`);
+
+const chunkedUpload = require('../../src/services/chunkedUploadService');
+
+describe('chunkedUploadService.initializeUpload filename sanitisation (GHSA-pc72-jf53-w28j)', () => {
+  afterAll(async () => {
+    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true }).catch(() => {});
+  });
+
+  it('strips directory-traversal components from the stored filename', async () => {
+    const { uploadId } = await chunkedUpload.initializeUpload({
+      filename: '../../uploads/logos/evil.svg',
+      fileSize: 10,
+      mimeType: 'video/mp4',
+      eventId: 1,
+      totalChunks: 1,
+    });
+    const meta = chunkedUpload.getUploadStatus(uploadId);
+    // basename('../../uploads/logos/evil.svg') === 'evil.svg' — the traversal
+    // is gone, so path.join(tempDir, filename) can no longer escape tempDir.
+    expect(meta.filename).toBe('evil.svg');
+  });
+
+  it('keeps a normal filename intact', async () => {
+    const { uploadId } = await chunkedUpload.initializeUpload({
+      filename: 'clip.mp4',
+      fileSize: 10,
+      mimeType: 'video/mp4',
+      eventId: 1,
+      totalChunks: 1,
+    });
+    expect(uploadId).toBeTruthy();
+  });
+
+  it('rejects a filename that collapses to nothing', async () => {
+    await expect(
+      chunkedUpload.initializeUpload({
+        filename: '../',
+        fileSize: 10,
+        mimeType: 'video/mp4',
+        eventId: 1,
+        totalChunks: 1,
+      })
+    ).rejects.toThrow(/Invalid filename/);
+  });
+});

backend/__tests__/services/picpeakReinjectAdmin.test.js

@@ -0,0 +1,111 @@
+/**
+ * Regression tests for reinjectCurrentAdmin — the operator-preservation step of
+ * the .picpeak restore (GHSA-qxfx-4493-4v8f follow-up). Runs against a real
+ * in-memory SQLite DB so the UNIQUE(email)/UNIQUE(username) constraints behave
+ * as in production. Reconciliation is non-destructive (update-in-place / rename,
+ * never delete) so restored rows referenced by FKs keep their ids.
+ */
+const knex = require('knex');
+
+let db;
+let reinjectCurrentAdmin;
+
+beforeAll(() => {
+  jest.doMock('../../knexfile', () => ({ client: 'sqlite3' }), { virtual: false });
+  reinjectCurrentAdmin = require('../../src/services/picpeakImportService').reinjectCurrentAdmin;
+});
+
+beforeEach(async () => {
+  db = knex({ client: 'sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true });
+  await db.schema.createTable('admin_users', (t) => {
+    t.increments('id');
+    t.string('username').notNullable().unique();
+    t.string('email').notNullable().unique();
+    t.string('password_hash');
+    t.boolean('is_active').defaultTo(true);
+    t.boolean('must_change_password').defaultTo(false);
+    t.integer('role_id');
+    t.integer('created_by');
+    t.boolean('two_factor_enabled').defaultTo(false);
+    t.string('two_factor_secret');
+    t.text('two_factor_recovery_codes');
+  });
+});
+
+afterEach(async () => { await db.destroy(); });
+
+const operator = {
+  id: 1, username: 'admin', email: 'op@example.com',
+  password_hash: 'OP_HASH', is_active: 1, must_change_password: 0, role_id: 1, created_by: 99,
+  two_factor_enabled: 1, two_factor_secret: 'OP_SECRET', two_factor_recovery_codes: '["a","b"]',
+};
+
+test('restores login + MFA in place, keeping the row id and its FK columns (FK-safe)', async () => {
+  await db('admin_users').insert({
+    id: 7, username: 'someoneelse', email: 'OP@example.com',
+    password_hash: 'ATTACKER', is_active: 1, must_change_password: 0, role_id: 4, created_by: 5,
+    two_factor_enabled: 0, two_factor_secret: 'ATTACKER_SECRET', two_factor_recovery_codes: null,
+  });
+  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
+
+  const rows = await db('admin_users');
+  expect(rows).toHaveLength(1);
+  const row = rows[0];
+  expect(row.id).toBe(7);                            // id preserved → FK refs hold
+  expect(row.username).toBe('admin');
+  expect(row.password_hash).toBe('OP_HASH');
+  expect(Boolean(row.two_factor_enabled)).toBe(true);
+  expect(row.two_factor_secret).toBe('OP_SECRET');   // attacker MFA secret gone
+  expect(row.two_factor_recovery_codes).toBe('["a","b"]');
+  // Relationship/audit FKs are NOT forced from the operator snapshot (avoids
+  // dangling role_id/created_by on a cross-instance restore) — the restored
+  // row keeps its own already-valid values.
+  expect(row.role_id).toBe(4);
+  expect(row.created_by).toBe(5);
+});
+
+test('renames (not deletes) a different row holding the operator username', async () => {
+  await db('admin_users').insert({
+    id: 3, username: 'admin', email: 'other@instance.test',
+    password_hash: 'OTHER', is_active: 1, role_id: 4,
+  });
+  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
+
+  const rows = await db('admin_users').orderBy('id');
+  expect(rows).toHaveLength(2);                       // the other admin survives (FK-safe)
+  const other = rows.find((r) => r.id === 3);
+  expect(other.username).toBe('admin__restored_3');  // renamed, id kept
+  expect(other.email).toBe('other@instance.test');
+  const op = rows.find((r) => r.username === 'admin');
+  expect(op.password_hash).toBe('OP_HASH');
+});
+
+test('reconciles email and username colliding with DIFFERENT rows without deleting either', async () => {
+  await db('admin_users').insert([
+    { id: 4, username: 'someoneelse', email: 'op@example.com', password_hash: 'A', role_id: 4 },
+    { id: 5, username: 'admin', email: 'other@instance.test', password_hash: 'B', role_id: 4 },
+  ]);
+  await expect(db.transaction((trx) => reinjectCurrentAdmin(trx, operator))).resolves.not.toThrow();
+
+  const rows = await db('admin_users').orderBy('id');
+  expect(rows).toHaveLength(2);                       // both rows survive
+  const opRow = rows.find((r) => r.id === 4);         // email match updated in place
+  expect(opRow.username).toBe('admin');
+  expect(opRow.password_hash).toBe('OP_HASH');
+  const renamed = rows.find((r) => r.id === 5);       // username holder renamed, not deleted
+  expect(renamed.username).toBe('admin__restored_5');
+});
+
+test('inserts the operator with a non-colliding id when neither key exists in the backup', async () => {
+  await db('admin_users').insert({
+    id: 9, username: 'backupadmin', email: 'backup@instance.test', password_hash: 'B', role_id: 1,
+  });
+  await db.transaction((trx) => reinjectCurrentAdmin(trx, operator));
+
+  const rows = await db('admin_users').orderBy('id');
+  expect(rows).toHaveLength(2);                       // backup admin untouched
+  const opRow = rows.find((r) => r.username === 'admin');
+  expect(opRow.password_hash).toBe('OP_HASH');
+  expect(opRow.id).toBe(10);                          // max(9)+1, no collision
+  expect(opRow.created_by).toBeNull();                // self-ref FK nulled so the insert can't dangle
+});

backend/__tests__/utils/safePathZipEntries.test.js

@@ -0,0 +1,41 @@
+const path = require('path');
+const { assertZipEntriesWithin } = require('../../src/utils/safePath');
+
+describe('assertZipEntriesWithin (ZIP-slip guard, GHSA-jfhw-fj23-fx6x)', () => {
+  const root = path.join('/tmp', 'picpeak-extract-root');
+
+  it('accepts entries that stay within the extraction root', () => {
+    const entries = [
+      { name: 'photo.jpg' },
+      { name: 'category/nested/photo.png' },
+      { name: 'photos_manifest.json' },
+      { name: 'subdir/' },
+    ];
+    expect(() => assertZipEntriesWithin(entries, root)).not.toThrow();
+  });
+
+  it('rejects a parent-traversal entry', () => {
+    const entries = [{ name: '../../uploads/logos/evil.svg' }];
+    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
+  });
+
+  it('rejects an absolute-path entry', () => {
+    const entries = [{ name: '/etc/cron.d/evil' }];
+    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
+  });
+
+  it('rejects when a safe entry is mixed with a traversal entry', () => {
+    const entries = [{ name: 'ok.jpg' }, { name: '../escape.txt' }];
+    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
+  });
+
+  it('tolerates empty / nameless entries', () => {
+    expect(() => assertZipEntriesWithin([{}, { name: '' }, null], root)).not.toThrow();
+  });
+
+  it('does not treat a sibling prefix directory as inside the root', () => {
+    // root is .../picpeak-extract-root; ../picpeak-extract-root-evil must not pass
+    const entries = [{ name: '../picpeak-extract-root-evil/x' }];
+    expect(() => assertZipEntriesWithin(entries, root)).toThrow(/escapes the extraction directory/);
+  });
+});

backend/migrations/core/158_slideshow_order_category.js

@@ -1,37 +0,0 @@
-/**
- * Migration 158: per-event slideshow ordering + category filter (#202).
- *
- * - `show_order`      — 'chronological' (default, upload order) | 'random'
- *                       (client-side shuffle). Lets the Live Slideshow play
- *                       photos in a varied order during an event.
- * - `show_category_id`— optional FK into `photo_categories`. When set, the
- *                       slideshow only shows photos in that category (NULL =
- *                       all visible photos, the existing behaviour).
- *
- * Both additive + guarded. Defaults preserve today's behaviour (chronological,
- * all photos), so existing slideshows are unchanged.
- */
-exports.up = async function up(knex) {
-  const hasOrder = await knex.schema.hasColumn('events', 'show_order');
-  if (!hasOrder) {
-    await knex.schema.alterTable('events', (t) => {
-      t.string('show_order', 20).defaultTo('chronological');
-    });
-  }
-  const hasCat = await knex.schema.hasColumn('events', 'show_category_id');
-  if (!hasCat) {
-    await knex.schema.alterTable('events', (t) => {
-      t.integer('show_category_id').nullable();
-    });
-  }
-};
-
-exports.down = async function down(knex) {
-  for (const col of ['show_order', 'show_category_id']) {
-    // eslint-disable-next-line no-await-in-loop
-    if (await knex.schema.hasColumn('events', col)) {
-      // eslint-disable-next-line no-await-in-loop
-      await knex.schema.alterTable('events', (t) => t.dropColumn(col));
-    }
-  }
-};

backend/migrations/core/159_add_category_display_order.js

@@ -1,57 +0,0 @@
-/**
- * Migration 159: per-event category ordering (#782).
- *
- * Adds a `display_order` integer to `photo_categories` so photographers can
- * arrange an event's categories in the flow of the day (Pre-Ceremony →
- * Ceremony → Reception …) instead of the hard-coded A–Z order. Mirrors the
- * `display_order` column + reorder pattern already used by `event_types`.
- *
- * Preserve existing galleries: backfill `display_order` from the CURRENT
- * (alphabetical) order, scoped — globals numbered together, event-specific
- * numbered per event — so nothing reshuffles on upgrade. A custom order is
- * opt-in via the admin reorder controls. See feedback: migrations should pin
- * previously-implicit defaults onto existing rows.
- *
- * Backfill runs in JS (not a SQL window function) to stay portable across
- * SQLite (dev) and Postgres (prod).
- *
- * Additive + hasColumn-guarded.
- */
-async function addColumn(knex, table, column, builder) {
-  if (!(await knex.schema.hasColumn(table, column))) {
-    await knex.schema.alterTable(table, builder);
-  }
-}
-
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasTable('photo_categories'))) return;
-
-  await addColumn(knex, 'photo_categories', 'display_order', (t) => {
-    t.integer('display_order').notNullable().defaultTo(0);
-    t.index('display_order');
-  });
-
-  // Backfill from the current alphabetical order, per scope, so existing
-  // galleries render exactly as before until an admin reorders.
-  const cats = await knex('photo_categories')
-    .select('id', 'name', 'is_global', 'event_id')
-    .orderBy('name', 'asc');
-
-  const counters = {};
-  for (const c of cats) {
-    const scope = c.is_global ? 'global' : `event:${c.event_id}`;
-    counters[scope] = (counters[scope] || 0) + 1;
-    await knex('photo_categories')
-      .where('id', c.id)
-      .update({ display_order: counters[scope] });
-  }
-};
-
-exports.down = async function (knex) {
-  if (!(await knex.schema.hasTable('photo_categories'))) return;
-  if (await knex.schema.hasColumn('photo_categories', 'display_order')) {
-    await knex.schema.alterTable('photo_categories', (t) =>
-      t.dropColumn('display_order')
-    );
-  }
-};

backend/migrations/core/160_add_event_category_order.js

@@ -1,46 +0,0 @@
-/**
- * Migration 160: per-event category order override (#782).
- *
- * Builds on migration 159 (photo_categories.display_order = the GLOBAL default
- * order) by adding a per-event OVERRIDE layer. Global categories are shared
- * across every event, so a single display_order can only express one order for
- * them. This table lets a single gallery arrange its categories — globals AND
- * event-specific, interleaved into the flow of the day — independently of the
- * global default.
- *
- * Resolution (see adminCategories / gallery):
- *   1. if the event has override rows -> use override.position;
- *   2. else fall back to photo_categories.display_order (the global default);
- *   3. else name.
- *
- * An event is either "using the default" (no rows here) or "customised" (a row
- * per category it shows). No backfill: every existing event starts on the
- * default order, so nothing reshuffles — a custom order is opt-in per event.
- *
- * Additive + hasTable-guarded.
- */
-exports.up = async function (knex) {
-  if (!(await knex.schema.hasTable('photo_categories'))) return;
-  if (await knex.schema.hasTable('event_category_order')) return;
-
-  await knex.schema.createTable('event_category_order', (t) => {
-    t.increments('id').primary();
-    t.integer('event_id').notNullable()
-      .references('id').inTable('events').onDelete('CASCADE');
-    t.integer('category_id').notNullable()
-      .references('id').inTable('photo_categories').onDelete('CASCADE');
-    t.integer('position').notNullable().defaultTo(0);
-    t.timestamp('created_at').defaultTo(knex.fn.now());
-
-    // At most one position per (event, category).
-    t.unique(['event_id', 'category_id']);
-    // Ordered reads are always scoped to one event.
-    t.index(['event_id', 'position']);
-  });
-};
-
-exports.down = async function (knex) {
-  if (await knex.schema.hasTable('event_category_order')) {
-    await knex.schema.dropTable('event_category_order');
-  }
-};

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "3.86.0-beta.0",
+  "version": "3.45.2",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "scripts": {

backend/server.js

@@ -38,7 +38,6 @@ const {
 
 // Import routes
 const authRoutes = require('./src/routes/auth');
-const eventRoutes = require('./src/routes/events');
 const galleryRoutes = require('./src/routes/gallery');
 const adminRoutes = require('./src/routes/admin');
 const adminAuthRoutes = require('./src/routes/adminAuth');
@@ -695,8 +694,7 @@ app.get('/health', async (req, res) => {
 // Routes
 app.use('/api/setup', setupRoutes); // public first-run bootstrap (self-closes after setup)
 app.use('/api/auth', authRoutes);
-  app.use('/api/events', eventRoutes);
-  app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
+app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
 // Gallery routes - main routes first, then feedback routes
 app.use('/api/gallery', galleryRoutes);
 app.use('/api/gallery', require('./src/routes/galleryFeedback'));

backend/src/routes/adminArchives.js

@@ -9,6 +9,7 @@ const { requirePermission } = require('../middleware/permissions');
 const archiver = require('archiver');
 const StreamZip = require('node-stream-zip');
 const { requireEventOwnership } = require('../middleware/ownership');
+const { assertZipEntriesWithin } = require('../utils/safePath');
 const logger = require('../utils/logger');
 const { getPagination } = require('../utils/routeHelpers');
 const router = express.Router();
@@ -183,6 +184,16 @@ router.post('/:id/restore', adminAuth, requirePermission('archives.restore'), re
       const entries = Object.values(await zip.entries());
       logger.info(`Archive contains ${entries.length} entries`);
 
+      // Reject ZIP-slip entries before writing anything to disk — extract()
+      // does not neutralise `../` in entry names (GHSA-jfhw-fj23-fx6x).
+      try {
+        assertZipEntriesWithin(entries, eventDir);
+      } catch (slipErr) {
+        await zip.close();
+        logger.warn(`Refusing archive restore — unsafe entry path: ${slipErr.message}`);
+        return res.status(400).json({ error: 'Archive contains invalid entry paths' });
+      }
+
       // Stream-extract everything to disk
       await zip.extract(null, eventDir);
       await zip.close();

backend/src/routes/adminBackup.js

@@ -2,6 +2,8 @@ const express = require('express');
 const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
+const { clearAdminAuthCookie } = require('../utils/tokenUtils');
+const { revokeToken } = require('../utils/tokenRevocation');
 const { triggerManualBackup, getBackupStatus, cleanupOldBackupRuns, getBackupManifest, validateBackupManifest } = require('../services/backupService');
 const logger = require('../utils/logger');
 const { errorResponse, getPagination } = require('../utils/routeHelpers');
@@ -178,12 +180,43 @@ router.post('/picpeak/import', adminAuth, requirePermission('backup.restore'), p
   const picpeakPath = req.file.path;
   try {
     const { importFromPicpeak } = require('../services/picpeakImportService');
-    const result = await importFromPicpeak({ picpeakPath, currentAdminId: req.user && req.user.id });
+    // adminAuth populates req.admin, not req.user. Passing req.user.id here
+    // left currentAdminId undefined, so reinjectCurrentAdmin() had no account
+    // to preserve and the admin_users table was fully replaced by the backup —
+    // letting a crafted .picpeak take over every admin account (GHSA-qxfx-4493-4v8f).
+    const result = await importFromPicpeak({ picpeakPath, currentAdminId: req.admin && req.admin.id });
+
+    // The restore rewrote admin_users, so ids may have shifted. The operator's
+    // current JWT is bound only to the pre-restore admin id (adminAuth trusts
+    // `decoded.id` — IP is logged, not enforced, and the backup controls
+    // password_changed_at), which could now resolve to a DIFFERENT restored
+    // account and silently grant its permissions. Force a fresh login instead
+    // of trusting the old session: revoke the token and clear the cookie.
+    // Clearing the cookie is the guarantee — it drops the operator's browser
+    // session unconditionally. Revocation is the extra layer that also kills a
+    // Bearer-header copy of the JWT; revokeToken() swallows DB errors and
+    // returns false, so check the result and log loudly if the denylist write
+    // didn't land (the operator should still re-login, which the cookie clear
+    // forces).
+    let tokenRevoked = false;
+    try {
+      if (req.token) {
+        tokenRevoked = await revokeToken(req.token, 'picpeak-import', { adminId: req.admin && req.admin.id });
+      }
+    } catch (revokeErr) {
+      logger.warn('[picpeak-import] failed to revoke session token after restore', { error: revokeErr.message });
+    }
+    if (req.token && !tokenRevoked) {
+      logger.warn('[picpeak-import] session token was NOT added to the revocation denylist after restore; relying on cookie clear to force re-login');
+    }
+    clearAdminAuthCookie(res);
+
     res.json({
       success: true,
       tables: result.tables,
       filesRestored: result.filesRestored,
       usesExternalMedia: result.usesExternalMedia,
+      sessionInvalidated: true,
     });
   } catch (error) {
     const status = error.statusCode || 500;

backend/src/routes/adminCategories.js

@@ -4,8 +4,6 @@ const { db, logActivity } = require('../database/db');
 const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth');
 const { requirePermission } = require('../middleware/permissions');
-const { requireEventOwnership } = require('../middleware/ownership');
-const { getEventCategoriesOrdered } = require('../utils/categoryOrder');
 const logger = require('../utils/logger');
 const router = express.Router();
 
@@ -14,9 +12,8 @@ router.get('/global', adminAuth, requirePermission('settings.view'), async (req,
   try {
     const categories = await db('photo_categories')
       .where('is_global', formatBoolean(true))
-      .orderBy('display_order', 'asc')
       .orderBy('name', 'asc');
-
+    
     res.json(categories);
   } catch (error) {
     logger.error('Error fetching categories:', error);
@@ -24,12 +21,19 @@ router.get('/global', adminAuth, requirePermission('settings.view'), async (req,
   }
 });
 
-// Get categories for a specific event (global + event-specific), resolved to
-// the event's effective order: per-event override, else global default, else
-// name (#782). Each row carries `override_position` (null when not customised).
-router.get('/event/:eventId', adminAuth, requirePermission('settings.view'), requireEventOwnership, async (req, res) => {
+// Get categories for a specific event (global + event-specific)
+router.get('/event/:eventId', adminAuth, requirePermission('settings.view'), async (req, res) => {
   try {
-    const categories = await getEventCategoriesOrdered(req.params.eventId);
+    const { eventId } = req.params;
+    
+    const categories = await db('photo_categories')
+      .where(function() {
+        this.where('is_global', formatBoolean(true))
+          .orWhere('event_id', eventId);
+      })
+      .orderBy('is_global', 'desc')
+      .orderBy('name', 'asc');
+    
     res.json(categories);
   } catch (error) {
     logger.error('Error fetching event categories:', error);
@@ -77,27 +81,12 @@ router.post('/', adminAuth, requirePermission('settings.edit'), [
       return res.status(400).json({ error: 'Category with this slug already exists' });
     }
     
-    // Append to the end of its scope so a new category doesn't jump to the
-    // top of an admin-defined order (#782).
-    const maxRow = await db('photo_categories')
-      .where(function() {
-        if (is_global) {
-          this.where('is_global', formatBoolean(true));
-        } else {
-          this.where('event_id', event_id);
-        }
-      })
-      .max('display_order as maxOrder')
-      .first();
-    const nextOrder = (maxRow?.maxOrder || 0) + 1;
-
     // Create category
     const insertResult = await db('photo_categories').insert({
       name,
       slug: categorySlug,
       is_global,
-      event_id: is_global ? null : event_id,
-      display_order: nextOrder
+      event_id: is_global ? null : event_id
     }).returning('id');
     
     const categoryId = insertResult[0]?.id || insertResult[0];
@@ -265,133 +254,4 @@ router.delete('/:id', adminAuth, requirePermission('settings.edit'), async (req,
   }
 });
 
-// Set a per-event category order override (#782). The client sends the full
-// ordered id list for THIS event — globals + event-specific, interleaved — and
-// we replace the event's override rows in one transaction. This overrides the
-// global default order for this gallery only.
-router.post('/reorder', adminAuth, requirePermission('settings.edit'), [
-  body('event_id').isInt().withMessage('event_id must be an integer'),
-  body('orderedIds').isArray({ min: 1 }).withMessage('orderedIds must be a non-empty array'),
-  body('orderedIds.*').isInt().withMessage('Each id must be an integer')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const eventId = parseInt(req.body.event_id, 10);
-    const orderedIds = req.body.orderedIds.map((id) => parseInt(id, 10));
-
-    // Event ownership (event_id comes from the body, so requireEventOwnership —
-    // which reads req.params — can't be used here). Mirror it: super_admins
-    // bypass; other admins may only reorder events they own (ownerless
-    // legacy/system events allowed).
-    if (req.admin.roleName !== 'super_admin') {
-      const event = await db('events').where('id', eventId).first();
-      if (!event) {
-        return res.status(404).json({ error: 'Event not found' });
-      }
-      if (event.created_by && event.created_by !== req.admin.id) {
-        return res.status(403).json({ error: 'Access denied' });
-      }
-    }
-
-    // Every id must be a category available to this event: a shared global OR
-    // one of the event's own categories. Anything else is out of scope.
-    const available = await db('photo_categories')
-      .where(function() {
-        this.where('is_global', formatBoolean(true)).orWhere('event_id', eventId);
-      })
-      .pluck('id');
-    const availableSet = new Set(available);
-    const invalid = orderedIds.filter((id) => !availableSet.has(id));
-    if (invalid.length > 0) {
-      return res.status(400).json({ error: 'One or more categories are not available for this event' });
-    }
-
-    await db.transaction(async (trx) => {
-      await trx('event_category_order').where('event_id', eventId).del();
-      await trx('event_category_order').insert(
-        orderedIds.map((id, i) => ({ event_id: eventId, category_id: id, position: i + 1 }))
-      );
-    });
-
-    // Log activity after commit (avoids a SQLite in-transaction global write).
-    await logActivity('event_category_order_set',
-      { eventId, count: orderedIds.length },
-      eventId,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json(await getEventCategoriesOrdered(eventId));
-  } catch (error) {
-    logger.error('Error reordering categories:', error);
-    res.status(500).json({ error: 'Failed to reorder categories' });
-  }
-});
-
-// Clear an event's override — revert this gallery to the global default order.
-router.delete('/reorder/:eventId', adminAuth, requirePermission('settings.edit'), requireEventOwnership, async (req, res) => {
-  try {
-    const eventId = parseInt(req.params.eventId, 10);
-    await db('event_category_order').where('event_id', eventId).del();
-
-    await logActivity('event_category_order_reset',
-      { eventId },
-      eventId,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    res.json(await getEventCategoriesOrdered(eventId));
-  } catch (error) {
-    logger.error('Error resetting category order:', error);
-    res.status(500).json({ error: 'Failed to reset category order' });
-  }
-});
-
-// Set the GLOBAL default order for shared (global) categories (#782). Applies
-// to every gallery that hasn't set its own override. Rewrites display_order.
-router.post('/reorder-global', adminAuth, requirePermission('settings.edit'), [
-  body('orderedIds').isArray({ min: 1 }).withMessage('orderedIds must be a non-empty array'),
-  body('orderedIds.*').isInt().withMessage('Each id must be an integer')
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const orderedIds = req.body.orderedIds.map((id) => parseInt(id, 10));
-
-    const globals = await db('photo_categories').where('is_global', formatBoolean(true)).pluck('id');
-    const globalsSet = new Set(globals);
-    const invalid = orderedIds.filter((id) => !globalsSet.has(id));
-    if (invalid.length > 0) {
-      return res.status(400).json({ error: 'One or more categories are not global' });
-    }
-
-    await db.transaction(async (trx) => {
-      for (let i = 0; i < orderedIds.length; i += 1) {
-        await trx('photo_categories').where('id', orderedIds[i]).update({ display_order: i + 1 });
-      }
-    });
-
-    await logActivity('global_category_order_set',
-      { count: orderedIds.length },
-      null,
-      { type: 'admin', id: req.admin.id, name: req.admin.username }
-    );
-
-    const categories = await db('photo_categories')
-      .where('is_global', formatBoolean(true))
-      .orderBy('display_order', 'asc')
-      .orderBy('name', 'asc');
-    res.json(categories);
-  } catch (error) {
-    logger.error('Error reordering global categories:', error);
-    res.status(500).json({ error: 'Failed to reorder global categories' });
-  }
-});
-
 module.exports = router;

backend/src/routes/adminEvents/crud.js

@@ -1596,4 +1596,51 @@ module.exports = (router) => {
     }
   });
 
+  // Extend a gallery's expiration. Migrated from the legacy /api/events router
+  // (removed — GHSA-4j34-x562-5vfq), now on the canonical mount with the same
+  // permission + ownership guards as every other gallery mutation, so a
+  // non-owning editor/viewer can no longer touch a gallery they don't own.
+  router.post('/:id/extend', adminAuth, requirePermission('events.edit'), requireEventOwnership, [
+    body('days').isInt({ min: 1, max: 365 })
+  ], async (req, res) => {
+    try {
+      const errors = validationResult(req);
+      if (!errors.isEmpty()) {
+        return res.status(400).json({ errors: errors.array() });
+      }
+
+      const { id } = req.params;
+      const { days } = req.body;
+
+      let eventQuery = db('events').where('id', id);
+      // Editor role can only touch their own events (defence in depth alongside
+      // requireEventOwnership).
+      if (req.admin.roleName === 'editor') {
+        eventQuery = eventQuery.where('created_by', req.admin.id);
+      }
+      const event = await eventQuery.first();
+      if (!event) {
+        return res.status(404).json({ error: 'Event not found' });
+      }
+
+      const newExpiration = new Date(event.expires_at);
+      newExpiration.setDate(newExpiration.getDate() + days);
+
+      await db('events').where('id', id).update({
+        expires_at: newExpiration,
+        is_active: formatBoolean(true) // reactivate if it had expired
+      });
+
+      await logActivity('event_expiration_extended',
+        { eventName: event.event_name, days },
+        id,
+        { type: 'admin', id: req.admin.id, name: req.admin.username }
+      );
+
+      res.json({ expires_at: newExpiration });
+    } catch (error) {
+      errorResponse(res, error, 500, 'Failed to extend expiration');
+    }
+  });
+
 };

backend/src/routes/adminEvents/helpers.js

@@ -307,9 +307,6 @@ async function deleteEventCascade(eventId, adminContext) {
 const SLIDESHOW_TRANSITIONS = ['crossfade', 'cut', 'slide', 'kenburns', 'dipwhite', 'dipblack'];
 // Allowed per-slide color filters.
 const SLIDESHOW_COLORFILTERS = ['none', 'bw', 'sepia', 'warm', 'cool', 'vignette'];
-// Allowed slideshow play orders (#202). 'chronological' = upload order,
-// 'random' = client-side shuffle.
-const SLIDESHOW_ORDERS = ['chronological', 'random'];
 module.exports = {
   validateHeroImageAnchor,
   getStoragePath,
@@ -324,7 +321,6 @@ module.exports = {
   mapEventForApi,
   hasCustomerContactColumns,
   deleteEventCascade,
-  SLIDESHOW_ORDERS,
   SLIDESHOW_TRANSITIONS,
   SLIDESHOW_COLORFILTERS,
 };

backend/src/routes/adminEvents/slideshow.js

@@ -13,7 +13,7 @@ const { parseBooleanInput } = require('../../utils/parsers');
 const { requireEventOwnership } = require('../../middleware/ownership');
 const { requireFeatureFlag } = require('../../middleware/requireFeatureFlag');
 const { getFrontendBaseUrl } = require('../../utils/frontendUrl');
-const { SLIDESHOW_TRANSITIONS, SLIDESHOW_COLORFILTERS, SLIDESHOW_ORDERS } = require('./helpers');
+const { SLIDESHOW_TRANSITIONS, SLIDESHOW_COLORFILTERS } = require('./helpers');
 
 // The watermark LOOK (source/position/opacity/style/size) is global-only
 // (app_settings, Settings → Slideshow); events only carry the show_watermark
@@ -105,9 +105,7 @@ module.exports = (router) => {
     body('show_transition').optional().isIn(SLIDESHOW_TRANSITIONS),
     body('show_transition_ms').optional().isInt({ min: 100, max: 5000 }),
     body('show_watermark').optional({ nullable: true }),
-    body('show_colorfilter').optional().isIn(SLIDESHOW_COLORFILTERS),
-    body('show_order').optional().isIn(SLIDESHOW_ORDERS),
-    body('show_category_id').optional({ nullable: true }).isInt({ min: 1 })
+    body('show_colorfilter').optional().isIn(SLIDESHOW_COLORFILTERS)
   ], async (req, res) => {
     try {
       const errors = validationResult(req);
@@ -132,23 +130,6 @@ module.exports = (router) => {
           : formatBoolean(parseBooleanInput(req.body.show_watermark, false));
       }
       if (req.body.show_colorfilter !== undefined) updates.show_colorfilter = req.body.show_colorfilter;
-      if (req.body.show_order !== undefined) updates.show_order = req.body.show_order;
-      // Category filter (#202). null clears it (all photos). A non-null id must
-      // belong to this event or be a global category — otherwise ignore it so a
-      // stale/foreign id can't leak another event's category selection.
-      if (req.body.show_category_id !== undefined) {
-        if (req.body.show_category_id === null) {
-          updates.show_category_id = null;
-        } else {
-          const catId = parseInt(req.body.show_category_id, 10);
-          const cat = await db('photo_categories')
-            .where({ id: catId })
-            .where(function () { this.where('event_id', event.id).orWhere('is_global', formatBoolean(true)); })
-            .first();
-          if (!cat) return res.status(400).json({ error: 'Category does not belong to this event' });
-          updates.show_category_id = catId;
-        }
-      }
 
       // Knex throws on an empty update; only write if something changed.
       if (Object.keys(updates).length > 0) {
@@ -160,9 +141,7 @@ module.exports = (router) => {
         show_transition: updates.show_transition ?? event.show_transition ?? 'crossfade',
         show_transition_ms: updates.show_transition_ms ?? event.show_transition_ms ?? 800,
         show_watermark: updates.show_watermark ?? event.show_watermark ?? null,
-        show_colorfilter: updates.show_colorfilter ?? event.show_colorfilter ?? 'none',
-        show_order: updates.show_order ?? event.show_order ?? 'chronological',
-        show_category_id: 'show_category_id' in updates ? updates.show_category_id : (event.show_category_id ?? null)
+        show_colorfilter: updates.show_colorfilter ?? event.show_colorfilter ?? 'none'
       });
     } catch (error) {
       errorResponse(res, error, 500, 'Failed to update slideshow settings');

backend/src/routes/auth.js

@@ -543,6 +543,18 @@ router.post('/gallery/share-login', [
       return res.status(401).json({ error: 'Invalid or expired share link' });
     }
 
+    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
+
+    // The share link only proves the holder was given the link — it is NOT the
+    // gallery password. For a password-protected gallery, minting a full
+    // `type:'gallery'` token here would let anyone with the share URL bypass
+    // the password entirely (GHSA-9hmx-68vc-qpqw). Signal that a password is
+    // still required and return WITHOUT a token/cookie; the client then goes
+    // through POST /gallery/verify, which does check the password.
+    if (requiresPassword) {
+      return res.json({ requires_password: true });
+    }
+
     const jwtToken = jwt.sign({
       eventId: event.id,
       eventSlug: event.slug,
@@ -557,8 +569,6 @@ router.post('/gallery/share-login', [
     await trackSuccessfulLogin(`gallery:${event.slug}:share`, ipAddress, userAgent);
     setGalleryAuthCookies(res, jwtToken, event.slug);
 
-    const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
-
     res.json({
       token: jwtToken,
       event: {

backend/src/routes/events.js

@@ -1,443 +0,0 @@
-const express = require('express');
-const { body, validationResult } = require('express-validator');
-const bcrypt = require('bcrypt');
-const crypto = require('crypto');
-const { db } = require('../database/db');
-const { formatBoolean } = require('../utils/dbCompat');
-const { slugify } = require('../utils/slug');
-const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
-const { adminAuth } = require('../middleware/auth');
-const fs = require('fs').promises;
-const path = require('path');
-const router = express.Router();
-const { buildShareLinkVariants } = require('../services/shareLinkService');
-const { parseBooleanInput, parseStringInput } = require('../utils/parsers');
-const eventTypeService = require('../services/eventTypeService');
-const { IDENTITY_PRESERVING_NORMALIZE_EMAIL } = require('../utils/emailNormalization');
-const logger = require('../utils/logger');
-
-// Use parseStringInput from shared parsers for customer data extraction
-const getCustomerNameFromPayload = (payload = {}) => parseStringInput(payload.customer_name);
-const getCustomerEmailFromPayload = (payload = {}) => parseStringInput(payload.customer_email);
-const getCustomerPhoneFromPayload = (payload = {}) => parseStringInput(payload.customer_phone);
-
-// Whether the global "phone field" toggle (#322) is enabled. Same shape as
-// the helper in adminEvents.js — kept local so this route doesn't import
-// from a sibling route file.
-const isPhoneFieldEnabled = async () => {
-  try {
-    const row = await db('app_settings').where('setting_key', 'event_phone_field_enabled').first();
-    if (!row) return false;
-    let value = row.setting_value;
-    if (typeof value === 'string') {
-      try { value = JSON.parse(value); } catch { /* keep raw */ }
-    }
-    return value === true;
-  } catch {
-    return false;
-  }
-};
-
-const mapEventForApi = (event) => {
-  if (!event || typeof event !== 'object') {
-    return event;
-  }
-
-  const {
-    host_name,
-    host_email,
-    customer_name,
-    customer_email,
-    ...rest
-  } = event;
-
-  return {
-    ...rest,
-    customer_name: customer_name ?? host_name ?? null,
-    customer_email: customer_email ?? host_email ?? null
-  };
-};
-
-let customerColumnCache = null;
-const hasCustomerContactColumns = async () => {
-  if (customerColumnCache === true) {
-    return true;
-  }
-
-  try {
-    const hasColumn = await db.schema.hasColumn('events', 'customer_email');
-    if (hasColumn) {
-      customerColumnCache = true;
-    }
-    return hasColumn;
-  } catch (error) {
-    return false;
-  }
-};
-
-// Create new event
-router.post('/', adminAuth, [
-  body('event_type').notEmpty().trim().custom(async (value) => {
-    const isValid = await eventTypeService.isValidEventType(value);
-    if (!isValid) {
-      throw new Error('Invalid event type');
-    }
-    return true;
-  }),
-  body('event_name').notEmpty(),
-  body('event_date').isDate(),
-  body('customer_name').notEmpty().trim(),
-  body('customer_email').isEmail().normalizeEmail(IDENTITY_PRESERVING_NORMALIZE_EMAIL),
-  body('customer_phone').optional({ nullable: true, checkFalsy: true })
-    .isString().trim()
-    .isLength({ max: 32 }).withMessage('Phone number must be at most 32 characters'),
-  body('admin_email').isEmail(),
-  body('require_password').optional().isBoolean(),
-  body('password').optional().isString().custom((value, { req }) => {
-    const requirePassword = parseBooleanInput(req.body.require_password, true);
-    if (!requirePassword) {
-      return true;
-    }
-    if (typeof value !== 'string' || value.trim().length < 6) {
-      throw new Error('Password must be at least 6 characters long');
-    }
-    return true;
-  }),
-  body('expiration_days').isInt({ min: 1, max: 365 }).optional()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-    
-    const {
-      event_type,
-      event_name,
-      event_date,
-      admin_email,
-      password,
-      require_password: requirePasswordInput = true,
-      welcome_message,
-      color_theme,
-      expiration_days = 30
-    } = req.body;
-
-    const customerEmail = getCustomerEmailFromPayload(req.body);
-    const customerName = getCustomerNameFromPayload(req.body);
-
-    if (!customerName || !customerEmail) {
-      return res.status(400).json({ error: 'customer_name and customer_email are required' });
-    }
-
-    const customerColumnsAvailable = await hasCustomerContactColumns();
-    const phoneEnabled = await isPhoneFieldEnabled();
-    const customerPhone = phoneEnabled ? getCustomerPhoneFromPayload(req.body) : null;
-
-    const requirePassword = parseBooleanInput(requirePasswordInput, true);
-
-    if (requirePassword) {
-      const passwordValidation = await validatePasswordInContext(password, 'gallery', {
-        eventName: event_name
-      });
-
-      if (!passwordValidation.valid) {
-        return res.status(400).json({ 
-          error: 'Password does not meet security requirements',
-          details: passwordValidation.errors,
-          score: passwordValidation.score,
-          feedback: passwordValidation.feedback
-        });
-      }
-    }
-    
-    // Generate unique slug — slugify() handles accents (see #525).
-    const baseSlug = `${event_type}-${slugify(event_name)}-${event_date}`;
-    let slug = baseSlug;
-    let counter = 1;
-    
-    while (await db('events').where({ slug }).first()) {
-      slug = `${baseSlug}-${counter}`;
-      counter++;
-    }
-    
-    // Generate share link variants (auto-detects short URL preference)
-    const shareToken = crypto.randomBytes(16).toString('hex');
-    const { sharePath, shareUrl, shareLinkToStore } = await buildShareLinkVariants({ slug, shareToken });
-    
-    // Hash password (or placeholder when not required)
-    const password_hash = requirePassword
-      ? await bcrypt.hash(password, getBcryptRounds())
-      : await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
-    
-    // Calculate expiration date (days after event date)
-    const expires_at = new Date(event_date);
-    expires_at.setDate(expires_at.getDate() + parseInt(expiration_days, 10));
-    
-    // Create folder structure
-    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
-    const eventPath = path.join(storagePath, 'events/active', slug);
-    await fs.mkdir(path.join(eventPath, 'collages'), { recursive: true });
-    await fs.mkdir(path.join(eventPath, 'individual'), { recursive: true });
-    
-    // Insert into database
-    const insertResult = await db('events').insert({
-      slug,
-      event_type,
-      event_name,
-      event_date,
-      ...(customerColumnsAvailable ? { customer_name: customerName, customer_email: customerEmail } : {}),
-      ...(customerPhone ? { customer_phone: customerPhone } : {}),
-      host_name: customerName,
-      host_email: customerEmail,
-      admin_email,
-      password_hash,
-      welcome_message,
-      color_theme,
-      share_link: shareLinkToStore,
-      share_token: shareToken,
-      expires_at,
-      require_password: formatBoolean(requirePassword)
-    }).returning('id');
-    
-    // Handle both PostgreSQL (returns array of objects) and SQLite (returns array of IDs)
-    const eventId = insertResult[0]?.id || insertResult[0];
-    
-    // Queue creation email
-    const { queueEmail } = require('../services/emailProcessor');
-    await queueEmail(eventId, customerEmail, 'gallery_created', {
-      customer_name: customerName,
-      customer_email: customerEmail,
-      host_name: customerName,
-      event_name,
-      event_date: event_date,  // Pass raw date - will be formatted by email processor
-      gallery_link: shareUrl,
-      gallery_password: requirePassword ? password : 'No password required',
-      expiry_date: expires_at.toISOString(),  // Pass ISO string - will be formatted by email processor
-      welcome_message: welcome_message || ''
-    });
-
-    // WhatsApp gallery_ready notification (#647 follow-up). Mirrors the
-    // adminEvents.js path: fires when the customer supplied a phone, the
-    // feature is enabled, and a config exists. Non-fatal — a queue failure
-    // must never block gallery creation.
-    if (customerPhone) {
-      try {
-        const { queueWhatsapp, getWhatsAppConfig } = require('../services/whatsappProcessor');
-        const waConfig = await getWhatsAppConfig();
-        if (waConfig && waConfig.enabled) {
-          await queueWhatsapp(eventId, customerPhone, 'gallery_created', {
-            customer_name: customerName || '',
-            event_name,
-            gallery_link: shareUrl,
-            gallery_password: requirePassword ? password : '',
-            expiry_date: expires_at ? expires_at.toISOString() : null,
-            language: null,
-          });
-        }
-      } catch (waError) {
-        logger.warn('Failed to queue WhatsApp notification on create', waError.message);
-      }
-    }
-
-    // Webhook lifecycle (#327). Legacy public endpoint — events go live
-    // immediately so created + published fire together. Payload uses the
-    // canonical event subject (#341) — every event.* webhook now includes
-    // customer contact + share_token.
-    try {
-      const webhookService = require('../services/webhookService');
-      const eventSubject = webhookService.buildEventSubject({
-        id: eventId,
-        slug,
-        event_name,
-        event_type,
-        event_date,
-        share_url: shareUrl,
-        share_token: shareToken,
-        customer_name: customerName,
-        customer_email: customerEmail,
-        customer_phone: customerPhone,
-      });
-      await webhookService.fire('event.created', { event: eventSubject });
-      await webhookService.fire('event.published', { event: eventSubject });
-    } catch (e) { /* non-fatal */ }
-
-    res.json({
-      id: eventId,
-      slug,
-      share_link: shareUrl,
-      expires_at,
-      require_password: requirePassword,
-      customer_name: customerName,
-      customer_email: customerEmail
-    });
-  } catch (error) {
-    logger.error(error);
-    res.status(500).json({ error: 'Failed to create event' });
-  }
-});
-
-// Get all events (admin)
-router.get('/', adminAuth, async (req, res) => {
-  try {
-    const { status = 'all' } = req.query;
-    
-    let query = db('events').select('*');
-    
-    if (status === 'active') {
-      query = query.where('is_active', formatBoolean(true));
-    } else if (status === 'archived') {
-      query = query.where('is_archived', formatBoolean(true));
-    }
-    
-    const events = await query.orderBy('created_at', 'desc');
-    
-    // Add photo counts
-    for (const event of events) {
-      const photoCount = await db('photos').where('event_id', event.id).count('id as count').first();
-      event.photo_count = photoCount.count;
-    }
-    
-    res.json(events.map(mapEventForApi));
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to fetch events' });
-  }
-});
-
-// Update event
-router.put('/:id', adminAuth, [
-  body('customer_name').optional().trim().notEmpty(),
-  body('customer_email').optional().isEmail().normalizeEmail(IDENTITY_PRESERVING_NORMALIZE_EMAIL),
-  body('require_password').optional().isBoolean()
-], async (req, res) => {
-  try {
-    const errors = validationResult(req);
-    if (!errors.isEmpty()) {
-      return res.status(400).json({ errors: errors.array() });
-    }
-
-    const { id } = req.params;
-    const updates = { ...req.body };
-    const customerColumnsAvailable = await hasCustomerContactColumns();
-    
-    // Don't allow updating certain fields
-    delete updates.id;
-    delete updates.slug;
-    delete updates.created_at;
-    delete updates.password_confirmation;
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'host_name') || Object.prototype.hasOwnProperty.call(updates, 'host_email')) {
-      return res.status(400).json({ error: 'host_name and host_email are no longer supported. Use customer_name and customer_email instead.' });
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_name')) {
-      const nextName = getCustomerNameFromPayload(updates);
-      if (nextName) {
-        if (customerColumnsAvailable) {
-          updates.customer_name = nextName;
-        } else {
-          delete updates.customer_name;
-        }
-        updates.host_name = nextName;
-      } else {
-        delete updates.customer_name;
-      }
-    }
-
-    if (Object.prototype.hasOwnProperty.call(updates, 'customer_email')) {
-      const nextEmail = getCustomerEmailFromPayload(updates);
-      if (nextEmail) {
-        if (customerColumnsAvailable) {
-          updates.customer_email = nextEmail;
-        } else {
-          delete updates.customer_email;
-        }
-        updates.host_email = nextEmail;
-      } else {
-        delete updates.customer_email;
-      }
-    }
-
-    const hasRequirePasswordUpdate = Object.prototype.hasOwnProperty.call(updates, 'require_password');
-    let requirePasswordUpdate;
-    if (hasRequirePasswordUpdate) {
-      requirePasswordUpdate = parseBooleanInput(updates.require_password, true);
-      updates.require_password = formatBoolean(requirePasswordUpdate);
-    }
-
-    let newPasswordPlain;
-    if (Object.prototype.hasOwnProperty.call(updates, 'password')) {
-      if (updates.password === undefined || updates.password === null || updates.password === '') {
-        delete updates.password;
-      } else {
-        newPasswordPlain = updates.password;
-        delete updates.password;
-      }
-    }
-
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-
-    const currentRequirePassword = parseBooleanInput(event.require_password, true);
-
-    if (hasRequirePasswordUpdate && requirePasswordUpdate === true && !currentRequirePassword && !newPasswordPlain) {
-      return res.status(400).json({ error: 'Password must be provided when enabling password requirement.' });
-    }
-
-    if (newPasswordPlain) {
-      updates.password_hash = await bcrypt.hash(newPasswordPlain, getBcryptRounds());
-    } else if (hasRequirePasswordUpdate && requirePasswordUpdate === false && currentRequirePassword) {
-      updates.password_hash = await bcrypt.hash(crypto.randomBytes(32).toString('hex'), getBcryptRounds());
-    }
-    
-    await db('events').where('id', id).update(updates);
-    
-    res.json({ success: true });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to update event' });
-  }
-});
-
-// Delete event (mark as inactive)
-router.delete('/:id', adminAuth, async (req, res) => {
-  try {
-    const { id } = req.params;
-    
-    await db('events').where('id', id).update({ is_active: formatBoolean(false) });
-    
-    res.json({ success: true });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to delete event' });
-  }
-});
-
-// Extend expiration
-router.post('/:id/extend', adminAuth, [
-  body('days').isInt({ min: 1, max: 365 })
-], async (req, res) => {
-  try {
-    const { id } = req.params;
-    const { days } = req.body;
-    
-    const event = await db('events').where('id', id).first();
-    if (!event) {
-      return res.status(404).json({ error: 'Event not found' });
-    }
-    
-    const newExpiration = new Date(event.expires_at);
-    newExpiration.setDate(newExpiration.getDate() + days);
-    
-    await db('events').where('id', id).update({ 
-      expires_at: newExpiration,
-      is_active: formatBoolean(true) // Reactivate if expired
-    });
-    
-    res.json({ expires_at: newExpiration });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to extend expiration' });
-  }
-});
-
-module.exports = router;

backend/src/routes/gallery.js

@@ -25,7 +25,6 @@ const { generateGuestIdentifier } = require('../middleware/feedbackRateLimit');
 const secureImageService = require('../services/secureImageService');
 const logger = require('../utils/logger');
 const { resolvePhotoFilePath } = require('../services/photoResolver');
-const { getEventCategoriesOrdered } = require('../utils/categoryOrder');
 const { getEventShareToken, resolveShareIdentifier, buildShareLinkVariants } = require('../services/shareLinkService');
 const { handleAsync, errorResponse } = require('../utils/routeHelpers');
 const { NotFoundError } = require('../utils/errors');
@@ -244,8 +243,8 @@ router.get('/:slug/info', async (req, res) => {
 
 // Photos a slideshow may display: published, finished, non-hidden. Mirrors the
 // guest filter in GET /:slug/photos so the live count matches the rendered set.
-function slideshowPhotosQuery(eventId, categoryId = null) {
-  const q = db('photos')
+function slideshowPhotosQuery(eventId) {
+  return db('photos')
     .where('photos.event_id', eventId)
     .where(function() {
       this.where('photos.processing_status', 'complete').orWhereNull('photos.processing_status');
@@ -253,10 +252,6 @@ function slideshowPhotosQuery(eventId, categoryId = null) {
     .where(function() {
       this.where('photos.visibility', 'visible').orWhereNull('photos.visibility');
     });
-  // Category filter (#202) — keep the /session + /state count in sync with the
-  // photos the kiosk actually renders.
-  if (categoryId) q.where('photos.category_id', categoryId);
-  return q;
 }
 
 // Resolve an active slideshow by slug + token. Returns the event row, or null
@@ -329,9 +324,6 @@ async function slideshowSettings(event) {
     transition: event.show_transition || 'crossfade',
     transition_ms: event.show_transition_ms || 800,
     colorfilter: event.show_colorfilter || 'none',
-    // Play order (#202): 'chronological' | 'random'. The client shuffles when
-    // 'random' so live-appended uploads keep working.
-    order: event.show_order || 'chronological',
     fit: g.fit,
     watermark,
   };
@@ -364,7 +356,7 @@ router.get('/:slug/show/:token/session', handleAsync(async (req, res) => {
   // here so the kiosk's image requests are authorized with zero extra wiring.
   setGalleryAuthCookies(res, sessionToken, event.slug);
 
-  const [{ count }] = await slideshowPhotosQuery(event.id, event.show_category_id).count('* as count');
+  const [{ count }] = await slideshowPhotosQuery(event.id).count('* as count');
 
   res.json({
     token: sessionToken,
@@ -390,7 +382,7 @@ router.get('/:slug/show/:token/state', handleAsync(async (req, res) => {
     throw new NotFoundError('Slideshow');
   }
 
-  const [{ count }] = await slideshowPhotosQuery(event.id, event.show_category_id).count('* as count');
+  const [{ count }] = await slideshowPhotosQuery(event.id).count('* as count');
 
   res.json({
     ...(await slideshowSettings(event)),
@@ -434,13 +426,6 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, async (req, res)
       });
     }
 
-    // Live Slideshow category filter (#202). Enforced server-side so the kiosk
-    // viewer can't widen the set: when the event pins show_category_id, the
-    // slideshow only sees that category. NULL = all photos (unchanged).
-    if (req.accessLevel === 'slideshow' && req.event.show_category_id) {
-      photosQuery = photosQuery.where('photos.category_id', req.event.show_category_id);
-    }
-
     // Apply sort option
     if (sort === 'capture_date') {
       // Sort by capture date, falling back to uploaded_at if capture date is null
@@ -588,12 +573,10 @@ router.get('/:slug/photos', verifyGalleryAccess, resolveGuest, async (req, res)
     // Fetch category details from photo_categories table
     let categories = [];
     if (usedCategoryIds.length > 0) {
-      // Resolved category order (#782): per-event override, else global
-      // default, else name — restricted to categories that have photos.
-      const categoryDetails = await getEventCategoriesOrdered(req.event.id, {
-        onlyIds: usedCategoryIds,
-        select: ['c.id', 'c.name', 'c.slug', 'c.is_global', 'c.hero_photo_id', 'c.allow_downloads'],
-      });
+      const categoryDetails = await db('photo_categories')
+        .whereIn('id', usedCategoryIds)
+        .select('id', 'name', 'slug', 'is_global', 'hero_photo_id', 'allow_downloads')
+        .orderBy('name', 'asc');
 
       categories = categoryDetails.map(cat => ({
         id: cat.id,

backend/src/services/chunkedUploadService.js

@@ -30,6 +30,16 @@ async function initializeUpload(options) {
     totalChunks
   } = options;
 
+  // Strip any directory components from the client-supplied filename. It is
+  // later joined onto the temp merge dir (path.join(tempDir, filename)), and
+  // path.join does NOT neutralise `../` — a filename like `../../uploads/
+  // logos/evil.svg` would escape the temp dir and overwrite arbitrary files
+  // (GHSA-pc72-jf53-w28j). basename() collapses it to the leaf name only.
+  const safeFilename = path.basename(String(filename || ''));
+  if (!safeFilename || safeFilename === '.' || safeFilename === '..') {
+    throw new Error('Invalid filename');
+  }
+
   // Generate unique upload ID
   const uploadId = crypto.randomUUID();
 
@@ -43,7 +53,7 @@ async function initializeUpload(options) {
   // Store upload metadata
   const uploadMeta = {
     uploadId,
-    filename,
+    filename: safeFilename,
     fileSize,
     mimeType,
     eventId,
@@ -59,7 +69,7 @@ async function initializeUpload(options) {
 
   logger.info('Initialized chunked upload', {
     uploadId,
-    filename,
+    filename: safeFilename,
     fileSize,
     expectedChunks,
     eventId

backend/src/services/picpeakImportService.js

@@ -18,6 +18,7 @@ const fsp = require('fs').promises;
 const path = require('path');
 const os = require('os');
 const StreamZip = require('node-stream-zip');
+const { assertZipEntriesWithin } = require('../utils/safePath');
 const { db } = require('../database/db');
 const knexConfig = require('../../knexfile');
 const { getStoragePath } = require('../config/storage');
@@ -80,25 +81,85 @@ function parseNdjson(filePath) {
 }
 
 // Re-insert the operator's account inside the restore transaction so they keep
-// working credentials. If the backup already loaded an admin with the same
-// email, overwrite that row's credentials with the current account's (current
-// creds win); otherwise insert the snapshot with a fresh id.
+// working credentials after the wipe.
+//
+// The operator's login + credentials + MFA must be restored, not just the
+// password. A crafted backup can carry a row with the operator's email whose
+// two_factor_* fields are attacker-chosen — leaving those in place would let
+// the backup strip or hijack the operator's MFA, or (cross-instance) pin a TOTP
+// secret encrypted with the source instance's key the operator can never
+// satisfy. These columns are scalar/text (recovery codes are a JSON string in a
+// TEXT column), so writing them needs no special json handling. Relationship/
+// audit FKs (role_id, created_by) are deliberately NOT forced from the snapshot
+// — see the update branch below.
+//
+// admin_users has UNIQUE constraints on BOTH email and username, and a restored
+// backup can collide with the operator on either — possibly on two DIFFERENT
+// rows (one shares the email, another shares the default `admin` username). We
+// reconcile WITHOUT deleting any restored row: deleting would fire ON DELETE
+// actions (SQLite) or dangle references such as events.created_by (Postgres,
+// where replica mode suppresses cascades). Instead:
+//   - if a row already has the operator's email, overwrite it in place (its id
+//     is preserved, so every FK pointing at the operator stays valid);
+//   - if a DIFFERENT row holds the operator's username, rename that row (id
+//     preserved, its own FKs stay valid) to free the username;
+//   - only when no row has the operator's email do we insert a fresh row.
 async function reinjectCurrentAdmin(trx, currentAdmin) {
   if (!currentAdmin) return;
-  const existing = await trx('admin_users').whereRaw('lower(email) = lower(?)', [currentAdmin.email]).first();
-  if (existing) {
-    await trx('admin_users').where({ id: existing.id }).update({
-      password_hash: currentAdmin.password_hash,
-      is_active: currentAdmin.is_active,
-      must_change_password: currentAdmin.must_change_password,
-    });
+
+  const emailMatch = await trx('admin_users')
+    .whereRaw('lower(email) = lower(?)', [currentAdmin.email])
+    .first();
+
+  // Free the operator's username if a different row holds it (rename, not delete).
+  const usernameHolder = await trx('admin_users')
+    .whereRaw('lower(username) = lower(?)', [currentAdmin.username])
+    .first();
+  if (usernameHolder && (!emailMatch || usernameHolder.id !== emailMatch.id)) {
+    await trx('admin_users')
+      .where({ id: usernameHolder.id })
+      .update({ username: `${usernameHolder.username}__restored_${usernameHolder.id}` });
+  }
+
+  if (emailMatch) {
+    // Update in place — keeps emailMatch.id so restored FKs to the operator
+    // hold. Write only the AUTH-critical columns (login identity + credentials
+    // + MFA), never the relationship/audit FKs (role_id → roles, created_by →
+    // admin_users). Forcing the operator's pre-restore role_id/created_by here
+    // could reference rows absent from a cross-instance backup and dangle the
+    // FK (SQLite rolls back at commit); the row already carries the backup's
+    // own valid values for those. This still closes the MFA-hijack gap — a
+    // crafted backup can't strip or replace the operator's second factor.
+    const authUpdate = {};
+    for (const field of PRESERVED_AUTH_FIELDS) {
+      if (field in currentAdmin) authUpdate[field] = currentAdmin[field];
+    }
+    await trx('admin_users').where({ id: emailMatch.id }).update(authUpdate);
   } else {
-    const row = { ...currentAdmin };
-    delete row.id; // let the engine assign a fresh id to avoid collision
-    await trx('admin_users').insert(row);
+    // The operator's email isn't in the backup, so nothing restored references
+    // their id — a fresh row can't dangle a reference TO the operator. Null the
+    // self-referential created_by (its target admin may be absent from this
+    // backup; ON DELETE SET NULL makes null the correct "unknown inviter"
+    // value) so the insert itself can't dangle. Use an explicit max(id)+1
+    // rather than the identity sequence, which batchInsert left unadvanced on
+    // Postgres (a sequence-based insert could collide with a restored id).
+    const snapshot = { ...currentAdmin };
+    delete snapshot.id;
+    if ('created_by' in snapshot) snapshot.created_by = null;
+    const maxRow = await trx('admin_users').max({ m: 'id' }).first();
+    snapshot.id = (Number(maxRow && maxRow.m) || 0) + 1;
+    await trx('admin_users').insert(snapshot);
   }
 }
 
+// AUTH-critical admin_users columns preserved when overwriting a restored row
+// that shares the operator's email. Deliberately excludes relationship/audit
+// FKs (role_id, created_by) — see reinjectCurrentAdmin for why.
+const PRESERVED_AUTH_FIELDS = [
+  'username', 'email', 'password_hash', 'is_active', 'must_change_password',
+  'two_factor_enabled', 'two_factor_secret', 'two_factor_recovery_codes', 'two_factor_enrolled_at',
+];
+
 // The json/jsonb columns of a table (Postgres only). The pg driver returns
 // jsonb as parsed JS values, so on re-insert they must be serialised back to
 // valid JSON text — otherwise a scalar like the string "PicPeak" is sent
@@ -232,6 +293,10 @@ async function importFromPicpeak({ picpeakPath, currentAdminId }) {
   try {
     const zip = new StreamZip.async({ file: picpeakPath });
     try {
+      // Reject ZIP-slip entries before extracting — a crafted .picpeak could
+      // otherwise write outside the staging dir via `../` entry names
+      // (same class as GHSA-jfhw-fj23-fx6x).
+      assertZipEntriesWithin(Object.values(await zip.entries()), staging);
       await zip.extract(null, staging);
     } finally {
       await zip.close();
@@ -268,4 +333,5 @@ module.exports = {
   importFromPicpeak,
   readManifestFromZip,
   validateManifest,
+  reinjectCurrentAdmin,
 };

backend/src/utils/categoryOrder.js

@@ -1,63 +0,0 @@
-/**
- * Category order resolution (#782).
- *
- * Resolves an event's categories into their effective display order, layering:
- *   1. per-event override — event_category_order.position, when the event has
- *      been customised;
- *   2. the global default — photo_categories.display_order (migration 159);
- *   3. name.
- *
- * Globals and event-specific categories are ordered together so a custom order
- * can interleave them into the flow of the day. Shared by the admin event view
- * and the public gallery so the two never diverge.
- */
-const { db } = require('../database/db');
-const { formatBoolean } = require('./dbCompat');
-const { hasColumnCached } = require('./schemaCache');
-
-/**
- * @param {number|string} eventId
- * @param {object} [opts]
- * @param {number[]|null} [opts.onlyIds] restrict to these category ids (the
- *   public gallery only shows categories that actually have photos).
- * @param {string[]|null} [opts.select] qualified columns to select (default
- *   `c.*`). Always aliased to the `photo_categories as c` table.
- * @returns rows with an added `override_position` (null when not customised).
- */
-async function getEventCategoriesOrdered(eventId, { onlyIds = null, select = null } = {}) {
-  const eid = parseInt(eventId, 10);
-
-  const base = db('photo_categories as c').where(function () {
-    this.where('c.is_global', formatBoolean(true)).orWhere('c.event_id', eid);
-  });
-  if (onlyIds) base.whereIn('c.id', onlyIds);
-
-  // Fail safe: if the override table isn't present yet (half-applied migration),
-  // fall back to the global-default order so the public gallery never 500s.
-  const overrideReady = await hasColumnCached('event_category_order', 'position');
-  if (!overrideReady) {
-    return base
-      .select(select || 'c.*')
-      .orderBy('c.is_global', 'desc')
-      .orderBy('c.display_order', 'asc')
-      .orderBy('c.name', 'asc');
-  }
-
-  const cols = select ? [...select] : ['c.*'];
-  cols.push('o.position as override_position');
-
-  return base
-    .leftJoin('event_category_order as o', function () {
-      this.on('o.category_id', 'c.id').andOnVal('o.event_id', '=', eid);
-    })
-    .select(cols)
-    // Overridden categories first (in their pinned order), then the rest by the
-    // global default. CASE keeps NULL-ordering portable across SQLite + Postgres.
-    .orderByRaw('CASE WHEN o.position IS NULL THEN 1 ELSE 0 END ASC')
-    .orderBy('o.position', 'asc')
-    .orderBy('c.is_global', 'desc')
-    .orderBy('c.display_order', 'asc')
-    .orderBy('c.name', 'asc');
-}
-
-module.exports = { getEventCategoriesOrdered };

backend/src/utils/safePath.js

@@ -118,7 +118,41 @@ function assertContractPdfPath(filePath) {
   ]);
 }
 
+/**
+ * ZIP-slip guard. `node-stream-zip`'s `extract(null, root)` writes each entry
+ * to `path.join(root, entry.name)` without neutralising `../` — a crafted
+ * archive with an entry named `../../uploads/logos/evil.svg` escapes `root`
+ * and overwrites arbitrary files (GHSA-jfhw-fj23-fx6x). Call this with the
+ * entry list BEFORE extract() to reject any entry that resolves outside the
+ * target directory.
+ *
+ * Purely lexical (path.resolve, no realpath) because the extraction target
+ * does not exist on disk yet. Absolute entry names (`/etc/passwd`) resolve
+ * away from `root` and are caught too. Throws AppError 400 on the first
+ * offending entry so the whole archive is refused.
+ *
+ * @param {Array<{name?: string}>} entries  node-stream-zip entry objects
+ * @param {string} extractRoot              directory extract() will write into
+ */
+function assertZipEntriesWithin(entries, extractRoot) {
+  const rootResolved = path.resolve(extractRoot);
+  const prefix = rootResolved.endsWith(path.sep) ? rootResolved : rootResolved + path.sep;
+  for (const entry of entries || []) {
+    const name = entry && entry.name;
+    if (!name) continue;
+    const target = path.resolve(rootResolved, name);
+    if (target !== rootResolved && !target.startsWith(prefix)) {
+      throw new AppError(
+        `Archive contains an entry that escapes the extraction directory: ${name}`,
+        400,
+        'ZIP_SLIP'
+      );
+    }
+  }
+}
+
 module.exports = {
   assertPathInside,
   assertContractPdfPath,
+  assertZipEntriesWithin,
 };

frontend/Dockerfile

@@ -29,14 +29,24 @@ COPY . .
 # Build the application
 RUN npm run build
 
-# Production stage (Alpine 3.23 with OpenSSL 3.5.5, patched libexpat)
-FROM nginx:1.28-alpine
+# Production stage (nginx stable 1.30 on Alpine 3.24). The 1.28 base is a
+# dead end for the nginx HTTP/2 + rewrite/charset CVEs (CVE-2026-42055 /
+# -49975 / -9256 / -48142): nginx.org's nginx-module-* packages pin the exact
+# nginx version, so `apk upgrade` can never pull Alpine's patched 1.28.3-r4 —
+# nginx fixes have to come via the base image tag, not apk.
+FROM nginx:1.30-alpine
 
-# Upgrade all Alpine packages for security fixes. The explicit nginx upgrade
-# closes the HTTP/2 + rewrite/charset CVEs (CVE-2026-42055 / -49975 / -9256 /
-# -48142, fixed in nginx 1.28.3-r4) and busts any cached layer still carrying
-# the vulnerable r1 build.
-RUN apk upgrade --no-cache && apk add --no-cache --upgrade nginx
+# Redeclare CACHEBUST — ARGs don't cross stage boundaries, so the builder
+# stage's declaration never reached this stage. Consuming it in the RUN below
+# busts that layer's cache every CI run (CACHEBUST=github.run_number), so the
+# image always picks up current Alpine security updates. Without this, the
+# upgrade layer was cached indefinitely and builds kept shipping curl 8.19.0 /
+# c-ares 1.34.6 for weeks after fixed packages landed in the Alpine repo.
+ARG CACHEBUST=1
+
+# Upgrade all Alpine packages for security fixes (nginx itself is version-
+# pinned by its module packages — see the FROM comment above).
+RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
 
 # Install runtime dependencies. `gettext` provides envsubst, used by
 # docker-entrypoint.sh for the BRAND_TITLE / BRAND_DESCRIPTION runtime

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "3.86.0-beta.0",
+  "version": "3.45.2",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/components/admin/AdminSidebar.tsx

@@ -15,13 +15,11 @@ import {
   Workflow,
   PanelLeftClose,
   PanelLeftOpen,
-  Github,
 } from 'lucide-react';
 import { useQuery } from '@tanstack/react-query';
 import { useTranslation } from 'react-i18next';
 import { settingsService } from '../../services/settings.service';
 import { VersionInfo } from './VersionInfo';
-import { repoUrl } from '../../utils/githubReleaseUrl';
 import { usePermissions } from '../../contexts/PermissionsContext';
 import { useAdminDarkMode } from '../../contexts/AdminDarkModeContext';
 import { useFeatureFlags, type FeatureKey } from '../../contexts/FeatureFlagsContext';
@@ -326,20 +324,6 @@ export const AdminSidebar: React.FC<AdminSidebarProps> = ({ isOpen, onClose, col
 
             {/* Storage Info */}
             <StorageInfo />
-
-            {/* Link to the project on GitHub (#778). Subtle footer row so
-                admins can reach the repo — star, source, report an issue —
-                from anywhere in the dashboard, not just the setup screen. */}
-            <a
-              href={repoUrl}
-              target="_blank"
-              rel="noopener noreferrer"
-              className="mx-4 mb-3 flex items-center gap-2 text-xs text-neutral-500 dark:text-neutral-400 hover:text-neutral-700 dark:hover:text-neutral-200 transition-colors"
-              title={t('admin.viewOnGithub', 'View PicPeak on GitHub')}
-            >
-              <Github className="w-3.5 h-3.5" />
-              <span>{t('admin.viewOnGithub', 'View PicPeak on GitHub')}</span>
-            </a>
           </div>
         )}
       </div>

frontend/src/components/admin/CategoryManager.tsx

@@ -1,6 +1,6 @@
-import React, { useEffect, useState } from 'react';
+import React, { useState } from 'react';
 import { useQuery } from '@tanstack/react-query';
-import { Plus, Edit2, Trash2, Loader2, ArrowUp, ArrowDown } from 'lucide-react';
+import { Plus, Edit2, Trash2, Loader2 } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
 import { categoriesService, type PhotoCategory } from '../../services/categories.service';
 import { Button } from '../common';
@@ -13,36 +13,12 @@ export const CategoryManager: React.FC = () => {
   const [newCategoryName, setNewCategoryName] = useState('');
   const [editingName, setEditingName] = useState('');
 
-  // Fetch global categories (ordered by the global default display_order)
+  // Fetch global categories
   const { data: categories = [], isLoading } = useQuery({
     queryKey: ['global-categories'],
     queryFn: categoriesService.getGlobalCategories,
   });
 
-  // Local copy so the up/down reorder buttons feel instant; resynced when the
-  // query data changes.
-  const [ordered, setOrdered] = useState<PhotoCategory[]>(categories);
-  useEffect(() => {
-    setOrdered(categories);
-  }, [categories]);
-
-  // Set the GLOBAL default order (#782). Applies to every gallery that hasn't
-  // set its own per-event override.
-  const reorderMutation = useMutationWithToast({
-    mutationFn: (orderedIds: number[]) => categoriesService.reorderGlobalCategories(orderedIds),
-    invalidateKeys: [['global-categories']],
-    errorMessage: t('categories.failedToReorder', 'Failed to update category order'),
-  });
-
-  const handleMove = (index: number, dir: -1 | 1) => {
-    const target = index + dir;
-    if (target < 0 || target >= ordered.length) return;
-    const next = [...ordered];
-    [next[index], next[target]] = [next[target], next[index]];
-    setOrdered(next); // optimistic
-    reorderMutation.mutate(next.map((c) => c.id));
-  };
-
   // Create category mutation
   const createMutation = useMutationWithToast({
     mutationFn: (name: string) =>
@@ -168,12 +144,12 @@ export const CategoryManager: React.FC = () => {
 
       {/* Categories list */}
       <div className="space-y-2">
-        {ordered.length === 0 ? (
+        {categories.length === 0 ? (
           <p className="text-neutral-500 dark:text-neutral-400 text-center py-8">
             {t('categories.noCategoriesYet')}
           </p>
         ) : (
-          ordered.map((category, index) => (
+          categories.map((category) => (
             <div
               key={category.id}
               className="flex items-center justify-between p-3 bg-white dark:bg-neutral-800 rounded-lg border border-neutral-200 dark:border-neutral-700 hover:border-neutral-300 dark:hover:border-neutral-600 transition-colors"
@@ -213,33 +189,9 @@ export const CategoryManager: React.FC = () => {
                 </div>
               ) : (
                 <>
-                  <div className="flex items-center gap-2 min-w-0">
-                    {/* Global default order (#782). The gallery uses this order
-                        unless a specific event overrides it. */}
-                    <div className="flex flex-col -space-y-1">
-                      <button
-                        onClick={() => handleMove(index, -1)}
-                        disabled={index === 0 || reorderMutation.isPending}
-                        className="p-0.5 text-neutral-400 dark:text-neutral-500 hover:text-accent-dark disabled:opacity-30 disabled:hover:text-neutral-400 transition-colors"
-                        title={t('categories.moveUp', 'Move up')}
-                        aria-label={t('categories.moveUp', 'Move up')}
-                      >
-                        <ArrowUp className="w-4 h-4" />
-                      </button>
-                      <button
-                        onClick={() => handleMove(index, 1)}
-                        disabled={index === ordered.length - 1 || reorderMutation.isPending}
-                        className="p-0.5 text-neutral-400 dark:text-neutral-500 hover:text-accent-dark disabled:opacity-30 disabled:hover:text-neutral-400 transition-colors"
-                        title={t('categories.moveDown', 'Move down')}
-                        aria-label={t('categories.moveDown', 'Move down')}
-                      >
-                        <ArrowDown className="w-4 h-4" />
-                      </button>
-                    </div>
-                    <div className="min-w-0">
-                      <p className="font-medium text-neutral-900 dark:text-neutral-100 truncate">{category.name}</p>
-                      <p className="text-sm text-neutral-500 dark:text-neutral-400 truncate">/{category.slug}</p>
-                    </div>
+                  <div>
+                    <p className="font-medium text-neutral-900 dark:text-neutral-100">{category.name}</p>
+                    <p className="text-sm text-neutral-500 dark:text-neutral-400">/{category.slug}</p>
                   </div>
                   <div className="flex gap-1">
                     <button

frontend/src/components/admin/EventCategoryManager.tsx

@@ -1,6 +1,6 @@
-import React, { useEffect, useState } from 'react';
+import React, { useState } from 'react';
 import { useQuery } from '@tanstack/react-query';
-import { Plus, X, Loader2, Image as ImageIcon, Check, Download, DownloadCloud, ArrowUp, ArrowDown, RotateCcw } from 'lucide-react';
+import { Plus, X, Loader2, Image as ImageIcon, Check, Download, DownloadCloud } from 'lucide-react';
 import { categoriesService, type PhotoCategory } from '../../services/categories.service';
 import { photosService } from '../../services/photos.service';
 import { Button, Card, AuthenticatedImage } from '../common';
@@ -17,8 +17,7 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
   const [newCategoryName, setNewCategoryName] = useState('');
   const [heroPickerCategoryId, setHeroPickerCategoryId] = useState<number | null>(null);
 
-  // Fetch this event's categories (globals + event-specific), already resolved
-  // to the event's effective order by the backend (#782).
+  // Fetch categories for this event
   const { data: categories = [], isLoading } = useQuery({
     queryKey: ['event-categories', eventId],
     queryFn: () => categoriesService.getEventCategories(eventId),
@@ -31,21 +30,17 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
     enabled: heroPickerCategoryId !== null,
   });
 
-  // Combined list (globals + event-specific) in the resolved order, kept in
-  // local state so the up/down reorder buttons feel instant; resynced whenever
-  // the query data changes (e.g. after a reorder or reset persists).
-  const [ordered, setOrdered] = useState<PhotoCategory[]>(categories);
-  useEffect(() => {
-    setOrdered(categories);
-  }, [categories]);
+  // Filter to show only event-specific categories
+  const eventCategories = categories.filter(cat => !cat.is_global);
 
-  // The event is "customised" when it has its own per-event override.
-  const isCustomised = ordered.some((c) => c.override_position != null);
-
-  // Create category mutation (always event-specific)
+  // Create category mutation
   const createMutation = useMutationWithToast({
     mutationFn: (name: string) =>
-      categoriesService.createCategory({ name, is_global: false, event_id: eventId }),
+      categoriesService.createCategory({
+        name,
+        is_global: false,
+        event_id: eventId
+      }),
     invalidateKeys: [['event-categories', eventId]],
     successMessage: t('categories.categoryCreatedSuccess'),
     onSuccess: () => {
@@ -76,7 +71,9 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
     errorMessage: t('categories.failedToSetCoverPhoto'),
   });
 
-  // Toggle per-category download permission (#640). Event-specific only.
+  // Toggle per-category download permission (#640). The backend AND's this
+  // with the event-level `allow_downloads`, so disabling at either level
+  // blocks downloads for this category's photos.
   const downloadToggleMutation = useMutationWithToast({
     mutationFn: ({ category, allow }: { category: PhotoCategory; allow: boolean }) =>
       categoriesService.updateCategory(category.id, category.name, { allow_downloads: allow }),
@@ -88,32 +85,6 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
     errorMessage: t('categories.failedToToggleDownloads', 'Failed to update download permission'),
   });
 
-  // Per-event order override (#782). Sends the full ordered id list; the backend
-  // pins it for this gallery only. Up/down buttons match the invoice line-item
-  // convention (no drag-and-drop dependency).
-  const reorderMutation = useMutationWithToast({
-    mutationFn: (orderedIds: number[]) => categoriesService.reorderCategories(eventId, orderedIds),
-    invalidateKeys: [['event-categories', eventId]],
-    errorMessage: t('categories.failedToReorder', 'Failed to update category order'),
-  });
-
-  // Revert this gallery to the global default order.
-  const resetMutation = useMutationWithToast({
-    mutationFn: () => categoriesService.resetEventOrder(eventId),
-    invalidateKeys: [['event-categories', eventId]],
-    successMessage: t('categories.orderReset', 'Reverted to the default order'),
-    errorMessage: t('categories.failedToReorder', 'Failed to update category order'),
-  });
-
-  const handleMove = (index: number, dir: -1 | 1) => {
-    const target = index + dir;
-    if (target < 0 || target >= ordered.length) return;
-    const next = [...ordered];
-    [next[index], next[target]] = [next[target], next[index]];
-    setOrdered(next); // optimistic — instant feedback
-    reorderMutation.mutate(next.map((c) => c.id));
-  };
-
   const handleCreate = () => {
     if (newCategoryName.trim()) {
       createMutation.mutate(newCategoryName.trim());
@@ -134,8 +105,6 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
     heroMutation.mutate({ categoryId, photoId: null });
   };
 
-  const busy = reorderMutation.isPending || resetMutation.isPending;
-
   if (isLoading) {
     return (
       <div className="flex justify-center items-center py-4">
@@ -146,38 +115,23 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
 
   return (
     <div className="space-y-3">
-      <div className="flex justify-between items-center gap-2">
-        <h3 className="text-sm font-medium text-neutral-700 dark:text-neutral-300">{t('categories.galleryOrder', 'Gallery order')}</h3>
-        <div className="flex items-center gap-2">
-          {isCustomised && (
-            <Button
-              variant="outline"
-              size="sm"
-              onClick={() => resetMutation.mutate()}
-              disabled={busy}
-              leftIcon={<RotateCcw className="w-3 h-3" />}
-            >
-              {t('categories.resetToDefault', 'Reset to default')}
-            </Button>
-          )}
-          {!addingModal.isOpen && (
-            <Button
-              variant="outline"
-              size="sm"
-              onClick={addingModal.open}
-              leftIcon={<Plus className="w-3 h-3" />}
-            >
-              {t('common.add')}
-            </Button>
-          )}
-        </div>
+      <div className="flex justify-between items-center">
+        <h3 className="text-sm font-medium text-neutral-700 dark:text-neutral-300">{t('categories.eventSpecificCategories')}</h3>
+        {!addingModal.isOpen && (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={addingModal.open}
+            leftIcon={<Plus className="w-3 h-3" />}
+          >
+            {t('common.add')}
+          </Button>
+        )}
       </div>
 
-      {/* Explain the two ordering layers */}
+      {/* Hint about hero photo fallback */}
       <p className="text-xs text-neutral-500 dark:text-neutral-400 italic">
-        {isCustomised
-          ? t('categories.orderCustomisedHint', 'This gallery uses a custom order. Reset to follow the global default (Settings → Photo Categories).')
-          : t('categories.orderDefaultHint', 'Use the arrows to set the order for this gallery. Otherwise it follows the global default (Settings → Photo Categories).')}
+        {t('categories.categoryHeroHint')}
       </p>
 
       {/* Add new category form */}
@@ -198,7 +152,11 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
             onClick={handleCreate}
             disabled={!newCategoryName.trim() || createMutation.isPending}
           >
-            {createMutation.isPending ? <Loader2 className="w-3 h-3 animate-spin" /> : t('common.add')}
+            {createMutation.isPending ? (
+              <Loader2 className="w-3 h-3 animate-spin" />
+            ) : (
+              t('common.add')
+            )}
           </Button>
           <Button
             variant="outline"
@@ -213,14 +171,14 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
         </div>
       )}
 
-      {/* Combined, reorderable category list (globals + event-specific) */}
-      {ordered.length === 0 ? (
+      {/* Event categories list */}
+      {eventCategories.length === 0 ? (
         <p className="text-sm text-neutral-500 dark:text-neutral-400 italic">
           {t('categories.noEventSpecificCategories')}
         </p>
       ) : (
         <div className="space-y-2">
-          {ordered.map((category, index) => {
+          {eventCategories.map((category) => {
             const heroPhoto = category.hero_photo_id
               ? photos.find(p => p.id === category.hero_photo_id)
               : null;
@@ -229,30 +187,7 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
                 key={category.id}
                 className="flex items-center justify-between px-3 py-2 bg-neutral-50 dark:bg-neutral-800 rounded-md"
               >
-                <div className="flex items-center gap-2 flex-1 min-w-0">
-                  {/* Reorder controls (#782). The gallery renders categories in
-                      this order; changes here override the global default for
-                      this event only. */}
-                  <div className="flex flex-col -space-y-1">
-                    <button
-                      onClick={() => handleMove(index, -1)}
-                      disabled={index === 0 || busy}
-                      className="p-0.5 text-neutral-400 dark:text-neutral-500 hover:text-accent-dark disabled:opacity-30 disabled:hover:text-neutral-400 transition-colors"
-                      title={t('categories.moveUp', 'Move up')}
-                      aria-label={t('categories.moveUp', 'Move up')}
-                    >
-                      <ArrowUp className="w-3.5 h-3.5" />
-                    </button>
-                    <button
-                      onClick={() => handleMove(index, 1)}
-                      disabled={index === ordered.length - 1 || busy}
-                      className="p-0.5 text-neutral-400 dark:text-neutral-500 hover:text-accent-dark disabled:opacity-30 disabled:hover:text-neutral-400 transition-colors"
-                      title={t('categories.moveDown', 'Move down')}
-                      aria-label={t('categories.moveDown', 'Move down')}
-                    >
-                      <ArrowDown className="w-3.5 h-3.5" />
-                    </button>
-                  </div>
+                <div className="flex items-center gap-3 flex-1 min-w-0">
                   {/* Hero photo thumbnail */}
                   <button
                     onClick={() => setHeroPickerCategoryId(category.id)}
@@ -272,56 +207,49 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
                     )}
                   </button>
                   <span className="text-sm text-neutral-700 dark:text-neutral-300 truncate">{category.name}</span>
-                  {category.is_global && (
-                    <span className="flex-shrink-0 text-[10px] uppercase tracking-wide px-1.5 py-0.5 rounded bg-neutral-200 dark:bg-neutral-700 text-neutral-500 dark:text-neutral-400">
-                      {t('categories.sharedBadge', 'Shared')}
-                    </span>
-                  )}
                 </div>
                 <div className="flex items-center gap-1">
-                  {/* Download toggle + delete apply to event-specific categories
-                      only. Global categories are managed in Settings. */}
-                  {!category.is_global && (
-                    <>
-                      <button
-                        onClick={() => downloadToggleMutation.mutate({
-                          category,
-                          allow: category.allow_downloads === false,
-                        })}
-                        className={`p-1 transition-colors ${
-                          category.allow_downloads === false
-                            ? 'text-neutral-400 dark:text-neutral-500 hover:text-green-600 dark:hover:text-green-400'
-                            : 'text-green-600 dark:text-green-400 hover:text-neutral-400'
-                        }`}
-                        title={
-                          category.allow_downloads === false
-                            ? t('categories.enableDownloadsTitle', 'Click to enable downloads for this category')
-                            : t('categories.disableDownloadsTitle', 'Click to disable downloads for this category')
-                        }
-                        disabled={downloadToggleMutation.isPending}
-                      >
-                        {downloadToggleMutation.isPending ? (
-                          <Loader2 className="w-3 h-3 animate-spin" />
-                        ) : category.allow_downloads === false ? (
-                          <Download className="w-3 h-3" />
-                        ) : (
-                          <DownloadCloud className="w-3 h-3" />
-                        )}
-                      </button>
-                      <button
-                        onClick={() => handleDelete(category)}
-                        className="p-1 text-neutral-400 dark:text-neutral-500 hover:text-red-600 dark:hover:text-red-400 transition-colors"
-                        title={t('categories.deleteCategoryTitle')}
-                        disabled={deleteMutation.isPending}
-                      >
-                        {deleteMutation.isPending ? (
-                          <Loader2 className="w-3 h-3 animate-spin" />
-                        ) : (
-                          <X className="w-3 h-3" />
-                        )}
-                      </button>
-                    </>
-                  )}
+                  {/* Per-category downloads toggle (#640). Green DownloadCloud
+                      icon when on, struck-through outline when off. The
+                      event-level `allow_downloads` AND's with this — if the
+                      whole event has downloads off, this toggle is cosmetic. */}
+                  <button
+                    onClick={() => downloadToggleMutation.mutate({
+                      category,
+                      allow: category.allow_downloads === false,
+                    })}
+                    className={`p-1 transition-colors ${
+                      category.allow_downloads === false
+                        ? 'text-neutral-400 dark:text-neutral-500 hover:text-green-600 dark:hover:text-green-400'
+                        : 'text-green-600 dark:text-green-400 hover:text-neutral-400'
+                    }`}
+                    title={
+                      category.allow_downloads === false
+                        ? t('categories.enableDownloadsTitle', 'Click to enable downloads for this category')
+                        : t('categories.disableDownloadsTitle', 'Click to disable downloads for this category')
+                    }
+                    disabled={downloadToggleMutation.isPending}
+                  >
+                    {downloadToggleMutation.isPending ? (
+                      <Loader2 className="w-3 h-3 animate-spin" />
+                    ) : category.allow_downloads === false ? (
+                      <Download className="w-3 h-3" />
+                    ) : (
+                      <DownloadCloud className="w-3 h-3" />
+                    )}
+                  </button>
+                  <button
+                    onClick={() => handleDelete(category)}
+                    className="p-1 text-neutral-400 dark:text-neutral-500 hover:text-red-600 dark:hover:text-red-400 transition-colors"
+                    title={t('categories.deleteCategoryTitle')}
+                    disabled={deleteMutation.isPending}
+                  >
+                    {deleteMutation.isPending ? (
+                      <Loader2 className="w-3 h-3 animate-spin" />
+                    ) : (
+                      <X className="w-3 h-3" />
+                    )}
+                  </button>
                 </div>
               </div>
             );
@@ -329,10 +257,41 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
         </div>
       )}
 
-      {/* Hint about hero photo fallback */}
-      <p className="text-xs text-neutral-500 dark:text-neutral-400 italic">
-        {t('categories.categoryHeroHint')}
-      </p>
+      {/* Show available global categories */}
+      <div className="mt-4 pt-3 border-t border-neutral-200 dark:border-neutral-700">
+        <p className="text-xs font-medium text-neutral-500 dark:text-neutral-400 mb-2">{t('categories.globalCategoriesAlwaysAvailable')}</p>
+        <div className="space-y-2">
+          {categories
+            .filter(cat => cat.is_global)
+            .map(cat => {
+              const heroPhoto = cat.hero_photo_id
+                ? photos.find(p => p.id === cat.hero_photo_id)
+                : null;
+              return (
+                <div key={cat.id} className="flex items-center gap-3 px-3 py-2 bg-neutral-50 dark:bg-neutral-800 rounded-md">
+                  <button
+                    onClick={() => setHeroPickerCategoryId(cat.id)}
+                    className="flex-shrink-0 w-10 h-10 rounded border border-neutral-200 dark:border-neutral-700 overflow-hidden bg-neutral-100 dark:bg-neutral-700 hover:border-accent-dark transition-colors flex items-center justify-center"
+                    title={t('categories.setCoverPhoto')}
+                  >
+                    {heroPhoto ? (
+                      <AuthenticatedImage
+                        src={heroPhoto.thumbnail_url || heroPhoto.url}
+                        alt={cat.name}
+                        className="w-full h-full object-cover"
+                      />
+                    ) : cat.hero_photo_id ? (
+                      <ImageIcon className="w-4 h-4 text-accent" />
+                    ) : (
+                      <ImageIcon className="w-4 h-4 text-neutral-300" />
+                    )}
+                  </button>
+                  <span className="text-sm text-neutral-600 dark:text-neutral-400">{cat.name}</span>
+                </div>
+              );
+            })}
+        </div>
+      </div>
 
       {/* Hero Photo Picker Modal */}
       {heroPickerCategoryId !== null && (
@@ -358,7 +317,7 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
               ) : (
                 <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 gap-4">
                   {photos.map((photo) => {
-                    const currentCategory = ordered.find(c => c.id === heroPickerCategoryId);
+                    const currentCategory = categories.find(c => c.id === heroPickerCategoryId);
                     const isSelected = photo.id === currentCategory?.hero_photo_id;
                     return (
                       <div
@@ -378,7 +337,7 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
                           />
                         </div>
                         {isSelected && (
-                          <div className="absolute top-2 right-2 bg-accent-dark text-white rounded-full p-1">
+                          <div className="absolute top-2 right-2 bg-accent-dark/150 text-white rounded-full p-1">
                             <Check className="w-4 h-4" />
                           </div>
                         )}
@@ -393,7 +352,7 @@ export const EventCategoryManager: React.FC<EventCategoryManagerProps> = ({ even
             </div>
 
             <div className="p-6 border-t border-neutral-200 dark:border-neutral-700 flex justify-between gap-3">
-              {ordered.find(c => c.id === heroPickerCategoryId)?.hero_photo_id && (
+              {categories.find(c => c.id === heroPickerCategoryId)?.hero_photo_id && (
                 <Button
                   variant="outline"
                   onClick={() => handleRemoveHeroPhoto(heroPickerCategoryId)}

frontend/src/components/admin/PicpeakBackupCard.tsx

@@ -16,6 +16,7 @@ interface RestoreResult {
   tables: number;
   filesRestored: number;
   usesExternalMedia: boolean;
+  sessionInvalidated?: boolean;
 }
 
 // ── Download half (Dashboard) ────────────────────────────────────────────────
@@ -114,6 +115,13 @@ export const PicpeakRestoreCard: React.FC = () => {
       setResult(res.data);
       setPendingFile(null);
       toast.success(t('backup.picpeak.restoreDone', 'Backup restored.'));
+      // The restore rewrote admin_users and the backend revoked our session
+      // (ids may have shifted). Send the operator to a fresh login rather than
+      // letting the now-stale token resolve to a different restored account.
+      if (res.data?.sessionInvalidated) {
+        toast.success(t('backup.picpeak.reloginRequired', 'Restore complete — please sign in again.'));
+        setTimeout(() => { window.location.href = '/admin/login'; }, 1500);
+      }
     } catch (e: any) {
       const msg = e.response?.data?.error || t('backup.picpeak.restoreFailed', 'Restore failed.');
       toast.error(msg);

frontend/src/components/admin/SlideshowSettingsCard.tsx

@@ -16,13 +16,11 @@
  * POST .../slideshow/{generate,disable}.
  */
 import React, { useState } from 'react';
-import { useQuery } from '@tanstack/react-query';
 import { useTranslation } from 'react-i18next';
 import { toast } from 'react-toastify';
 import { MonitorPlay, Copy, CheckCircle, RotateCw, Trash2, Save } from 'lucide-react';
 import { Button, Card } from '../common';
 import { eventsService } from '../../services/events.service';
-import { categoriesService } from '../../services/categories.service';
 import { DEFAULT_SLIDESHOW_STYLE, type SlideshowStyle } from '../../services/slideshow.service';
 import { SlideshowStyleFields } from './SlideshowStyleFields';
 
@@ -37,8 +35,6 @@ export interface SlideshowSettingsCardProps {
     show_transition_ms?: number;
     show_watermark?: boolean | null;
     show_colorfilter?: string;
-    show_order?: string;
-    show_category_id?: number | null;
   };
   onChanged?: () => void;
 }
@@ -56,8 +52,6 @@ function styleFromInitial(initial: SlideshowSettingsCardProps['initial']): Slide
     transition_ms: initial.show_transition_ms ?? DEFAULT_SLIDESHOW_STYLE.transition_ms,
     watermark: watermarkMode(initial.show_watermark),
     colorfilter: (initial.show_colorfilter as SlideshowStyle['colorfilter']) ?? DEFAULT_SLIDESHOW_STYLE.colorfilter,
-    order: (initial.show_order as SlideshowStyle['order']) ?? DEFAULT_SLIDESHOW_STYLE.order,
-    category_id: initial.show_category_id ?? null,
   };
 }
 
@@ -74,14 +68,6 @@ export const SlideshowSettingsCard: React.FC<SlideshowSettingsCardProps> = ({
 
   const link = token ? `${window.location.origin}/gallery/${slug}/show/${token}` : '';
 
-  // Event categories for the slideshow content filter (#202). Global + this
-  // event's own categories; empty for events without any → picker hides.
-  const { data: categories = [] } = useQuery({
-    queryKey: ['event-categories', eventId],
-    queryFn: () => categoriesService.getEventCategories(eventId),
-    staleTime: 60_000,
-  });
-
   const generate = async () => {
     setBusy(true);
     try {
@@ -143,8 +129,6 @@ export const SlideshowSettingsCard: React.FC<SlideshowSettingsCardProps> = ({
         // is global-only (Settings → Slideshow); we only send the mode here.
         show_watermark: style.watermark === 'inherit' ? null : style.watermark === 'on',
         show_colorfilter: style.colorfilter,
-        show_order: style.order,
-        show_category_id: style.category_id,
       });
       toast.success(t('slideshow.settingsSaved', 'Slideshow settings saved'));
       onChanged?.();
@@ -224,7 +208,7 @@ export const SlideshowSettingsCard: React.FC<SlideshowSettingsCardProps> = ({
 
             {/* Live style settings */}
             <div className="pt-2 border-t border-neutral-200 dark:border-neutral-700">
-              <SlideshowStyleFields value={style} onChange={setStyle} categories={categories} />
+              <SlideshowStyleFields value={style} onChange={setStyle} />
             </div>
             <p className="text-xs text-neutral-500 dark:text-neutral-400">
               {t('slideshow.liveHint', 'Changes apply to a running slideshow within a few seconds — no need to regenerate the link.')}

frontend/src/components/admin/SlideshowStyleFields.tsx

@@ -15,17 +15,12 @@ import {
   SLIDESHOW_TRANSITIONS,
   SLIDESHOW_COLORFILTERS,
   SLIDESHOW_WATERMARK_MODES,
-  SLIDESHOW_ORDERS,
   type SlideshowStyle,
 } from '../../services/slideshow.service';
-import type { PhotoCategory } from '../../services/categories.service';
 
 export interface SlideshowStyleFieldsProps {
   value: SlideshowStyle;
   onChange: (next: SlideshowStyle) => void;
-  /** Event categories for the content filter (#202). Omitted/empty → the
-   *  category picker is hidden (e.g. events without any categories). */
-  categories?: PhotoCategory[];
 }
 
 const inputClass =
@@ -34,7 +29,7 @@ const labelClass = 'block text-sm font-medium text-neutral-700 dark:text-neutral
 
 const titleCase = (s: string) => s.charAt(0).toUpperCase() + s.slice(1);
 
-export const SlideshowStyleFields: React.FC<SlideshowStyleFieldsProps> = ({ value, onChange, categories = [] }) => {
+export const SlideshowStyleFields: React.FC<SlideshowStyleFieldsProps> = ({ value, onChange }) => {
   const { t } = useTranslation();
   const set = (patch: Partial<SlideshowStyle>) => onChange({ ...value, ...patch });
 
@@ -97,39 +92,6 @@ export const SlideshowStyleFields: React.FC<SlideshowStyleFieldsProps> = ({ valu
         </select>
       </div>
 
-      {/* Play order + content filter (#202) */}
-      <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
-        <div>
-          <label className={labelClass}>{t('slideshow.orderLabel', 'Play order')}</label>
-          <select
-            value={value.order}
-            onChange={(e) => set({ order: e.target.value as SlideshowStyle['order'] })}
-            className={inputClass}
-          >
-            {SLIDESHOW_ORDERS.map((o) => (
-              <option key={o} value={o}>
-                {t(`slideshow.order.${o}`, o === 'random' ? 'Random (shuffle)' : 'Chronological')}
-              </option>
-            ))}
-          </select>
-        </div>
-        {categories.length > 0 && (
-          <div>
-            <label className={labelClass}>{t('slideshow.categoryLabel', 'Show only category')}</label>
-            <select
-              value={value.category_id ?? ''}
-              onChange={(e) => set({ category_id: e.target.value === '' ? null : parseInt(e.target.value, 10) })}
-              className={inputClass}
-            >
-              <option value="">{t('slideshow.categoryAll', 'All photos')}</option>
-              {categories.map((c) => (
-                <option key={c.id} value={c.id}>{c.name}</option>
-              ))}
-            </select>
-          </div>
-        )}
-      </div>
-
       {/* Watermark — MODE only. The look (logo/position/opacity/style/size)
           lives in Settings → Slideshow, so it isn't duplicated here. */}
       <div className="pt-2 border-t border-neutral-200 dark:border-neutral-700">

frontend/src/i18n/locales/de.json

@@ -947,15 +947,6 @@
     "coverPhotoRemoved": "Titelbild entfernt",
     "failedToSetCoverPhoto": "Titelbild konnte nicht festgelegt werden",
     "categoryHeroHint": "Wenn kein Titelbild für eine Kategorie festgelegt ist, wird das Standard-Hero-Foto verwendet.",
-    "moveUp": "Nach oben",
-    "moveDown": "Nach unten",
-    "failedToReorder": "Kategorie-Reihenfolge konnte nicht aktualisiert werden",
-    "galleryOrder": "Galerie-Reihenfolge",
-    "resetToDefault": "Auf Standard zurücksetzen",
-    "orderReset": "Auf Standardreihenfolge zurückgesetzt",
-    "orderCustomisedHint": "Diese Galerie verwendet eine eigene Reihenfolge. Zurücksetzen, um der globalen Standardreihenfolge zu folgen (Einstellungen → Fotokategorien).",
-    "orderDefaultHint": "Mit den Pfeilen die Reihenfolge für diese Galerie festlegen. Andernfalls gilt die globale Standardreihenfolge (Einstellungen → Fotokategorien).",
-    "sharedBadge": "Geteilt",
     "downloadsEnabled": "Downloads für diese Kategorie aktiviert",
     "downloadsDisabled": "Downloads für diese Kategorie deaktiviert",
     "enableDownloadsTitle": "Klicken zum Aktivieren der Downloads für diese Kategorie",
@@ -2420,7 +2411,6 @@
       "channelBeta": "Beta",
       "beta": "BETA",
       "viewReleaseNotes": "Versionshinweise anzeigen",
-      "viewOnGithub": "PicPeak auf GitHub ansehen",
       "updateAvailableShort": "v{{version}} verfügbar",
       "upToDate": "Alles aktuell",
       "updateNow": "Jetzt aktualisieren",
@@ -3485,13 +3475,6 @@
       "cool": "Kühl",
       "vignette": "Vignette"
     },
-    "orderLabel": "Reihenfolge",
-    "order": {
-      "chronological": "Chronologisch",
-      "random": "Zufällig (mischen)"
-    },
-    "categoryLabel": "Nur Kategorie zeigen",
-    "categoryAll": "Alle Fotos",
     "watermarkToggle": "Logo-Wasserzeichen anzeigen",
     "watermarkDescription": "Blendet ein weißes, halbtransparentes Logo in einer Ecke ein (wie ein Senderlogo im TV).",
     "watermarkSourceLabel": "Logo",

frontend/src/i18n/locales/en.json

@@ -494,15 +494,6 @@
     "coverPhotoRemoved": "Cover photo removed",
     "failedToSetCoverPhoto": "Failed to set cover photo",
     "categoryHeroHint": "If no cover photo is set for a category, the default hero photo will be used.",
-    "moveUp": "Move up",
-    "moveDown": "Move down",
-    "failedToReorder": "Failed to update category order",
-    "galleryOrder": "Gallery order",
-    "resetToDefault": "Reset to default",
-    "orderReset": "Reverted to the default order",
-    "orderCustomisedHint": "This gallery uses a custom order. Reset to follow the global default (Settings → Photo Categories).",
-    "orderDefaultHint": "Use the arrows to set the order for this gallery. Otherwise it follows the global default (Settings → Photo Categories).",
-    "sharedBadge": "Shared",
     "downloadsEnabled": "Downloads enabled for this category",
     "downloadsDisabled": "Downloads disabled for this category",
     "enableDownloadsTitle": "Click to enable downloads for this category",
@@ -1996,7 +1987,6 @@
       "channelBeta": "Beta",
       "beta": "BETA",
       "viewReleaseNotes": "View Release Notes",
-      "viewOnGithub": "View PicPeak on GitHub",
       "updateAvailableShort": "v{{version}} available",
       "upToDate": "You're up to date",
       "updateNow": "Update Now",
@@ -3613,13 +3603,6 @@
       "cool": "Cool",
       "vignette": "Vignette"
     },
-    "orderLabel": "Play order",
-    "order": {
-      "chronological": "Chronological",
-      "random": "Random (shuffle)"
-    },
-    "categoryLabel": "Show only category",
-    "categoryAll": "All photos",
     "watermarkToggle": "Show logo watermark",
     "watermarkDescription": "Overlay a white, semi-transparent logo in a corner (like a TV station ident).",
     "watermarkSourceLabel": "Logo",

frontend/src/pages/gallery/SlideshowPage.tsx

@@ -13,7 +13,6 @@ const DEFAULT_SETTINGS: SlideshowSettings = {
   transition: 'crossfade',
   transition_ms: 800,
   colorfilter: 'none',
-  order: 'chronological',
   fit: 'cover',
   watermark: null,
 };
@@ -66,17 +65,6 @@ function watermarkCorner(position: string): React.CSSProperties {
 
 type Phase = 'splash' | 'running' | 'ended';
 
-// Fisher–Yates shuffle for the 'random' play order (#202). Used once on the
-// initial photo set; live-appended uploads keep landing at the end.
-function shuffle<T>(arr: T[]): T[] {
-  const a = [...arr];
-  for (let i = a.length - 1; i > 0; i--) {
-    const j = Math.floor(Math.random() * (i + 1));
-    [a[i], a[j]] = [a[j], a[i]];
-  }
-  return a;
-}
-
 export function SlideshowPage() {
   const { slug = '', token = '' } = useParams<{ slug: string; token: string }>();
   const { t } = useTranslation();
@@ -171,15 +159,13 @@ export function SlideshowPage() {
       storeGalleryToken(slug, session.token);
       setActiveGallerySlug(slug);
       setEventName(session.event.event_name || '');
-      const settings = session.settings || DEFAULT_SETTINGS;
-      setSettings(settings);
+      setSettings(session.settings || DEFAULT_SETTINGS);
 
       // Load the list and DECODE the first slide (and the next) before we flip
       // to running, so playback starts on an already-rasterised image instead
       // of struggling on the first transition.
       const data = await galleryService.getGalleryPhotos(slug);
-      // 'random' shuffles the initial set once; new uploads still append (#202).
-      const list = settings.order === 'random' ? shuffle(data.photos || []) : (data.photos || []);
+      const list = data.photos || [];
       setPhotos(list);
       await preloadDecode(list[0]);
       void preloadDecode(list[1]);

frontend/src/services/categories.service.ts

@@ -10,12 +10,6 @@ export interface PhotoCategory {
   // Per-category download permission (#640). Defaults true (server-side) so
   // categories created before migration 135 keep working.
   allow_downloads?: boolean;
-  // Global default sort order (#782). Backfilled from the previous alphabetical
-  // order on migration, so existing galleries don't reshuffle.
-  display_order?: number;
-  // Per-event override position (#782). Non-null on the /event/:id response when
-  // this gallery has customised its order; null means it follows the default.
-  override_position?: number | null;
   created_at: string;
 }
 
@@ -67,31 +61,5 @@ export const categoriesService = {
   // Delete a category
   async deleteCategory(id: number): Promise<void> {
     await api.delete(`/admin/categories/${id}`);
-  },
-
-  // Set a per-event order override (#782). Sends the full ordered id list for
-  // this event — globals + event-specific — and returns the resolved order.
-  // Overrides the global default for this gallery only.
-  async reorderCategories(eventId: number, orderedIds: number[]): Promise<PhotoCategory[]> {
-    const response = await api.post<PhotoCategory[]>('/admin/categories/reorder', {
-      event_id: eventId,
-      orderedIds
-    });
-    return response.data;
-  },
-
-  // Clear an event's override — revert this gallery to the global default order.
-  async resetEventOrder(eventId: number): Promise<PhotoCategory[]> {
-    const response = await api.delete<PhotoCategory[]>(`/admin/categories/reorder/${eventId}`);
-    return response.data;
-  },
-
-  // Set the GLOBAL default order for shared categories (#782). Applies to every
-  // gallery that hasn't set its own override.
-  async reorderGlobalCategories(orderedIds: number[]): Promise<PhotoCategory[]> {
-    const response = await api.post<PhotoCategory[]>('/admin/categories/reorder-global', {
-      orderedIds
-    });
-    return response.data;
   }
 };

frontend/src/services/events.service.ts

@@ -158,8 +158,6 @@ export const eventsService = {
       show_transition_ms?: number;
       show_watermark?: boolean | null;
       show_colorfilter?: string;
-      show_order?: string;
-      show_category_id?: number | null;
     }
   ): Promise<Record<string, unknown>> {
     const response = await api.patch(`/admin/events/${id}/slideshow`, settings);
@@ -203,9 +201,10 @@ export const eventsService = {
     return response.data;
   },
 
-  // Extend event expiration (admin)
+  // Extend event expiration (admin). Uses the canonical, ownership-guarded
+  // route; the old /events/:id/extend legacy endpoint was removed (GHSA-4j34).
   async extendExpiration(id: number, days: number): Promise<Event> {
-    const response = await api.post<Event>(`/events/${id}/extend`, {
+    const response = await api.post<Event>(`/admin/events/${id}/extend`, {
       days,
     });
     return response.data;

frontend/src/services/slideshow.service.ts

@@ -18,9 +18,6 @@ export const SLIDESHOW_WATERMARK_STYLES: SlideshowWatermarkStyle[] = ['white', '
 // (admin Settings → Slideshow); 'on'/'off' = explicit override.
 export type SlideshowWatermarkMode = 'inherit' | 'on' | 'off';
 export const SLIDESHOW_WATERMARK_MODES: SlideshowWatermarkMode[] = ['inherit', 'on', 'off'];
-// Play order (#202): 'chronological' = upload order; 'random' = client shuffle.
-export type SlideshowOrder = 'chronological' | 'random';
-export const SLIDESHOW_ORDERS: SlideshowOrder[] = ['chronological', 'random'];
 
 export const SLIDESHOW_TRANSITIONS: SlideshowTransition[] = ['crossfade', 'cut', 'slide', 'kenburns', 'dipwhite', 'dipblack'];
 export const SLIDESHOW_COLORFILTERS: SlideshowColorFilter[] = ['none', 'bw', 'sepia', 'warm', 'cool', 'vignette'];
@@ -40,9 +37,6 @@ export interface SlideshowStyle {
   transition_ms: number;
   watermark: SlideshowWatermarkMode;
   colorfilter: SlideshowColorFilter;
-  // Play order + optional category filter (#202). category_id null = all photos.
-  order: SlideshowOrder;
-  category_id: number | null;
 }
 
 export const DEFAULT_SLIDESHOW_STYLE: SlideshowStyle = {
@@ -51,8 +45,6 @@ export const DEFAULT_SLIDESHOW_STYLE: SlideshowStyle = {
   transition_ms: 800,
   watermark: 'inherit',
   colorfilter: 'none',
-  order: 'chronological',
-  category_id: null,
 };
 
 // Global slideshow defaults (admin Settings → Slideshow). The single source of
@@ -89,10 +81,6 @@ export interface SlideshowSettings {
   transition: SlideshowTransition;
   transition_ms: number;
   colorfilter: SlideshowColorFilter;
-  // Play order the kiosk applies (#202): 'random' shuffles client-side so
-  // live-appended uploads keep working. The category filter is enforced
-  // server-side, so it isn't echoed here.
-  order: SlideshowOrder;
   fit: SlideshowFit;
   watermark: SlideshowWatermark | null;
 }

frontend/src/utils/githubReleaseUrl.ts

@@ -10,10 +10,5 @@
  * notes for the running version (#566) and by the update-available
  * indicator to link to the upgrade target's notes.
  */
-/** Repository home on GitHub. Single source of truth for the org URL so
- *  links (release notes, the admin "view on GitHub" button, #778) don't
- *  each hardcode it. */
-export const repoUrl = 'https://github.com/PicPeak/picpeak';
-
 export const githubReleaseUrl = (version: string): string =>
-  `${repoUrl}/releases/tag/v${version}`;
+  `https://github.com/PicPeak/picpeak/releases/tag/v${version}`;