picpeak

__tests__

fix(test-infra): scope databaseBackup fs.unlink stub so it doesn't leak

2026-05-29 16:21:15 +02:00

contract

fix(security): enforce project ownership on project + project-email routes (GHSA-wrg5, GHSA-93x4) (#960 )

2026-08-02 21:24:38 +02:00

invoice

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979 )

2026-08-03 22:03:31 +02:00

storage

fix(storage): add S3 client timeouts so a dropped connection can't wedge uploads (#1049 )

2026-08-16 15:14:48 +02:00

trackers

fix(security): escape brand tokens, block tracker redirects, trim logo diagnostic (GHSA-j347, mw76, 29vm) (#961 )

2026-08-02 21:17:17 +02:00

workflows

feat(gallery): reveal mode — hide gallery from guests until reveal (#838 ) (#856 )

2026-07-22 20:59:59 +02:00

_backupPathsBoot.js

chore(migrations): renumber 108_add_backup_paths to 109 to avoid upstream collision

2026-06-01 00:31:08 +02:00

_billingRecipients.js

feat(crm): route billing docs to billing_email when set

2026-05-27 14:04:15 +02:00

_emailTemplateBoot.js

fix(crm): self-heal missing CRM email templates at boot + recover queue

2026-05-27 15:18:29 +02:00

_installFromBackupBoot.js

feat(restore): docker-logs visibility + ADMIN_CREDENTIALS.txt restore notice

2026-06-01 21:52:38 +02:00

_permissionsBoot.js

feat(permissions): granular permission gating + role editor & presets (#747 , phase 1 of #743 ) (#1045 )

2026-08-16 14:59:52 +02:00

_renderContext.js

feat(accounting): consolidate VAT/financial config into Settings → Accounting

2026-06-18 15:10:44 +02:00

_restoreSettingsBoot.js

fix(restore): default restore_allow_force=true + auto-upgrade existing installs

2026-05-31 21:35:48 +02:00

_workflowSeedBoot.js

fix(workflows): backfill existing invoices + anchor grace to due date when dunning is enabled (#750 )

2026-07-06 21:57:23 +02:00

archiveService.js

fix(security): neutralize spreadsheet formulas in all CSV/export cell-writers (CSV injection cluster) (#948 )

2026-08-02 08:37:56 +02:00

backgroundProcessor.js

fix(upload): auto-throttle on low-memory hosts + correct documented RAM minimum (#628 )

2026-06-17 23:04:30 +02:00

backupCoverageService.js

fix(backup): make backup settings actually apply (#871 ) (#874 )

2026-07-27 09:06:38 +02:00

backupIntegrityService.js

feat(backup): admin endpoint to verify CRM document-artefact integrity

2026-05-29 13:00:18 +02:00

backupManifest.js

fix(security): backup/restore hardening — public-dir DB dump, restore path allowlist, gunzip bound, manifest keying (#956 )

2026-08-02 21:17:05 +02:00

backupService.js

fix(security): resolve DNS before vetting external hostnames (SSRF cluster) (#941 )

2026-08-01 17:36:21 +02:00

businessProfileService.js

fix(crm): pass trx to logActivity inside transactions — audit rows silently lost on SQLite (#851 )

2026-07-19 22:36:52 +02:00

chunkedUploadService.js

fix(admin): serve videos with their real MIME type in the admin photo view (#908 ) (#910 )

2026-07-29 21:32:33 +02:00

combinedBillingService.js

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979 )

2026-08-03 22:03:31 +02:00

contractBlocksService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

contractEmailTemplates.js

chore(migrations): consolidate CRM migrations 102-143 + extract email-template seeds to self-heal services

2026-05-26 18:18:15 +02:00

contractService.js

refactor(backend): decompose invoiceService, contractService, adminEvents

2026-07-03 08:10:25 +02:00

crmEmailTemplates.js

feat(workflows): collections-handoff block after dunning exhausts

2026-06-23 12:37:50 +02:00

customerAccountsService.js

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979 )

2026-08-03 22:03:31 +02:00

customerHoursService.js

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979 )

2026-08-03 22:03:31 +02:00

databaseBackup.js

ix(database-backup): drop bogus --single-transaction flag from pg_dump

2026-05-30 03:35:08 +02:00

dealsService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

downloadFilenameService.js

feat(downloads): preserve original camera filenames on download (opt-in) (#493 )

2026-05-14 23:11:00 +02:00

downloadJobCleanupService.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

downloadJobService.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

downloadRendition.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

downloadZipService.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

emailIntakeService.js

fix(security): bound inbound-mail resources, redact secrets from logs (GHSA-2qf9, pgmp, r794) (#959 )

2026-08-02 21:17:11 +02:00

emailProcessor.js

fix(dates): normalize SQLite epoch timestamps at remaining API surfaces (#485 follow-up) (#857 )

2026-07-22 21:07:32 +02:00

emailService.js

…

environmentService.js

fix(update): target docker-compose.production.yml in dashboard update steps

2026-07-17 20:55:49 +02:00

eventReminderService.js

fix(reminders): wrap is_active/is_archived wheres in formatBoolean

2026-06-29 19:39:40 +02:00

eventReminderTemplates.js

feat(setup): event-types step in first-run wizard + un-hardcode event type deps (#800 )

2026-07-15 21:30:23 +02:00

eventRenameService.js

…

eventService.js

feat(workflows): admin review gates before sends + migrate lifecycle/time triggers

2026-06-23 14:58:48 +02:00

eventTypeService.js

Merge pull request #803 from PicPeak/fix/event-type-hardcoded-deps

2026-07-15 23:02:35 +02:00

expenseCategoriesService.js

feat(accounting): inbound supplier-invoice capture + expense re-bill (backend)

2026-06-11 00:04:16 +02:00

expenseService.js

feat(accounting): re-bill proof attachment, CRM panel & hours↔re-bills cross-add (#979 )

2026-08-03 22:03:31 +02:00

expirationChecker.js

fix(workflows): ship built-ins disabled for first beta + enabled-based mutex + admin sentinel

2026-06-23 23:35:56 +02:00

externalMediaService.js

…

extractionService.js

feat(accounting): inbound supplier-invoice capture + expense re-bill (backend)

2026-06-11 00:04:16 +02:00

feedbackModeration.js

…

feedbackService.js

fix(feedback): persist guest feedback settings, unshadow the guest route (#1030 ) (#1031 )

2026-08-13 18:50:52 +02:00

fileWatcher.js

fix(file-watcher): bound concurrent photo processing (#846 )

2026-07-19 22:00:46 +02:00

fontsService.js

feat(branding): per-family generic fallback via meta.json

2026-05-04 22:27:52 +02:00

galleryOgService.js

feat(gallery): reveal mode — hide gallery from guests until reveal (#838 ) (#856 )

2026-07-22 20:59:59 +02:00

galleryShortUrlService.js

feat(gallery): branded URL shortener — /s/<slug> with OG injection (#699 )

2026-06-30 16:30:13 +02:00

guestRecoveryService.js

…

imageProcessor.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

invoiceSchedulerService.js

fix(workflows): defer quote.accepted/declined emit until the 15-min response window locks

2026-06-28 14:30:26 +02:00

invoiceService.js

refactor(backend): decompose invoiceService, contractService, adminEvents

2026-07-03 08:10:25 +02:00

ledgerService.js

fix(accounting): PR #622 blockers — CSV formula injection + IMAP double-ingest race

2026-06-16 18:21:02 +02:00

mfaService.js

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

oidcService.js

fix(auth): issuer-tag the oversize SSO logout marker (#798 ) (#1010 )

2026-08-10 09:14:56 +02:00

pdf-i18n.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

pdfService.js

feat(invoices): configurable VAT/free-text note + fix multi-page page-number overlap (#794 )

2026-07-11 02:01:20 +02:00

pdfStampService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

photoExportService.js

fix(security): neutralize spreadsheet formulas in all CSV/export cell-writers (CSV injection cluster) (#948 )

2026-08-02 08:37:56 +02:00

photoProcessor.js

fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931 ) (#933 )

2026-08-01 12:29:12 +02:00

photoReplacementService.js

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

photoResolver.js

…

photoService.js

…

picpeakExportService.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038 ) (#1039 )

2026-08-13 18:50:56 +02:00

picpeakImportService.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038 ) (#1039 )

2026-08-13 18:50:56 +02:00

projectService.js

fix(security): vet the destination project when linking a deal (#991 )

2026-08-04 16:36:12 +02:00

publicSiteService.js

fix(security): escape brand tokens, block tracker redirects, trim logo diagnostic (GHSA-j347, mw76, 29vm) (#961 )

2026-08-02 21:17:17 +02:00

quoteService.js

fix(security): enforce project ownership on project + project-email routes (GHSA-wrg5, GHSA-93x4) (#960 )

2026-08-02 21:24:38 +02:00

rasterizeService.js

fix(accounting): PR #622 concerns — flag-cache, customer master gate, VAT-unconfigured, helpers, page cap

2026-06-16 18:33:47 +02:00

rateLimitService.js

…

recaptcha.js

refactor(backend): standardize error responses, logging, pagination

2026-07-03 07:49:45 +02:00

restoreService.js

fix(security): backup/restore hardening — public-dir DB dump, restore path allowlist, gunzip bound, manifest keying (#956 )

2026-08-02 21:17:05 +02:00

revealScheduler.js

feat(gallery): reveal mode — hide gallery from guests until reveal (#838 ) (#856 )

2026-07-22 20:59:59 +02:00

robotsTxtService.js

…

s3AutoImporter.js

fix(import): capture photo dimensions in fileWatcher + s3AutoImporter (#447 )

2026-05-11 09:58:08 +02:00

secureImageService.js

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939 )

2026-08-01 17:36:15 +02:00

settingsService.js

…

setupService.js

fix(security): bound inbound-mail resources, redact secrets from logs (GHSA-2qf9, pgmp, r794) (#959 )

2026-08-02 21:17:11 +02:00

shareLinkService.js

fix(security): unauth share_token leak (HIGH) + restore path-traversal, logo file-read, branding path keys (#946 )

2026-08-02 08:37:48 +02:00

taxReportService.js

fix(accounting): tax-report storno totals + hours-line date on Postgres

2026-06-18 18:40:22 +02:00

transferCleanupService.js

feat(transfers): add PicTransfer — cross-event file transfers (#998 )

2026-08-09 13:40:03 +02:00

transferService.js

feat(transfers): add PicTransfer — cross-event file transfers (#998 )

2026-08-09 13:40:03 +02:00

updateCheckService.js

feat(admin): surface the registry move through the update check (#993 )

2026-08-04 16:36:50 +02:00

updateNotificationService.js

chore: migrate Docker registry + GitHub URLs to PicPeak org

2026-06-29 20:20:13 +02:00

uploadSettings.js

Merge remote-tracking branch 'origin/main' into feat/guest-upload-dng-raw

2026-07-18 20:52:08 +02:00

userManagementService.js

feat(permissions): granular permission gating + role editor & presets (#747 , phase 1 of #743 ) (#1045 )

2026-08-16 14:59:52 +02:00

videoProcessor.js

fix(docker): install system ffmpeg on Alpine, drop broken bundled binary

2026-05-04 09:04:38 +02:00

watermarkGeneratorService.js

fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931 ) (#933 )

2026-08-01 12:29:12 +02:00

watermarkService.js

feat(downloads): per-gallery download resolutions (#858 ) (#1022 )

2026-08-11 09:46:46 +02:00

webhookDeliveryWorker.js

fix(security): resolve DNS before vetting external hostnames (SSRF cluster) (#941 )

2026-08-01 17:36:21 +02:00

webhookService.js

feat(workflows): route webhook node through the delivery pipeline (full Option 1)

2026-06-25 18:44:27 +02:00

whatsappProcessor.js

feat(whatsapp): admin-selectable template parameters + reorder (#647 follow-up)

2026-06-21 20:51:20 +02:00

whatsappService.js

feat(whatsapp): WhatsApp Business API notification channel (#640 part D)

2026-06-18 22:57:22 +02:00

workerManager.js

…

xmpGenerator.js

…