feat(costs): rework Budget into Costs — Splitwise-style, multi-currency, mobile (#1106)

* fix(journey): authorize reads of the journey share link

GET /api/journeys/:id/share-link now requires journey access (canAccessJourney),
matching the create/delete share-link routes and the get_journey_share_link MCP
tool. Returns no link when the caller lacks access to the journey.

* feat(costs): rework Budget into Costs — Splitwise-style, multi-currency, mobile

Renames the Budget addon to "Costs" (UI only) and reworks it into a Tricount/
Splitwise-style cost tracker: multiple payers per expense, equal split across
chosen members, settle-up with persisted history + undo, 12 fixed categories,
per-expense currency with live FX conversion to a user-set display currency
(Settings -> Display), and locale-correct money formatting. Adds a desktop and a
dedicated mobile layout. A migration backfills existing budget items (single
payer, split members, currency). Closes #551 (per-expense currency).

Also switches the app font to self-hosted Poppins (Geist for secondary subtext),
replacing the Google Fonts CDN dependency.

* fix(costs): neutral dashboard dark palette + liquid glass, full page width, entry-count badge

- Dark mode used a warm oklch palette that read brownish; switch to the
  neutral zinc tokens used by the dashboard (#121215 bg, #f4f4f5 ink) and add a
  subtle backdrop-blur glass on cards.
- Costs now uses the full available page width on desktop instead of a 1280px cap.
- Render the expense count next to the Expenses title as a badge.
- Adapt budget/journey unit tests to the new payer-based settlement model and the
  Costs rename (category default 'other', Costs tab/CostsPanel).

* fix(costs): drop the entry-count badge, always show row edit/delete actions

Removes the count badge next to the Expenses title and makes the per-row
edit/delete actions permanently visible (no longer hover-only) on desktop too.

* feat(costs): currency-native money formatting, custom select/date, rename addon to Costs

- Format every amount in its own currency convention (symbol position, grouping
  and decimal separators) regardless of app language, via a currency->locale map
  (EUR -> '12,00 €', USD -> '$12.00', JPY -> '¥12', ...). Previously Intl used the
  app locale, so EUR showed the symbol in front under an English UI.
- Use TREK's CustomSelect (searchable, with symbols) and CustomDatePicker in the
  add/edit expense modal instead of the native <select>/<input type=date>.
- Rename the 'Budget Planner' add-on to 'Costs' in the admin list (display only;
  id/tables/permissions/MCP stay 'budget') via seed + a migration for existing DBs.

* feat(auth): configurable session duration via SESSION_DURATION

Adds a SESSION_DURATION env var (ms-style strings: 1h, 7d, 30d, ...) controlling
how long a session stays valid before re-login. It drives both the trek_session
JWT exp claim and the cookie maxAge from one source, so they never drift. Invalid
values warn at startup and fall back to the default (24h — unchanged). The MFA
challenge token and MCP OAuth tokens keep their own TTL.

Implements the request from discussion #946. Documented in the env-var wiki page,
.env.example and docker-compose.yml.

server/.env.example

@@ -8,6 +8,7 @@ NODE_ENV=development # development = development mode; production = production m
 # Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 TZ=UTC # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
 # DEFAULT_LANGUAGE=en # Default language on the login page for users with no saved preference (default: en)
+# SESSION_DURATION=30d # How long users stay logged in — sets the trek_session JWT exp + cookie maxAge. Accepts 1h, 12h, 7d, 30d, 90d. Default: 24h
 # Supported values: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
 # Note: browser/OS language is detected automatically first; this is the fallback when no match is found.
 LOG_LEVEL=info # info = concise user actions; debug = verbose admin-level details

server/src/config.ts

@@ -107,3 +107,32 @@ if (!SUPPORTED_LANG_CODES.includes(rawDefaultLang)) {
   console.warn(`DEFAULT_LANGUAGE="${rawDefaultLang}" is not supported. Falling back to "en". Supported: ${SUPPORTED_LANG_CODES.join(', ')}`);
 }
 export const DEFAULT_LANGUAGE = SUPPORTED_LANG_CODES.includes(rawDefaultLang) ? rawDefaultLang : 'en';
+
+// SESSION_DURATION controls how long a TREK session (the `trek_session` JWT
+// cookie) stays valid before re-login is required. Accepts ms-style strings:
+// '1h', '12h', '7d', '30d', '90d', etc. It applies to BOTH the JWT `exp` claim
+// and the cookie `maxAge`, so the two never drift apart. Invalid values warn at
+// startup and fall back to the default. Does not affect the short-lived MFA
+// challenge token or MCP OAuth tokens — those keep their own TTL.
+const DEFAULT_SESSION_DURATION = '24h';
+const DURATION_UNITS_MS: Record<string, number> = {
+  ms: 1, s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000, y: 31_557_600_000,
+};
+function parseDurationMs(value: string): number | null {
+  const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w|y)?$/i.exec(value.trim());
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return n * DURATION_UNITS_MS[(m[2] || 'ms').toLowerCase()];
+}
+const rawSessionDuration = process.env.SESSION_DURATION?.trim() || DEFAULT_SESSION_DURATION;
+const parsedSessionMs = parseDurationMs(rawSessionDuration);
+if (parsedSessionMs == null) {
+  console.warn(`SESSION_DURATION="${rawSessionDuration}" is not a valid duration (use e.g. 1h, 7d, 30d). Falling back to "${DEFAULT_SESSION_DURATION}".`);
+}
+/** Human-readable session length actually in effect (for logs/diagnostics). */
+export const SESSION_DURATION = parsedSessionMs == null ? DEFAULT_SESSION_DURATION : rawSessionDuration;
+/** Session length in milliseconds — used for the cookie `maxAge`. */
+export const SESSION_DURATION_MS = parsedSessionMs ?? parseDurationMs(DEFAULT_SESSION_DURATION)!;
+/** Session length in seconds — passed to `jwt.sign({ expiresIn })` (number = seconds). */
+export const SESSION_DURATION_SECONDS = Math.floor(SESSION_DURATION_MS / 1000);

server/src/db/migrations.ts

@@ -2278,6 +2278,68 @@ function runMigrations(db: Database.Database): void {
         if (!err.message?.includes('no such table')) throw err;
       }
     },
+    // Costs rework (budget → "Costs", Tricount/Splitwise style). Adds, additively
+    // and without touching existing rows:
+    //  - per-expense currency + exchange_rate, so an expense can be entered in a
+    //    foreign currency and converted to the trip base currency (NULL currency =
+    //    base currency; rate 1.0). Closes the multi-currency request (#551).
+    //  - budget_item_payers: several people can each have paid part of one expense
+    //    (amounts in the expense currency), replacing the single paid_by_user_id.
+    //  - budget_settlements: persisted "X paid Y" transfers so the settle-up
+    //    history (with undo) is shared across all trip members.
+    // The equal-split participants stay in budget_item_members. The single legacy
+    // payer is backfilled into budget_item_payers as one payer covering the total.
+    () => {
+      try { db.exec('ALTER TABLE budget_items ADD COLUMN currency TEXT'); }
+      catch (err: any) { if (!err.message?.includes('duplicate column name')) throw err; }
+      try { db.exec('ALTER TABLE budget_items ADD COLUMN exchange_rate REAL NOT NULL DEFAULT 1'); }
+      catch (err: any) { if (!err.message?.includes('duplicate column name')) throw err; }
+
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS budget_item_payers (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          budget_item_id INTEGER NOT NULL REFERENCES budget_items(id) ON DELETE CASCADE,
+          user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          amount REAL NOT NULL DEFAULT 0,
+          UNIQUE(budget_item_id, user_id)
+        )
+      `);
+      db.exec('CREATE INDEX IF NOT EXISTS idx_budget_item_payers_item ON budget_item_payers(budget_item_id)');
+
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS budget_settlements (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+          from_user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          to_user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          amount REAL NOT NULL DEFAULT 0,
+          created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+          created_by_user_id INTEGER REFERENCES users(id)
+        )
+      `);
+      db.exec('CREATE INDEX IF NOT EXISTS idx_budget_settlements_trip ON budget_settlements(trip_id)');
+
+      // Backfill the legacy single payer: that person paid the full total of the
+      // expense, in the (base) currency the existing amount was already stored in.
+      try {
+        db.exec(`
+          INSERT OR IGNORE INTO budget_item_payers (budget_item_id, user_id, amount)
+          SELECT id, paid_by_user_id, total_price
+          FROM budget_items
+          WHERE paid_by_user_id IS NOT NULL
+        `);
+      } catch (err: any) {
+        if (!err.message?.includes('no such column')) throw err;
+      }
+    },
+    // Rename the "Budget Planner" addon to "Costs" in the admin add-on list. This
+    // is a display rename only — the addon id, tables, permissions and MCP tools
+    // all stay 'budget'. Scoped to the default name so a customised one is kept.
+    () => {
+      db.prepare(
+        "UPDATE addons SET name = 'Costs', description = 'Track and split trip expenses' WHERE id = 'budget' AND name = 'Budget Planner'",
+      ).run();
+    },
   ];
 
   if (currentVersion < migrations.length) {

server/src/db/seeds.ts

@@ -90,7 +90,7 @@ function seedAddons(db: Database.Database): void {
   try {
     const defaultAddons = [
       { id: 'packing', name: 'Lists', description: 'Packing lists and to-do tasks for your trips', type: 'trip', icon: 'ListChecks', enabled: 1, sort_order: 0 },
-      { id: 'budget', name: 'Budget Planner', description: 'Track expenses and plan your travel budget', type: 'trip', icon: 'Wallet', enabled: 1, sort_order: 1 },
+      { id: 'budget', name: 'Costs', description: 'Track and split trip expenses', type: 'trip', icon: 'Wallet', enabled: 1, sort_order: 1 },
       { id: 'documents', name: 'Documents', description: 'Store and manage travel documents', type: 'trip', icon: 'FileText', enabled: 1, sort_order: 2 },
       { id: 'vacay', name: 'Vacay', description: 'Personal vacation day planner with calendar view', type: 'global', icon: 'CalendarDays', enabled: 1, sort_order: 10 },
       { id: 'atlas', name: 'Atlas', description: 'World map of your visited countries with travel stats', type: 'global', icon: 'Globe', enabled: 1, sort_order: 11 },

server/src/nest/budget/budget.controller.ts

@@ -8,6 +8,7 @@ import {
   Param,
   Post,
   Put,
+  Query,
   UseGuards,
 } from '@nestjs/common';
 import type { User } from '../../types';
@@ -57,9 +58,56 @@ export class BudgetController {
   }
 
   @Get('settlement')
-  settlement(@CurrentUser() user: User, @Param('tripId') tripId: string) {
+  settlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Query('base') base?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    return this.budget.settlement(tripId, base, (trip as { currency?: string }).currency || 'EUR');
+  }
+
+  @Get('settlements')
+  listSettlements(@CurrentUser() user: User, @Param('tripId') tripId: string) {
     this.requireTrip(tripId, user);
-    return this.budget.settlement(tripId);
+    return { settlements: this.budget.listSettlements(tripId) };
+  }
+
+  @Post('settlements')
+  createSettlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Body() body: { from_user_id?: number; to_user_id?: number; amount?: number },
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (body.from_user_id == null || body.to_user_id == null || body.amount == null) {
+      throw new HttpException({ error: 'from_user_id, to_user_id and amount are required' }, 400);
+    }
+    const settlement = this.budget.createSettlement(
+      tripId,
+      { from_user_id: body.from_user_id, to_user_id: body.to_user_id, amount: body.amount },
+      user.id,
+    );
+    this.budget.broadcast(tripId, 'budget:settlement-created', { settlement }, socketId);
+    return { settlement };
+  }
+
+  @Delete('settlements/:settlementId')
+  deleteSettlement(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('settlementId') settlementId: string,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!this.budget.deleteSettlement(settlementId, tripId)) {
+      throw new HttpException({ error: 'Settlement not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:settlement-deleted', { settlementId: Number(settlementId) }, socketId);
+    return { success: true };
   }
 
   @Post()
@@ -149,6 +197,27 @@ export class BudgetController {
     return { members: result.members, item: result.item };
   }
 
+  @Put(':id/payers')
+  setPayers(
+    @CurrentUser() user: User,
+    @Param('tripId') tripId: string,
+    @Param('id') id: string,
+    @Body('payers') payers: unknown,
+    @Headers('x-socket-id') socketId?: string,
+  ) {
+    const trip = this.requireTrip(tripId, user);
+    this.requireEdit(trip, user);
+    if (!Array.isArray(payers)) {
+      throw new HttpException({ error: 'payers must be an array' }, 400);
+    }
+    const item = this.budget.setPayers(id, tripId, payers as { user_id: number; amount: number }[]);
+    if (!item) {
+      throw new HttpException({ error: 'Budget item not found' }, 404);
+    }
+    this.budget.broadcast(tripId, 'budget:updated', { item }, socketId);
+    return { item };
+  }
+
   @Put(':id/members/:userId/paid')
   toggleMemberPaid(
     @CurrentUser() user: User,

server/src/nest/budget/budget.service.ts

@@ -4,6 +4,7 @@ import { broadcast } from '../../websocket';
 import { checkPermission } from '../../services/permissions';
 import type { User } from '../../types';
 import * as svc from '../../services/budgetService';
+import { getRates } from '../../services/exchangeRateService';
 
 type Trip = NonNullable<ReturnType<typeof svc.verifyTripAccess>>;
 
@@ -34,8 +35,10 @@ export class BudgetService {
     return svc.getPerPersonSummary(tripId);
   }
 
-  settlement(tripId: string) {
-    return svc.calculateSettlement(tripId);
+  async settlement(tripId: string, base: string | undefined, tripCurrency: string) {
+    const effectiveBase = (base || tripCurrency || 'EUR').toUpperCase();
+    const rates = await getRates(effectiveBase);
+    return svc.calculateSettlement(tripId, { base: effectiveBase, rates, tripCurrency });
   }
 
   create(tripId: string, data: Parameters<typeof svc.createBudgetItem>[1]) {
@@ -58,6 +61,22 @@ export class BudgetService {
     return svc.toggleMemberPaid(id, userId, paid);
   }
 
+  setPayers(id: string, tripId: string, payers: { user_id: number; amount: number }[]) {
+    return svc.setItemPayers(id, tripId, payers);
+  }
+
+  listSettlements(tripId: string) {
+    return svc.listSettlements(tripId);
+  }
+
+  createSettlement(tripId: string, data: { from_user_id: number; to_user_id: number; amount: number }, userId: number) {
+    return svc.createSettlement(tripId, data, userId);
+  }
+
+  deleteSettlement(id: string, tripId: string): boolean {
+    return svc.deleteSettlement(id, tripId);
+  }
+
   reorderItems(tripId: string, orderedIds: number[]): void {
     svc.reorderBudgetItems(tripId, orderedIds);
   }

server/src/nest/journey/journey.controller.ts

@@ -392,7 +392,7 @@ export class JourneyController {
   // ── Share Link ──────────────────────────────────────────────────────────
   @Get(':id/share-link')
   getShareLink(@CurrentUser() user: User, @Param('id') id: string) {
-    return { link: this.journey.getJourneyShareLink(Number(id)) };
+    return { link: this.journey.getJourneyShareLink(Number(id), user.id) };
   }
 
   @Post(':id/share-link')

server/src/nest/journey/journey.service.ts

@@ -61,7 +61,13 @@ export class JourneyService {
   removeContributor(id: number, userId: number, targetUserId: number) { return svc.removeContributor(id, userId, targetUserId); }
 
   // Share links
-  getJourneyShareLink(id: number) { return share.getJourneyShareLink(id); }
+  // Authorization: only someone with access to the journey may read its public
+  // share token — same access model as create/delete here and the
+  // get_journey_share_link MCP tool.
+  getJourneyShareLink(id: number, userId: number) {
+    if (!svc.canAccessJourney(id, userId)) return null;
+    return share.getJourneyShareLink(id);
+  }
   createOrUpdateJourneyShareLink(id: number, userId: number, data: Parameters<typeof share.createOrUpdateJourneyShareLink>[2]) { return share.createOrUpdateJourneyShareLink(id, userId, data); }
   deleteJourneyShareLink(id: number, userId: number) { return share.deleteJourneyShareLink(id, userId); }
 

server/src/services/authService.ts

@@ -7,7 +7,7 @@ import { authenticator } from 'otplib';
 import QRCode from 'qrcode';
 import { randomBytes, createHash } from 'crypto';
 import { db } from '../db/database';
-import { JWT_SECRET } from '../config';
+import { JWT_SECRET, SESSION_DURATION_SECONDS } from '../config';
 import { validatePassword } from './passwordPolicy';
 import { encryptMfaSecret, decryptMfaSecret } from './mfaCrypto';
 import { getAllPermissions } from './permissions';
@@ -177,7 +177,7 @@ export function generateToken(user: { id: number | bigint; password_version?: nu
   return jwt.sign(
     { id: user.id, pv },
     JWT_SECRET,
-    { expiresIn: '24h', algorithm: 'HS256' }
+    { expiresIn: SESSION_DURATION_SECONDS, algorithm: 'HS256' }
   );
 }
 

server/src/services/budgetService.ts

@@ -1,5 +1,5 @@
 import { db } from '../db/database';
-import { BudgetItem, BudgetItemMember } from '../types';
+import { BudgetItem, BudgetItemMember, BudgetItemPayer } from '../types';
 import { avatarUrl } from './avatarUrl';
 
 // ---------------------------------------------------------------------------
@@ -19,6 +19,30 @@ function loadItemMembers(itemId: number | string) {
   return rows.map(m => ({ ...m, avatar_url: avatarUrl(m) }));
 }
 
+function loadItemPayers(itemId: number | string) {
+  const rows = db.prepare(`
+    SELECT bp.user_id, bp.amount, u.username, u.avatar
+    FROM budget_item_payers bp
+    JOIN users u ON bp.user_id = u.id
+    WHERE bp.budget_item_id = ?
+  `).all(itemId) as BudgetItemPayer[];
+  return rows.map(p => ({ ...p, avatar_url: avatarUrl(p) }));
+}
+
+/** Replace the payer rows of an item and keep total_price = sum of payer amounts. */
+function writeItemPayers(itemId: number | string, payers: { user_id: number; amount: number }[]) {
+  db.prepare('DELETE FROM budget_item_payers WHERE budget_item_id = ?').run(itemId);
+  const insert = db.prepare('INSERT OR IGNORE INTO budget_item_payers (budget_item_id, user_id, amount) VALUES (?, ?, ?)');
+  let total = 0;
+  for (const p of payers) {
+    if (!(p.amount > 0)) continue;
+    insert.run(itemId, p.user_id, p.amount);
+    total += p.amount;
+  }
+  db.prepare('UPDATE budget_items SET total_price = ? WHERE id = ?').run(total, itemId);
+  return total;
+}
+
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -50,20 +74,45 @@ export function listBudgetItems(tripId: string | number) {
     }
   }
 
-  items.forEach(item => { item.members = membersByItem[item.id] || []; });
+  const payersByItem: Record<number, (BudgetItemPayer & { avatar_url: string | null })[]> = {};
+  if (itemIds.length > 0) {
+    const allPayers = db.prepare(`
+      SELECT bp.budget_item_id, bp.user_id, bp.amount, u.username, u.avatar
+      FROM budget_item_payers bp
+      JOIN users u ON bp.user_id = u.id
+      WHERE bp.budget_item_id IN (${itemIds.map(() => '?').join(',')})
+    `).all(...itemIds) as (BudgetItemPayer & { budget_item_id: number })[];
+
+    for (const p of allPayers) {
+      if (!payersByItem[p.budget_item_id]) payersByItem[p.budget_item_id] = [];
+      payersByItem[p.budget_item_id].push({
+        user_id: p.user_id, amount: p.amount, username: p.username, avatar_url: avatarUrl(p),
+      });
+    }
+  }
+
+  items.forEach(item => {
+    item.members = membersByItem[item.id] || [];
+    item.payers = payersByItem[item.id] || [];
+  });
   return items;
 }
 
 export function createBudgetItem(
   tripId: string | number,
-  data: { category?: string; name: string; total_price?: number; persons?: number | null; days?: number | null; note?: string | null; expense_date?: string | null },
+  data: {
+    category?: string; name: string; total_price?: number;
+    currency?: string | null; exchange_rate?: number;
+    payers?: { user_id: number; amount: number }[]; member_ids?: number[];
+    persons?: number | null; days?: number | null; note?: string | null; expense_date?: string | null;
+  },
 ) {
   const maxOrder = db.prepare(
     'SELECT MAX(sort_order) as max FROM budget_items WHERE trip_id = ?'
   ).get(tripId) as { max: number | null };
   const sortOrder = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
 
-  const cat = data.category || 'Other';
+  const cat = data.category || 'other';
 
   // Ensure category has a sort_order entry
   const catExists = db.prepare('SELECT 1 FROM budget_category_order WHERE trip_id = ? AND category = ?').get(tripId, cat);
@@ -73,22 +122,37 @@ export function createBudgetItem(
     db.prepare('INSERT OR IGNORE INTO budget_category_order (trip_id, category, sort_order) VALUES (?, ?, ?)').run(tripId, cat, catOrder);
   }
 
+  // total_price is derived from explicit payers when given; otherwise the caller
+  // value (planning entries, or a bill no one has paid yet).
+  const payerTotal = (data.payers || []).reduce((a, p) => a + (p.amount > 0 ? p.amount : 0), 0);
+  const total = data.payers && data.payers.length > 0 ? payerTotal : (data.total_price || 0);
+
   const result = db.prepare(
-    'INSERT INTO budget_items (trip_id, category, name, total_price, persons, days, note, sort_order, expense_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)'
+    'INSERT INTO budget_items (trip_id, category, name, total_price, currency, exchange_rate, persons, days, note, sort_order, expense_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'
   ).run(
     tripId,
     cat,
     data.name,
-    data.total_price || 0,
-    data.persons != null ? data.persons : null,
+    total,
+    data.currency || null,
+    data.exchange_rate != null ? data.exchange_rate : 1,
+    data.member_ids ? data.member_ids.length : (data.persons != null ? data.persons : null),
     data.days !== undefined && data.days !== null ? data.days : null,
     data.note || null,
     sortOrder,
     data.expense_date || null,
   );
 
-  const item = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(result.lastInsertRowid) as BudgetItem & { members?: BudgetItemMember[] };
-  item.members = [];
+  const itemId = result.lastInsertRowid as number;
+  if (data.payers && data.payers.length > 0) writeItemPayers(itemId, data.payers);
+  if (data.member_ids && data.member_ids.length > 0) {
+    const insert = db.prepare('INSERT OR IGNORE INTO budget_item_members (budget_item_id, user_id, paid) VALUES (?, ?, 0)');
+    for (const uid of data.member_ids) insert.run(itemId, uid);
+  }
+
+  const item = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(itemId) as BudgetItem;
+  item.members = loadItemMembers(itemId);
+  item.payers = loadItemPayers(itemId);
   return item;
 }
 
@@ -106,7 +170,12 @@ export function linkBudgetItemToReservation(
 export function updateBudgetItem(
   id: string | number,
   tripId: string | number,
-  data: { category?: string; name?: string; total_price?: number; persons?: number | null; days?: number | null; note?: string | null; sort_order?: number; expense_date?: string | null },
+  data: {
+    category?: string; name?: string; total_price?: number;
+    currency?: string | null; exchange_rate?: number;
+    payers?: { user_id: number; amount: number }[]; member_ids?: number[];
+    persons?: number | null; days?: number | null; note?: string | null; sort_order?: number; expense_date?: string | null;
+  },
 ) {
   const item = db.prepare('SELECT * FROM budget_items WHERE id = ? AND trip_id = ?').get(id, tripId);
   if (!item) return null;
@@ -116,6 +185,8 @@ export function updateBudgetItem(
       category = COALESCE(?, category),
       name = COALESCE(?, name),
       total_price = CASE WHEN ? IS NOT NULL THEN ? ELSE total_price END,
+      currency = CASE WHEN ? THEN ? ELSE currency END,
+      exchange_rate = CASE WHEN ? IS NOT NULL THEN ? ELSE exchange_rate END,
       persons = CASE WHEN ? IS NOT NULL THEN ? ELSE persons END,
       days = CASE WHEN ? THEN ? ELSE days END,
       note = CASE WHEN ? THEN ? ELSE note END,
@@ -126,6 +197,8 @@ export function updateBudgetItem(
     data.category || null,
     data.name || null,
     data.total_price !== undefined ? 1 : null, data.total_price !== undefined ? data.total_price : 0,
+    data.currency !== undefined ? 1 : 0, data.currency !== undefined ? (data.currency || null) : null,
+    data.exchange_rate !== undefined ? 1 : null, data.exchange_rate !== undefined ? data.exchange_rate : 1,
     data.persons !== undefined ? 1 : null, data.persons !== undefined ? data.persons : null,
     data.days !== undefined ? 1 : 0, data.days !== undefined ? data.days : null,
     data.note !== undefined ? 1 : 0, data.note !== undefined ? data.note : null,
@@ -134,6 +207,15 @@ export function updateBudgetItem(
     id,
   );
 
+  // Optional inline payer/member replacement (the edit modal saves all at once).
+  if (data.payers !== undefined) writeItemPayers(id, data.payers);
+  if (data.member_ids !== undefined) {
+    db.prepare('DELETE FROM budget_item_members WHERE budget_item_id = ?').run(id);
+    const insert = db.prepare('INSERT OR IGNORE INTO budget_item_members (budget_item_id, user_id, paid) VALUES (?, ?, 0)');
+    for (const uid of data.member_ids) insert.run(id, uid);
+    db.prepare('UPDATE budget_items SET persons = ? WHERE id = ?').run(data.member_ids.length || null, id);
+  }
+
   // If category changed, update category order table
   if (data.category) {
     const catExists = db.prepare('SELECT 1 FROM budget_category_order WHERE trip_id = ? AND category = ?').get(tripId, data.category);
@@ -144,8 +226,23 @@ export function updateBudgetItem(
     }
   }
 
-  const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(id) as BudgetItem & { members?: BudgetItemMember[] };
+  const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(id) as BudgetItem;
   updated.members = loadItemMembers(id);
+  updated.payers = loadItemPayers(id);
+  return updated;
+}
+
+// ---------------------------------------------------------------------------
+// Payers
+// ---------------------------------------------------------------------------
+
+export function setItemPayers(id: string | number, tripId: string | number, payers: { user_id: number; amount: number }[]) {
+  const item = db.prepare('SELECT id FROM budget_items WHERE id = ? AND trip_id = ?').get(id, tripId);
+  if (!item) return null;
+  writeItemPayers(id, payers);
+  const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(id) as BudgetItem;
+  updated.members = loadItemMembers(id);
+  updated.payers = loadItemPayers(id);
   return updated;
 }
 
@@ -220,37 +317,65 @@ export function getPerPersonSummary(tripId: string | number) {
 // Settlement calculation (greedy debt matching)
 // ---------------------------------------------------------------------------
 
-export function calculateSettlement(tripId: string | number) {
+export function calculateSettlement(
+  tripId: string | number,
+  opts: { base?: string; rates?: Record<string, number> | null; tripCurrency?: string } = {},
+) {
+  const base = (opts.base || opts.tripCurrency || 'EUR').toUpperCase();
+  const tripCurrency = (opts.tripCurrency || base).toUpperCase();
+  const rates = opts.rates ?? null;
+  // Amount in some currency → base. Pre-rework rows store currency = NULL, which
+  // means "the trip's own currency". rates[X] = units of X per 1 base.
+  const toBase = (amount: number, itemCurrency: string | null | undefined): number => {
+    const cur = (itemCurrency || tripCurrency).toUpperCase();
+    if (cur === base || !rates) return amount;
+    const r = rates[cur];
+    return r && r > 0 ? amount / r : amount;
+  };
+
   const items = db.prepare('SELECT * FROM budget_items WHERE trip_id = ?').all(tripId) as BudgetItem[];
   const allMembers = db.prepare(`
-    SELECT bm.budget_item_id, bm.user_id, bm.paid, u.username, u.avatar
+    SELECT bm.budget_item_id, bm.user_id, u.username, u.avatar
     FROM budget_item_members bm
     JOIN users u ON bm.user_id = u.id
     WHERE bm.budget_item_id IN (SELECT id FROM budget_items WHERE trip_id = ?)
   `).all(tripId) as (BudgetItemMember & { budget_item_id: number })[];
+  const allPayers = db.prepare(`
+    SELECT bp.budget_item_id, bp.user_id, bp.amount, u.username, u.avatar
+    FROM budget_item_payers bp
+    JOIN users u ON bp.user_id = u.id
+    WHERE bp.budget_item_id IN (SELECT id FROM budget_items WHERE trip_id = ?)
+  `).all(tripId) as (BudgetItemPayer & { budget_item_id: number })[];
 
-  // Calculate net balance per user: positive = is owed money, negative = owes money
+  // Net balance per user, in the requested base currency: positive = is owed
+  // money, negative = owes money. Each expense's amounts are converted from their
+  // own currency to the base with live rates, so mixed-currency trips net correctly.
   const balances: Record<number, { user_id: number; username: string; avatar_url: string | null; balance: number }> = {};
+  const ensure = (id: number, src: { username?: string; avatar?: string | null }) => {
+    if (!balances[id]) balances[id] = { user_id: id, username: src.username || '', avatar_url: avatarUrl(src), balance: 0 };
+    return balances[id];
+  };
 
   for (const item of items) {
     const members = allMembers.filter(m => m.budget_item_id === item.id);
-    if (members.length === 0) continue;
+    const payers = allPayers.filter(p => p.budget_item_id === item.id);
+    if (members.length === 0) continue; // planning-only entry → doesn't affect balances
 
-    const payers = members.filter(m => m.paid);
-    if (payers.length === 0) continue; // no one marked as paid
+    const paidBase = payers.reduce((a, p) => a + toBase(p.amount > 0 ? p.amount : 0, item.currency), 0);
+    const sharePerMember = paidBase / members.length;
 
-    const sharePerMember = item.total_price / members.length;
-    const paidPerPayer = item.total_price / payers.length;
+    // Payers are credited what they actually paid (converted to base)…
+    for (const p of payers) ensure(p.user_id, p).balance += toBase(p.amount > 0 ? p.amount : 0, item.currency);
+    // …and every split participant owes an equal share of the base total.
+    for (const m of members) ensure(m.user_id, m).balance -= sharePerMember;
+  }
 
-    for (const m of members) {
-      if (!balances[m.user_id]) {
-        balances[m.user_id] = { user_id: m.user_id, username: m.username, avatar_url: avatarUrl(m), balance: 0 };
-      }
-      // Everyone owes their share
-      balances[m.user_id].balance -= sharePerMember;
-      // Payers get credited what they paid
-      if (m.paid) balances[m.user_id].balance += paidPerPayer;
-    }
+  // Persisted settle-up transfers already moved money: the payer's debt shrinks,
+  // the receiver's credit shrinks, so the corresponding flow disappears.
+  const settlements = listSettlements(tripId);
+  for (const s of settlements) {
+    if (balances[s.from_user_id]) balances[s.from_user_id].balance += s.amount;
+    if (balances[s.to_user_id]) balances[s.to_user_id].balance -= s.amount;
   }
 
   // Calculate optimized payment flows (greedy algorithm)
@@ -283,9 +408,52 @@ export function calculateSettlement(tripId: string | number) {
   return {
     balances: Object.values(balances).map(b => ({ ...b, balance: Math.round(b.balance * 100) / 100 })),
     flows,
+    settlements,
   };
 }
 
+// ---------------------------------------------------------------------------
+// Settlements (persisted settle-up transfers — history + undo)
+// ---------------------------------------------------------------------------
+
+export function listSettlements(tripId: string | number) {
+  const rows = db.prepare(`
+    SELECT s.id, s.trip_id, s.from_user_id, s.to_user_id, s.amount, s.created_at, s.created_by_user_id,
+           fu.username AS from_username, fu.avatar AS from_avatar,
+           tu.username AS to_username,   tu.avatar AS to_avatar
+    FROM budget_settlements s
+    JOIN users fu ON s.from_user_id = fu.id
+    JOIN users tu ON s.to_user_id = tu.id
+    WHERE s.trip_id = ?
+    ORDER BY s.created_at DESC, s.id DESC
+  `).all(tripId) as any[];
+  return rows.map(r => ({
+    id: r.id, trip_id: r.trip_id,
+    from_user_id: r.from_user_id, to_user_id: r.to_user_id,
+    amount: r.amount, created_at: r.created_at, created_by_user_id: r.created_by_user_id,
+    from_username: r.from_username, from_avatar_url: avatarUrl({ avatar: r.from_avatar }),
+    to_username: r.to_username, to_avatar_url: avatarUrl({ avatar: r.to_avatar }),
+  }));
+}
+
+export function createSettlement(
+  tripId: string | number,
+  data: { from_user_id: number; to_user_id: number; amount: number },
+  createdByUserId?: number,
+) {
+  const result = db.prepare(
+    'INSERT INTO budget_settlements (trip_id, from_user_id, to_user_id, amount, created_by_user_id) VALUES (?, ?, ?, ?, ?)'
+  ).run(tripId, data.from_user_id, data.to_user_id, Math.round(data.amount * 100) / 100, createdByUserId ?? null);
+  return listSettlements(tripId).find(s => s.id === Number(result.lastInsertRowid)) || null;
+}
+
+export function deleteSettlement(id: string | number, tripId: string | number): boolean {
+  const row = db.prepare('SELECT id FROM budget_settlements WHERE id = ? AND trip_id = ?').get(id, tripId);
+  if (!row) return false;
+  db.prepare('DELETE FROM budget_settlements WHERE id = ?').run(id);
+  return true;
+}
+
 // ---------------------------------------------------------------------------
 // Reorder
 // ---------------------------------------------------------------------------

server/src/services/cookie.ts

@@ -1,4 +1,5 @@
 import { Request, Response } from 'express';
+import { SESSION_DURATION_MS } from '../config';
 
 const COOKIE_NAME = 'trek_session';
 
@@ -32,7 +33,7 @@ function buildOptions(clear: boolean, secure: boolean) {
     secure,
     sameSite: 'lax' as const,
     path: '/',
-    ...(clear ? {} : { maxAge: 24 * 60 * 60 * 1000 }), // 24h — matches JWT expiry
+    ...(clear ? {} : { maxAge: SESSION_DURATION_MS }), // matches the JWT expiry (SESSION_DURATION)
   };
 }
 

server/src/services/exchangeRateService.ts

@@ -0,0 +1,68 @@
+/**
+ * Live exchange rates for the Costs/Budget money conversion.
+ *
+ * Fetches from exchangerate-api.com (no key, already CSP-allowlisted for the
+ * dashboard widget) and caches per base currency in-memory for a few hours so a
+ * settlement request never hammers the upstream. Rates are "units of X per 1
+ * base", so an amount in currency C converts to base as `amount / rates[C]`.
+ *
+ * Everything degrades gracefully: if the fetch fails (offline, upstream down),
+ * callers get `null`/identity conversion and amounts are treated as already in
+ * the base currency rather than throwing.
+ */
+
+const TTL_MS = 6 * 60 * 60 * 1000; // 6h
+const cache = new Map<string, { rates: Record<string, number>; ts: number }>();
+const inflight = new Map<string, Promise<Record<string, number> | null>>();
+
+async function fetchRates(base: string): Promise<Record<string, number> | null> {
+  try {
+    const res = await fetch(`https://api.exchangerate-api.com/v4/latest/${encodeURIComponent(base)}`);
+    if (!res.ok) return null;
+    const data = (await res.json()) as { rates?: Record<string, number> };
+    return data.rates && typeof data.rates === 'object' ? data.rates : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Rates map for `base` (cached). Returns null if unavailable. */
+export async function getRates(base: string): Promise<Record<string, number> | null> {
+  const key = (base || 'EUR').toUpperCase();
+  const hit = cache.get(key);
+  const now = Date.now();
+  if (hit && now - hit.ts < TTL_MS) return hit.rates;
+
+  // Coalesce concurrent fetches for the same base.
+  let p = inflight.get(key);
+  if (!p) {
+    p = fetchRates(key).then(rates => {
+      if (rates) cache.set(key, { rates, ts: Date.now() });
+      inflight.delete(key);
+      return rates;
+    });
+    inflight.set(key, p);
+  }
+  const rates = await p;
+  // On failure fall back to the last cached value if we have one.
+  if (!rates && hit) return hit.rates;
+  return rates;
+}
+
+/**
+ * Convert `amount` from `from` currency into `base` using a rates map obtained
+ * from getRates(base). Identity when same currency or the rate is missing.
+ */
+export function convertWithRates(
+  amount: number,
+  from: string | null | undefined,
+  base: string,
+  rates: Record<string, number> | null,
+): number {
+  const fromCur = (from || base).toUpperCase();
+  const baseCur = base.toUpperCase();
+  if (fromCur === baseCur || !rates) return amount;
+  const r = rates[fromCur];
+  if (!r || r <= 0) return amount;
+  return amount / r;
+}

server/src/services/oidcService.ts

@@ -1,7 +1,7 @@
 import crypto from 'crypto';
 import jwt from 'jsonwebtoken';
 import { db } from '../db/database';
-import { JWT_SECRET } from '../config';
+import { JWT_SECRET, SESSION_DURATION_SECONDS } from '../config';
 import { User } from '../types';
 import { decrypt_api_key } from './apiKeyCrypto';
 import { resolveAuthToggles } from './authService';
@@ -200,7 +200,7 @@ export function frontendUrl(path: string): string {
 }
 
 export function generateToken(user: { id: number }): string {
-  return jwt.sign({ id: user.id }, JWT_SECRET, { expiresIn: '24h', algorithm: 'HS256' });
+  return jwt.sign({ id: user.id }, JWT_SECRET, { expiresIn: SESSION_DURATION_SECONDS, algorithm: 'HS256' });
 }
 
 // ---------------------------------------------------------------------------

server/src/types.ts

@@ -122,13 +122,18 @@ export interface BudgetItem {
   category: string;
   name: string;
   total_price: number;
+  currency?: string | null;
+  exchange_rate?: number;
   persons?: number | null;
   days?: number | null;
   note?: string | null;
   reservation_id?: number | null;
+  paid_by_user_id?: number | null;
+  expense_date?: string | null;
   sort_order: number;
   created_at?: string;
   members?: BudgetItemMember[];
+  payers?: BudgetItemPayer[];
 }
 
 export interface BudgetItemMember {
@@ -140,6 +145,15 @@ export interface BudgetItemMember {
   budget_item_id?: number;
 }
 
+export interface BudgetItemPayer {
+  user_id: number;
+  amount: number;
+  username?: string;
+  avatar_url?: string | null;
+  avatar?: string | null;
+  budget_item_id?: number;
+}
+
 export interface ReservationEndpoint {
   id: number;
   reservation_id: number;

server/tests/helpers/test-db.ts

@@ -120,7 +120,7 @@ const DEFAULT_CATEGORIES = [
 
 const DEFAULT_ADDONS = [
   { id: 'packing',   name: 'Packing List',    description: 'Pack your bags',            type: 'trip',        icon: 'ListChecks',  enabled: 1, sort_order: 0  },
-  { id: 'budget',    name: 'Budget Planner',  description: 'Track expenses',             type: 'trip',        icon: 'Wallet',      enabled: 1, sort_order: 1  },
+  { id: 'budget',    name: 'Costs',           description: 'Track and split trip expenses', type: 'trip',     icon: 'Wallet',      enabled: 1, sort_order: 1  },
   { id: 'documents', name: 'Documents',       description: 'Manage travel documents',    type: 'trip',        icon: 'FileText',    enabled: 1, sort_order: 2  },
   { id: 'vacay',     name: 'Vacay',           description: 'Vacation day planner',       type: 'global',      icon: 'CalendarDays',enabled: 1, sort_order: 10 },
   { id: 'atlas',     name: 'Atlas',           description: 'Visited countries map',      type: 'global',      icon: 'Globe',       enabled: 1, sort_order: 11 },
@@ -262,4 +262,7 @@ export const TEST_CONFIG = {
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
 };

server/tests/integration/admin.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/assignments.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/atlas.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/auth.test.ts

@@ -47,6 +47,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/backup.test.ts

@@ -40,6 +40,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/bootstrap.test.ts

@@ -38,6 +38,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/budget.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));
@@ -347,10 +350,12 @@ describe('Budget summary and settlement', () => {
       .put(`/api/trips/${trip.id}/budget/${item.id}/members`)
       .set('Cookie', authCookie(user.id))
       .send({ user_ids: [user.id, user2.id] });
+    // New model: who actually paid is recorded as an explicit payer (amount in
+    // the expense currency), not a per-member "paid" toggle.
     await request(app)
-      .put(`/api/trips/${trip.id}/budget/${item.id}/members/${user.id}/paid`)
+      .put(`/api/trips/${trip.id}/budget/${item.id}/payers`)
       .set('Cookie', authCookie(user.id))
-      .send({ paid: true });
+      .send({ payers: [{ user_id: user.id, amount: 60 }] });
 
     const res = await request(app)
       .get(`/api/trips/${trip.id}/budget/settlement`)

server/tests/integration/categories.test.ts

@@ -31,6 +31,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/collab.test.ts

@@ -41,6 +41,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/dayNotes.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/days.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/files.test.ts

@@ -43,6 +43,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/immich.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/journey.test.ts

@@ -44,6 +44,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({

server/tests/integration/maps.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/mcp.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/memories-immich.test.ts

@@ -37,6 +37,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/memories-synology.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/memories-unified.test.ts

@@ -37,6 +37,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/misc.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/notifications.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/oauth.test.ts

@@ -38,6 +38,9 @@ vi.mock('../../src/config', () => ({
     JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
     ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
     updateJwtSecret: () => {},
+    SESSION_DURATION: '24h',
+    SESSION_DURATION_MS: 86400000,
+    SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 

server/tests/integration/oidc.test.ts

@@ -35,6 +35,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/packing.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/places.test.ts

@@ -42,6 +42,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/profile.test.ts

@@ -37,6 +37,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/reservations.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/security.test.ts

@@ -43,6 +43,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/settings.test.ts

@@ -31,6 +31,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/share.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/systemNotices.test.ts

@@ -34,6 +34,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/tags.test.ts

@@ -31,6 +31,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/todo.test.ts

@@ -31,6 +31,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/trips.test.ts

@@ -44,6 +44,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/integration/vacay.test.ts

@@ -36,6 +36,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));
 vi.mock('../../src/websocket', () => ({ broadcast: vi.fn(), broadcastToUser: vi.fn() }));

server/tests/unit/mcp/tools-budget.test.ts

@@ -88,7 +88,7 @@ describe('Tool: create_budget_item', () => {
         arguments: { tripId: trip.id, name: 'Misc', total_price: 10 },
       });
       const data = parseToolResult(result) as any;
-      expect(data.item.category).toBe('Other');
+      expect(data.item.category).toBe('other');
     });
   });
 

server/tests/unit/services/budgetService.test.ts

@@ -2,26 +2,14 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 // ── DB mock setup ────────────────────────────────────────────────────────────
 
-interface MockPrepared {
-  all: ReturnType<typeof vi.fn>;
-  get: ReturnType<typeof vi.fn>;
-  run: ReturnType<typeof vi.fn>;
-}
-
-const preparedMap: Record<string, MockPrepared> = {};
-let defaultAll: ReturnType<typeof vi.fn>;
-let defaultGet: ReturnType<typeof vi.fn>;
-
 const mockDb = vi.hoisted(() => {
   return {
     db: {
-      prepare: vi.fn((sql: string) => {
-        return {
-          all: vi.fn(() => []),
-          get: vi.fn(() => undefined),
-          run: vi.fn(),
-        };
-      }),
+      prepare: vi.fn(() => ({
+        all: vi.fn(() => []),
+        get: vi.fn(() => undefined),
+        run: vi.fn(),
+      })),
     },
     canAccessTrip: vi.fn(() => true),
   };
@@ -30,25 +18,29 @@ const mockDb = vi.hoisted(() => {
 vi.mock('../../../src/db/database', () => mockDb);
 
 import { calculateSettlement } from '../../../src/services/budgetService';
-import type { BudgetItem, BudgetItemMember } from '../../../src/types';
+import type { BudgetItem, BudgetItemMember, BudgetItemPayer } from '../../../src/types';
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
+// Who actually paid is recorded as explicit payers (budget_item_payers); members
+// are only the equal-split participants.
 
 function makeItem(id: number, total_price: number, trip_id = 1): BudgetItem {
-  return { id, trip_id, name: `Item ${id}`, total_price, category: 'Other' } as BudgetItem;
+  return { id, trip_id, name: `Item ${id}`, total_price, category: 'other' } as BudgetItem;
 }
 
-function makeMember(budget_item_id: number, user_id: number, paid: boolean | 0 | 1, username: string): BudgetItemMember & { budget_item_id: number } {
-  return {
-    budget_item_id,
-    user_id,
-    paid: paid ? 1 : 0,
-    username,
-    avatar: null,
-  } as BudgetItemMember & { budget_item_id: number };
+function makeMember(budget_item_id: number, user_id: number, username: string): BudgetItemMember & { budget_item_id: number } {
+  return { budget_item_id, user_id, paid: 0, username, avatar: null } as BudgetItemMember & { budget_item_id: number };
 }
 
-function setupDb(items: BudgetItem[], members: (BudgetItemMember & { budget_item_id: number })[]) {
+function makePayer(budget_item_id: number, user_id: number, amount: number, username: string): BudgetItemPayer & { budget_item_id: number } {
+  return { budget_item_id, user_id, amount, username, avatar: null } as BudgetItemPayer & { budget_item_id: number };
+}
+
+function setupDb(
+  items: BudgetItem[],
+  members: (BudgetItemMember & { budget_item_id: number })[],
+  payers: (BudgetItemPayer & { budget_item_id: number })[] = [],
+) {
   mockDb.db.prepare.mockImplementation((sql: string) => {
     if (sql.includes('SELECT * FROM budget_items')) {
       return { all: vi.fn(() => items), get: vi.fn(), run: vi.fn() };
@@ -56,45 +48,51 @@ function setupDb(items: BudgetItem[], members: (BudgetItemMember & { budget_item
     if (sql.includes('budget_item_members')) {
       return { all: vi.fn(() => members), get: vi.fn(), run: vi.fn() };
     }
+    if (sql.includes('budget_item_payers')) {
+      return { all: vi.fn(() => payers), get: vi.fn(), run: vi.fn() };
+    }
+    // budget_settlements and anything else → empty
     return { all: vi.fn(() => []), get: vi.fn(), run: vi.fn() };
   });
 }
 
 beforeEach(() => {
   vi.clearAllMocks();
-  setupDb([], []);
+  setupDb([], [], []);
 });
 
 // ── calculateSettlement ──────────────────────────────────────────────────────
 
 describe('calculateSettlement', () => {
   it('returns empty balances and flows when trip has no items', () => {
-    setupDb([], []);
+    setupDb([], [], []);
     const result = calculateSettlement(1);
     expect(result.balances).toEqual([]);
     expect(result.flows).toEqual([]);
   });
 
   it('returns no flows when there are items but no members', () => {
-    setupDb([makeItem(1, 100)], []);
+    setupDb([makeItem(1, 100)], [], [makePayer(1, 1, 100, 'alice')]);
     const result = calculateSettlement(1);
     expect(result.flows).toEqual([]);
   });
 
-  it('returns no flows when no one is marked as paid', () => {
+  it('returns no flows when no one has paid', () => {
     setupDb(
       [makeItem(1, 100)],
-      [makeMember(1, 1, 0, 'alice'), makeMember(1, 2, 0, 'bob')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob')],
+      [],
     );
     const result = calculateSettlement(1);
     expect(result.flows).toEqual([]);
   });
 
   it('2 members, 1 payer: payer is owed half, non-payer owes half', () => {
-    // Item: $100. Alice paid, Bob did not. Each owes $50. Alice net: +$50. Bob net: -$50.
+    // Item: $100. Alice paid all, [Alice, Bob] split. Each owes $50. Alice net: +$50. Bob: -$50.
     setupDb(
       [makeItem(1, 100)],
-      [makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 0, 'bob')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob')],
+      [makePayer(1, 1, 100, 'alice')],
     );
     const result = calculateSettlement(1);
     const alice = result.balances.find(b => b.user_id === 1)!;
@@ -111,7 +109,8 @@ describe('calculateSettlement', () => {
     // Item: $90. Alice paid. Each of 3 owes $30. Alice net: +$60. Bob: -$30. Carol: -$30.
     setupDb(
       [makeItem(1, 90)],
-      [makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 0, 'bob'), makeMember(1, 3, 0, 'carol')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob'), makeMember(1, 3, 'carol')],
+      [makePayer(1, 1, 90, 'alice')],
     );
     const result = calculateSettlement(1);
     const alice = result.balances.find(b => b.user_id === 1)!;
@@ -124,12 +123,11 @@ describe('calculateSettlement', () => {
   });
 
   it('all paid equally: all balances are zero, no flows', () => {
-    // Item: $60. 3 members, all paid equally (each paid $20, each owes $20). Net: 0.
-    // Actually with "paid" flag it means: paidPerPayer = item.total / numPayers.
-    // If all 3 paid: each gets +20 credit, each owes -20 = net 0 for everyone.
+    // Item: $60. 3 members, each paid $20 and owes $20. Net: 0 for everyone.
     setupDb(
       [makeItem(1, 60)],
-      [makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 1, 'bob'), makeMember(1, 3, 1, 'carol')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob'), makeMember(1, 3, 'carol')],
+      [makePayer(1, 1, 20, 'alice'), makePayer(1, 2, 20, 'bob'), makePayer(1, 3, 20, 'carol')],
     );
     const result = calculateSettlement(1);
     for (const b of result.balances) {
@@ -142,7 +140,8 @@ describe('calculateSettlement', () => {
     // Alice paid $100 for 2 people. Bob owes Alice $50.
     setupDb(
       [makeItem(1, 100)],
-      [makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 0, 'bob')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob')],
+      [makePayer(1, 1, 100, 'alice')],
     );
     const result = calculateSettlement(1);
     const flow = result.flows[0];
@@ -154,7 +153,8 @@ describe('calculateSettlement', () => {
     // Item: $10. 3 members, 1 payer. Share = 3.333... Each rounded to 3.33.
     setupDb(
       [makeItem(1, 10)],
-      [makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 0, 'bob'), makeMember(1, 3, 0, 'carol')],
+      [makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob'), makeMember(1, 3, 'carol')],
+      [makePayer(1, 1, 10, 'alice')],
     );
     const result = calculateSettlement(1);
     for (const b of result.balances) {
@@ -176,9 +176,10 @@ describe('calculateSettlement', () => {
     setupDb(
       [makeItem(1, 100), makeItem(2, 60)],
       [
-        makeMember(1, 1, 1, 'alice'), makeMember(1, 2, 0, 'bob'),
-        makeMember(2, 1, 0, 'alice'), makeMember(2, 2, 1, 'bob'),
+        makeMember(1, 1, 'alice'), makeMember(1, 2, 'bob'),
+        makeMember(2, 1, 'alice'), makeMember(2, 2, 'bob'),
       ],
+      [makePayer(1, 1, 100, 'alice'), makePayer(2, 2, 60, 'bob')],
     );
     const result = calculateSettlement(1);
     const alice = result.balances.find(b => b.user_id === 1)!;

server/tests/websocket/connection.test.ts

@@ -39,6 +39,9 @@ vi.mock('../../src/config', () => ({
   JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
   ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
   updateJwtSecret: () => {},
+  SESSION_DURATION: '24h',
+  SESSION_DURATION_MS: 86400000,
+  SESSION_DURATION_SECONDS: 86400,
   DEFAULT_LANGUAGE: 'en',
 }));