Files

T

Paul Nothaft 808b15bafb feat: public v1 API + token management + OpenAPI docs (#322 )

Adds a long-lived bearer-token mechanism + scoped REST surface designed
for n8n-style automation: create a gallery, upload photos, fetch the
share URL — all via documented HTTPS endpoints instead of poking at the
admin UI's internal routes.

API
- Migration 081 adds `api_tokens` (hashed_token, scopes, owner FK,
  last_used/expires/revoked timestamps).
- New apiTokenAuth middleware: parses `Authorization: Bearer pp_live_…`,
  resolves to the owner admin user, attaches `req.admin` so existing
  permission decorators (events.create etc.) still work. Token-level
  scope check (read/write/admin) layers on top as defence in depth —
  a leaked read-only token cannot mutate even if its owner is super_admin.
- adminApiTokens route exposes list/create/revoke for admins (cookie-
  authed). Plaintext token is returned exactly once on creation.
- v1 surface mounted at /api/v1: POST/GET /events, GET /events/:id,
  POST /events/:id/photos (multipart, single file), GET
  /events/:id/share-link. Each endpoint annotated with @openapi JSDoc.

Documentation
- swagger-jsdoc + swagger-ui-express produce a live spec at
  /api/openapi.json and a Swagger UI at /api/docs (admin-gated).
- backend/scripts/generate-openapi.js writes docs/openapi.{json,yaml}
  to the repo so the spec is versioned.
- scripts/sync-api-docs.sh runs in pre-push: regenerates the spec and
  copies it into the picpeak-docs Nextra site at app/api/. Writes only,
  never commits or pushes the docs repo (PUSH_SKIP_DOCS=1 to bypass).

Frontend
- New Settings → API Tokens tab: generate, list, revoke. Plaintext
  tokens are shown once with a copy-to-clipboard control.

2026-04-27 22:38:00 +02:00

core

feat: public v1 API + token management + OpenAPI docs (#322 )

2026-04-27 22:38:00 +02:00

legacy

fix: prevent database migration restart failures

2026-01-15 15:43:13 +01:00

041_add_logo_customization_settings.js

feat: implement gallery logo customization (Issue #17 )

2025-09-05 14:56:09 +02:00

helpers.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

README.md

feat: pre-generate watermarks for instant lightbox loading

2026-01-15 21:00:10 +01:00

run-migrations-safe.js

fix: prevent database migration restart failures

2026-01-15 15:43:13 +01:00

run-migrations.js

fix: prevent database migration restart failures

2026-01-15 15:43:13 +01:00

README.md

Database Migrations

This directory contains database migrations for the PicPeak photo sharing platform.

Directory Structure

`/core`

Essential migrations that are always run for new deployments. These include:

init.js - Initial database schema creation
Backup service tables (029-035)
Gallery feedback tables (033)
Pre-generated watermarks (061)

`/legacy`

Migrations needed only when upgrading from older versions. New deployments can skip these as the core schema already includes all necessary tables and columns.

For New Deployments

If you're deploying this application for the first time:

The initializeDatabase() function in src/database/db.js will create all necessary tables
Only migrations in the /core directory will be run
This ensures a clean, optimized database schema

For Existing Deployments

If you're upgrading from an older version:

All migrations (both core and legacy) will be run in sequence
The migration system tracks which migrations have been applied
Only new migrations will be executed

Running Migrations

# Development
npm run migrate

# Production
npm run migrate:prod

Note on Duplicate Migration Numbers

The legacy directory contains renamed duplicates:

014_add_host_name_to_events_duplicate.js (was duplicate of 014)
027_add_rate_limit_settings_duplicate.js (was duplicate of 027)

These have been renamed to avoid conflicts while preserving the migration history.