chore: bump version to 2.8.3 [skip ci]

Removes 'groups' from the default OIDC_SCOPE fallback, which caused
invalid_scope errors with providers that don't support it (e.g. Google).

Fixes #391

.dockerignore

@@ -6,8 +6,8 @@ data
 uploads
 .git
 .github
-.env
-.env.*
+**/.env
+**/.env.*
 *.log
 *.md
 !client/**/*.md
@@ -21,8 +21,12 @@ unraid-template.xml
 *.db
 *.db-shm
 *.db-wal
-coverage
+**/coverage
 .DS_Store
 Thumbs.db
 .vscode
 .idea
+sonar-project.properties
+server/tests/
+server/vitest.config.ts
+server/reset-admin.js

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,38 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: "[BUG]"
-labels: ''
-assignees: ''
-
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
-
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,108 @@
+name: Bug Report
+description: Create a report to help us improve TREK
+title: "[BUG] "
+labels: []
+body:
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Pre-flight checklist
+      options:
+        - label: I have searched [existing issues](https://github.com/mauriceboe/TREK/issues) and this bug has not been reported yet
+          required: true
+        - label: I am running the latest available version of TREK
+          required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: TREK version
+      description: Found in the Settings → About, or in the Docker image tag
+      placeholder: "e.g. 2.8.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+      placeholder: When I do X, Y happens instead of Z…
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Step-by-step instructions to reliably trigger the bug.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Deployment method
+      options:
+        - Docker Compose
+        - Docker (standalone)
+        - Kubernetes / Helm
+        - Unraid template
+        - Sources
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Host OS
+      placeholder: "e.g. Ubuntu 24.04, Unraid 6.12, Synology DSM 7"
+
+  - type: dropdown
+    id: user_os
+    attributes:
+      label: Accessing TREK from
+      options:
+        - Desktop browser
+        - Mobile browser
+        - Mobile app (PWA)
+    validations:
+      required: true
+
+  - type: input
+    id: browser
+    attributes:
+      label: Browser (if applicable)
+      placeholder: "e.g. Chrome 124, Firefox 125, Safari 17"
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or error output
+      description: Paste any relevant server or browser console output here.
+      render: shell
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: Drag and drop screenshots here if applicable.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Anything else that might help us understand the issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://github.com/mauriceboe/TREK/wiki
+    about: Check the docs before opening an issue
+  - name: Feature Request
+    url: https://github.com/mauriceboe/TREK/discussions/new?category=feature-requests
+    about: Suggest a new feature or improvement in Discussions
+  - name: Questions & Help
+    url: https://github.com/mauriceboe/TREK/discussions
+    about: For questions and general help, use Discussions instead

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: "[FEATURE]"
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/workflows/close-untitled-issues.yml

@@ -0,0 +1,67 @@
+name: Close untitled issues
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  check-title:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Close if title is empty or generic
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = context.payload.issue.title.trim();
+            const badTitles = [
+              "[bug]",
+              "bug report",
+              "bug",
+              "issue",
+            ];
+            
+            const featureRequestTitles = [
+              "feature request",
+              "[feature]",
+              "[feature request]",
+              "[enhancement]"
+            ]
+
+            const titleLower = title.toLowerCase();
+
+            if (badTitles.includes(titleLower)) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                body: "This issue was closed because no title was provided. Please re-open with a descriptive title that summarizes the problem."
+              });
+
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                state: "closed",
+                state_reason: "not_planned"
+              });
+            } else if (featureRequestTitles.some(t => titleLower.startsWith(t))) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                body: "Feature requests should be made in the [Discussions](https://github.com/mauriceboe/TREK/discussions/new?category=feature-requests) — not as issues. This issue has been closed."
+              });
+
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                state: "closed",
+                state_reason: "not_planned"
+              });
+            }

.github/workflows/docker.yml

@@ -3,11 +3,72 @@ name: Build & Push Docker Image
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
+  version-bump:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.bump.outputs.VERSION }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine bump type and update version
+        id: bump
+        run: |
+          # Check if this push is a merge commit from dev branch
+          COMMIT_MSG=$(git log -1 --pretty=%s)
+          PARENT_COUNT=$(git log -1 --pretty=%p | wc -w)
+
+          if echo "$COMMIT_MSG" | grep -qiE "^Merge (pull request|branch).*dev"; then
+            BUMP="minor"
+          elif [ "$PARENT_COUNT" -gt 1 ] && git log -1 --pretty=%P | xargs -n1 git branch -r --contains 2>/dev/null | grep -q "origin/dev"; then
+            BUMP="minor"
+          else
+            BUMP="patch"
+          fi
+
+          echo "Bump type: $BUMP"
+
+          # Read current version
+          CURRENT=$(node -p "require('./server/package.json').version")
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
+
+          if [ "$BUMP" = "minor" ]; then
+            MINOR=$((MINOR + 1))
+            PATCH=0
+          else
+            PATCH=$((PATCH + 1))
+          fi
+
+          NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "$CURRENT → $NEW_VERSION ($BUMP)"
+
+          # Update both package.json files
+          cd server && npm version "$NEW_VERSION" --no-git-tag-version && cd ..
+          cd client && npm version "$NEW_VERSION" --no-git-tag-version && cd ..
+
+          # Commit and tag
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add server/package.json server/package-lock.json client/package.json client/package-lock.json
+          git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
+          git tag "v$NEW_VERSION"
+          git push origin main --follow-tags
+
   build:
     runs-on: ${{ matrix.runner }}
+    needs: version-bump
     strategy:
       fail-fast: false
       matrix:
@@ -21,6 +82,8 @@ jobs:
         run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV
 
       - uses: actions/checkout@v4
+        with:
+          ref: main
 
       - uses: docker/setup-buildx-action@v3
 
@@ -54,13 +117,11 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
-    needs: build
+    needs: [version-bump, build]
     steps:
       - uses: actions/checkout@v4
-
-      - name: Get version from package.json
-        id: version
-        run: echo "VERSION=$(node -p "require('./server/package.json').version")" >> $GITHUB_OUTPUT
+        with:
+          ref: main
 
       - name: Download build digests
         uses: actions/download-artifact@v4
@@ -79,12 +140,13 @@ jobs:
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
         run: |
+          VERSION=${{ needs.version-bump.outputs.version }}
           mapfile -t digests < <(printf 'mauriceboe/trek@sha256:%s\n' *)
           docker buildx imagetools create \
             -t mauriceboe/trek:latest \
-            -t mauriceboe/trek:${{ steps.version.outputs.VERSION }} \
+            -t mauriceboe/trek:$VERSION \
             -t mauriceboe/nomad:latest \
-            -t mauriceboe/nomad:${{ steps.version.outputs.VERSION }} \
+            -t mauriceboe/nomad:$VERSION \
             "${digests[@]}"
 
       - name: Inspect manifest

.github/workflows/test.yml

@@ -0,0 +1,44 @@
+name: Tests
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'server/**'
+      - '.github/workflows/test.yml'
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - 'server/**'
+      - '.github/workflows/test.yml'
+
+jobs:
+  server-tests:
+    name: Server Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: server/package-lock.json
+
+      - name: Install dependencies
+        run: cd server && npm ci
+
+      - name: Run tests
+        run: cd server && npm run test:coverage
+
+      - name: Upload coverage
+        if: success()
+        uses: actions/upload-artifact@v6
+        with:
+          name: coverage
+          path: server/coverage/
+          retention-days: 7

.gitignore

@@ -56,3 +56,5 @@ coverage
 .cache
 *.tsbuildinfo
 *.tgz
+
+.scannerwork

AUDIT_FINDINGS.md

@@ -1,281 +0,0 @@
-# TREK Security & Code Quality Audit
-
-**Date:** 2026-03-30
-**Auditor:** Automated comprehensive audit
-**Scope:** Full codebase — server, client, infrastructure, dependencies
-
----
-
-## Table of Contents
-
-1. [Security](#1-security)
-2. [Code Quality](#2-code-quality)
-3. [Best Practices](#3-best-practices)
-4. [Dependency Hygiene](#4-dependency-hygiene)
-5. [Documentation & DX](#5-documentation--dx)
-6. [Testing](#6-testing)
-7. [Remediation Summary](#7-remediation-summary)
-
----
-
-## 1. Security
-
-### 1.1 General
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| S-1 | **CRITICAL** | `server/src/middleware/auth.ts` | 17 | JWT `verify()` does not pin algorithm — accepts whatever algorithm is in the token header, potentially including `none`. | Pass `{ algorithms: ['HS256'] }` to all `jwt.verify()` calls. | FIXED |
-| S-2 | **HIGH** | `server/src/websocket.ts` | 56 | Same JWT verify without algorithm pinning in WebSocket auth. | Pin algorithm to HS256. | FIXED |
-| S-3 | **HIGH** | `server/src/middleware/mfaPolicy.ts` | 54 | Same JWT verify without algorithm pinning. | Pin algorithm to HS256. | FIXED |
-| S-4 | **HIGH** | `server/src/routes/oidc.ts` | 84-88 | OIDC `generateToken()` includes excessive claims (username, email, role) in JWT payload. If the JWT is leaked, this exposes PII. | Only include `{ id: user.id }` in token, consistent with auth.ts. | FIXED |
-| S-5 | **HIGH** | `client/src/api/websocket.ts` | 27 | Auth token passed in WebSocket URL query string (`?token=`). Tokens in URLs appear in server logs, proxy logs, and browser history. | Document as known limitation; WebSocket protocol doesn't easily support headers from browsers. Add `LOW` priority note to switch to message-based auth in the future. | DOCUMENTED |
-| S-6 | **HIGH** | `client/vite.config.js` | 47-56 | Service worker caches ALL `/api/.*` responses with `NetworkFirst`, including auth tokens, user data, budget, reservations. Data persists after logout. | Exclude sensitive API paths from caching: `/api/auth/.*`, `/api/admin/.*`, `/api/backup/.*`. | FIXED |
-| S-7 | **HIGH** | `client/vite.config.js` | 57-65 | User-uploaded files (possibly passport scans, booking confirmations) cached with `CacheFirst` for 30 days, persisting after logout. | Reduce cache lifetime; add note about clearing on logout. | FIXED |
-| S-8 | **MEDIUM** | `server/src/index.ts` | 60 | CSP allows `'unsafe-inline'` for scripts, weakening XSS protection. | Remove `'unsafe-inline'` from `scriptSrc` if Vite build doesn't require it. If needed for development, only allow in non-production. | FIXED |
-| S-9 | **MEDIUM** | `server/src/index.ts` | 64 | CSP `connectSrc` allows `http:` and `https:` broadly, permitting connections to any origin. | Restrict to known API domains (nominatim, overpass, Google APIs) or use `'self'` with specific external origins. | FIXED |
-| S-10 | **MEDIUM** | `server/src/index.ts` | 62 | CSP `imgSrc` allows `http:` broadly. | Restrict to `https:` and `'self'` plus known image domains. | FIXED |
-| S-11 | **MEDIUM** | `server/src/websocket.ts` | 84-90 | No message size limit on WebSocket messages. A malicious client could send very large messages to exhaust server memory. | Set `maxPayload` on WebSocketServer configuration. | FIXED |
-| S-12 | **MEDIUM** | `server/src/websocket.ts` | 84 | No rate limiting on WebSocket messages. A client can flood the server with join/leave messages. | Add per-connection message rate limiting. | FIXED |
-| S-13 | **MEDIUM** | `server/src/websocket.ts` | 29 | No origin validation on WebSocket connections. | Add origin checking against allowed origins. | FIXED |
-| S-14 | **MEDIUM** | `server/src/routes/auth.ts` | 157-163 | JWT tokens have 24h expiry with no refresh token mechanism. Long-lived tokens increase window of exposure if leaked. | Document as accepted risk for self-hosted app. Consider refresh tokens in future. | DOCUMENTED |
-| S-15 | **MEDIUM** | `server/src/routes/auth.ts` | 367-368 | Password change does not invalidate existing JWT tokens. Old tokens remain valid for up to 24h. | Implement token version/generation tracking, or reduce token expiry and add refresh tokens. | REQUIRES MANUAL REVIEW |
-| S-16 | **MEDIUM** | `server/src/services/mfaCrypto.ts` | 2, 5 | MFA encryption key is derived from JWT_SECRET. If JWT_SECRET is compromised, all MFA secrets are also compromised. Single point of failure. | Use a separate MFA_ENCRYPTION_KEY env var, or derive using a different salt/purpose. Current implementation with `:mfa:v1` salt is acceptable but tightly coupled. | DOCUMENTED |
-| S-17 | **MEDIUM** | `server/src/routes/maps.ts` | 429 | Google API key exposed in URL query string (`&key=${apiKey}`). Could appear in logs. | Use header-based auth (X-Goog-Api-Key) consistently. Already used elsewhere in the file. | FIXED |
-| S-18 | **MEDIUM** | `MCP.md` | 232-235 | Contains publicly accessible database download link with hardcoded credentials (`admin@admin.com` / `admin123`). | Remove credentials from documentation. | FIXED |
-| S-19 | **LOW** | `server/src/index.ts` | 229 | Error handler logs full error object including stack trace to console. In containerized deployments, this could leak to centralized logging. | Sanitize error logging in production. | FIXED |
-| S-20 | **LOW** | `server/src/routes/backup.ts` | 301-304 | Error detail leaked in non-production environments (`detail: process.env.NODE_ENV !== 'production' ? msg : undefined`). | Acceptable for dev, but ensure it's consistently not leaked in production. Already correct. | OK |
-
-### 1.2 Auth (JWT + OIDC + TOTP)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| A-1 | **CRITICAL** | All jwt.verify calls | Multiple | JWT algorithm not pinned. `jsonwebtoken` library defaults to accepting the algorithm specified in the token header, which could include `none`. | Add `{ algorithms: ['HS256'] }` to every `jwt.verify()` call. | FIXED |
-| A-2 | **MEDIUM** | `server/src/routes/auth.ts` | 315-318 | MFA login token uses same JWT_SECRET and same `jwt.sign()`. Purpose field `mfa_login` prevents misuse but should use a shorter expiry. Currently 5m which is acceptable. | OK — 5 minute expiry is reasonable. | OK |
-| A-3 | **MEDIUM** | `server/src/routes/oidc.ts` | 113-143 | OIDC redirect URI is dynamically constructed from request headers (`x-forwarded-proto`, `x-forwarded-host`). An attacker who can control these headers could redirect the callback to a malicious domain. | Validate the constructed redirect URI against an allowlist, or use a configured base URL from env vars. | FIXED |
-| A-4 | **LOW** | `server/src/routes/auth.ts` | 21 | TOTP `window: 1` allows codes from adjacent time periods (±30s). This is standard and acceptable. | OK | OK |
-
-### 1.3 SQLite (better-sqlite3)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| D-1 | **HIGH** | `server/src/routes/files.ts` | 90-91 | Dynamic SQL with `IN (${placeholders})` — however, placeholders are correctly generated from array length and values are parameterized. **Not an injection risk.** | OK — pattern is safe. | OK |
-| D-2 | **MEDIUM** | `server/src/routes/auth.ts` | 455 | Dynamic SQL `UPDATE users SET ${updates.join(', ')} WHERE id = ?` — column names come from controlled server-side code, not user input. Parameters are properly bound. | OK — column names are from a controlled set. | OK |
-| D-3 | **LOW** | `server/src/db/database.ts` | 26-28 | WAL mode and busy_timeout configured. Good. | OK | OK |
-
-### 1.4 WebSocket (ws)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| W-1 | **MEDIUM** | `server/src/websocket.ts` | 29 | No `maxPayload` set on WebSocketServer. Default is 100MB which is excessive. | Set `maxPayload: 64 * 1024` (64KB). | FIXED |
-| W-2 | **MEDIUM** | `server/src/websocket.ts` | 84-110 | Only `join` and `leave` message types are handled; unknown types are silently ignored. This is acceptable but there is no schema validation on the message structure. | Add basic type/schema validation using Zod. | FIXED |
-| W-3 | **LOW** | `server/src/websocket.ts` | 88 | `JSON.parse` errors are silently caught with empty catch. | Log malformed messages at debug level. | FIXED |
-
-### 1.5 Express
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| E-1 | **LOW** | `server/src/index.ts` | 82 | Body parser limit set to 100KB. Good. | OK | OK |
-| E-2 | **LOW** | `server/src/index.ts` | 14-16 | Trust proxy configured conditionally. Good. | OK | OK |
-| E-3 | **LOW** | `server/src/index.ts` | 121-136 | Path traversal protection on uploads endpoint. Uses `path.basename` and `path.resolve` check. Good. | OK | OK |
-
-### 1.6 PWA / Workbox
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| P-1 | **HIGH** | `client/vite.config.js` | 47-56 | API response caching includes sensitive endpoints. | Exclude auth, admin, backup, and settings endpoints from caching. | FIXED |
-| P-2 | **MEDIUM** | `client/vite.config.js` | 23, 31, 42, 54, 63 | `cacheableResponse: { statuses: [0, 200] }` — status 0 represents opaque responses which may cache error responses silently. | Remove status 0 from API and upload caches (keep for CDN/map tiles where CORS may return opaque responses). | FIXED |
-| P-3 | **MEDIUM** | `client/src/store/authStore.ts` | 126-135 | Logout does not clear service worker caches. Sensitive data persists after logout. | Clear CacheStorage for `api-data` and `user-uploads` caches on logout. | FIXED |
-
----
-
-## 2. Code Quality
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| Q-1 | **MEDIUM** | `client/src/store/authStore.ts` | 153-161 | `loadUser` silently catches all errors and logs user out. A transient network failure logs the user out. | Only logout on 401 responses, not on network errors. | FIXED |
-| Q-2 | **MEDIUM** | `client/src/hooks/useRouteCalculation.ts` | 36 | `useCallback` depends on entire `tripStore` object, defeating memoization. | Select only needed properties from the store. | DOCUMENTED |
-| Q-3 | **MEDIUM** | `client/src/hooks/useTripWebSocket.ts` | 14 | `collabFileSync` captures stale `tripStore` reference from initial render. | Use `useTripStore.getState()` instead. | DOCUMENTED |
-| Q-4 | **MEDIUM** | `client/src/store/authStore.ts` | 38 vs 105 | `register` function accepts 4 params but TypeScript interface only declares 3. | Update interface to include optional `invite_token`. | FIXED |
-| Q-5 | **LOW** | `client/src/store/slices/filesSlice.ts` | — | Empty catch block on file link operation (`catch {}`). | Log error. | DOCUMENTED |
-| Q-6 | **LOW** | `client/src/App.tsx` | 101, 108 | Empty catch blocks silently swallow errors. | Add minimal error logging. | DOCUMENTED |
-| Q-7 | **LOW** | `client/src/App.tsx` | 155 | `RegisterPage` imported but never used — `/register` route renders `LoginPage`. | Remove unused import. | FIXED |
-| Q-8 | **LOW** | `client/tsconfig.json` | 14 | `strict: false` disables TypeScript strict mode. | Enable strict mode and fix resulting type errors. | REQUIRES MANUAL REVIEW |
-| Q-9 | **LOW** | `client/src/main.tsx` | 7 | Non-null assertion on `getElementById('root')!`. | Add null check. | DOCUMENTED |
-| Q-10 | **LOW** | `server/src/routes/files.ts` | 278 | Empty catch block on file link insert (`catch {}`). | Log duplicate link errors. | FIXED |
-| Q-11 | **LOW** | `server/src/db/database.ts` | 20-21 | Silent catch on WAL checkpoint in `initDb`. | Log warning on failure. | DOCUMENTED |
-
----
-
-## 3. Best Practices
-
-### 3.1 Node / Express
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| B-1 | **LOW** | `server/src/index.ts` | 251-271 | Graceful shutdown implemented with SIGTERM/SIGINT handlers. Good — closes DB, HTTP server, with 10s timeout. | OK | OK |
-| B-2 | **LOW** | `server/src/index.ts` | 87-112 | Debug logging redacts sensitive fields. Good. | OK | OK |
-
-### 3.2 React / Vite
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| V-1 | **MEDIUM** | `client/vite.config.js` | — | No explicit `build.sourcemap: false` for production. Source maps may be generated. | Add `build: { sourcemap: false }` to Vite config. | FIXED |
-| V-2 | **LOW** | `client/index.html` | 24 | Leaflet CSS loaded from unpkg CDN without Subresource Integrity (SRI) hash. | Add `integrity` and `crossorigin` attributes. | FIXED |
-
-### 3.3 Docker
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| K-1 | **MEDIUM** | `Dockerfile` | 2, 10 | Base images use floating tags (`node:22-alpine`), not pinned to digest. | Pin to specific digest for reproducible builds. | DOCUMENTED |
-| K-2 | **MEDIUM** | `Dockerfile` | — | No `HEALTHCHECK` instruction. Only docker-compose has health check. | Add `HEALTHCHECK` to Dockerfile for standalone deployments. | FIXED |
-| K-3 | **LOW** | `.dockerignore` | — | Missing exclusions for `chart/`, `docs/`, `.github/`, `docker-compose.yml`, `*.sqlite*`. | Add missing exclusions. | FIXED |
-
-### 3.4 docker-compose.yml
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| C-1 | **HIGH** | `docker-compose.yml` | 25 | `JWT_SECRET` defaults to empty string if not set. App auto-generates one, but it changes on restart, invalidating all sessions. | Log a prominent warning on startup if JWT_SECRET is auto-generated. | FIXED |
-| C-2 | **MEDIUM** | `docker-compose.yml` | — | No resource limits defined for the `app` service. | Add `deploy.resources.limits` section. | DOCUMENTED |
-
-### 3.5 Git Hygiene
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| G-1 | **HIGH** | `.gitignore` | 12-14 | Missing `*.sqlite`, `*.sqlite-wal`, `*.sqlite-shm` patterns. Only `*.db` variants covered. | Add sqlite patterns. | FIXED |
-| G-2 | **LOW** | — | — | No `.env` or `.sqlite` files found in git history. | OK | OK |
-
-### 3.6 Helm Chart
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| H-1 | **MEDIUM** | `chart/templates/secret.yaml` | 22 | `randAlphaNum 32` generates a new JWT secret on every `helm upgrade`, invalidating all sessions. | Use `lookup` to preserve existing secret across upgrades. | FIXED |
-| H-2 | **MEDIUM** | `chart/values.yaml` | 3 | Default image tag is `latest`. | Use a specific version tag. | DOCUMENTED |
-| H-3 | **MEDIUM** | `chart/templates/deployment.yaml` | — | No `securityContext` on pod or container. Runs as root by default. | Add `runAsNonRoot: true`, `runAsUser: 1000`. | FIXED |
-| H-4 | **MEDIUM** | `chart/templates/pvc.yaml` | — | PVC always created regardless of `.Values.persistence.enabled`. | Add conditional check. | FIXED |
-| H-5 | **LOW** | `chart/values.yaml` | 41 | `resources: {}` — no default resource requests or limits. | Add sensible defaults. | FIXED |
-
----
-
-## 4. Dependency Hygiene
-
-### 4.1 npm audit
-
-| Package | Severity | Description | Status |
-|---------|----------|-------------|--------|
-| `serialize-javascript` (via vite-plugin-pwa → workbox-build → @rollup/plugin-terser) | **HIGH** | RCE via RegExp.flags / CPU exhaustion DoS | Fix requires `vite-plugin-pwa` major version upgrade. | DOCUMENTED |
-| `picomatch` (via @rollup/pluginutils, tinyglobby) | **MODERATE** | ReDoS via extglob quantifiers | `npm audit fix` available. | FIXED |
-
-**Server:** 0 vulnerabilities.
-
-### 4.2 Outdated Dependencies (Notable)
-
-| Package | Current | Latest | Risk | Status |
-|---------|---------|--------|------|--------|
-| `express` | ^4.18.3 | 5.2.1 | Major version — breaking changes | DOCUMENTED |
-| `uuid` | ^9.0.0 | 13.0.0 | Major version | DOCUMENTED |
-| `dotenv` | ^16.4.1 | 17.3.1 | Major version | DOCUMENTED |
-| `lucide-react` | ^0.344.0 | 1.7.0 | Major version | DOCUMENTED |
-| `react` | ^18.2.0 | 19.2.4 | Major version | DOCUMENTED |
-| `zustand` | ^4.5.2 | 5.0.12 | Major version | DOCUMENTED |
-
-> Major version upgrades require manual evaluation and testing. Not applied in this remediation pass.
-
----
-
-## 5. Documentation & DX
-
-| # | Severity | File | Description | Recommended Fix | Status |
-|---|----------|------|-------------|-----------------|--------|
-| X-1 | **MEDIUM** | `server/.env.example` | Missing many env vars documented in README: `OIDC_*`, `FORCE_HTTPS`, `TRUST_PROXY`, `DEMO_MODE`, `TZ`, `ALLOWED_ORIGINS`, `DEBUG`. | Add all configurable env vars. | FIXED |
-| X-2 | **MEDIUM** | `server/.env.example` | JWT_SECRET placeholder is `your-super-secret-jwt-key-change-in-production` — easily overlooked. | Use `CHANGEME_GENERATE_WITH_openssl_rand_hex_32`. | FIXED |
-| X-3 | **LOW** | `server/.env.example` | `PORT=3001` differs from Docker default of `3000`. | Align to `3000`. | FIXED |
-
----
-
-## 6. Testing
-
-| # | Severity | Description | Status |
-|---|----------|-------------|--------|
-| T-1 | **HIGH** | No test files found anywhere in the repository. Zero test coverage for auth flows, WebSocket handling, SQLite queries, API routes, or React components. | REQUIRES MANUAL REVIEW |
-| T-2 | **HIGH** | No test framework configured (no jest, vitest, or similar in dependencies). | REQUIRES MANUAL REVIEW |
-| T-3 | **MEDIUM** | No CI step runs tests before building Docker image. | DOCUMENTED |
-
----
-
-## 7. Remediation Summary
-
-### Applied Fixes
-
-- **Immich SSRF prevention** — Added URL validation on save (block private IPs, metadata endpoints, non-HTTP protocols)
-- **Immich API key isolation** — Removed `userId` query parameter from asset proxy endpoints; all Immich requests now use authenticated user's own credentials only
-- **Immich asset ID validation** — Added alphanumeric pattern validation to prevent path traversal in proxied URLs
-- **JWT algorithm pinning** — Added `{ algorithms: ['HS256'] }` to all `jwt.verify()` calls (auth middleware, MFA policy, WebSocket, OIDC, auth routes)
-- **OIDC token payload** — Reduced to `{ id }` only, matching auth.ts pattern
-- **OIDC redirect URI validation** — Validates against `APP_URL` env var when set
-- **WebSocket hardening** — Added `maxPayload: 64KB`, message rate limiting (30 msg/10s), origin validation, improved message validation
-- **CSP tightening** — Removed `'unsafe-inline'` from scripts in production, restricted `connectSrc` and `imgSrc` to known domains
-- **PWA cache security** — Excluded sensitive API paths from caching, removed opaque response caching for API/uploads, clear caches on logout
-- **Service worker cache cleanup on logout**
-- **Google API key** — Moved from URL query string to header in maps photo endpoint
-- **MCP.md credentials** — Removed hardcoded demo credentials
-- **.gitignore** — Added `*.sqlite*` patterns
-- **.dockerignore** — Added missing exclusions
-- **Dockerfile** — Added HEALTHCHECK instruction
-- **Helm chart** — Fixed secret rotation, added securityContext, conditional PVC, resource defaults
-- **Vite config** — Disabled source maps in production
-- **CDN integrity** — Added SRI hash for Leaflet CSS
-- **.env.example** — Complete with all env vars
-- **Various code quality fixes** — Removed dead imports, fixed empty catch blocks, fixed auth store interface
-
-### Requires Manual Review
-
-- Password change should invalidate existing tokens (S-15)
-- TypeScript strict mode should be enabled (Q-8)
-- Test suite needs to be created from scratch (T-1, T-2)
-- Major dependency upgrades (express 5, React 19, zustand 5, etc.)
-- `serialize-javascript` vulnerability fix requires vite-plugin-pwa major upgrade
-
-### 1.7 Immich Integration
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| I-1 | **CRITICAL** | `server/src/routes/immich.ts` | 38-39, 85, 199, 250, 274 | SSRF via user-controlled `immich_url`. Users can set any URL which is then used in `fetch()` calls, allowing requests to internal metadata endpoints (169.254.169.254), localhost services, etc. | Validate URL on save: require HTTP(S) protocol, block private/internal IPs. | FIXED |
-| I-2 | **CRITICAL** | `server/src/routes/immich.ts` | 194-196, 244-246, 269-270 | Asset info/thumbnail/original endpoints accept `userId` query param, allowing any authenticated user to proxy requests through another user's Immich API key. This exposes other users' Immich credentials and photo libraries. | Restrict all Immich proxy endpoints to the authenticated user's own credentials only. | FIXED |
-| I-3 | **MEDIUM** | `server/src/routes/immich.ts` | 199, 250, 274 | `assetId` URL parameter used directly in `fetch()` URL construction. Path traversal characters could redirect requests to unintended Immich API endpoints. | Validate assetId matches `[a-zA-Z0-9_-]+` pattern. | FIXED |
-
-### 1.8 Admin Routes
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| AD-1 | **MEDIUM** | `server/src/routes/admin.ts` | 302-310 | Self-update endpoint runs `git pull` then `npm run build`. While admin-only and `npm install` uses `--ignore-scripts`, `npm run build` executes whatever is in the pulled package.json. A compromised upstream could execute arbitrary code. | Document as accepted risk for self-hosted self-update feature. Users should pin to specific versions. | DOCUMENTED |
-
-### 1.9 Client-Side XSS
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| X-1 | **CRITICAL** | `client/src/components/Admin/GitHubPanel.tsx` | 66, 106 | `dangerouslySetInnerHTML` with `inlineFormat()` renders GitHub release notes as HTML without escaping. Malicious HTML in release notes could execute scripts. | Escape HTML entities before applying markdown-style formatting. Validate link URLs. | FIXED |
-| X-2 | **LOW** | `client/src/components/Map/MapView.tsx` | divIcon | Uses `escAttr()` for HTML sanitization in divIcon strings. Properly mitigated. | OK | OK |
-
-### 1.10 Route Calculator Bug
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| RC-1 | **HIGH** | `client/src/components/Map/RouteCalculator.ts` | 16 | OSRM URL hardcodes `'driving'` profile, ignoring the `profile` parameter. Walking/cycling routes always return driving results. | Use the `profile` parameter in URL construction. | FIXED |
-
-### Additional Findings (from exhaustive scan)
-
-- **MEDIUM** — `server/src/index.ts:121-136`: Upload files (`/uploads/:type/:filename`) served without authentication. UUIDs are unguessable but this is security-through-obscurity. **REQUIRES MANUAL REVIEW** — adding auth would break shared trip image URLs.
-- **MEDIUM** — `server/src/routes/oidc.ts:194`: OIDC token exchange error was logging full token response (potentially including access tokens). **FIXED** — now logs only HTTP status.
-- **MEDIUM** — `server/src/services/notifications.ts:194-196`: Email body is not HTML-escaped. User-generated content (trip names, usernames) interpolated directly into HTML email template. Potential stored XSS in email clients. **DOCUMENTED** — needs HTML entity escaping.
-- **LOW** — `server/src/demo/demo-seed.ts:7-9`: Hardcoded demo credentials (`demo12345`, `admin12345`). Intentional for demo mode but dangerous if DEMO_MODE accidentally left on in production. Already has startup warning.
-- **LOW** — `server/src/routes/auth.ts:742`: MFA setup returns plaintext TOTP secret to client. This is standard TOTP enrollment flow — users need the secret for manual entry. Must be served over HTTPS.
-- **LOW** — `server/src/routes/auth.ts:473`: Admin settings GET returns API keys in full (not masked). Only accessible to admins.
-- **LOW** — `server/src/routes/auth.ts:564`: SMTP password stored as plaintext in `app_settings` table. Masked in API response but unencrypted at rest.
-
-### Accepted Risks (Documented)
-
-- WebSocket token in URL query string (browser limitation)
-- 24h JWT expiry without refresh tokens (acceptable for self-hosted)
-- MFA encryption key derived from JWT_SECRET (noted coupling)
-- localStorage for token storage (standard SPA pattern)
-- Upload files served without auth (UUID-based obscurity, needed for shared trips)

CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing to TREK
+
+Thanks for your interest in contributing! Please read these guidelines before opening a pull request.
+
+## Ground Rules
+
+1. **Ask in Discord first** — Before writing any code, pitch your idea in the `#github-pr` channel on our [Discord server](https://discord.gg/P7TUxHJs). We'll let you know if the PR is wanted and give direction. PRs that show up without prior discussion will be closed
+2. **One change per PR** — Keep it focused. Don't bundle unrelated fixes or refactors
+3. **No breaking changes** — Backwards compatibility is non-negotiable
+4. **Target the `dev` branch** — All PRs must be opened against `dev`, not `main`
+5. **Match the existing style** — No reformatting, no linter config changes, no "while I'm here" cleanups
+
+## Pull Requests
+
+### Your PR should include:
+
+- **Summary** — What does this change and why? (1-3 bullet points)
+- **Test plan** — How did you verify it works?
+- **Linked issue** — Reference the issue (e.g. `Fixes #123`)
+
+### Your PR will be closed if it:
+
+- Wasn't discussed and approved in `#github-pr` on Discord first
+- Introduces breaking changes
+- Adds unnecessary complexity or features beyond scope
+- Reformats or refactors unrelated code
+- Adds dependencies without clear justification
+
+### Commit messages
+
+Use [conventional commits](https://www.conventionalcommits.org/):
+
+```
+fix(maps): correct zoom level on Safari
+feat(budget): add CSV export for expenses
+```
+
+## Development Setup
+
+```bash
+git clone https://github.com/mauriceboe/TREK.git
+cd TREK
+
+# Server
+cd server && npm install && npm run dev
+
+# Client (separate terminal)
+cd client && npm install && npm run dev
+```
+
+Server: `http://localhost:3001` | Client: `http://localhost:5173`
+
+On first run, check the server logs for the auto-generated admin credentials.
+
+## More Details
+
+See the [Contributing wiki page](https://github.com/mauriceboe/TREK/wiki/Contributing) for the full tech stack, architecture overview, and detailed guidelines.

README.md

@@ -9,6 +9,7 @@
 </p>
 
 <p align="center">
+  <a href="https://discord.gg/J27gr9GH"><img src="https://img.shields.io/badge/Discord-Join%20Community-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg" alt="License: AGPL v3" /></a>
   <a href="https://hub.docker.com/r/mauriceboe/trek"><img src="https://img.shields.io/docker/pulls/mauriceboe/trek" alt="Docker Pulls" /></a>
   <a href="https://github.com/mauriceboe/TREK"><img src="https://img.shields.io/github/stars/mauriceboe/TREK" alt="GitHub Stars" /></a>
@@ -139,10 +140,27 @@ services:
       - NODE_ENV=production
       - PORT=3000
       - ENCRYPTION_KEY=${ENCRYPTION_KEY:-} # Recommended. Generate with: openssl rand -hex 32. If unset, falls back to data/.jwt_secret (existing installs) or auto-generates a key (fresh installs).
-      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-} # Comma-separated origins for CORS and email notification links
       - TZ=${TZ:-UTC} # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
       - LOG_LEVEL=${LOG_LEVEL:-info} # info = concise user actions; debug = verbose admin-level details
-      # - ALLOW_INTERNAL_NETWORK=true # Uncomment if Immich is on your local network (RFC-1918 IPs)
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-} # Comma-separated origins for CORS and email notification links
+      - FORCE_HTTPS=true # Redirect HTTP to HTTPS when behind a TLS-terminating proxy
+      # - COOKIE_SECURE=false # Uncomment if accessing over plain HTTP (no HTTPS). Not recommended for production.
+      - TRUST_PROXY=1 # Number of trusted proxies for X-Forwarded-For
+      # - ALLOW_INTERNAL_NETWORK=true # Uncomment if Immich or other services are on your local network (RFC-1918 IPs)
+      - APP_URL=${APP_URL:-} # Base URL of this instance — required when OIDC is enabled; must match the redirect URI registered with your IdP; Also used as the base URL for email notifications and other external links
+      # - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
+      # - OIDC_CLIENT_ID=trek # OpenID Connect client ID
+      # - OIDC_CLIENT_SECRET=supersecret # OpenID Connect client secret
+      # - OIDC_DISPLAY_NAME=SSO # Label shown on the SSO login button
+      # - OIDC_ONLY=false # Set to true to disable local password auth entirely (SSO only)
+      # - OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
+      # - OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
+      # - OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
+      # - OIDC_DISCOVERY_URL= # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik)
+      # - DEMO_MODE=false # Enable demo mode (resets data hourly)
+      # - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
+      # - ADMIN_PASSWORD=changeme      # Initial admin password — only used on first boot when no users exist
+      # - MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
     volumes:
       - ./data:/app/data
       - ./uploads:/app/uploads
@@ -265,16 +283,26 @@ trek.yourdomain.com {
 | `LOG_LEVEL` | `info` = concise user actions, `debug` = verbose details | `info` |
 | `ALLOWED_ORIGINS` | Comma-separated origins for CORS and email links | same-origin |
 | `FORCE_HTTPS` | Redirect HTTP to HTTPS behind a TLS-terminating proxy | `false` |
+| `COOKIE_SECURE` | Set to `false` to allow session cookies over plain HTTP (e.g. accessing via IP without HTTPS). Defaults to `true` in production. **Not recommended to disable in production.** | `true` |
 | `TRUST_PROXY` | Number of trusted reverse proxies for `X-Forwarded-For` | `1` |
 | `ALLOW_INTERNAL_NETWORK` | Allow outbound requests to private/RFC-1918 IP addresses. Set to `true` if Immich or other integrated services are hosted on your local network. Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) are always blocked regardless of this setting. | `false` |
+| `APP_URL` | Public base URL of this instance (e.g. `https://trek.example.com`). Required when OIDC is enabled — must match the redirect URI registered with your IdP. Also used as the base URL for external links in email notifications. | — |
 | **OIDC / SSO** | | |
 | `OIDC_ISSUER` | OpenID Connect provider URL | — |
 | `OIDC_CLIENT_ID` | OIDC client ID | — |
 | `OIDC_CLIENT_SECRET` | OIDC client secret | — |
 | `OIDC_DISPLAY_NAME` | Label shown on the SSO login button | `SSO` |
 | `OIDC_ONLY` | Disable local password auth entirely (first SSO login becomes admin) | `false` |
+| `OIDC_ADMIN_CLAIM` | OIDC claim used to identify admin users | — |
+| `OIDC_ADMIN_VALUE` | Value of the OIDC claim that grants admin role | — |
+| `OIDC_SCOPE` | Space-separated OIDC scopes to request. **Fully replaces** the default — always include `openid email profile` plus any extra scopes you need (e.g. add `groups` when using `OIDC_ADMIN_CLAIM`) | `openid email profile` |
+| `OIDC_DISCOVERY_URL` | Override the auto-constructed OIDC discovery endpoint. Useful for providers that expose it at a non-standard path (e.g. Authentik: `https://auth.example.com/application/o/trek/.well-known/openid-configuration`) | — |
+| **Initial Setup** | | |
+| `ADMIN_EMAIL` | Email for the first admin account created on initial boot. Must be set together with `ADMIN_PASSWORD`. If either is omitted a random password is generated and printed to the server log. Has no effect once any user exists. | `admin@trek.local` |
+| `ADMIN_PASSWORD` | Password for the first admin account created on initial boot. Must be set together with `ADMIN_EMAIL`. | random |
 | **Other** | | |
 | `DEMO_MODE` | Enable demo mode (hourly data resets) | `false` |
+| `MCP_RATE_LIMIT` | Max MCP API requests per user per minute | `60` |
 
 ## Optional API Keys
 

chart/README.md

@@ -32,3 +32,5 @@ See `values.yaml` for more options.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
 - If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
 - Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
+- Set `env.COOKIE_SECURE: "false"` only if your deployment has no TLS (e.g. during local testing without ingress). Session cookies require HTTPS in all other cases.
+- Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.

chart/templates/configmap.yaml

@@ -7,9 +7,57 @@ metadata:
 data:
   NODE_ENV: {{ .Values.env.NODE_ENV | quote }}
   PORT: {{ .Values.env.PORT | quote }}
+  {{- if .Values.env.TZ }}
+  TZ: {{ .Values.env.TZ | quote }}
+  {{- end }}
+  {{- if .Values.env.LOG_LEVEL }}
+  LOG_LEVEL: {{ .Values.env.LOG_LEVEL | quote }}
+  {{- end }}
   {{- if .Values.env.ALLOWED_ORIGINS }}
   ALLOWED_ORIGINS: {{ .Values.env.ALLOWED_ORIGINS | quote }}
   {{- end }}
+  {{- if .Values.env.APP_URL }}
+  APP_URL: {{ .Values.env.APP_URL | quote }}
+  {{- end }}
+  {{- if .Values.env.FORCE_HTTPS }}
+  FORCE_HTTPS: {{ .Values.env.FORCE_HTTPS | quote }}
+  {{- end }}
+  {{- if .Values.env.COOKIE_SECURE }}
+  COOKIE_SECURE: {{ .Values.env.COOKIE_SECURE | quote }}
+  {{- end }}
+  {{- if .Values.env.TRUST_PROXY }}
+  TRUST_PROXY: {{ .Values.env.TRUST_PROXY | quote }}
+  {{- end }}
   {{- if .Values.env.ALLOW_INTERNAL_NETWORK }}
   ALLOW_INTERNAL_NETWORK: {{ .Values.env.ALLOW_INTERNAL_NETWORK | quote }}
   {{- end }}
+  {{- if .Values.env.OIDC_ISSUER }}
+  OIDC_ISSUER: {{ .Values.env.OIDC_ISSUER | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_CLIENT_ID }}
+  OIDC_CLIENT_ID: {{ .Values.env.OIDC_CLIENT_ID | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_DISPLAY_NAME }}
+  OIDC_DISPLAY_NAME: {{ .Values.env.OIDC_DISPLAY_NAME | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_ONLY }}
+  OIDC_ONLY: {{ .Values.env.OIDC_ONLY | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_ADMIN_CLAIM }}
+  OIDC_ADMIN_CLAIM: {{ .Values.env.OIDC_ADMIN_CLAIM | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_ADMIN_VALUE }}
+  OIDC_ADMIN_VALUE: {{ .Values.env.OIDC_ADMIN_VALUE | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_SCOPE }}
+  OIDC_SCOPE: {{ .Values.env.OIDC_SCOPE | quote }}
+  {{- end }}
+  {{- if .Values.env.OIDC_DISCOVERY_URL }}
+  OIDC_DISCOVERY_URL: {{ .Values.env.OIDC_DISCOVERY_URL | quote }}
+  {{- end }}
+  {{- if .Values.env.DEMO_MODE }}
+  DEMO_MODE: {{ .Values.env.DEMO_MODE | quote }}
+  {{- end }}
+  {{- if .Values.env.MCP_RATE_LIMIT }}
+  MCP_RATE_LIMIT: {{ .Values.env.MCP_RATE_LIMIT | quote }}
+  {{- end }}

chart/templates/deployment.yaml

@@ -11,6 +11,9 @@ spec:
       app: {{ include "trek.name" . }}
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
       labels:
         app: {{ include "trek.name" . }}
     spec:
@@ -42,6 +45,24 @@ spec:
                   name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                   key: {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}
                   optional: true
+            - name: ADMIN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
+                  key: ADMIN_EMAIL
+                  optional: true
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
+                  key: ADMIN_PASSWORD
+                  optional: true
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
+                  key: OIDC_CLIENT_SECRET
+                  optional: true
           volumeMounts:
             - name: data
               mountPath: /app/data

chart/templates/ingress.yaml

@@ -10,6 +10,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
   {{- if .Values.ingress.tls }}
   tls:
     {{- toYaml .Values.ingress.tls | nindent 4 }}

chart/templates/secret.yaml

@@ -8,6 +8,15 @@ metadata:
 type: Opaque
 data:
   {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ .Values.secretEnv.ENCRYPTION_KEY | b64enc | quote }}
+  {{- if .Values.secretEnv.ADMIN_EMAIL }}
+  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.secretEnv.ADMIN_PASSWORD }}
+  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
+  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | b64enc | quote }}
+  {{- end }}
 {{- end }}
 
 {{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
@@ -26,4 +35,13 @@ stringData:
   {{- else }}
   {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
   {{- end }}
+  {{- if .Values.secretEnv.ADMIN_EMAIL }}
+  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL }}
+  {{- end }}
+  {{- if .Values.secretEnv.ADMIN_PASSWORD }}
+  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD }}
+  {{- end }}
+  {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
+  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET }}
+  {{- end }}
 {{- end }}

chart/values.yaml

@@ -15,11 +15,44 @@ service:
 env:
   NODE_ENV: production
   PORT: 3000
+  # TZ: "UTC"
+  # Timezone for logs, reminders, and cron jobs (e.g. Europe/Berlin).
+  # LOG_LEVEL: "info"
+  # "info" = concise user actions, "debug" = verbose details.
   # ALLOWED_ORIGINS: ""
   # NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
+  # APP_URL: "https://trek.example.com"
+  # Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
+  # Also used as the base URL for links in email notifications and other external links.
+  # FORCE_HTTPS: "false"
+  # Set to "true" to redirect HTTP to HTTPS behind a TLS-terminating proxy.
+  # COOKIE_SECURE: "true"
+  # Set to "false" to allow session cookies over plain HTTP (e.g. no ingress TLS). Not recommended for production.
+  # TRUST_PROXY: "1"
+  # Number of trusted reverse proxies for X-Forwarded-For header parsing.
   # ALLOW_INTERNAL_NETWORK: "false"
   # Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
   # Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
+  # OIDC_ISSUER: ""
+  # OpenID Connect provider URL.
+  # OIDC_CLIENT_ID: ""
+  # OIDC client ID.
+  # OIDC_DISPLAY_NAME: "SSO"
+  # Label shown on the SSO login button.
+  # OIDC_ONLY: "false"
+  # Set to "true" to disable local password auth entirely (first SSO login becomes admin).
+  # OIDC_ADMIN_CLAIM: ""
+  # OIDC claim used to identify admin users.
+  # OIDC_ADMIN_VALUE: ""
+  # Value of the OIDC claim that grants admin role.
+  # OIDC_SCOPE: "openid email profile groups"
+  # Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
+  # OIDC_DISCOVERY_URL: ""
+  # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
+  # DEMO_MODE: "false"
+  # Enable demo mode (hourly data resets).
+  # MCP_RATE_LIMIT: "60"
+  # Max MCP API requests per user per minute. Defaults to 60.
 
 
 # Secret environment variables stored in a Kubernetes Secret.
@@ -32,6 +65,13 @@ secretEnv:
   #   1. data/.jwt_secret (existing installs — encrypted data stays readable after upgrade)
   #   2. data/.encryption_key auto-generated on first start (fresh installs)
   ENCRYPTION_KEY: ""
+  # Initial admin account — only used on first boot when no users exist yet.
+  # If both values are non-empty the admin account is created with these credentials.
+  # If either is empty a random password is generated and printed to the server log.
+  ADMIN_EMAIL: ""
+  ADMIN_PASSWORD: ""
+  # OIDC client secret — set together with env.OIDC_ISSUER and env.OIDC_CLIENT_ID.
+  OIDC_CLIENT_SECRET: ""
 
 # If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
 generateEncryptionKey: false
@@ -57,6 +97,7 @@ resources:
 
 ingress:
   enabled: false
+  className: ""
   annotations: {}
   hosts:
     - host: chart-example.local

client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "trek-client",
-  "version": "2.7.2",
+  "version": "2.8.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trek-client",
-      "version": "2.7.2",
+      "version": "2.8.3",
       "dependencies": {
         "@react-pdf/renderer": "^4.3.2",
         "axios": "^1.6.7",
@@ -5941,9 +5941,9 @@
       "license": "MIT"
     },
     "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },

client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek-client",
-  "version": "2.7.2",
+  "version": "2.8.3",
   "private": true,
   "type": "module",
   "scripts": {

client/src/App.tsx

@@ -11,10 +11,12 @@ import SettingsPage from './pages/SettingsPage'
 import VacayPage from './pages/VacayPage'
 import AtlasPage from './pages/AtlasPage'
 import SharedTripPage from './pages/SharedTripPage'
+import InAppNotificationsPage from './pages/InAppNotificationsPage.tsx'
 import { ToastContainer } from './components/shared/Toast'
 import { TranslationProvider, useTranslation } from './i18n'
 import { authApi } from './api/client'
 import { usePermissionsStore, PermissionLevel } from './store/permissionsStore'
+import { useInAppNotificationListener } from './hooks/useInAppNotificationListener.ts'
 
 interface ProtectedRouteProps {
   children: ReactNode
@@ -75,13 +77,16 @@ function RootRedirect() {
 }
 
 export default function App() {
-  const { loadUser, isAuthenticated, demoMode, setDemoMode, setHasMapsKey, setServerTimezone, setAppRequireMfa, setTripRemindersEnabled } = useAuthStore()
+  const { loadUser, isAuthenticated, demoMode, setDemoMode, setDevMode, setHasMapsKey, setServerTimezone, setAppRequireMfa, setTripRemindersEnabled } = useAuthStore()
   const { loadSettings } = useSettingsStore()
 
   useEffect(() => {
-    loadUser()
-    authApi.getAppConfig().then(async (config: { demo_mode?: boolean; has_maps_key?: boolean; version?: string; timezone?: string; require_mfa?: boolean; trip_reminders_enabled?: boolean; permissions?: Record<string, PermissionLevel> }) => {
+    if (!location.pathname.startsWith('/shared/')) {
+      loadUser()
+    }
+    authApi.getAppConfig().then(async (config: { demo_mode?: boolean; dev_mode?: boolean; has_maps_key?: boolean; version?: string; timezone?: string; require_mfa?: boolean; trip_reminders_enabled?: boolean; permissions?: Record<string, PermissionLevel> }) => {
       if (config?.demo_mode) setDemoMode(true)
+      if (config?.dev_mode) setDevMode(true)
       if (config?.has_maps_key !== undefined) setHasMapsKey(config.has_maps_key)
       if (config?.timezone) setServerTimezone(config.timezone)
       if (config?.require_mfa !== undefined) setAppRequireMfa(!!config.require_mfa)
@@ -112,6 +117,8 @@ export default function App() {
 
   const { settings } = useSettingsStore()
 
+  useInAppNotificationListener()
+
   useEffect(() => {
     if (isAuthenticated) {
       loadSettings()
@@ -211,6 +218,14 @@ export default function App() {
             </ProtectedRoute>
           }
         />
+        <Route
+          path="/notifications"
+          element={
+            <ProtectedRoute>
+              <InAppNotificationsPage />
+            </ProtectedRoute>
+          }
+        />
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>
     </TranslationProvider>

client/src/api/authUrl.ts

@@ -14,3 +14,45 @@ export async function getAuthUrl(url: string, purpose: 'download' | 'immich'): P
     return url
   }
 }
+
+// ── Blob-based image fetching (Safari-safe, no ephemeral tokens needed) ────
+
+const MAX_CONCURRENT = 6
+let active = 0
+const queue: Array<() => void> = []
+
+function dequeue() {
+  while (active < MAX_CONCURRENT && queue.length > 0) {
+    active++
+    queue.shift()!()
+  }
+}
+
+export function clearImageQueue() {
+  queue.length = 0
+}
+
+export async function fetchImageAsBlob(url: string): Promise<string> {
+  if (!url) return ''
+  return new Promise<string>((resolve) => {
+    const run = async () => {
+      try {
+        const resp = await fetch(url, { credentials: 'include' })
+        if (!resp.ok) { resolve(''); return }
+        const blob = await resp.blob()
+        resolve(URL.createObjectURL(blob))
+      } catch {
+        resolve('')
+      } finally {
+        active--
+        dequeue()
+      }
+    }
+    if (active < MAX_CONCURRENT) {
+      active++
+      run()
+    } else {
+      queue.push(run)
+    }
+  })
+}

client/src/api/client.ts

@@ -25,8 +25,8 @@ apiClient.interceptors.request.use(
 apiClient.interceptors.response.use(
   (response) => response,
   (error) => {
-    if (error.response?.status === 401) {
-      if (!window.location.pathname.includes('/login') && !window.location.pathname.includes('/register')) {
+    if (error.response?.status === 401 && (error.response?.data as { code?: string } | undefined)?.code === 'AUTH_REQUIRED') {
+      if (!window.location.pathname.includes('/login') && !window.location.pathname.includes('/register') && !window.location.pathname.startsWith('/shared/')) {
         window.location.href = '/login'
       }
     }
@@ -83,6 +83,7 @@ export const tripsApi = {
   getMembers: (id: number | string) => apiClient.get(`/trips/${id}/members`).then(r => r.data),
   addMember: (id: number | string, identifier: string) => apiClient.post(`/trips/${id}/members`, { identifier }).then(r => r.data),
   removeMember: (id: number | string, userId: number) => apiClient.delete(`/trips/${id}/members/${userId}`).then(r => r.data),
+  copy: (id: number | string, data?: { title?: string }) => apiClient.post(`/trips/${id}/copy`, data || {}).then(r => r.data),
 }
 
 export const daysApi = {
@@ -184,6 +185,8 @@ export const adminApi = {
   getPermissions: () => apiClient.get('/admin/permissions').then(r => r.data),
   updatePermissions: (permissions: Record<string, string>) => apiClient.put('/admin/permissions', { permissions }).then(r => r.data),
   rotateJwtSecret: () => apiClient.post('/admin/rotate-jwt-secret').then(r => r.data),
+  sendTestNotification: (data: Record<string, unknown>) =>
+    apiClient.post('/admin/dev/test-notification', data).then(r => r.data),
 }
 
 export const addonsApi = {
@@ -318,4 +321,23 @@ export const notificationsApi = {
   testWebhook: () => apiClient.post('/notifications/test-webhook').then(r => r.data),
 }
 
+export const inAppNotificationsApi = {
+  list: (params?: { limit?: number; offset?: number; unread_only?: boolean }) =>
+    apiClient.get('/notifications/in-app', { params }).then(r => r.data),
+  unreadCount: () =>
+    apiClient.get('/notifications/in-app/unread-count').then(r => r.data),
+  markRead: (id: number) =>
+    apiClient.put(`/notifications/in-app/${id}/read`).then(r => r.data),
+  markUnread: (id: number) =>
+    apiClient.put(`/notifications/in-app/${id}/unread`).then(r => r.data),
+  markAllRead: () =>
+    apiClient.put('/notifications/in-app/read-all').then(r => r.data),
+  delete: (id: number) =>
+    apiClient.delete(`/notifications/in-app/${id}`).then(r => r.data),
+  deleteAll: () =>
+    apiClient.delete('/notifications/in-app/all').then(r => r.data),
+  respond: (id: number, response: 'positive' | 'negative') =>
+    apiClient.post(`/notifications/in-app/${id}/respond`, { response }).then(r => r.data),
+}
+
 export default apiClient

client/src/components/Admin/DevNotificationsPanel.tsx

@@ -0,0 +1,343 @@
+import React, { useState, useEffect } from 'react'
+import { adminApi, tripsApi } from '../../api/client'
+import { useAuthStore } from '../../store/authStore'
+import { useToast } from '../shared/Toast'
+import { Bell, Send, Zap, ArrowRight, CheckCircle, XCircle, Navigation, User } from 'lucide-react'
+
+interface Trip {
+  id: number
+  title: string
+}
+
+interface AppUser {
+  id: number
+  username: string
+  email: string
+}
+
+export default function DevNotificationsPanel(): React.ReactElement {
+  const toast = useToast()
+  const user = useAuthStore(s => s.user)
+  const [sending, setSending] = useState<string | null>(null)
+  const [trips, setTrips] = useState<Trip[]>([])
+  const [selectedTripId, setSelectedTripId] = useState<number | null>(null)
+  const [users, setUsers] = useState<AppUser[]>([])
+  const [selectedUserId, setSelectedUserId] = useState<number | null>(null)
+
+  useEffect(() => {
+    tripsApi.list().then(data => {
+      const list = (data.trips || data || []) as Trip[]
+      setTrips(list)
+      if (list.length > 0) setSelectedTripId(list[0].id)
+    }).catch(() => {})
+    adminApi.users().then(data => {
+      const list = (data.users || data || []) as AppUser[]
+      setUsers(list)
+      if (list.length > 0) setSelectedUserId(list[0].id)
+    }).catch(() => {})
+  }, [])
+
+  const send = async (label: string, payload: Record<string, unknown>) => {
+    setSending(label)
+    try {
+      await adminApi.sendTestNotification(payload)
+      toast.success(`Sent: ${label}`)
+    } catch (err: any) {
+      toast.error(err.message || 'Failed')
+    } finally {
+      setSending(null)
+    }
+  }
+
+  const buttons = [
+    {
+      label: 'Simple → Me',
+      icon: Bell,
+      color: '#6366f1',
+      payload: {
+        type: 'simple',
+        scope: 'user',
+        target: user?.id,
+        title_key: 'notifications.test.title',
+        title_params: { actor: user?.username || 'Admin' },
+        text_key: 'notifications.test.text',
+        text_params: {},
+      },
+    },
+    {
+      label: 'Boolean → Me',
+      icon: CheckCircle,
+      color: '#10b981',
+      payload: {
+        type: 'boolean',
+        scope: 'user',
+        target: user?.id,
+        title_key: 'notifications.test.booleanTitle',
+        title_params: { actor: user?.username || 'Admin' },
+        text_key: 'notifications.test.booleanText',
+        text_params: {},
+        positive_text_key: 'notifications.test.accept',
+        negative_text_key: 'notifications.test.decline',
+        positive_callback: { action: 'test_approve', payload: {} },
+        negative_callback: { action: 'test_deny', payload: {} },
+      },
+    },
+    {
+      label: 'Navigate → Me',
+      icon: Navigation,
+      color: '#f59e0b',
+      payload: {
+        type: 'navigate',
+        scope: 'user',
+        target: user?.id,
+        title_key: 'notifications.test.navigateTitle',
+        title_params: {},
+        text_key: 'notifications.test.navigateText',
+        text_params: {},
+        navigate_text_key: 'notifications.test.goThere',
+        navigate_target: '/dashboard',
+      },
+    },
+    {
+      label: 'Simple → Admins',
+      icon: Zap,
+      color: '#ef4444',
+      payload: {
+        type: 'simple',
+        scope: 'admin',
+        target: 0,
+        title_key: 'notifications.test.adminTitle',
+        title_params: {},
+        text_key: 'notifications.test.adminText',
+        text_params: { actor: user?.username || 'Admin' },
+      },
+    },
+  ]
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center gap-2 mb-2">
+        <div className="px-2 py-0.5 rounded text-xs font-mono font-bold" style={{ background: '#fbbf24', color: '#000' }}>
+          DEV ONLY
+        </div>
+        <span className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>
+          Notification Testing
+        </span>
+      </div>
+
+      <p className="text-xs" style={{ color: 'var(--text-muted)' }}>
+        Send test notifications to yourself, all admins, or trip members. These use test i18n keys.
+      </p>
+
+      {/* Quick-fire buttons */}
+      <div>
+        <h3 className="text-sm font-semibold mb-3" style={{ color: 'var(--text-secondary)' }}>Quick Send</h3>
+        <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
+          {buttons.map(btn => {
+            const Icon = btn.icon
+            return (
+              <button
+                key={btn.label}
+                onClick={() => send(btn.label, btn.payload)}
+                disabled={sending !== null}
+                className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+                style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+                onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+              >
+                <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                  style={{ background: `${btn.color}20`, color: btn.color }}>
+                  <Icon className="w-4 h-4" />
+                </div>
+                <div className="min-w-0">
+                  <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>{btn.label}</p>
+                  <p className="text-xs truncate" style={{ color: 'var(--text-faint)' }}>
+                    {btn.payload.type} · {btn.payload.scope}
+                  </p>
+                </div>
+                {sending === btn.label && (
+                  <div className="ml-auto w-4 h-4 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />
+                )}
+              </button>
+            )
+          })}
+        </div>
+      </div>
+
+      {/* Trip-scoped notifications */}
+      {trips.length > 0 && (
+        <div>
+          <h3 className="text-sm font-semibold mb-3" style={{ color: 'var(--text-secondary)' }}>Trip-Scoped</h3>
+          <div className="flex gap-2 mb-2">
+            <select
+              value={selectedTripId ?? ''}
+              onChange={e => setSelectedTripId(Number(e.target.value))}
+              className="flex-1 px-3 py-2 rounded-lg border text-sm"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-primary)' }}
+            >
+              {trips.map(trip => (
+                <option key={trip.id} value={trip.id}>{trip.title}</option>
+              ))}
+            </select>
+          </div>
+          <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
+            <button
+              onClick={() => selectedTripId && send('Simple → Trip', {
+                type: 'simple',
+                scope: 'trip',
+                target: selectedTripId,
+                title_key: 'notifications.test.tripTitle',
+                title_params: { actor: user?.username || 'Admin' },
+                text_key: 'notifications.test.tripText',
+                text_params: { trip: trips.find(t => t.id === selectedTripId)?.title || 'Trip' },
+              })}
+              disabled={sending !== null || !selectedTripId}
+              className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+            >
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                style={{ background: '#8b5cf620', color: '#8b5cf6' }}>
+                <Send className="w-4 h-4" />
+              </div>
+              <div>
+                <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>Simple → Trip Members</p>
+                <p className="text-xs" style={{ color: 'var(--text-faint)' }}>simple · trip</p>
+              </div>
+            </button>
+            <button
+              onClick={() => selectedTripId && send('Navigate → Trip', {
+                type: 'navigate',
+                scope: 'trip',
+                target: selectedTripId,
+                title_key: 'notifications.test.tripTitle',
+                title_params: { actor: user?.username || 'Admin' },
+                text_key: 'notifications.test.tripText',
+                text_params: { trip: trips.find(t => t.id === selectedTripId)?.title || 'Trip' },
+                navigate_text_key: 'notifications.test.goThere',
+                navigate_target: `/trips/${selectedTripId}`,
+              })}
+              disabled={sending !== null || !selectedTripId}
+              className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+            >
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                style={{ background: '#f59e0b20', color: '#f59e0b' }}>
+                <ArrowRight className="w-4 h-4" />
+              </div>
+              <div>
+                <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>Navigate → Trip Members</p>
+                <p className="text-xs" style={{ color: 'var(--text-faint)' }}>navigate · trip</p>
+              </div>
+            </button>
+          </div>
+        </div>
+      )}
+
+      {/* User-scoped notifications */}
+      {users.length > 0 && (
+        <div>
+          <h3 className="text-sm font-semibold mb-3" style={{ color: 'var(--text-secondary)' }}>User-Scoped</h3>
+          <div className="flex gap-2 mb-2">
+            <select
+              value={selectedUserId ?? ''}
+              onChange={e => setSelectedUserId(Number(e.target.value))}
+              className="flex-1 px-3 py-2 rounded-lg border text-sm"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)', color: 'var(--text-primary)' }}
+            >
+              {users.map(u => (
+                <option key={u.id} value={u.id}>{u.username} ({u.email})</option>
+              ))}
+            </select>
+          </div>
+          <div className="grid grid-cols-1 sm:grid-cols-2 gap-2">
+            <button
+              onClick={() => selectedUserId && send(`Simple → ${users.find(u => u.id === selectedUserId)?.username}`, {
+                type: 'simple',
+                scope: 'user',
+                target: selectedUserId,
+                title_key: 'notifications.test.title',
+                title_params: { actor: user?.username || 'Admin' },
+                text_key: 'notifications.test.text',
+                text_params: {},
+              })}
+              disabled={sending !== null || !selectedUserId}
+              className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+            >
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                style={{ background: '#06b6d420', color: '#06b6d4' }}>
+                <User className="w-4 h-4" />
+              </div>
+              <div>
+                <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>Simple → User</p>
+                <p className="text-xs" style={{ color: 'var(--text-faint)' }}>simple · user</p>
+              </div>
+            </button>
+            <button
+              onClick={() => selectedUserId && send(`Boolean → ${users.find(u => u.id === selectedUserId)?.username}`, {
+                type: 'boolean',
+                scope: 'user',
+                target: selectedUserId,
+                title_key: 'notifications.test.booleanTitle',
+                title_params: { actor: user?.username || 'Admin' },
+                text_key: 'notifications.test.booleanText',
+                text_params: {},
+                positive_text_key: 'notifications.test.accept',
+                negative_text_key: 'notifications.test.decline',
+                positive_callback: { action: 'test_approve', payload: {} },
+                negative_callback: { action: 'test_deny', payload: {} },
+              })}
+              disabled={sending !== null || !selectedUserId}
+              className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+            >
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                style={{ background: '#10b98120', color: '#10b981' }}>
+                <CheckCircle className="w-4 h-4" />
+              </div>
+              <div>
+                <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>Boolean → User</p>
+                <p className="text-xs" style={{ color: 'var(--text-faint)' }}>boolean · user</p>
+              </div>
+            </button>
+            <button
+              onClick={() => selectedUserId && send(`Navigate → ${users.find(u => u.id === selectedUserId)?.username}`, {
+                type: 'navigate',
+                scope: 'user',
+                target: selectedUserId,
+                title_key: 'notifications.test.navigateTitle',
+                title_params: {},
+                text_key: 'notifications.test.navigateText',
+                text_params: {},
+                navigate_text_key: 'notifications.test.goThere',
+                navigate_target: '/dashboard',
+              })}
+              disabled={sending !== null || !selectedUserId}
+              className="flex items-center gap-3 px-4 py-3 rounded-lg border transition-colors text-left"
+              style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-card)'}
+            >
+              <div className="w-8 h-8 rounded-lg flex items-center justify-center flex-shrink-0"
+                style={{ background: '#f59e0b20', color: '#f59e0b' }}>
+                <ArrowRight className="w-4 h-4" />
+              </div>
+              <div>
+                <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>Navigate → User</p>
+                <p className="text-xs" style={{ color: 'var(--text-faint)' }}>navigate · user</p>
+              </div>
+            </button>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}

client/src/components/Admin/GitHubPanel.tsx

@@ -119,7 +119,7 @@ export default function GitHubPanel() {
   return (
     <div className="space-y-3">
       {/* Support cards */}
-      <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
+      <div className="grid grid-cols-1 sm:grid-cols-3 gap-3">
         <a
           href="https://ko-fi.com/mauriceboe"
           target="_blank"
@@ -156,6 +156,24 @@ export default function GitHubPanel() {
           </div>
           <ExternalLink size={14} className="ml-auto flex-shrink-0" style={{ color: 'var(--text-faint)' }} />
         </a>
+        <a
+          href="https://discord.gg/nSdKaXgN"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="rounded-xl border overflow-hidden flex items-center gap-4 px-5 py-4 transition-all"
+          style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)', textDecoration: 'none' }}
+          onMouseEnter={e => { e.currentTarget.style.borderColor = '#5865F2'; e.currentTarget.style.boxShadow = '0 0 0 1px #5865F222' }}
+          onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--border-primary)'; e.currentTarget.style.boxShadow = 'none' }}
+        >
+          <div style={{ width: 40, height: 40, borderRadius: 10, background: '#5865F215', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>
+            <svg width="20" height="20" viewBox="0 0 24 24" fill="#5865F2"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg>
+          </div>
+          <div>
+            <div className="text-sm font-semibold" style={{ color: 'var(--text-primary)' }}>Discord</div>
+            <div className="text-xs" style={{ color: 'var(--text-faint)' }}>Join the community</div>
+          </div>
+          <ExternalLink size={14} className="ml-auto flex-shrink-0" style={{ color: 'var(--text-faint)' }} />
+        </a>
       </div>
 
       {/* Loading / Error / Releases */}

client/src/components/Budget/BudgetPanel.tsx

@@ -489,7 +489,7 @@ export default function BudgetPanel({ tripId, tripMembers = [] }: BudgetPanelPro
     const d = currencyDecimals(currency)
     const fmtPrice = (v: number | null | undefined) => v != null ? v.toFixed(d) : ''
 
-    const fmtDate = (iso: string) => { if (!iso) return ''; const d = new Date(iso + 'T00:00:00'); return d.toLocaleDateString(locale, { day: '2-digit', month: '2-digit', year: 'numeric' }) }
+    const fmtDate = (iso: string) => { if (!iso) return ''; const d = new Date(iso + 'T00:00:00Z'); return d.toLocaleDateString(locale, { day: '2-digit', month: '2-digit', year: 'numeric', timeZone: 'UTC' }) }
     const header = ['Category', 'Name', 'Date', 'Total (' + currency + ')', 'Persons', 'Days', 'Per Person', 'Per Day', 'Per Person/Day', 'Note']
     const rows = [header.join(sep)]
 
@@ -701,7 +701,7 @@ export default function BudgetPanel({ tripId, tripMembers = [] }: BudgetPanelPro
           })}
         </div>
 
-        <div className="w-full md:w-[180px]" style={{ flexShrink: 0, position: 'sticky', top: 16, alignSelf: 'flex-start' }}>
+        <div className="w-full md:w-[240px]" style={{ flexShrink: 0, position: 'sticky', top: 16, alignSelf: 'flex-start' }}>
           <div style={{ marginBottom: 12 }}>
             <CustomSelect
               value={currency}

client/src/components/Collab/CollabNotes.tsx

@@ -5,6 +5,7 @@ import Markdown from 'react-markdown'
 import remarkGfm from 'remark-gfm'
 import { Plus, Trash2, Pin, PinOff, Pencil, X, Check, StickyNote, Settings, ExternalLink, Maximize2 } from 'lucide-react'
 import { collabApi } from '../../api/client'
+import { getAuthUrl } from '../../api/authUrl'
 import { useCanDo } from '../../store/permissionsStore'
 import { useTripStore } from '../../store/tripStore'
 import { addListener, removeListener } from '../../api/websocket'
@@ -96,22 +97,33 @@ interface FilePreviewPortalProps {
 }
 
 function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
+  const [authUrl, setAuthUrl] = useState('')
+  const rawUrl = file?.url || ''
+  useEffect(() => {
+    if (!rawUrl) return
+    getAuthUrl(rawUrl, 'download').then(setAuthUrl)
+  }, [rawUrl])
+
   if (!file) return null
-  const url = file.url || `/uploads/${file.filename}`
   const isImage = file.mime_type?.startsWith('image/')
   const isPdf = file.mime_type === 'application/pdf'
   const isTxt = file.mime_type?.startsWith('text/')
 
+  const openInNewTab = async () => {
+    const u = await getAuthUrl(rawUrl, 'download')
+    window.open(u, '_blank', 'noreferrer')
+  }
+
   return ReactDOM.createPortal(
     <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.88)', zIndex: 10000, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16 }} onClick={onClose}>
       {isImage ? (
         /* Image lightbox — floating controls */
         <div style={{ position: 'relative', maxWidth: '90vw', maxHeight: '90vh' }} onClick={e => e.stopPropagation()}>
-          <img src={url} alt={file.original_name} style={{ maxWidth: '90vw', maxHeight: '90vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
+          <img src={authUrl} alt={file.original_name} style={{ maxWidth: '90vw', maxHeight: '90vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
           <div style={{ position: 'absolute', top: -36, left: 0, right: 0, display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '0 4px' }}>
             <span style={{ fontSize: 11, color: 'rgba(255,255,255,0.7)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: '70%' }}>{file.original_name}</span>
             <div style={{ display: 'flex', gap: 8 }}>
-              <a href={url} target="_blank" rel="noreferrer" style={{ color: 'rgba(255,255,255,0.7)', display: 'flex' }}><ExternalLink size={15} /></a>
+              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><ExternalLink size={15} /></button>
               <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'rgba(255,255,255,0.7)', display: 'flex', padding: 0 }}><X size={17} /></button>
             </div>
           </div>
@@ -122,19 +134,19 @@ function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
           <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '10px 16px', borderBottom: '1px solid var(--border-primary)', flexShrink: 0 }}>
             <span style={{ fontSize: 13, fontWeight: 600, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', flex: 1 }}>{file.original_name}</span>
             <div style={{ display: 'flex', gap: 8, flexShrink: 0 }}>
-              <a href={url} target="_blank" rel="noreferrer" style={{ display: 'flex', alignItems: 'center', gap: 3, fontSize: 11, color: 'var(--text-muted)', textDecoration: 'none' }}><ExternalLink size={13} /></a>
+              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', display: 'flex', alignItems: 'center', gap: 3, fontSize: 11, color: 'var(--text-muted)', padding: 0 }}><ExternalLink size={13} /></button>
               <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', display: 'flex', padding: 2 }}><X size={18} /></button>
             </div>
           </div>
           {(isPdf || isTxt) ? (
-            <object data={`${url}#view=FitH`} type={file.mime_type} style={{ flex: 1, width: '100%', border: 'none', background: '#fff' }} title={file.original_name}>
+            <object data={authUrl ? `${authUrl}#view=FitH` : ''} type={file.mime_type} style={{ flex: 1, width: '100%', border: 'none', background: '#fff' }} title={file.original_name}>
               <p style={{ padding: 24, textAlign: 'center', color: 'var(--text-muted)' }}>
-                <a href={url} target="_blank" rel="noopener noreferrer" style={{ color: 'var(--text-primary)', textDecoration: 'underline' }}>Download</a>
+                <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 14, padding: 0 }}>Download</button>
               </p>
             </object>
           ) : (
             <div style={{ flex: 1, display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 40 }}>
-              <a href={url} target="_blank" rel="noopener noreferrer" style={{ color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 14 }}>Download {file.original_name}</a>
+              <button onClick={openInNewTab} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-primary)', textDecoration: 'underline', fontSize: 14, padding: 0 }}>Download {file.original_name}</button>
             </div>
           )}
         </div>
@@ -144,6 +156,14 @@ function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
   )
 }
 
+function AuthedImg({ src, style, onClick, onMouseEnter, onMouseLeave, alt }: { src: string; style?: React.CSSProperties; onClick?: () => void; onMouseEnter?: React.MouseEventHandler<HTMLImageElement>; onMouseLeave?: React.MouseEventHandler<HTMLImageElement>; alt?: string }) {
+  const [authSrc, setAuthSrc] = useState('')
+  useEffect(() => {
+    getAuthUrl(src, 'download').then(setAuthSrc)
+  }, [src])
+  return authSrc ? <img src={authSrc} alt={alt} style={style} onClick={onClick} onMouseEnter={onMouseEnter} onMouseLeave={onMouseLeave} /> : null
+}
+
 const NOTE_COLORS = [
   { value: '#6366f1', label: 'Indigo' },
   { value: '#ef4444', label: 'Red' },
@@ -460,7 +480,7 @@ function NoteFormModal({ onClose, onSubmit, onDeleteFile, existingCategories, ca
             <div style={{ fontSize: 9, fontWeight: 600, color: 'var(--text-faint)', textTransform: 'uppercase', letterSpacing: '0.05em', marginBottom: 4, fontFamily: FONT }}>
               {t('collab.notes.attachFiles')}
             </div>
-            <input id="note-file-input" ref={fileRef} type="file" multiple style={{ display: 'none' }} onChange={e => { setPendingFiles(prev => [...prev, ...Array.from((e.target as HTMLInputElement).files)]); e.target.value = '' }} />
+            <input ref={fileRef} type="file" multiple style={{ display: 'none' }} onChange={e => { const files = e.target.files; if (files?.length) setPendingFiles(prev => [...prev, ...Array.from(files)]); e.target.value = '' }} />
             <div style={{ display: 'flex', gap: 6, flexWrap: 'wrap', alignItems: 'center' }}>
               {/* Existing attachments (edit mode) */}
               {existingAttachments.map(a => {
@@ -484,10 +504,10 @@ function NoteFormModal({ onClose, onSubmit, onDeleteFile, existingCategories, ca
                   </button>
                 </div>
               ))}
-              <label htmlFor="note-file-input"
+              <button type="button" onClick={() => fileRef.current?.click()}
                 style={{ padding: '4px 10px', borderRadius: 8, border: '1px dashed var(--border-faint)', background: 'transparent', cursor: 'pointer', color: 'var(--text-faint)', fontSize: 11, fontFamily: FONT, display: 'inline-flex', alignItems: 'center', gap: 4 }}>
                 <Plus size={11} /> {t('files.attach') || 'Add'}
-              </label>
+              </button>
             </div>
           </div>}
 
@@ -845,7 +865,7 @@ function NoteCard({ note, currentUser, canEdit, onUpdate, onDelete, onEdit, onVi
                     const isImage = a.mime_type?.startsWith('image/')
                     const ext = (a.original_name || '').split('.').pop()?.toUpperCase() || '?'
                     return isImage ? (
-                      <img key={a.id} src={a.url} alt={a.original_name}
+                      <AuthedImg key={a.id} src={a.url} alt={a.original_name}
                         style={{ width: 48, height: 48, objectFit: 'cover', borderRadius: 8, cursor: 'pointer', transition: 'transform 0.12s, box-shadow 0.12s' }}
                         onClick={() => onPreviewFile?.(a)}
                         onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.08)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
@@ -974,7 +994,7 @@ export default function CollabNotes({ tripId, currentUser }: CollabNotesProps) {
         for (const file of pendingFiles) {
           const fd = new FormData()
           fd.append('file', file)
-          try { await collabApi.uploadNoteFile(tripId, note.id, fd) } catch {}
+          try { await collabApi.uploadNoteFile(tripId, note.id, fd) } catch (err) { console.error('Failed to upload note attachment:', err) }
         }
         // Reload note with attachments
         const fresh = await collabApi.getNotes(tripId)

client/src/components/Collab/WhatsNextWidget.tsx

@@ -23,7 +23,7 @@ function formatDayLabel(date, t, locale) {
   if (d.toDateString() === now.toDateString()) return t('collab.whatsNext.today') || 'Today'
   if (d.toDateString() === tomorrow.toDateString()) return t('collab.whatsNext.tomorrow') || 'Tomorrow'
 
-  return d.toLocaleDateString(locale || undefined, { weekday: 'short', day: 'numeric', month: 'short' })
+  return new Date(date + 'T00:00:00Z').toLocaleDateString(locale || undefined, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })
 }
 
 interface TripMember {

client/src/components/Layout/InAppNotificationBell.tsx

@@ -0,0 +1,171 @@
+import React, { useState, useEffect } from 'react'
+import ReactDOM from 'react-dom'
+import { useNavigate } from 'react-router-dom'
+import { Bell, Trash2, CheckCheck } from 'lucide-react'
+import { useTranslation } from '../../i18n'
+import { useInAppNotificationStore } from '../../store/inAppNotificationStore.ts'
+import { useSettingsStore } from '../../store/settingsStore'
+import { useAuthStore } from '../../store/authStore'
+import InAppNotificationItem from '../Notifications/InAppNotificationItem.tsx'
+
+export default function InAppNotificationBell(): React.ReactElement {
+  const { t } = useTranslation()
+  const navigate = useNavigate()
+  const { settings } = useSettingsStore()
+  const darkMode = settings.dark_mode
+  const dark = darkMode === true || darkMode === 'dark' || (darkMode === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+
+  const isAuthenticated = useAuthStore(s => s.isAuthenticated)
+  const { notifications, unreadCount, isLoading, fetchNotifications, fetchUnreadCount, markAllRead, deleteAll } = useInAppNotificationStore()
+
+  const [open, setOpen] = useState(false)
+
+  useEffect(() => {
+    if (isAuthenticated) {
+      fetchUnreadCount()
+    }
+  }, [isAuthenticated])
+
+  const handleOpen = () => {
+    if (!open) {
+      fetchNotifications(true)
+    }
+    setOpen(v => !v)
+  }
+
+  const handleShowAll = () => {
+    setOpen(false)
+    navigate('/notifications')
+  }
+
+  const displayCount = unreadCount > 99 ? '99+' : unreadCount
+
+  return (
+    <div className="relative flex-shrink-0">
+      <button
+        onClick={handleOpen}
+        title={t('notifications.title')}
+        className="relative p-2 rounded-lg transition-colors"
+        style={{ color: 'var(--text-muted)' }}
+        onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+        onMouseLeave={e => e.currentTarget.style.background = 'transparent'}
+      >
+        <Bell className="w-4 h-4" />
+        {unreadCount > 0 && (
+          <span
+            className="absolute -top-0.5 -right-0.5 flex items-center justify-center rounded-full text-white font-bold"
+            style={{
+              background: '#ef4444',
+              fontSize: 9,
+              minWidth: 14,
+              height: 14,
+              padding: '0 3px',
+              lineHeight: 1,
+            }}
+          >
+            {displayCount}
+          </span>
+        )}
+      </button>
+
+      {open && ReactDOM.createPortal(
+        <>
+          <div style={{ position: 'fixed', inset: 0, zIndex: 9998 }} onClick={() => setOpen(false)} />
+          <div
+            className="rounded-xl shadow-xl border overflow-hidden"
+            style={{
+              position: 'fixed',
+              top: 'var(--nav-h)',
+              right: 8,
+              width: 360,
+              maxWidth: 'calc(100vw - 16px)',
+              maxHeight: 'min(480px, calc(100vh - var(--nav-h) - 16px))',
+              zIndex: 9999,
+              background: 'var(--bg-card)',
+              borderColor: 'var(--border-primary)',
+              display: 'flex',
+              flexDirection: 'column',
+            }}
+          >
+            {/* Header */}
+            <div
+              className="flex items-center justify-between px-4 py-3 flex-shrink-0"
+              style={{ borderBottom: '1px solid var(--border-secondary)' }}
+            >
+              <span className="text-sm font-semibold" style={{ color: 'var(--text-primary)' }}>
+                {t('notifications.title')}
+                {unreadCount > 0 && (
+                  <span className="ml-2 px-1.5 py-0.5 rounded-full text-xs font-medium"
+                    style={{ background: '#6366f1', color: '#fff' }}>
+                    {unreadCount}
+                  </span>
+                )}
+              </span>
+              <div className="flex items-center gap-1">
+                {unreadCount > 0 && (
+                  <button
+                    onClick={markAllRead}
+                    title={t('notifications.markAllRead')}
+                    className="p-1.5 rounded-lg transition-colors"
+                    style={{ color: 'var(--text-muted)' }}
+                    onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                    onMouseLeave={e => e.currentTarget.style.background = 'transparent'}
+                  >
+                    <CheckCheck className="w-3.5 h-3.5" />
+                  </button>
+                )}
+                {notifications.length > 0 && (
+                  <button
+                    onClick={deleteAll}
+                    title={t('notifications.deleteAll')}
+                    className="p-1.5 rounded-lg transition-colors"
+                    style={{ color: 'var(--text-muted)' }}
+                    onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                    onMouseLeave={e => e.currentTarget.style.background = 'transparent'}
+                  >
+                    <Trash2 className="w-3.5 h-3.5" />
+                  </button>
+                )}
+              </div>
+            </div>
+
+            {/* Notification list */}
+            <div className="overflow-y-auto flex-1">
+              {isLoading && notifications.length === 0 ? (
+                <div className="flex items-center justify-center py-10">
+                  <div className="w-5 h-5 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />
+                </div>
+              ) : notifications.length === 0 ? (
+                <div className="flex flex-col items-center justify-center py-10 px-4 text-center gap-2">
+                  <Bell className="w-8 h-8" style={{ color: 'var(--text-faint)' }} />
+                  <p className="text-sm font-medium" style={{ color: 'var(--text-muted)' }}>{t('notifications.empty')}</p>
+                  <p className="text-xs" style={{ color: 'var(--text-faint)' }}>{t('notifications.emptyDescription')}</p>
+                </div>
+              ) : (
+                notifications.slice(0, 10).map(n => (
+                  <InAppNotificationItem key={n.id} notification={n} onClose={() => setOpen(false)} />
+                ))
+              )}
+            </div>
+
+            {/* Footer */}
+            <button
+              onClick={handleShowAll}
+              className="w-full py-2.5 text-xs font-medium transition-colors flex-shrink-0"
+              style={{
+                borderTop: '1px solid var(--border-secondary)',
+                color: '#6366f1',
+                background: 'transparent',
+              }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = 'transparent'}
+            >
+              {t('notifications.showAll')}
+            </button>
+          </div>
+        </>,
+        document.body
+      )}
+    </div>
+  )
+}

client/src/components/Layout/Navbar.tsx

@@ -7,6 +7,7 @@ import { useAddonStore } from '../../store/addonStore'
 import { useTranslation } from '../../i18n'
 import { Plane, LogOut, Settings, ChevronDown, Shield, ArrowLeft, Users, Moon, Sun, Monitor, CalendarDays, Briefcase, Globe } from 'lucide-react'
 import type { LucideIcon } from 'lucide-react'
+import InAppNotificationBell from './InAppNotificationBell.tsx'
 
 const ADDON_ICONS: Record<string, LucideIcon> = { CalendarDays, Briefcase, Globe }
 
@@ -163,6 +164,9 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
         {dark ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />}
       </button>
 
+      {/* Notification bell */}
+      {user && <InAppNotificationBell />}
+
       {/* User menu */}
       {user && (
         <div className="relative">
@@ -228,9 +232,18 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
                   </button>
                   {appVersion && (
                     <div className="px-4 pt-2 pb-2.5 text-center" style={{ marginTop: 4, borderTop: '1px solid var(--border-secondary)' }}>
-                      <div style={{ display: 'inline-flex', alignItems: 'center', gap: 5, background: 'var(--bg-tertiary)', borderRadius: 99, padding: '4px 12px' }}>
-                        <img src={dark ? '/text-light.svg' : '/text-dark.svg'} alt="TREK" style={{ height: 10, opacity: 0.5 }} />
-                        <span style={{ fontSize: 10, fontWeight: 600, color: 'var(--text-faint)' }}>v{appVersion}</span>
+                      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6 }}>
+                        <div style={{ display: 'inline-flex', alignItems: 'center', gap: 5, background: 'var(--bg-tertiary)', borderRadius: 99, padding: '4px 12px' }}>
+                          <img src={dark ? '/text-light.svg' : '/text-dark.svg'} alt="TREK" style={{ height: 10, opacity: 0.5 }} />
+                          <span style={{ fontSize: 10, fontWeight: 600, color: 'var(--text-faint)' }}>v{appVersion}</span>
+                        </div>
+                        <a href="https://discord.gg/nSdKaXgN" target="_blank" rel="noopener noreferrer"
+                          style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 24, height: 24, borderRadius: 99, background: 'var(--bg-tertiary)', transition: 'background 0.15s' }}
+                          onMouseEnter={e => e.currentTarget.style.background = '#5865F220'}
+                          onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-tertiary)'}
+                          title="Discord">
+                          <svg width="12" height="12" viewBox="0 0 24 24" fill="var(--text-faint)"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg>
+                        </a>
                       </div>
                     </div>
                   )}

client/src/components/Map/MapView.tsx

@@ -72,13 +72,17 @@ function createPlaceIcon(place, orderNumbers, isSelected) {
     const imgIcon = L.divIcon({
       className: '',
       html: `<div style="
-        width:${size}px;height:${size}px;border-radius:50%;
-        border:${borderWidth}px solid ${borderColor};
-        box-shadow:${shadow};
-        overflow:hidden;background:${bgColor};
+        width:${size}px;height:${size}px;
         cursor:pointer;position:relative;
       ">
-        <img src="${place.image_url}" width="${size}" height="${size}" style="display:block;border-radius:50%;object-fit:cover;" />
+        <div style="
+          width:${size}px;height:${size}px;border-radius:50%;
+          border:${borderWidth}px solid ${borderColor};
+          box-shadow:${shadow};
+          overflow:hidden;background:${bgColor};
+        ">
+          <img src="${place.image_url}" width="${size}" height="${size}" style="display:block;border-radius:50%;object-fit:cover;" />
+        </div>
         ${badgeHtml}
       </div>`,
       iconSize: [size, size],

client/src/components/Memories/MemoriesPanel.tsx

@@ -3,12 +3,18 @@ import { Camera, Plus, Share2, EyeOff, Eye, X, Check, Search, ArrowUpDown, MapPi
 import apiClient from '../../api/client'
 import { useAuthStore } from '../../store/authStore'
 import { useTranslation } from '../../i18n'
-import { getAuthUrl } from '../../api/authUrl'
+import { getAuthUrl, fetchImageAsBlob, clearImageQueue } from '../../api/authUrl'
+import { useToast } from '../shared/Toast'
 
 function ImmichImg({ baseUrl, style, loading }: { baseUrl: string; style?: React.CSSProperties; loading?: 'lazy' | 'eager' }) {
   const [src, setSrc] = useState('')
   useEffect(() => {
-    getAuthUrl(baseUrl, 'immich').then(setSrc)
+    let revoke = ''
+    fetchImageAsBlob(baseUrl).then(blobUrl => {
+      revoke = blobUrl
+      setSrc(blobUrl)
+    })
+    return () => { if (revoke) URL.revokeObjectURL(revoke) }
   }, [baseUrl])
   return src ? <img src={src} alt="" loading={loading} style={style} /> : null
 }
@@ -40,6 +46,7 @@ interface MemoriesPanelProps {
 
 export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPanelProps) {
   const { t } = useTranslation()
+  const toast = useToast()
   const currentUser = useAuthStore(s => s.user)
 
   const [connected, setConnected] = useState(false)
@@ -81,7 +88,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
     try {
       const res = await apiClient.get('/integrations/immich/albums')
       setAlbums(res.data.albums || [])
-    } catch { setAlbums([]) }
+    } catch { setAlbums([]); toast.error(t('memories.error.loadAlbums')) }
     finally { setAlbumsLoading(false) }
   }
 
@@ -94,14 +101,14 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
       const linksRes = await apiClient.get(`/integrations/immich/trips/${tripId}/album-links`)
       const newLink = (linksRes.data.links || []).find((l: any) => l.immich_album_id === albumId)
       if (newLink) await syncAlbum(newLink.id)
-    } catch {}
+    } catch { toast.error(t('memories.error.linkAlbum')) }
   }
 
   const unlinkAlbum = async (linkId: number) => {
     try {
       await apiClient.delete(`/integrations/immich/trips/${tripId}/album-links/${linkId}`)
       loadAlbumLinks()
-    } catch {}
+    } catch { toast.error(t('memories.error.unlinkAlbum')) }
   }
 
   const syncAlbum = async (linkId: number) => {
@@ -110,7 +117,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
       await apiClient.post(`/integrations/immich/trips/${tripId}/album-links/${linkId}/sync`)
       await loadAlbumLinks()
       await loadPhotos()
-    } catch {}
+    } catch { toast.error(t('memories.error.syncAlbum')) }
     finally { setSyncing(null) }
   }
 
@@ -178,6 +185,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
       setPickerPhotos(res.data.assets || [])
     } catch {
       setPickerPhotos([])
+      toast.error(t('memories.error.loadPhotos'))
     } finally {
       setPickerLoading(false)
     }
@@ -205,8 +213,9 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
         shared: true,
       })
       setShowPicker(false)
+      clearImageQueue()
       loadInitial()
-    } catch {}
+    } catch { toast.error(t('memories.error.addPhotos')) }
   }
 
   // ── Remove photo ──────────────────────────────────────────────────────────
@@ -215,7 +224,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
     try {
       await apiClient.delete(`/integrations/immich/trips/${tripId}/photos/${assetId}`)
       setTripPhotos(prev => prev.filter(p => p.immich_asset_id !== assetId))
-    } catch {}
+    } catch { toast.error(t('memories.error.removePhoto')) }
   }
 
   // ── Toggle sharing ────────────────────────────────────────────────────────
@@ -226,7 +235,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
       setTripPhotos(prev => prev.map(p =>
         p.immich_asset_id === assetId ? { ...p, shared: shared ? 1 : 0 } : p
       ))
-    } catch {}
+    } catch { toast.error(t('memories.error.toggleSharing')) }
   }
 
   // ── Helpers ───────────────────────────────────────────────────────────────
@@ -362,7 +371,7 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
               {t('memories.selectPhotos')}
             </h3>
             <div style={{ display: 'flex', gap: 8 }}>
-              <button onClick={() => setShowPicker(false)}
+              <button onClick={() => { clearImageQueue(); setShowPicker(false) }}
                 style={{ padding: '7px 14px', borderRadius: 10, border: '1px solid var(--border-primary)', background: 'none', fontSize: 12, cursor: 'pointer', fontFamily: 'inherit', color: 'var(--text-muted)' }}>
                 {t('common.cancel')}
               </button>
@@ -631,8 +640,9 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
                   style={{ position: 'relative', aspectRatio: '1', borderRadius: 10, overflow: 'visible', cursor: 'pointer' }}
                   onClick={() => {
                     setLightboxId(photo.immich_asset_id); setLightboxUserId(photo.user_id); setLightboxInfo(null)
+                    if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc)
                     setLightboxOriginalSrc('')
-                    getAuthUrl(`/api/integrations/immich/assets/${photo.immich_asset_id}/original?userId=${photo.user_id}`, 'immich').then(setLightboxOriginalSrc)
+                    fetchImageAsBlob(`/api/integrations/immich/assets/${photo.immich_asset_id}/original?userId=${photo.user_id}`).then(setLightboxOriginalSrc)
                     setLightboxInfoLoading(true)
                     apiClient.get(`/integrations/immich/assets/${photo.immich_asset_id}/info?userId=${photo.user_id}`)
                       .then(r => setLightboxInfo(r.data)).catch(() => {}).finally(() => setLightboxInfoLoading(false))
@@ -740,12 +750,12 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
 
       {/* Lightbox */}
       {lightboxId && lightboxUserId && (
-        <div onClick={() => { setLightboxId(null); setLightboxUserId(null) }}
+        <div onClick={() => { if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc); setLightboxOriginalSrc(''); setLightboxId(null); setLightboxUserId(null) }}
           style={{
             position: 'absolute', inset: 0, zIndex: 100,
             background: 'rgba(0,0,0,0.92)', display: 'flex', alignItems: 'center', justifyContent: 'center',
           }}>
-          <button onClick={() => { setLightboxId(null); setLightboxUserId(null) }}
+          <button onClick={() => { if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc); setLightboxOriginalSrc(''); setLightboxId(null); setLightboxUserId(null) }}
             style={{
               position: 'absolute', top: 16, right: 16, width: 40, height: 40, borderRadius: '50%',
               background: 'rgba(255,255,255,0.1)', border: 'none', cursor: 'pointer',

client/src/components/Notifications/InAppNotificationItem.tsx

@@ -0,0 +1,195 @@
+import React, { useState } from 'react'
+import { useNavigate } from 'react-router-dom'
+import { User, Check, X, ArrowRight, Trash2, CheckCheck } from 'lucide-react'
+import { useTranslation } from '../../i18n'
+import { useInAppNotificationStore, InAppNotification } from '../../store/inAppNotificationStore'
+import { useSettingsStore } from '../../store/settingsStore'
+
+function relativeTime(dateStr: string, locale: string): string {
+  const diff = Date.now() - new Date(dateStr).getTime()
+  const minutes = Math.floor(diff / 60000)
+  if (minutes < 1) return locale === 'ar' ? 'الآن' : 'just now'
+  if (minutes < 60) return `${minutes}m`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}h`
+  const days = Math.floor(hours / 24)
+  return `${days}d`
+}
+
+interface NotificationItemProps {
+  notification: InAppNotification
+  onClose?: () => void
+}
+
+export default function InAppNotificationItem({ notification, onClose }: NotificationItemProps): React.ReactElement {
+  const { t, locale } = useTranslation()
+  const navigate = useNavigate()
+  const { settings } = useSettingsStore()
+  const darkMode = settings.dark_mode
+  const dark = darkMode === true || darkMode === 'dark' || (darkMode === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+  const [responding, setResponding] = useState(false)
+
+  const { markRead, markUnread, deleteNotification, respondToBoolean } = useInAppNotificationStore()
+
+  const handleNavigate = async () => {
+    if (!notification.is_read) await markRead(notification.id)
+    if (notification.navigate_target) {
+      navigate(notification.navigate_target)
+      onClose?.()
+    }
+  }
+
+  const handleRespond = async (response: 'positive' | 'negative') => {
+    if (responding || notification.response !== null) return
+    setResponding(true)
+    await respondToBoolean(notification.id, response)
+    setResponding(false)
+  }
+
+  const titleText = t(notification.title_key, notification.title_params)
+  const bodyText = t(notification.text_key, notification.text_params)
+  const hasUnknownTitle = titleText === notification.title_key
+  const hasUnknownBody = bodyText === notification.text_key
+
+  return (
+    <div
+      className="relative px-4 py-3 transition-colors"
+      style={{
+        background: notification.is_read ? 'transparent' : (dark ? 'rgba(99,102,241,0.07)' : 'rgba(99,102,241,0.05)'),
+        borderBottom: '1px solid var(--border-secondary)',
+      }}
+    >
+      {/* Unread dot */}
+      {!notification.is_read && (
+        <div className="absolute left-2 top-1/2 -translate-y-1/2 w-1.5 h-1.5 rounded-full" style={{ background: '#6366f1' }} />
+      )}
+
+      <div className="flex gap-3 items-start">
+        {/* Sender avatar */}
+        <div className="flex-shrink-0 mt-0.5">
+          {notification.sender_avatar ? (
+            <img
+              src={notification.sender_avatar}
+              alt=""
+              className="w-8 h-8 rounded-full object-cover"
+            />
+          ) : (
+            <div
+              className="w-8 h-8 rounded-full flex items-center justify-center text-xs font-bold"
+              style={{ background: dark ? '#27272a' : '#f1f5f9', color: 'var(--text-muted)' }}
+            >
+              {notification.sender_username
+                ? notification.sender_username.charAt(0).toUpperCase()
+                : <User className="w-4 h-4" />
+              }
+            </div>
+          )}
+        </div>
+
+        {/* Content */}
+        <div className="flex-1 min-w-0">
+          <div className="flex items-start justify-between gap-2">
+            <p className="text-sm font-medium leading-snug" style={{ color: 'var(--text-primary)' }}>
+              {hasUnknownTitle ? notification.title_key : titleText}
+            </p>
+            <div className="flex items-center gap-0.5 flex-shrink-0">
+              <span className="text-xs mr-1" style={{ color: 'var(--text-faint)' }}>
+                {relativeTime(notification.created_at, locale)}
+              </span>
+              {!notification.is_read && (
+                <button
+                  onClick={() => markRead(notification.id)}
+                  title={t('notifications.markRead')}
+                  className="p-1 rounded transition-colors"
+                  style={{ color: 'var(--text-faint)' }}
+                  onMouseEnter={e => { e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.color = '#6366f1' }}
+                  onMouseLeave={e => { e.currentTarget.style.background = 'transparent'; e.currentTarget.style.color = 'var(--text-faint)' }}
+                >
+                  <CheckCheck className="w-3.5 h-3.5" />
+                </button>
+              )}
+              <button
+                onClick={() => deleteNotification(notification.id)}
+                title={t('notifications.delete')}
+                className="p-1 rounded transition-colors"
+                style={{ color: 'var(--text-faint)' }}
+                onMouseEnter={e => { e.currentTarget.style.background = 'rgba(239,68,68,0.1)'; e.currentTarget.style.color = '#ef4444' }}
+                onMouseLeave={e => { e.currentTarget.style.background = 'transparent'; e.currentTarget.style.color = 'var(--text-faint)' }}
+              >
+                <Trash2 className="w-3.5 h-3.5" />
+              </button>
+            </div>
+          </div>
+
+          <p className="text-xs mt-0.5 leading-relaxed" style={{ color: 'var(--text-muted)' }}>
+            {hasUnknownBody ? notification.text_key : bodyText}
+          </p>
+
+          {/* Boolean actions */}
+          {notification.type === 'boolean' && notification.positive_text_key && notification.negative_text_key && (
+            <div className="flex gap-2 mt-2">
+              <button
+                onClick={() => handleRespond('positive')}
+                disabled={responding || notification.response !== null}
+                className="flex items-center gap-1 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
+                style={{
+                  background: notification.response === 'positive'
+                    ? '#6366f1'
+                    : notification.response === 'negative'
+                      ? (dark ? '#27272a' : '#f1f5f9')
+                      : (dark ? '#27272a' : '#f1f5f9'),
+                  color: notification.response === 'positive'
+                    ? '#fff'
+                    : notification.response === 'negative'
+                      ? 'var(--text-faint)'
+                      : 'var(--text-secondary)',
+                  opacity: notification.response === 'negative' ? 0.5 : 1,
+                  cursor: notification.response !== null || responding ? 'default' : 'pointer',
+                }}
+              >
+                <Check className="w-3 h-3" />
+                {t(notification.positive_text_key)}
+              </button>
+              <button
+                onClick={() => handleRespond('negative')}
+                disabled={responding || notification.response !== null}
+                className="flex items-center gap-1 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
+                style={{
+                  background: notification.response === 'negative'
+                    ? '#ef4444'
+                    : notification.response === 'positive'
+                      ? (dark ? '#27272a' : '#f1f5f9')
+                      : (dark ? '#27272a' : '#f1f5f9'),
+                  color: notification.response === 'negative'
+                    ? '#fff'
+                    : notification.response === 'positive'
+                      ? 'var(--text-faint)'
+                      : 'var(--text-secondary)',
+                  opacity: notification.response === 'positive' ? 0.5 : 1,
+                  cursor: notification.response !== null || responding ? 'default' : 'pointer',
+                }}
+              >
+                <X className="w-3 h-3" />
+                {t(notification.negative_text_key)}
+              </button>
+            </div>
+          )}
+
+          {/* Navigate action */}
+          {notification.type === 'navigate' && notification.navigate_text_key && notification.navigate_target && (
+            <button
+              onClick={handleNavigate}
+              className="flex items-center gap-1 mt-2 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
+              style={{ background: dark ? '#27272a' : '#f1f5f9', color: 'var(--text-secondary)' }}
+              onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+              onMouseLeave={e => e.currentTarget.style.background = dark ? '#27272a' : '#f1f5f9'}
+            >
+              <ArrowRight className="w-3 h-3" />
+              {t(notification.navigate_text_key)}
+            </button>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

client/src/components/PDF/TripPDF.tsx

@@ -61,15 +61,15 @@ function categoryIconSvg(iconName, color = '#6366f1', size = 24) {
 
 function shortDate(d, locale) {
   if (!d) return ''
-  return new Date(d + 'T00:00:00').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short' })
+  return new Date(d + 'T00:00:00Z').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })
 }
 
 function longDateRange(days, locale) {
   const dd = [...days].filter(d => d.date).sort((a, b) => a.day_number - b.day_number)
   if (!dd.length) return null
-  const f = new Date(dd[0].date + 'T00:00:00')
-  const l = new Date(dd[dd.length - 1].date + 'T00:00:00')
-  return `${f.toLocaleDateString(locale, { day: 'numeric', month: 'long' })} – ${l.toLocaleDateString(locale, { day: 'numeric', month: 'long', year: 'numeric' })}`
+  const f = new Date(dd[0].date + 'T00:00:00Z')
+  const l = new Date(dd[dd.length - 1].date + 'T00:00:00Z')
+  return `${f.toLocaleDateString(locale, { day: 'numeric', month: 'long', timeZone: 'UTC' })} – ${l.toLocaleDateString(locale, { day: 'numeric', month: 'long', year: 'numeric', timeZone: 'UTC' })}`
 }
 
 function dayCost(assignments, dayId, locale) {

client/src/components/Photos/PhotoGallery.tsx

@@ -213,5 +213,5 @@ function PhotoThumbnail({ photo, days, places, onClick }: PhotoThumbnailProps) {
 
 function formatDate(dateStr, locale) {
   if (!dateStr) return ''
-  return new Date(dateStr + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' })
+  return new Date(dateStr + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })
 }

client/src/components/Planner/DayDetailPanel.tsx

@@ -154,9 +154,9 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
 
   if (!day) return null
 
-  const formattedDate = day.date ? new Date(day.date + 'T00:00:00').toLocaleDateString(
+  const formattedDate = day.date ? new Date(day.date + 'T00:00:00Z').toLocaleDateString(
     getLocaleForLanguage(language),
-    { weekday: 'long', day: 'numeric', month: 'long' }
+    { weekday: 'long', day: 'numeric', month: 'long', timeZone: 'UTC' }
   ) : null
 
   const placesWithCoords = places.filter(p => p.lat && p.lng)
@@ -445,7 +445,7 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
                           onChange={v => setHotelDayRange(prev => ({ start: v, end: Math.max(v, prev.end) }))}
                           options={days.map((d, i) => ({
                             value: d.id,
-                            label: `${d.title || t('planner.dayN', { n: i + 1 })}${d.date ? ` — ${new Date(d.date + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' })}` : ''}`,
+                            label: `${d.title || t('planner.dayN', { n: i + 1 })}${d.date ? ` — ${new Date(d.date + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })}` : ''}`,
                           }))}
                           size="sm"
                         />
@@ -457,7 +457,7 @@ export default function DayDetailPanel({ day, days, places, categories = [], tri
                           onChange={v => setHotelDayRange(prev => ({ start: Math.min(prev.start, v), end: v }))}
                           options={days.map((d, i) => ({
                             value: d.id,
-                            label: `${d.title || t('planner.dayN', { n: i + 1 })}${d.date ? ` — ${new Date(d.date + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' })}` : ''}`,
+                            label: `${d.title || t('planner.dayN', { n: i + 1 })}${d.date ? ` — ${new Date(d.date + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })}` : ''}`,
                           }))}
                           size="sm"
                         />

client/src/components/Planner/DayPlanSidebar.tsx

@@ -4,7 +4,7 @@ declare global { interface Window { __dragData: DragDataPayload | null } }
 
 import React, { useState, useEffect, useRef, useMemo } from 'react'
 import ReactDOM from 'react-dom'
-import { ChevronDown, ChevronRight, ChevronUp, Navigation, RotateCcw, ExternalLink, Clock, Pencil, GripVertical, Ticket, Plus, FileText, Check, Trash2, Info, MapPin, Star, Heart, Camera, Lightbulb, Flag, Bookmark, Train, Bus, Plane, Car, Ship, Coffee, ShoppingBag, AlertTriangle, FileDown, Lock, Hotel, Utensils, Users } from 'lucide-react'
+import { ChevronDown, ChevronRight, ChevronUp, Navigation, RotateCcw, ExternalLink, Clock, Pencil, GripVertical, Ticket, Plus, FileText, Check, Trash2, Info, MapPin, Star, Heart, Camera, Lightbulb, Flag, Bookmark, Train, Bus, Plane, Car, Ship, Coffee, ShoppingBag, AlertTriangle, FileDown, Lock, Hotel, Utensils, Users, Undo2 } from 'lucide-react'
 
 const RES_ICONS = { flight: Plane, hotel: Hotel, restaurant: Utensils, train: Train, car: Car, cruise: Ship, event: Ticket, tour: Users, other: FileText }
 import { assignmentsApi, reservationsApi } from '../../api/client'
@@ -80,6 +80,10 @@ interface DayPlanSidebarProps {
   onAddReservation: () => void
   onNavigateToFiles?: () => void
   onExpandedDaysChange?: (expandedDayIds: Set<number>) => void
+  pushUndo?: (label: string, undoFn: () => Promise<void> | void) => void
+  canUndo?: boolean
+  lastActionLabel?: string | null
+  onUndo?: () => void
 }
 
 const DayPlanSidebar = React.memo(function DayPlanSidebar({
@@ -93,6 +97,10 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
   onAddReservation,
   onNavigateToFiles,
   onExpandedDaysChange,
+  pushUndo,
+  canUndo = false,
+  lastActionLabel = null,
+  onUndo,
 }: DayPlanSidebarProps) {
   const toast = useToast()
   const { t, language, locale } = useTranslation()
@@ -119,6 +127,9 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
   const [draggingId, setDraggingId] = useState(null)
   const [lockedIds, setLockedIds] = useState(new Set())
   const [lockHoverId, setLockHoverId] = useState(null)
+  const [undoHover, setUndoHover] = useState(false)
+  const [pdfHover, setPdfHover] = useState(false)
+  const [icsHover, setIcsHover] = useState(false)
   const [dropTargetKey, _setDropTargetKey] = useState(null)
   const dropTargetRef = useRef(null)
   const setDropTargetKey = (key) => { dropTargetRef.current = key; _setDropTargetKey(key) }
@@ -395,6 +406,9 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
 
   // Unified reorder: assigns positions to ALL item types based on new visual order
   const applyMergedOrder = async (dayId: number, newOrder: { type: string; data: any }[]) => {
+    // Capture previous place order for undo
+    const prevAssignmentIds = getDayAssignments(dayId).map(a => a.id)
+
     // Places get sequential integer positions (0, 1, 2, ...)
     // Non-place items between place N-1 and place N get fractional positions
     const assignmentIds: number[] = []
@@ -437,6 +451,13 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
         }
         await reservationsApi.updatePositions(tripId, transportUpdates)
       }
+      if (prevAssignmentIds.length) {
+        const capturedDayId = dayId
+        const capturedPrevIds = prevAssignmentIds
+        pushUndo?.(t('undo.reorder'), async () => {
+          await tripActions.reorderAssignments(tripId, capturedDayId, capturedPrevIds)
+        })
+      }
     } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Unknown error') }
   }
 
@@ -599,12 +620,14 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
   }
 
   const toggleLock = (assignmentId) => {
+    const prevLocked = new Set(lockedIds)
     setLockedIds(prev => {
       const next = new Set(prev)
       if (next.has(assignmentId)) next.delete(assignmentId)
       else next.add(assignmentId)
       return next
     })
+    pushUndo?.(t('undo.lock'), () => { setLockedIds(prevLocked) })
   }
 
   const handleOptimize = async () => {
@@ -612,6 +635,8 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
     const da = getDayAssignments(selectedDayId)
     if (da.length < 3) return
 
+    const prevIds = da.map(a => a.id)
+
     // Separate locked (stay at their index) and unlocked assignments
     const locked = new Map() // index -> assignment
     const unlocked = []
@@ -638,6 +663,10 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
 
     await onReorder(selectedDayId, result.map(a => a.id))
     toast.success(t('dayplan.toast.routeOptimized'))
+    const capturedDayId = selectedDayId
+    pushUndo?.(t('undo.optimize'), async () => {
+      await tripActions.reorderAssignments(tripId, capturedDayId, prevIds)
+    })
   }
 
   const handleGoogleMaps = () => {
@@ -656,7 +685,16 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
     if (placeId) {
       onAssignToDay?.(parseInt(placeId), dayId)
     } else if (assignmentId && fromDayId !== dayId) {
-      tripActions.moveAssignment(tripId, Number(assignmentId), fromDayId, dayId).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
+      const srcAssignment = (useTripStore.getState().assignments[String(fromDayId)] || []).find(a => a.id === Number(assignmentId))
+      const capturedFromDayId = fromDayId
+      const capturedOrderIndex = srcAssignment?.order_index ?? 0
+      tripActions.moveAssignment(tripId, Number(assignmentId), fromDayId, dayId)
+        .then(() => {
+          pushUndo?.(t('undo.moveDay'), async () => {
+            await tripActions.moveAssignment(tripId, Number(assignmentId), dayId, capturedFromDayId, capturedOrderIndex)
+          })
+        })
+        .catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
     } else if (noteId && fromDayId !== dayId) {
       tripActions.moveDayNote(tripId, fromDayId, dayId, Number(noteId)).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
     }
@@ -705,62 +743,124 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
             <div style={{ fontWeight: 600, fontSize: 14, color: 'var(--text-primary)', lineHeight: '1.3' }}>{trip?.title}</div>
             {(trip?.start_date || trip?.end_date) && (
               <div style={{ fontSize: 11, color: 'var(--text-faint)', marginTop: 3 }}>
-                {[trip.start_date, trip.end_date].filter(Boolean).map(d => new Date(d + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' })).join(' – ')}
+                {[trip.start_date, trip.end_date].filter(Boolean).map(d => new Date(d + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })).join(' – ')}
                 {days.length > 0 && ` · ${days.length} ${t('dayplan.days')}`}
               </div>
             )}
           </div>
-          <button
-            onClick={async () => {
-              const flatNotes = Object.entries(dayNotes).flatMap(([dayId, notes]) =>
-                notes.map(n => ({ ...n, day_id: Number(dayId) }))
-              )
-              try {
-                await downloadTripPDF({ trip, days, places, assignments, categories, dayNotes: flatNotes, reservations, t, locale })
-              } catch (e) {
-                console.error('PDF error:', e)
-                toast.error(t('dayplan.pdfError') + ': ' + (e?.message || String(e)))
-              }
-            }}
-            title={t('dayplan.pdfTooltip')}
-            style={{
-              flexShrink: 0, display: 'flex', alignItems: 'center', gap: 5,
-              padding: '5px 10px', borderRadius: 8, border: 'none',
-              background: 'var(--accent)', color: 'var(--accent-text)', fontSize: 11, fontWeight: 500,
-              cursor: 'pointer', fontFamily: 'inherit',
-            }}
-          >
-            <FileDown size={13} strokeWidth={2} />
-            {t('dayplan.pdf')}
-          </button>
-          <button
-            onClick={async () => {
-              try {
-                const res = await fetch(`/api/trips/${tripId}/export.ics`, {
-                  credentials: 'include',
-                })
-                if (!res.ok) throw new Error()
-                const blob = await res.blob()
-                const url = URL.createObjectURL(blob)
-                const a = document.createElement('a')
-                a.href = url
-                a.download = `${trip?.title || 'trip'}.ics`
-                a.click()
-                URL.revokeObjectURL(url)
-              } catch { toast.error('ICS export failed') }
-            }}
-            title={t('dayplan.icsTooltip')}
-            style={{
-              flexShrink: 0, display: 'flex', alignItems: 'center', gap: 5,
-              padding: '5px 10px', borderRadius: 8,
-              border: '1px solid var(--border-primary)', background: 'none',
-              color: 'var(--text-muted)', fontSize: 11, fontWeight: 500,
-              cursor: 'pointer', fontFamily: 'inherit',
-            }}
-          >
-            <FileDown size={13} strokeWidth={2} />
-            ICS
-          </button>
+          <div style={{ position: 'relative', flexShrink: 0 }}>
+            <button
+              onClick={async () => {
+                const flatNotes = Object.entries(dayNotes).flatMap(([dayId, notes]) =>
+                  notes.map(n => ({ ...n, day_id: Number(dayId) }))
+                )
+                try {
+                  await downloadTripPDF({ trip, days, places, assignments, categories, dayNotes: flatNotes, reservations, t, locale })
+                } catch (e) {
+                  console.error('PDF error:', e)
+                  toast.error(t('dayplan.pdfError') + ': ' + (e?.message || String(e)))
+                }
+              }}
+              onMouseEnter={() => setPdfHover(true)}
+              onMouseLeave={() => setPdfHover(false)}
+              style={{
+                display: 'flex', alignItems: 'center', gap: 5,
+                padding: '5px 10px', borderRadius: 8, border: 'none',
+                background: 'var(--accent)', color: 'var(--accent-text)', fontSize: 11, fontWeight: 500,
+                cursor: 'pointer', fontFamily: 'inherit',
+              }}
+            >
+              <FileDown size={13} strokeWidth={2} />
+              {t('dayplan.pdf')}
+            </button>
+            {pdfHover && (
+              <div style={{
+                position: 'absolute', top: 'calc(100% + 6px)', right: 0,
+                whiteSpace: 'nowrap', pointerEvents: 'none', zIndex: 200,
+                background: 'var(--bg-card, white)', color: 'var(--text-primary, #111827)',
+                fontSize: 11, fontWeight: 500, padding: '5px 10px',
+                borderRadius: 8, boxShadow: '0 4px 12px rgba(0,0,0,0.15)',
+                border: '1px solid var(--border-faint, #e5e7eb)',
+              }}>
+                {t('dayplan.pdfTooltip')}
+              </div>
+            )}
+          </div>
+          <div style={{ position: 'relative', flexShrink: 0 }}>
+            <button
+              onClick={async () => {
+                try {
+                  const res = await fetch(`/api/trips/${tripId}/export.ics`, {
+                    credentials: 'include',
+                  })
+                  if (!res.ok) throw new Error()
+                  const blob = await res.blob()
+                  const url = URL.createObjectURL(blob)
+                  const a = document.createElement('a')
+                  a.href = url
+                  a.download = `${trip?.title || 'trip'}.ics`
+                  a.click()
+                  URL.revokeObjectURL(url)
+                } catch { toast.error('ICS export failed') }
+              }}
+              onMouseEnter={() => setIcsHover(true)}
+              onMouseLeave={() => setIcsHover(false)}
+              style={{
+                display: 'flex', alignItems: 'center', gap: 5,
+                padding: '5px 10px', borderRadius: 8,
+                border: '1px solid var(--border-primary)', background: 'none',
+                color: 'var(--text-muted)', fontSize: 11, fontWeight: 500,
+                cursor: 'pointer', fontFamily: 'inherit',
+              }}
+            >
+              <FileDown size={13} strokeWidth={2} />
+              ICS
+            </button>
+            {icsHover && (
+              <div style={{
+                position: 'absolute', top: 'calc(100% + 6px)', right: 0,
+                whiteSpace: 'nowrap', pointerEvents: 'none', zIndex: 200,
+                background: 'var(--bg-card, white)', color: 'var(--text-primary, #111827)',
+                fontSize: 11, fontWeight: 500, padding: '5px 10px',
+                borderRadius: 8, boxShadow: '0 4px 12px rgba(0,0,0,0.15)',
+                border: '1px solid var(--border-faint, #e5e7eb)',
+              }}>
+                {t('dayplan.icsTooltip')}
+              </div>
+            )}
+          </div>
+          {onUndo && (
+            <div style={{ position: 'relative', flexShrink: 0 }}>
+              <button
+                onClick={onUndo}
+                disabled={!canUndo}
+                onMouseEnter={() => setUndoHover(true)}
+                onMouseLeave={() => setUndoHover(false)}
+                style={{
+                  display: 'flex', alignItems: 'center', justifyContent: 'center',
+                  width: 30, height: 30, borderRadius: 8,
+                  border: '1px solid var(--border-primary)', background: 'none',
+                  color: canUndo ? 'var(--text-primary)' : 'var(--border-primary)',
+                  cursor: canUndo ? 'pointer' : 'default', fontFamily: 'inherit',
+                  transition: 'color 0.15s, border-color 0.15s',
+                }}
+              >
+                <Undo2 size={14} strokeWidth={2} />
+              </button>
+              {undoHover && (
+                <div style={{
+                  position: 'absolute', top: 'calc(100% + 6px)', right: 0,
+                  whiteSpace: 'nowrap', pointerEvents: 'none', zIndex: 200,
+                  background: 'var(--bg-card, white)', color: 'var(--text-primary, #111827)',
+                  fontSize: 11, fontWeight: 500, padding: '5px 10px',
+                  borderRadius: 8, boxShadow: '0 4px 12px rgba(0,0,0,0.15)',
+                  border: '1px solid var(--border-faint, #e5e7eb)',
+                }}>
+                  {canUndo && lastActionLabel ? t('undo.tooltip', { action: lastActionLabel }) : t('undo.button')}
+                </div>
+              )}
+            </div>
+          )}
         </div>
       </div>
 
@@ -779,7 +879,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
           const placeItems = merged.filter(i => i.type === 'place')
 
           return (
-            <div key={day.id} style={{ borderBottom: '1px solid var(--border-faint)', contentVisibility: 'auto', containIntrinsicSize: '0 64px' }}>
+            <div key={day.id} style={{ borderBottom: '1px solid var(--border-faint)' }}>
               {/* Tages-Header — akzeptiert Drops aus der PlacesSidebar */}
               <div
                 onClick={() => { onSelectDay(day.id); if (onDayDetail) onDayDetail(day) }}
@@ -796,6 +896,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                   outline: isDragTarget ? '2px dashed rgba(17,24,39,0.25)' : 'none',
                   outlineOffset: -2,
                   borderRadius: isDragTarget ? 8 : 0,
+                  touchAction: 'manipulation',
                 }}
                 onMouseEnter={e => { if (!isSelected && !isDragTarget) e.currentTarget.style.background = 'var(--bg-tertiary)' }}
                 onMouseLeave={e => { if (!isSelected) e.currentTarget.style.background = isDragTarget ? 'rgba(17,24,39,0.07)' : 'transparent' }}
@@ -1453,8 +1554,9 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
               value={ui.text}
               onChange={e => setNoteUi(prev => ({ ...prev, [dayId]: { ...prev[dayId], text: e.target.value } }))}
               onKeyDown={e => { if (e.key === 'Enter') { e.preventDefault(); saveNote(Number(dayId)) } if (e.key === 'Escape') cancelNote(Number(dayId)) }}
-              placeholder={t('dayplan.noteTitle')}
-              style={{ fontSize: 13, fontWeight: 500, border: '1px solid var(--border-primary)', borderRadius: 8, padding: '8px 10px', fontFamily: 'inherit', outline: 'none', width: '100%', boxSizing: 'border-box', color: 'var(--text-primary)' }}
+              placeholder={t('dayplan.noteTitle') + ' *'}
+              required
+              style={{ fontSize: 13, fontWeight: 500, border: `1px solid ${!ui.text?.trim() ? 'var(--border-primary)' : 'var(--border-primary)'}`, borderRadius: 8, padding: '8px 10px', fontFamily: 'inherit', outline: 'none', width: '100%', boxSizing: 'border-box', color: 'var(--text-primary)' }}
             />
             <textarea
               value={ui.time}
@@ -1468,7 +1570,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
             <div style={{ textAlign: 'right', fontSize: 11, color: (ui.time?.length || 0) >= 140 ? '#d97706' : 'var(--text-faint)', marginTop: -2 }}>{ui.time?.length || 0}/150</div>
             <div style={{ display: 'flex', gap: 8, justifyContent: 'flex-end' }}>
               <button onClick={() => cancelNote(Number(dayId))} style={{ fontSize: 12, background: 'none', border: '1px solid var(--border-primary)', borderRadius: 8, padding: '6px 14px', cursor: 'pointer', color: 'var(--text-muted)', fontFamily: 'inherit' }}>{t('common.cancel')}</button>
-              <button onClick={() => saveNote(Number(dayId))} style={{ fontSize: 12, background: 'var(--accent)', color: 'var(--accent-text)', border: 'none', borderRadius: 8, padding: '6px 16px', cursor: 'pointer', fontWeight: 600, fontFamily: 'inherit' }}>
+              <button onClick={() => saveNote(Number(dayId))} disabled={!ui.text?.trim()} style={{ fontSize: 12, background: !ui.text?.trim() ? 'var(--border-primary)' : 'var(--accent)', color: !ui.text?.trim() ? 'var(--text-faint)' : 'var(--accent-text)', border: 'none', borderRadius: 8, padding: '6px 16px', cursor: !ui.text?.trim() ? 'not-allowed' : 'pointer', fontWeight: 600, fontFamily: 'inherit', transition: 'background 0.15s, color 0.15s' }}>
                 {ui.mode === 'add' ? t('common.add') : t('common.save')}
               </button>
             </div>
@@ -1569,7 +1671,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                         {res.reservation_time?.includes('T')
                           ? new Date(res.reservation_time).toLocaleString(locale, { weekday: 'short', day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })
                           : res.reservation_time
-                            ? new Date(res.reservation_time + 'T00:00:00').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short' })
+                            ? new Date(res.reservation_time + 'T00:00:00Z').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })
                             : ''
                         }
                         {res.reservation_end_time?.includes('T') && ` – ${new Date(res.reservation_end_time).toLocaleTimeString(locale, { hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })}`}

client/src/components/Planner/PlaceInspector.tsx

@@ -373,7 +373,7 @@ export default function PlaceInspector({
                         {res.reservation_time && (
                           <div>
                             <div style={{ fontSize: 8, fontWeight: 600, color: 'var(--text-faint)', textTransform: 'uppercase' }}>{t('reservations.date')}</div>
-                            <div style={{ fontSize: 10, fontWeight: 500, color: 'var(--text-primary)', marginTop: 1 }}>{new Date(res.reservation_time).toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short' })}</div>
+                            <div style={{ fontSize: 10, fontWeight: 500, color: 'var(--text-primary)', marginTop: 1 }}>{new Date((res.reservation_time.includes('T') ? res.reservation_time.split('T')[0] : res.reservation_time) + 'T00:00:00Z').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })}</div>
                           </div>
                         )}
                         {res.reservation_time?.includes('T') && (

client/src/components/Planner/PlacesSidebar.tsx

@@ -29,11 +29,12 @@ interface PlacesSidebarProps {
   days: Day[]
   isMobile: boolean
   onCategoryFilterChange?: (categoryId: string) => void
+  pushUndo?: (label: string, undoFn: () => Promise<void> | void) => void
 }
 
 const PlacesSidebar = React.memo(function PlacesSidebar({
   tripId, places, categories, assignments, selectedDayId, selectedPlaceId,
-  onPlaceClick, onAddPlace, onAssignToDay, onEditPlace, onDeletePlace, days, isMobile, onCategoryFilterChange,
+  onPlaceClick, onAddPlace, onAssignToDay, onEditPlace, onDeletePlace, days, isMobile, onCategoryFilterChange, pushUndo,
 }: PlacesSidebarProps) {
   const { t } = useTranslation()
   const toast = useToast()
@@ -52,6 +53,15 @@ const PlacesSidebar = React.memo(function PlacesSidebar({
       const result = await placesApi.importGpx(tripId, file)
       await loadTrip(tripId)
       toast.success(t('places.gpxImported', { count: result.count }))
+      if (result.places?.length > 0) {
+        const importedIds: number[] = result.places.map((p: { id: number }) => p.id)
+        pushUndo?.(t('undo.importGpx'), async () => {
+          for (const id of importedIds) {
+            try { await placesApi.delete(tripId, id) } catch {}
+          }
+          await loadTrip(tripId)
+        })
+      }
     } catch (err: any) {
       toast.error(err?.response?.data?.error || t('places.gpxError'))
     }
@@ -70,6 +80,15 @@ const PlacesSidebar = React.memo(function PlacesSidebar({
       toast.success(t('places.googleListImported', { count: result.count, list: result.listName }))
       setGoogleListOpen(false)
       setGoogleListUrl('')
+      if (result.places?.length > 0) {
+        const importedIds: number[] = result.places.map((p: { id: number }) => p.id)
+        pushUndo?.(t('undo.importGoogleList'), async () => {
+          for (const id of importedIds) {
+            try { await placesApi.delete(tripId, id) } catch {}
+          }
+          await loadTrip(tripId)
+        })
+      }
     } catch (err: any) {
       toast.error(err?.response?.data?.error || t('places.googleListError'))
     } finally {
@@ -405,7 +424,7 @@ const PlacesSidebar = React.memo(function PlacesSidebar({
                           <div style={{ width: 28, height: 28, borderRadius: '50%', background: 'var(--bg-tertiary)', display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 12, fontWeight: 700, color: 'var(--text-primary)', flexShrink: 0 }}>{i + 1}</div>
                           <div style={{ flex: 1, minWidth: 0 }}>
                             <div style={{ fontSize: 13, fontWeight: 500, color: 'var(--text-primary)' }}>{day.title || t('dayplan.dayN', { n: i + 1 })}</div>
-                            {day.date && <div style={{ fontSize: 11, color: 'var(--text-faint)' }}>{new Date(day.date + 'T00:00:00').toLocaleDateString()}</div>}
+                            {day.date && <div style={{ fontSize: 11, color: 'var(--text-faint)' }}>{new Date(day.date + 'T00:00:00Z').toLocaleDateString(undefined, { timeZone: 'UTC' })}</div>}
                           </div>
                           {(assignments[String(day.id)] || []).some(a => a.place?.id === dayPickerPlace.id) && <Check size={14} color="var(--text-faint)" />}
                         </button>

client/src/components/Planner/ReservationModal.tsx

@@ -572,6 +572,6 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
 
 function formatDate(dateStr, locale) {
   if (!dateStr) return ''
-  const d = new Date(dateStr + 'T00:00:00')
-  return d.toLocaleDateString(locale || undefined, { day: 'numeric', month: 'short' })
+  const d = new Date(dateStr + 'T00:00:00Z')
+  return d.toLocaleDateString(locale || undefined, { day: 'numeric', month: 'short', timeZone: 'UTC' })
 }

client/src/components/Planner/ReservationsPanel.tsx

@@ -84,8 +84,8 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
   }
 
   const fmtDate = (str) => {
-    const d = new Date(str)
-    return d.toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short' })
+    const dateOnly = str.includes('T') ? str.split('T')[0] : str
+    return new Date(dateOnly + 'T00:00:00Z').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })
   }
   const fmtTime = (str) => {
     const d = new Date(str)

client/src/components/Trips/TripFormModal.tsx

@@ -197,10 +197,10 @@ export default function TripFormModal({ isOpen, onClose, onSave, trip, onCoverUp
       if (!prev.end_date || prev.end_date < value) {
         next.end_date = value
       } else if (prev.start_date) {
-        const oldStart = new Date(prev.start_date + 'T00:00:00')
-        const oldEnd = new Date(prev.end_date + 'T00:00:00')
+        const oldStart = new Date(prev.start_date + 'T00:00:00Z')
+        const oldEnd = new Date(prev.end_date + 'T00:00:00Z')
         const duration = Math.round((oldEnd - oldStart) / 86400000)
-        const newEnd = new Date(value + 'T00:00:00')
+        const newEnd = new Date(value + 'T00:00:00Z')
         newEnd.setDate(newEnd.getDate() + duration)
         next.end_date = newEnd.toISOString().split('T')[0]
       }

client/src/components/Vacay/VacayMonthCard.tsx

@@ -81,6 +81,7 @@ export default function VacayMonthCard({
               return (
                 <div
                   key={di}
+                  title={holiday ? (holiday.label ? `${holiday.label}: ${holiday.localName}` : holiday.localName) : undefined}
                   className="relative flex items-center justify-center cursor-pointer transition-colors"
                   style={{
                     height: 28,

client/src/components/Vacay/holidays.ts

@@ -104,18 +104,18 @@ export function getHolidays(year: number, bundesland: string = 'NW'): Record<str
 }
 
 export function isWeekend(dateStr: string, weekendDays: number[] = [0, 6]): boolean {
-  const d = new Date(dateStr + 'T00:00:00')
-  return weekendDays.includes(d.getDay())
+  const d = new Date(dateStr + 'T00:00:00Z')
+  return weekendDays.includes(d.getUTCDay())
 }
 
 export function getWeekday(dateStr: string): string {
-  const d = new Date(dateStr + 'T00:00:00')
-  return ['So', 'Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa'][d.getDay()]
+  const d = new Date(dateStr + 'T00:00:00Z')
+  return ['So', 'Mo', 'Di', 'Mi', 'Do', 'Fr', 'Sa'][d.getUTCDay()]
 }
 
 export function getWeekdayFull(dateStr: string): string {
-  const d = new Date(dateStr + 'T00:00:00')
-  return ['Sonntag', 'Montag', 'Dienstag', 'Mittwoch', 'Donnerstag', 'Freitag', 'Samstag'][d.getDay()]
+  const d = new Date(dateStr + 'T00:00:00Z')
+  return ['Sonntag', 'Montag', 'Dienstag', 'Mittwoch', 'Donnerstag', 'Freitag', 'Samstag'][d.getUTCDay()]
 }
 
 export function daysInMonth(year: number, month: number): number {
@@ -123,8 +123,8 @@ export function daysInMonth(year: number, month: number): number {
 }
 
 export function formatDate(dateStr: string, locale?: string): string {
-  const d = new Date(dateStr + 'T00:00:00')
-  return d.toLocaleDateString(locale || undefined, { weekday: 'short', day: '2-digit', month: '2-digit', year: 'numeric' })
+  const d = new Date(dateStr + 'T00:00:00Z')
+  return d.toLocaleDateString(locale || undefined, { weekday: 'short', day: '2-digit', month: '2-digit', year: 'numeric', timeZone: 'UTC' })
 }
 
 export { BUNDESLAENDER }

client/src/components/shared/CustomDateTimePicker.tsx

@@ -21,9 +21,9 @@ export function CustomDatePicker({ value, onChange, placeholder, style = {}, com
   const ref = useRef<HTMLDivElement>(null)
   const dropRef = useRef<HTMLDivElement>(null)
 
-  const parsed = value ? new Date(value + 'T00:00:00') : null
-  const [viewYear, setViewYear] = useState(parsed?.getFullYear() || new Date().getFullYear())
-  const [viewMonth, setViewMonth] = useState(parsed?.getMonth() ?? new Date().getMonth())
+  const parsed = value ? new Date(value + 'T00:00:00Z') : null
+  const [viewYear, setViewYear] = useState(parsed?.getUTCFullYear() || new Date().getFullYear())
+  const [viewMonth, setViewMonth] = useState(parsed?.getUTCMonth() ?? new Date().getMonth())
 
   useEffect(() => {
     const handler = (e: MouseEvent) => {
@@ -36,7 +36,7 @@ export function CustomDatePicker({ value, onChange, placeholder, style = {}, com
   }, [open])
 
   useEffect(() => {
-    if (open && parsed) { setViewYear(parsed.getFullYear()); setViewMonth(parsed.getMonth()) }
+    if (open && parsed) { setViewYear(parsed.getUTCFullYear()); setViewMonth(parsed.getUTCMonth()) }
   }, [open])
 
   const prevMonth = () => { if (viewMonth === 0) { setViewMonth(11); setViewYear(y => y - 1) } else setViewMonth(m => m - 1) }
@@ -47,7 +47,7 @@ export function CustomDatePicker({ value, onChange, placeholder, style = {}, com
   const startDay = (getWeekday(viewYear, viewMonth, 1) + 6) % 7
   const weekdays = Array.from({ length: 7 }, (_, i) => new Date(2024, 0, i + 1).toLocaleDateString(locale, { weekday: 'narrow' }))
 
-  const displayValue = parsed ? parsed.toLocaleDateString(locale, compact ? { day: '2-digit', month: '2-digit', year: '2-digit' } : { day: 'numeric', month: 'short', year: 'numeric' }) : null
+  const displayValue = parsed ? parsed.toLocaleDateString(locale, compact ? { day: '2-digit', month: '2-digit', year: '2-digit', timeZone: 'UTC' } : { day: 'numeric', month: 'short', year: 'numeric', timeZone: 'UTC' }) : null
 
   const selectDay = (day: number) => {
     const y = String(viewYear)
@@ -57,7 +57,7 @@ export function CustomDatePicker({ value, onChange, placeholder, style = {}, com
     setOpen(false)
   }
 
-  const selectedDay = parsed && parsed.getFullYear() === viewYear && parsed.getMonth() === viewMonth ? parsed.getDate() : null
+  const selectedDay = parsed && parsed.getUTCFullYear() === viewYear && parsed.getUTCMonth() === viewMonth ? parsed.getUTCDate() : null
   const today = new Date()
   const isToday = (d: number) => today.getFullYear() === viewYear && today.getMonth() === viewMonth && today.getDate() === d
 

client/src/hooks/useInAppNotificationListener.ts

@@ -0,0 +1,20 @@
+import { useEffect } from 'react'
+import { addListener, removeListener } from '../api/websocket'
+import { useInAppNotificationStore } from '../store/inAppNotificationStore.ts'
+
+export function useInAppNotificationListener(): void {
+  const handleNew = useInAppNotificationStore(s => s.handleNewNotification)
+  const handleUpdated = useInAppNotificationStore(s => s.handleUpdatedNotification)
+
+  useEffect(() => {
+    const listener = (event: Record<string, unknown>) => {
+      if (event.type === 'notification:new') {
+        handleNew(event.notification as any)
+      } else if (event.type === 'notification:updated') {
+        handleUpdated(event.notification as any)
+      }
+    }
+    addListener(listener)
+    return () => removeListener(listener)
+  }, [handleNew, handleUpdated])
+}

client/src/hooks/usePlannerHistory.ts

@@ -0,0 +1,29 @@
+import { useRef, useReducer } from 'react'
+
+export interface UndoEntry {
+  label: string
+  undo: () => Promise<void> | void
+}
+
+export function usePlannerHistory(maxEntries = 30) {
+  const historyRef = useRef<UndoEntry[]>([])
+  const [, forceUpdate] = useReducer((x: number) => x + 1, 0)
+
+  const pushUndo = (label: string, undoFn: () => Promise<void> | void) => {
+    historyRef.current = [{ label, undo: undoFn }, ...historyRef.current].slice(0, maxEntries)
+    forceUpdate()
+  }
+
+  const undo = async () => {
+    if (historyRef.current.length === 0) return
+    const [first, ...rest] = historyRef.current
+    historyRef.current = rest
+    forceUpdate()
+    try { await first.undo() } catch (e) { console.error('Undo failed:', e) }
+  }
+
+  const canUndo = historyRef.current.length > 0
+  const lastActionLabel = historyRef.current[0]?.label ?? null
+
+  return { pushUndo, undo, canUndo, lastActionLabel }
+}

client/src/hooks/useRouteCalculation.ts

@@ -15,11 +15,14 @@ export function useRouteCalculation(tripStore: TripStoreState, selectedDayId: nu
   const [routeSegments, setRouteSegments] = useState<RouteSegment[]>([])
   const routeCalcEnabled = useSettingsStore((s) => s.settings.route_calculation) !== false
   const routeAbortRef = useRef<AbortController | null>(null)
+  // Keep a ref to the latest tripStore so updateRouteForDay never has a stale closure
+  const tripStoreRef = useRef(tripStore)
+  tripStoreRef.current = tripStore
 
   const updateRouteForDay = useCallback(async (dayId: number | null) => {
     if (routeAbortRef.current) routeAbortRef.current.abort()
     if (!dayId) { setRoute(null); setRouteSegments([]); return }
-    const currentAssignments = tripStore.assignments || {}
+    const currentAssignments = tripStoreRef.current.assignments || {}
     const da = (currentAssignments[String(dayId)] || []).slice().sort((a, b) => a.order_index - b.order_index)
     const waypoints = da.map((a) => a.place).filter((p) => p?.lat && p?.lng)
     if (waypoints.length < 2) { setRoute(null); setRouteSegments([]); return }

client/src/i18n/TranslationContext.tsx

@@ -12,6 +12,7 @@ import nl from './translations/nl'
 import ar from './translations/ar'
 import br from './translations/br'
 import cs from './translations/cs'
+import pl from './translations/pl'
 
 type TranslationStrings = Record<string, string | { name: string; category: string }[]>
 
@@ -24,14 +25,15 @@ export const SUPPORTED_LANGUAGES = [
   { value: 'nl', label: 'Nederlands' },
   { value: 'br', label: 'Português (Brasil)' },
   { value: 'cs', label: 'Česky' },
+  { value: 'pl', label: 'Polski' },
   { value: 'ru', label: 'Русский' },
   { value: 'zh', label: '中文' },
   { value: 'it', label: 'Italiano' },
   { value: 'ar', label: 'العربية' },
 ] as const
 
-const translations: Record<string, TranslationStrings> = { de, en, es, fr, hu, it, ru, zh, nl, ar, br, cs }
-const LOCALES: Record<string, string> = { de: 'de-DE', en: 'en-US', es: 'es-ES', fr: 'fr-FR', hu: 'hu-HU', it: 'it-IT', ru: 'ru-RU', zh: 'zh-CN', nl: 'nl-NL', ar: 'ar-SA', br: 'pt-BR', cs: 'cs-CZ' }
+const translations: Record<string, TranslationStrings> = { de, en, es, fr, hu, it, ru, zh, nl, ar, br, cs, pl }
+const LOCALES: Record<string, string> = { de: 'de-DE', en: 'en-US', es: 'es-ES', fr: 'fr-FR', hu: 'hu-HU', it: 'it-IT', ru: 'ru-RU', zh: 'zh-CN', nl: 'nl-NL', ar: 'ar-SA', br: 'pt-BR', cs: 'cs-CZ', pl: 'pl-PL' }
 const RTL_LANGUAGES = new Set(['ar'])
 
 export function getLocaleForLanguage(language: string): string {
@@ -40,7 +42,7 @@ export function getLocaleForLanguage(language: string): string {
 
 export function getIntlLanguage(language: string): string {
   if (language === 'br') return 'pt-BR'
-  return ['de', 'es', 'fr', 'hu', 'it', 'ru', 'zh', 'nl', 'ar', 'cs'].includes(language) ? language : 'en'
+  return ['de', 'es', 'fr', 'hu', 'it', 'ru', 'zh', 'nl', 'ar', 'cs', 'pl'].includes(language) ? language : 'en'
 }
 
 export function isRtlLanguage(language: string): boolean {

client/src/i18n/translations/en.ts

@@ -80,7 +80,10 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'dashboard.sharedBy': 'Shared by {name}',
   'dashboard.days': 'Days',
   'dashboard.places': 'Places',
+  'dashboard.members': 'Buddies',
   'dashboard.archive': 'Archive',
+  'dashboard.copyTrip': 'Copy',
+  'dashboard.copySuffix': 'copy',
   'dashboard.restore': 'Restore',
   'dashboard.archived': 'Archived',
   'dashboard.status.ongoing': 'Ongoing',
@@ -99,6 +102,8 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'dashboard.toast.archiveError': 'Failed to archive trip',
   'dashboard.toast.restored': 'Trip restored',
   'dashboard.toast.restoreError': 'Failed to restore trip',
+  'dashboard.toast.copied': 'Trip copied!',
+  'dashboard.toast.copyError': 'Failed to copy trip',
   'dashboard.confirm.delete': 'Delete trip "{title}"? All places and plans will be permanently deleted.',
   'dashboard.editTrip': 'Edit Trip',
   'dashboard.createTrip': 'Create New Trip',
@@ -237,6 +242,7 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'settings.mcp.toast.deleted': 'Token deleted',
   'settings.mcp.toast.deleteError': 'Failed to delete token',
   'settings.account': 'Account',
+  'settings.about': 'About',
   'settings.username': 'Username',
   'settings.email': 'Email',
   'settings.role': 'Role',
@@ -586,7 +592,8 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'vacay.subtitle': 'Plan and manage vacation days',
   'vacay.settings': 'Settings',
   'vacay.year': 'Year',
-  'vacay.addYear': 'Add year',
+  'vacay.addYear': 'Add next year',
+  'vacay.addPrevYear': 'Add previous year',
   'vacay.removeYear': 'Remove year',
   'vacay.removeYearConfirm': 'Remove {year}?',
   'vacay.removeYearHint': 'All vacation entries and company holidays for this year will be permanently deleted.',
@@ -1363,6 +1370,14 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'memories.confirmShareTitle': 'Share with trip members?',
   'memories.confirmShareHint': '{count} photos will be visible to all members of this trip. You can make individual photos private later.',
   'memories.confirmShareButton': 'Share photos',
+  'memories.error.loadAlbums': 'Failed to load albums',
+  'memories.error.linkAlbum': 'Failed to link album',
+  'memories.error.unlinkAlbum': 'Failed to unlink album',
+  'memories.error.syncAlbum': 'Failed to sync album',
+  'memories.error.loadPhotos': 'Failed to load photos',
+  'memories.error.addPhotos': 'Failed to add photos',
+  'memories.error.removePhoto': 'Failed to remove photo',
+  'memories.error.toggleSharing': 'Failed to update sharing',
 
   // Collab Addon
   'collab.tabs.chat': 'Chat',
@@ -1482,6 +1497,50 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'perm.actionHint.packing_edit': 'Who can manage packing items and bags',
   'perm.actionHint.collab_edit': 'Who can create notes, polls and send messages',
   'perm.actionHint.share_manage': 'Who can create or delete public share links',
+
+  // Undo
+  'undo.button': 'Undo',
+  'undo.tooltip': 'Undo: {action}',
+  'undo.assignPlace': 'Place assigned to day',
+  'undo.removeAssignment': 'Place removed from day',
+  'undo.reorder': 'Places reordered',
+  'undo.optimize': 'Route optimized',
+  'undo.deletePlace': 'Place deleted',
+  'undo.moveDay': 'Place moved to another day',
+  'undo.lock': 'Place lock toggled',
+  'undo.importGpx': 'GPX import',
+  'undo.importGoogleList': 'Google Maps import',
+  'undo.addPlace': 'Place added',
+  'undo.done': 'Undone: {action}',
+
+  // Notifications
+  'notifications.title': 'Notifications',
+  'notifications.markAllRead': 'Mark all read',
+  'notifications.deleteAll': 'Delete all',
+  'notifications.showAll': 'Show all notifications',
+  'notifications.empty': 'No notifications',
+  'notifications.emptyDescription': "You're all caught up!",
+  'notifications.all': 'All',
+  'notifications.unreadOnly': 'Unread',
+  'notifications.markRead': 'Mark as read',
+  'notifications.markUnread': 'Mark as unread',
+  'notifications.delete': 'Delete',
+  'notifications.system': 'System',
+
+  // Notification test keys (dev only)
+  'notifications.test.title': 'Test notification from {actor}',
+  'notifications.test.text': 'This is a simple test notification.',
+  'notifications.test.booleanTitle': '{actor} asks for your approval',
+  'notifications.test.booleanText': 'This is a test boolean notification. Choose an action below.',
+  'notifications.test.accept': 'Approve',
+  'notifications.test.decline': 'Decline',
+  'notifications.test.navigateTitle': 'Check something out',
+  'notifications.test.navigateText': 'This is a test navigate notification.',
+  'notifications.test.goThere': 'Go there',
+  'notifications.test.adminTitle': 'Admin broadcast',
+  'notifications.test.adminText': '{actor} sent a test notification to all admins.',
+  'notifications.test.tripTitle': '{actor} posted in your trip',
+  'notifications.test.tripText': 'Test notification for trip "{trip}".',
 }
 
 export default en

client/src/pages/AdminPage.tsx

@@ -1,6 +1,7 @@
 import React, { useEffect, useState } from 'react'
 import { useNavigate } from 'react-router-dom'
 import apiClient, { adminApi, authApi, notificationsApi } from '../api/client'
+import DevNotificationsPanel from '../components/Admin/DevNotificationsPanel'
 import { useAuthStore } from '../store/authStore'
 import { useSettingsStore } from '../store/settingsStore'
 import { useAddonStore } from '../store/addonStore'
@@ -17,7 +18,7 @@ import PackingTemplateManager from '../components/Admin/PackingTemplateManager'
 import AuditLogPanel from '../components/Admin/AuditLogPanel'
 import AdminMcpTokensPanel from '../components/Admin/AdminMcpTokensPanel'
 import PermissionsPanel from '../components/Admin/PermissionsPanel'
-import { Users, Map, Briefcase, Shield, Trash2, Edit2, Camera, FileText, Eye, EyeOff, Save, CheckCircle, XCircle, Loader2, UserPlus, ArrowUpCircle, ExternalLink, Download, GitBranch, Sun, Link2, Copy, Plus, RefreshCw, AlertTriangle } from 'lucide-react'
+import { Users, Map, Briefcase, Shield, Trash2, Edit2, FileText, Eye, EyeOff, Save, CheckCircle, XCircle, Loader2, UserPlus, ArrowUpCircle, ExternalLink, Download, Sun, Link2, Copy, Plus, RefreshCw, AlertTriangle } from 'lucide-react'
 import CustomSelect from '../components/shared/CustomSelect'
 
 interface AdminUser {
@@ -61,6 +62,7 @@ export default function AdminPage(): React.ReactElement {
   const { t, locale } = useTranslation()
   const hour12 = useSettingsStore(s => s.settings.time_format) === '12h'
   const mcpEnabled = useAddonStore(s => s.isEnabled('mcp'))
+  const devMode = useAuthStore(s => s.devMode)
   const TABS = [
     { id: 'users', label: t('admin.tabs.users') },
     { id: 'config', label: t('admin.tabs.config') },
@@ -70,6 +72,7 @@ export default function AdminPage(): React.ReactElement {
     { id: 'audit', label: t('admin.tabs.audit') },
     ...(mcpEnabled ? [{ id: 'mcp-tokens', label: t('admin.tabs.mcpTokens') }] : []),
     { id: 'github', label: t('admin.tabs.github') },
+    ...(devMode ? [{ id: 'dev-notifications', label: 'Dev: Notifications' }] : []),
   ]
 
   const [activeTab, setActiveTab] = useState<string>('users')
@@ -1183,6 +1186,8 @@ export default function AdminPage(): React.ReactElement {
           {activeTab === 'mcp-tokens' && <AdminMcpTokensPanel />}
 
           {activeTab === 'github' && <GitHubPanel />}
+
+          {activeTab === 'dev-notifications' && <DevNotificationsPanel />}
         </div>
       </div>
 

client/src/pages/DashboardPage.tsx

@@ -14,8 +14,8 @@ import ConfirmDialog from '../components/shared/ConfirmDialog'
 import { useToast } from '../components/shared/Toast'
 import {
   Plus, Calendar, Trash2, Edit2, Map, ChevronDown, ChevronUp,
-  Archive, ArchiveRestore, Clock, MapPin, Settings, X, ArrowRightLeft,
-  LayoutGrid, List,
+  Archive, ArchiveRestore, Clock, MapPin, Settings, X, ArrowRightLeft, Users,
+  LayoutGrid, List, Copy,
 } from 'lucide-react'
 import { useCanDo } from '../store/permissionsStore'
 
@@ -31,6 +31,7 @@ interface DashboardTrip {
   owner_username?: string
   day_count?: number
   place_count?: number
+  shared_count?: number
   [key: string]: string | number | boolean | null | undefined
 }
 
@@ -58,12 +59,12 @@ function getTripStatus(trip: DashboardTrip): string | null {
 
 function formatDate(dateStr: string | null | undefined, locale: string = 'en-US'): string | null {
   if (!dateStr) return null
-  return new Date(dateStr + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short', year: 'numeric' })
+  return new Date(dateStr + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', year: 'numeric', timeZone: 'UTC' })
 }
 
 function formatDateShort(dateStr: string | null | undefined, locale: string = 'en-US'): string | null {
   if (!dateStr) return null
-  return new Date(dateStr + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' })
+  return new Date(dateStr + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' })
 }
 
 function sortTrips(trips: DashboardTrip[]): DashboardTrip[] {
@@ -141,6 +142,7 @@ function LiquidGlass({ children, dark, style, className = '', onClick }: LiquidG
 interface TripCardProps {
   trip: DashboardTrip
   onEdit?: (trip: DashboardTrip) => void
+  onCopy?: (trip: DashboardTrip) => void
   onDelete?: (trip: DashboardTrip) => void
   onArchive?: (id: number) => void
   onClick: (trip: DashboardTrip) => void
@@ -149,7 +151,7 @@ interface TripCardProps {
   dark?: boolean
 }
 
-function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale, dark }: TripCardProps): React.ReactElement {
+function SpotlightCard({ trip, onEdit, onCopy, onDelete, onArchive, onClick, t, locale, dark }: TripCardProps): React.ReactElement {
   const status = getTripStatus(trip)
 
   const coverBg = trip.cover_image
@@ -188,10 +190,11 @@ function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale,
         </div>
 
         {/* Top-right actions */}
-        {(onEdit || onArchive || onDelete) && (
+        {(onEdit || onCopy || onArchive || onDelete) && (
         <div style={{ position: 'absolute', top: 16, right: 16, display: 'flex', gap: 6 }}
           onClick={e => e.stopPropagation()}>
           {onEdit && <IconBtn onClick={() => onEdit(trip)} title={t('common.edit')}><Edit2 size={14} /></IconBtn>}
+          {onCopy && <IconBtn onClick={() => onCopy(trip)} title={t('dashboard.copyTrip')}><Copy size={14} /></IconBtn>}
           {onArchive && <IconBtn onClick={() => onArchive(trip.id)} title={t('dashboard.archive')}><Archive size={14} /></IconBtn>}
           {onDelete && <IconBtn onClick={() => onDelete(trip)} title={t('common.delete')} danger><Trash2 size={14} /></IconBtn>}
         </div>
@@ -224,6 +227,9 @@ function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale,
             <div style={{ display: 'flex', alignItems: 'center', gap: 5, color: 'rgba(255,255,255,0.8)', fontSize: 13 }}>
               <MapPin size={13} /> {trip.place_count || 0} {t('dashboard.places')}
             </div>
+            <div className="hidden md:flex" style={{ alignItems: 'center', gap: 5, color: 'rgba(255,255,255,0.8)', fontSize: 13 }}>
+              <Users size={13} /> {trip.shared_count+1 || 0} {t('dashboard.members')}
+            </div>
           </div>
         </div>
       </div>
@@ -232,7 +238,7 @@ function SpotlightCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale,
 }
 
 // ── Regular Trip Card ────────────────────────────────────────────────────────
-function TripCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }: Omit<TripCardProps, 'dark'>): React.ReactElement {
+function TripCard({ trip, onEdit, onCopy, onDelete, onArchive, onClick, t, locale }: Omit<TripCardProps, 'dark'>): React.ReactElement {
   const status = getTripStatus(trip)
   const [hovered, setHovered] = useState(false)
 
@@ -307,12 +313,14 @@ function TripCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }: Omi
         <div style={{ display: 'flex', gap: 8, marginBottom: 10 }}>
           <Stat label={t('dashboard.days')} value={trip.day_count || 0} />
           <Stat label={t('dashboard.places')} value={trip.place_count || 0} />
+          <Stat label={t('dashboard.members')} value={trip.shared_count+1 || 0} />
         </div>
 
-        {(onEdit || onArchive || onDelete) && (
+        {(onEdit || onCopy || onArchive || onDelete) && (
         <div style={{ display: 'flex', gap: 6, borderTop: '1px solid #f3f4f6', paddingTop: 10 }}
           onClick={e => e.stopPropagation()}>
           {onEdit && <CardAction onClick={() => onEdit(trip)} icon={<Edit2 size={12} />} label={t('common.edit')} />}
+          {onCopy && <CardAction onClick={() => onCopy(trip)} icon={<Copy size={12} />} label={t('dashboard.copyTrip')} />}
           {onArchive && <CardAction onClick={() => onArchive(trip.id)} icon={<Archive size={12} />} label={t('dashboard.archive')} />}
           {onDelete && <CardAction onClick={() => onDelete(trip)} icon={<Trash2 size={12} />} label={t('common.delete')} danger />}
         </div>
@@ -323,7 +331,7 @@ function TripCard({ trip, onEdit, onDelete, onArchive, onClick, t, locale }: Omi
 }
 
 // ── List View Item ──────────────────────────────────────────────────────────
-function TripListItem({ trip, onEdit, onDelete, onArchive, onClick, t, locale }: Omit<TripCardProps, 'dark'>): React.ReactElement {
+function TripListItem({ trip, onEdit, onCopy, onDelete, onArchive, onClick, t, locale }: Omit<TripCardProps, 'dark'>): React.ReactElement {
   const status = getTripStatus(trip)
   const [hovered, setHovered] = useState(false)
 
@@ -406,12 +414,16 @@ function TripListItem({ trip, onEdit, onDelete, onArchive, onClick, t, locale }:
         <div className="hidden md:flex" style={{ alignItems: 'center', gap: 4, fontSize: 12, color: 'var(--text-muted)' }}>
           <MapPin size={11} /> {trip.place_count || 0}
         </div>
+        <div className="hidden md:flex" style={{ alignItems: 'center', gap: 4, fontSize: 12, color: 'var(--text-muted)' }}>
+          <Users size={11} /> {trip.shared_count+1 || 0}
+        </div>
       </div>
 
       {/* Actions */}
-      {(onEdit || onArchive || onDelete) && (
+      {(onEdit || onCopy || onArchive || onDelete) && (
       <div style={{ display: 'flex', gap: 4, flexShrink: 0 }} onClick={e => e.stopPropagation()}>
         {onEdit && <CardAction onClick={() => onEdit(trip)} icon={<Edit2 size={12} />} label="" />}
+        {onCopy && <CardAction onClick={() => onCopy(trip)} icon={<Copy size={12} />} label="" />}
         {onArchive && <CardAction onClick={() => onArchive(trip.id)} icon={<Archive size={12} />} label="" />}
         {onDelete && <CardAction onClick={() => onDelete(trip)} icon={<Trash2 size={12} />} label="" danger />}
       </div>
@@ -424,6 +436,7 @@ function TripListItem({ trip, onEdit, onDelete, onArchive, onClick, t, locale }:
 interface ArchivedRowProps {
   trip: DashboardTrip
   onEdit?: (trip: DashboardTrip) => void
+  onCopy?: (trip: DashboardTrip) => void
   onUnarchive?: (id: number) => void
   onDelete?: (trip: DashboardTrip) => void
   onClick: (trip: DashboardTrip) => void
@@ -431,7 +444,7 @@ interface ArchivedRowProps {
   locale: string
 }
 
-function ArchivedRow({ trip, onEdit, onUnarchive, onDelete, onClick, t, locale }: ArchivedRowProps): React.ReactElement {
+function ArchivedRow({ trip, onEdit, onCopy, onUnarchive, onDelete, onClick, t, locale }: ArchivedRowProps): React.ReactElement {
   return (
     <div onClick={() => onClick(trip)} style={{
       display: 'flex', alignItems: 'center', gap: 12, padding: '10px 16px',
@@ -457,8 +470,13 @@ function ArchivedRow({ trip, onEdit, onUnarchive, onDelete, onClick, t, locale }
           </div>
         )}
       </div>
-      {(onEdit || onUnarchive || onDelete) && (
+      {(onEdit || onCopy || onUnarchive || onDelete) && (
       <div style={{ display: 'flex', gap: 4, flexShrink: 0 }} onClick={e => e.stopPropagation()}>
+        {onCopy && <button onClick={() => onCopy(trip)} title={t('dashboard.copyTrip')} style={{ padding: '4px 8px', borderRadius: 8, border: '1px solid var(--border-primary)', background: 'var(--bg-card)', cursor: 'pointer', display: 'flex', alignItems: 'center', gap: 4, fontSize: 11, color: 'var(--text-muted)' }}
+          onMouseEnter={e => { e.currentTarget.style.borderColor = 'var(--text-faint)'; e.currentTarget.style.color = 'var(--text-primary)' }}
+          onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--border-primary)'; e.currentTarget.style.color = 'var(--text-muted)' }}>
+          <Copy size={12} />
+        </button>}
         {onUnarchive && <button onClick={() => onUnarchive(trip.id)} title={t('dashboard.restore')} style={{ padding: '4px 8px', borderRadius: 8, border: '1px solid var(--border-primary)', background: 'var(--bg-card)', cursor: 'pointer', display: 'flex', alignItems: 'center', gap: 4, fontSize: 11, color: 'var(--text-muted)' }}
           onMouseEnter={e => { e.currentTarget.style.borderColor = 'var(--text-faint)'; e.currentTarget.style.color = 'var(--text-primary)' }}
           onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--border-primary)'; e.currentTarget.style.color = 'var(--text-muted)' }}>
@@ -649,6 +667,16 @@ export default function DashboardPage(): React.ReactElement {
     setArchivedTrips(prev => prev.map(update))
   }
 
+  const handleCopy = async (trip: DashboardTrip) => {
+    try {
+      const data = await tripsApi.copy(trip.id, { title: `${trip.title} (${t('dashboard.copySuffix')})` })
+      setTrips(prev => sortTrips([data.trip, ...prev]))
+      toast.success(t('dashboard.toast.copied'))
+    } catch {
+      toast.error(t('dashboard.toast.copyError'))
+    }
+  }
+
   const today = new Date().toISOString().split('T')[0]
   const spotlight = trips.find(t => t.start_date && t.end_date && t.start_date <= today && t.end_date >= today)
     || trips.find(t => t.start_date && t.start_date >= today)
@@ -797,6 +825,7 @@ export default function DashboardPage(): React.ReactElement {
               trip={spotlight}
               t={t} locale={locale} dark={dark}
               onEdit={(can('trip_edit', spotlight) || can('trip_cover_upload', spotlight)) ? tr => { setEditingTrip(tr); setShowForm(true) } : undefined}
+              onCopy={can('trip_create') ? handleCopy : undefined}
               onDelete={can('trip_delete', spotlight) ? handleDelete : undefined}
               onArchive={can('trip_archive', spotlight) ? handleArchive : undefined}
               onClick={tr => navigate(`/trips/${tr.id}`)}
@@ -813,6 +842,7 @@ export default function DashboardPage(): React.ReactElement {
                     trip={trip}
                     t={t} locale={locale}
                     onEdit={(can('trip_edit', trip) || can('trip_cover_upload', trip)) ? tr => { setEditingTrip(tr); setShowForm(true) } : undefined}
+                    onCopy={can('trip_create') ? handleCopy : undefined}
                     onDelete={can('trip_delete', trip) ? handleDelete : undefined}
                     onArchive={can('trip_archive', trip) ? handleArchive : undefined}
                     onClick={tr => navigate(`/trips/${tr.id}`)}
@@ -827,6 +857,7 @@ export default function DashboardPage(): React.ReactElement {
                     trip={trip}
                     t={t} locale={locale}
                     onEdit={(can('trip_edit', trip) || can('trip_cover_upload', trip)) ? tr => { setEditingTrip(tr); setShowForm(true) } : undefined}
+                    onCopy={can('trip_create') ? handleCopy : undefined}
                     onDelete={can('trip_delete', trip) ? handleDelete : undefined}
                     onArchive={can('trip_archive', trip) ? handleArchive : undefined}
                     onClick={tr => navigate(`/trips/${tr.id}`)}
@@ -857,6 +888,7 @@ export default function DashboardPage(): React.ReactElement {
                       trip={trip}
                       t={t} locale={locale}
                       onEdit={(can('trip_edit', trip) || can('trip_cover_upload', trip)) ? tr => { setEditingTrip(tr); setShowForm(true) } : undefined}
+                      onCopy={can('trip_create') ? handleCopy : undefined}
                       onUnarchive={can('trip_archive', trip) ? handleUnarchive : undefined}
                       onDelete={can('trip_delete', trip) ? handleDelete : undefined}
                       onClick={tr => navigate(`/trips/${tr.id}`)}

client/src/pages/InAppNotificationsPage.tsx

@@ -0,0 +1,150 @@
+import React, { useEffect, useRef, useState } from 'react'
+import { Bell, CheckCheck, Trash2 } from 'lucide-react'
+import { useTranslation } from '../i18n'
+import { useInAppNotificationStore } from '../store/inAppNotificationStore.ts'
+import { useSettingsStore } from '../store/settingsStore'
+import Navbar from '../components/Layout/Navbar'
+import InAppNotificationItem from '../components/Notifications/InAppNotificationItem.tsx'
+
+export default function InAppNotificationsPage(): React.ReactElement {
+  const { t } = useTranslation()
+  const { settings } = useSettingsStore()
+  const darkMode = settings.dark_mode
+  const dark = darkMode === true || darkMode === 'dark' || (darkMode === 'auto' && window.matchMedia('(prefers-color-scheme: dark)').matches)
+
+  const { notifications, unreadCount, total, isLoading, hasMore, fetchNotifications, markAllRead, deleteAll } = useInAppNotificationStore()
+  const [unreadOnly, setUnreadOnly] = useState(false)
+  const loaderRef = useRef<HTMLDivElement>(null)
+
+  useEffect(() => {
+    fetchNotifications(true)
+  }, [])
+
+  // Reload when filter changes
+  useEffect(() => {
+    // We need to fetch with the unreadOnly filter — re-fetch from scratch
+    // The store fetchNotifications doesn't take a filter param directly,
+    // so we use the API directly for filtered view via a side channel.
+    // For now, reset and fetch — store always loads all, filter is client-side.
+    fetchNotifications(true)
+  }, [unreadOnly])
+
+  // Infinite scroll
+  useEffect(() => {
+    if (!loaderRef.current) return
+    const observer = new IntersectionObserver(entries => {
+      if (entries[0].isIntersecting && hasMore && !isLoading) {
+        fetchNotifications(false)
+      }
+    }, { threshold: 0.1 })
+    observer.observe(loaderRef.current)
+    return () => observer.disconnect()
+  }, [hasMore, isLoading])
+
+  const displayed = unreadOnly ? notifications.filter(n => !n.is_read) : notifications
+
+  return (
+    <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
+      <Navbar />
+      <div style={{ paddingTop: 'var(--nav-h)' }}>
+        <div className="max-w-2xl mx-auto px-4 py-8">
+          {/* Header */}
+          <div className="flex items-center justify-between mb-6">
+            <div>
+              <h1 className="text-xl font-semibold" style={{ color: 'var(--text-primary)' }}>
+                {t('notifications.title')}
+                {unreadCount > 0 && (
+                  <span className="ml-2 px-2 py-0.5 rounded-full text-xs font-medium"
+                    style={{ background: '#6366f1', color: '#fff' }}>
+                    {unreadCount}
+                  </span>
+                )}
+              </h1>
+              <p className="text-sm mt-0.5" style={{ color: 'var(--text-muted)' }}>
+                {total} {total === 1 ? 'notification' : 'notifications'}
+              </p>
+            </div>
+
+            {/* Bulk actions */}
+            <div className="flex items-center gap-2">
+              {unreadCount > 0 && (
+                <button
+                  onClick={markAllRead}
+                  className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors"
+                  style={{ background: 'var(--bg-hover)', color: 'var(--text-secondary)' }}
+                  onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-tertiary)'}
+                  onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-hover)'}
+                >
+                  <CheckCheck className="w-4 h-4" />
+                  <span className="hidden sm:inline">{t('notifications.markAllRead')}</span>
+                </button>
+              )}
+              {notifications.length > 0 && (
+                <button
+                  onClick={deleteAll}
+                  className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm transition-colors text-red-500 hover:bg-red-500/10"
+                >
+                  <Trash2 className="w-4 h-4" />
+                  <span className="hidden sm:inline">{t('notifications.deleteAll')}</span>
+                </button>
+              )}
+            </div>
+          </div>
+
+          {/* Filter toggle */}
+          <div className="flex gap-2 mb-4">
+            <button
+              onClick={() => setUnreadOnly(false)}
+              className="px-3 py-1.5 rounded-lg text-sm font-medium transition-colors"
+              style={{
+                background: !unreadOnly ? '#6366f1' : 'var(--bg-hover)',
+                color: !unreadOnly ? '#fff' : 'var(--text-secondary)',
+              }}
+            >
+              {t('notifications.all')}
+            </button>
+            <button
+              onClick={() => setUnreadOnly(true)}
+              className="px-3 py-1.5 rounded-lg text-sm font-medium transition-colors"
+              style={{
+                background: unreadOnly ? '#6366f1' : 'var(--bg-hover)',
+                color: unreadOnly ? '#fff' : 'var(--text-secondary)',
+              }}
+            >
+              {t('notifications.unreadOnly')}
+            </button>
+          </div>
+
+          {/* Notification list */}
+          <div
+            className="rounded-xl border overflow-hidden"
+            style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}
+          >
+            {isLoading && displayed.length === 0 ? (
+              <div className="flex items-center justify-center py-16">
+                <div className="w-6 h-6 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />
+              </div>
+            ) : displayed.length === 0 ? (
+              <div className="flex flex-col items-center justify-center py-16 px-4 text-center gap-3">
+                <Bell className="w-12 h-12" style={{ color: 'var(--text-faint)' }} />
+                <p className="text-base font-medium" style={{ color: 'var(--text-muted)' }}>{t('notifications.empty')}</p>
+                <p className="text-sm" style={{ color: 'var(--text-faint)' }}>{t('notifications.emptyDescription')}</p>
+              </div>
+            ) : (
+              displayed.map(n => (
+                <InAppNotificationItem key={n.id} notification={n} />
+              ))
+            )}
+
+            {/* Infinite scroll trigger */}
+            {hasMore && (
+              <div ref={loaderRef} className="flex items-center justify-center py-4">
+                {isLoading && <div className="w-5 h-5 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />}
+              </div>
+            )}
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}

client/src/pages/LoginPage.tsx

@@ -4,6 +4,7 @@ import { useAuthStore } from '../store/authStore'
 import { useSettingsStore } from '../store/settingsStore'
 import { SUPPORTED_LANGUAGES, useTranslation } from '../i18n'
 import { authApi } from '../api/client'
+import { getApiErrorMessage } from '../types'
 import { Plane, Eye, EyeOff, Mail, Lock, MapPin, Calendar, Package, User, Globe, Zap, Users, Wallet, Map, CheckSquare, BookMarked, FolderOpen, Route, Shield, KeyRound } from 'lucide-react'
 
 interface AppConfig {
@@ -49,7 +50,6 @@ export default function LoginPage(): React.ReactElement {
         setError('Invalid or expired invite link')
       })
       window.history.replaceState({}, '', window.location.pathname)
-      return
     }
 
     if (oidcCode) {
@@ -86,7 +86,7 @@ export default function LoginPage(): React.ReactElement {
       if (config) {
         setAppConfig(config)
         if (!config.has_users) setMode('register')
-        if (config.oidc_only_mode && config.oidc_configured && config.has_users) {
+        if (config.oidc_only_mode && config.oidc_configured && config.has_users && !invite) {
           window.location.href = '/api/auth/oidc/login'
         }
       }
@@ -171,7 +171,7 @@ export default function LoginPage(): React.ReactElement {
       setShowTakeoff(true)
       setTimeout(() => navigate('/dashboard'), 2600)
     } catch (err: unknown) {
-      setError(err instanceof Error ? err.message : t('login.error'))
+      setError(getApiErrorMessage(err, t('login.error')))
       setIsLoading(false)
     }
   }

client/src/pages/SettingsPage.tsx

@@ -1,4 +1,4 @@
-import React, { useState, useEffect } from 'react'
+import React, { useState, useEffect, useCallback, useMemo } from 'react'
 import { useNavigate, useSearchParams } from 'react-router-dom'
 import { useAuthStore } from '../store/authStore'
 import { useSettingsStore } from '../store/settingsStore'
@@ -6,13 +6,15 @@ import { SUPPORTED_LANGUAGES, useTranslation } from '../i18n'
 import Navbar from '../components/Layout/Navbar'
 import CustomSelect from '../components/shared/CustomSelect'
 import { useToast } from '../components/shared/Toast'
-import { Save, Map, Palette, User, Moon, Sun, Monitor, Shield, Camera, Trash2, Lock, KeyRound, AlertTriangle, Copy, Download, Printer, Terminal, Plus, Check } from 'lucide-react'
+import { Save, Map, Palette, User, Moon, Sun, Monitor, Shield, Camera, Trash2, Lock, KeyRound, AlertTriangle, Copy, Download, Printer, Terminal, Plus, Check, Info } from 'lucide-react'
 import { authApi, adminApi } from '../api/client'
 import apiClient from '../api/client'
 import { useAddonStore } from '../store/addonStore'
 import type { LucideIcon } from 'lucide-react'
 import type { UserWithOidc } from '../types'
 import { getApiErrorMessage } from '../types'
+import { MapView } from '../components/Map/MapView'
+import type { Place } from '../types'
 
 interface MapPreset {
   name: string
@@ -124,11 +126,20 @@ export default function SettingsPage(): React.ReactElement {
   // Addon gating (derived from store)
   const memoriesEnabled = addonEnabled('memories')
   const mcpEnabled = addonEnabled('mcp')
+  const [appVersion, setAppVersion] = useState<string | null>(null)
+  useEffect(() => {
+    authApi.getAppConfig?.().then(c => setAppVersion(c?.version)).catch(() => {})
+  }, [])
   const [immichUrl, setImmichUrl] = useState('')
   const [immichApiKey, setImmichApiKey] = useState('')
   const [immichConnected, setImmichConnected] = useState(false)
   const [immichTesting, setImmichTesting] = useState(false)
 
+  const handleMapClick = useCallback((mapInfo) => {
+    setDefaultLat(mapInfo.latlng.lat)
+    setDefaultLng(mapInfo.latlng.lng)
+  }, [])
+
   useEffect(() => {
     loadAddons()
   }, [])
@@ -148,7 +159,7 @@ export default function SettingsPage(): React.ReactElement {
     setSaving(s => ({ ...s, immich: true }))
     try {
       const saveRes = await apiClient.put('/integrations/immich/settings', { immich_url: immichUrl, immich_api_key: immichApiKey || undefined })
-      if (saveRes.data.warning) toast.warn(saveRes.data.warning)
+      if (saveRes.data.warning) toast.warning(saveRes.data.warning)
       toast.success(t('memories.saved'))
       const res = await apiClient.get('/integrations/immich/status')
       setImmichConnected(res.data.connected)
@@ -165,7 +176,12 @@ export default function SettingsPage(): React.ReactElement {
     try {
       const res = await apiClient.post('/integrations/immich/test', { immich_url: immichUrl, immich_api_key: immichApiKey })
       if (res.data.connected) {
-        toast.success(`${t('memories.connectionSuccess')} — ${res.data.user?.name || ''}`)
+        if (res.data.canonicalUrl) {
+          setImmichUrl(res.data.canonicalUrl)
+          toast.success(`${t('memories.connectionSuccess')} — ${res.data.user?.name || ''} (URL updated to ${res.data.canonicalUrl})`)
+        } else {
+          toast.success(`${t('memories.connectionSuccess')} — ${res.data.user?.name || ''}`)
+        }
         setImmichTestPassed(true)
       } else {
         toast.error(`${t('memories.connectionError')}: ${res.data.error}`)
@@ -245,6 +261,31 @@ export default function SettingsPage(): React.ReactElement {
   const [defaultLng, setDefaultLng] = useState<number | string>(settings.default_lng || 2.3522)
   const [defaultZoom, setDefaultZoom] = useState<number | string>(settings.default_zoom || 10)
 
+  const mapPlaces = useMemo(() => {
+      // Add center location to map places
+      let places: Place[] = []
+      places.push({
+        id: 1,
+        trip_id: 1,
+        name: "Default map center",
+        description: "",
+        lat: defaultLat as number,
+        lng: defaultLng as number,
+        address: "",
+        category_id: 0,
+        icon: null,
+        price: null,
+        image_url: null,
+        google_place_id: null,
+        osm_id: null,
+        route_geometry: null,
+        place_time: null,
+        end_time: null,
+        created_at: Date()
+      });
+      return places
+    }, [defaultLat, defaultLng])
+    
   // Display
   const [tempUnit, setTempUnit] = useState<string>(settings.temperature_unit || 'celsius')
 
@@ -471,6 +512,29 @@ export default function SettingsPage(): React.ReactElement {
               </div>
             </div>
 
+            <div>
+              <div style={{ position: 'relative', inset: 0, height:"200px", width: "100%" }}>
+                          <MapView
+                            places={mapPlaces}
+                            dayPlaces={[]}
+                            route={null}
+                            routeSegments={null}
+                            selectedPlaceId={null}
+                            onMarkerClick={null}
+                            onMapClick={handleMapClick}
+                            onMapContextMenu={null}
+                            center = {[settings.default_lat, settings.default_lng]}
+                            zoom={defaultZoom}
+                            tileUrl={mapTileUrl}
+                            fitKey={null}
+                            dayOrderMap={[]}
+                            leftWidth={0}
+                            rightWidth={0}
+                            hasInspector={false}
+                          />
+              </div>
+            </div>
+                
             <button
               onClick={saveMapSettings}
               disabled={saving.map}
@@ -1236,6 +1300,24 @@ export default function SettingsPage(): React.ReactElement {
             </div>
           </Section>
 
+          {appVersion && (
+            <Section title={t('settings.about')} icon={Info}>
+              <div style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
+                <div style={{ display: 'inline-flex', alignItems: 'center', gap: 6, background: 'var(--bg-tertiary)', borderRadius: 99, padding: '6px 14px' }}>
+                  <span style={{ fontSize: 13, fontWeight: 600, color: 'var(--text-secondary)' }}>TREK</span>
+                  <span style={{ fontSize: 13, color: 'var(--text-faint)' }}>v{appVersion}</span>
+                </div>
+                <a href="https://discord.gg/nSdKaXgN" target="_blank" rel="noopener noreferrer"
+                  style={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 30, height: 30, borderRadius: 99, background: 'var(--bg-tertiary)', transition: 'background 0.15s' }}
+                  onMouseEnter={e => e.currentTarget.style.background = '#5865F220'}
+                  onMouseLeave={e => e.currentTarget.style.background = 'var(--bg-tertiary)'}
+                  title="Discord">
+                  <svg width="14" height="14" viewBox="0 0 24 24" fill="var(--text-faint)"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg>
+                </a>
+              </div>
+            </Section>
+          )}
+
           {/* Delete Account Confirmation */}
           {showDeleteConfirm === 'blocked' && (
             <div style={{

client/src/pages/SharedTripPage.tsx

@@ -106,7 +106,7 @@ export default function SharedTripPage() {
         {(trip.start_date || trip.end_date) && (
           <div style={{ marginTop: 10, display: 'inline-flex', alignItems: 'center', gap: 8, padding: '6px 14px', borderRadius: 20, background: 'rgba(255,255,255,0.08)', backdropFilter: 'blur(4px)', border: '1px solid rgba(255,255,255,0.08)' }}>
             <span style={{ fontSize: 12, fontWeight: 500, opacity: 0.8 }}>
-              {[trip.start_date, trip.end_date].filter(Boolean).map((d: string) => new Date(d + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short', year: 'numeric' })).join(' — ')}
+              {[trip.start_date, trip.end_date].filter(Boolean).map((d: string) => new Date(d + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', year: 'numeric', timeZone: 'UTC' })).join(' — ')}
             </span>
             {days?.length > 0 && <span style={{ fontSize: 11, opacity: 0.4 }}>·</span>}
             {days?.length > 0 && <span style={{ fontSize: 11, opacity: 0.5 }}>{days.length} {t('shared.days')}</span>}
@@ -199,7 +199,7 @@ export default function SharedTripPage() {
                   <div style={{ width: 28, height: 28, borderRadius: '50%', background: selectedDay === day.id ? '#111827' : '#f3f4f6', color: selectedDay === day.id ? 'white' : '#6b7280', display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 12, fontWeight: 700, flexShrink: 0 }}>{di + 1}</div>
                   <div style={{ flex: 1 }}>
                     <div style={{ fontSize: 14, fontWeight: 600, color: '#111827' }}>{day.title || `Day ${day.day_number}`}</div>
-                    {day.date && <div style={{ fontSize: 11, color: '#9ca3af', marginTop: 1 }}>{new Date(day.date + 'T00:00:00').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short' })}</div>}
+                    {day.date && <div style={{ fontSize: 11, color: '#9ca3af', marginTop: 1 }}>{new Date(day.date + 'T00:00:00Z').toLocaleDateString(locale, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })}</div>}
                   </div>
                   {dayAccs.map((acc: any) => (
                     <span key={acc.id} style={{ fontSize: 9, padding: '2px 6px', borderRadius: 4, background: '#f3f4f6', color: '#6b7280', display: 'flex', alignItems: 'center', gap: 3 }}>
@@ -274,7 +274,7 @@ export default function SharedTripPage() {
               const meta = typeof r.metadata === 'string' ? JSON.parse(r.metadata || '{}') : (r.metadata || {})
               const TIcon = TRANSPORT_ICONS[r.type] || Ticket
               const time = r.reservation_time?.includes('T') ? r.reservation_time.split('T')[1]?.substring(0, 5) : ''
-              const date = r.reservation_time ? new Date(r.reservation_time.includes('T') ? r.reservation_time : r.reservation_time + 'T00:00:00').toLocaleDateString(locale, { day: 'numeric', month: 'short' }) : ''
+              const date = r.reservation_time ? new Date((r.reservation_time.includes('T') ? r.reservation_time.split('T')[0] : r.reservation_time) + 'T00:00:00Z').toLocaleDateString(locale, { day: 'numeric', month: 'short', timeZone: 'UTC' }) : ''
               return (
                 <div key={r.id} style={{ background: 'var(--bg-card, white)', borderRadius: 10, padding: '12px 16px', border: '1px solid var(--border-faint, #e5e7eb)', display: 'flex', alignItems: 'center', gap: 12 }}>
                   <div style={{ width: 32, height: 32, borderRadius: '50%', background: '#f3f4f6', display: 'flex', alignItems: 'center', justifyContent: 'center', flexShrink: 0 }}>

client/src/pages/TripPlannerPage.tsx

@@ -22,7 +22,7 @@ import BudgetPanel from '../components/Budget/BudgetPanel'
 import CollabPanel from '../components/Collab/CollabPanel'
 import Navbar from '../components/Layout/Navbar'
 import { useToast } from '../components/shared/Toast'
-import { Map, X, PanelLeftClose, PanelLeftOpen, PanelRightClose, PanelRightOpen } from 'lucide-react'
+import { Map, X, PanelLeftClose, PanelLeftOpen, PanelRightClose, PanelRightOpen, Ticket, PackageCheck, Wallet, FolderOpen, Camera, Users } from 'lucide-react'
 import { useTranslation } from '../i18n'
 import { addonsApi, accommodationsApi, authApi, tripsApi, assignmentsApi, mapsApi } from '../api/client'
 import ConfirmDialog from '../components/shared/ConfirmDialog'
@@ -30,6 +30,7 @@ import { useResizablePanels } from '../hooks/useResizablePanels'
 import { useTripWebSocket } from '../hooks/useTripWebSocket'
 import { useRouteCalculation } from '../hooks/useRouteCalculation'
 import { usePlaceSelection } from '../hooks/usePlaceSelection'
+import { usePlannerHistory } from '../hooks/usePlannerHistory'
 import type { Accommodation, TripMember, Day, Place, Reservation } from '../types'
 
 export default function TripPlannerPage(): React.ReactElement | null {
@@ -53,6 +54,13 @@ export default function TripPlannerPage(): React.ReactElement | null {
   const tripActions = useRef(useTripStore.getState()).current
   const can = useCanDo()
   const canUploadFiles = can('file_upload', trip)
+  const { pushUndo, undo, canUndo, lastActionLabel } = usePlannerHistory()
+
+  const handleUndo = useCallback(async () => {
+    const label = lastActionLabel
+    await undo()
+    toast.info(t('undo.done', { action: label ?? '' }))
+  }, [undo, lastActionLabel, toast])
 
   const [enabledAddons, setEnabledAddons] = useState<Record<string, boolean>>({ packing: true, budget: true, documents: true })
   const [tripAccommodations, setTripAccommodations] = useState<Accommodation[]>([])
@@ -78,13 +86,13 @@ export default function TripPlannerPage(): React.ReactElement | null {
   }, [])
 
   const TRIP_TABS = [
-    { id: 'plan', label: t('trip.tabs.plan') },
-    { id: 'buchungen', label: t('trip.tabs.reservations'), shortLabel: t('trip.tabs.reservationsShort') },
-    ...(enabledAddons.packing ? [{ id: 'packliste', label: t('trip.tabs.packing'), shortLabel: t('trip.tabs.packingShort') }] : []),
-    ...(enabledAddons.budget ? [{ id: 'finanzplan', label: t('trip.tabs.budget') }] : []),
-    ...(enabledAddons.documents ? [{ id: 'dateien', label: t('trip.tabs.files') }] : []),
-    ...(enabledAddons.memories ? [{ id: 'memories', label: t('memories.title') }] : []),
-    ...(enabledAddons.collab ? [{ id: 'collab', label: t('admin.addons.catalog.collab.name') }] : []),
+    { id: 'plan', label: t('trip.tabs.plan'), icon: Map },
+    { id: 'buchungen', label: t('trip.tabs.reservations'), shortLabel: t('trip.tabs.reservationsShort'), icon: Ticket },
+    ...(enabledAddons.packing ? [{ id: 'packliste', label: t('trip.tabs.packing'), shortLabel: t('trip.tabs.packingShort'), icon: PackageCheck }] : []),
+    ...(enabledAddons.budget ? [{ id: 'finanzplan', label: t('trip.tabs.budget'), icon: Wallet }] : []),
+    ...(enabledAddons.documents ? [{ id: 'dateien', label: t('trip.tabs.files'), icon: FolderOpen }] : []),
+    ...(enabledAddons.memories ? [{ id: 'memories', label: t('memories.title'), icon: Camera }] : []),
+    ...(enabledAddons.collab ? [{ id: 'collab', label: t('admin.addons.catalog.collab.name'), icon: Users }] : []),
   ]
 
   const [activeTab, setActiveTab] = useState<string>(() => {
@@ -267,8 +275,14 @@ export default function TripPlannerPage(): React.ReactElement | null {
         }
       }
       toast.success(t('trip.toast.placeAdded'))
+      if (place?.id) {
+        const capturedId = place.id
+        pushUndo(t('undo.addPlace'), async () => {
+          await tripActions.deletePlace(tripId, capturedId)
+        })
+      }
     }
-  }, [editingPlace, editingAssignmentId, tripId, toast])
+  }, [editingPlace, editingAssignmentId, tripId, toast, pushUndo])
 
   const handleDeletePlace = useCallback((placeId) => {
     setDeletePlaceId(placeId)
@@ -276,33 +290,83 @@ export default function TripPlannerPage(): React.ReactElement | null {
 
   const confirmDeletePlace = useCallback(async () => {
     if (!deletePlaceId) return
+    const state = useTripStore.getState()
+    const capturedPlace = state.places.find(p => p.id === deletePlaceId)
+    const capturedAssignments = Object.entries(state.assignments).flatMap(([dayId, as]) =>
+      as.filter(a => a.place?.id === deletePlaceId).map(a => ({ dayId: Number(dayId), orderIndex: a.order_index }))
+    )
     try {
       await tripActions.deletePlace(tripId, deletePlaceId)
       if (selectedPlaceId === deletePlaceId) setSelectedPlaceId(null)
       toast.success(t('trip.toast.placeDeleted'))
+      if (capturedPlace) {
+        pushUndo(t('undo.deletePlace'), async () => {
+          const newPlace = await tripActions.addPlace(tripId, {
+            name: capturedPlace.name,
+            description: capturedPlace.description,
+            lat: capturedPlace.lat,
+            lng: capturedPlace.lng,
+            address: capturedPlace.address,
+            category_id: capturedPlace.category_id,
+            icon: capturedPlace.icon,
+            price: capturedPlace.price,
+          })
+          for (const { dayId, orderIndex } of capturedAssignments) {
+            await tripActions.assignPlaceToDay(tripId, dayId, newPlace.id, orderIndex)
+          }
+        })
+      }
     } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Unknown error') }
-  }, [deletePlaceId, tripId, toast, selectedPlaceId])
+  }, [deletePlaceId, tripId, toast, selectedPlaceId, pushUndo])
 
   const handleAssignToDay = useCallback(async (placeId, dayId, position) => {
     const target = dayId || selectedDayId
     if (!target) { toast.error(t('trip.toast.selectDay')); return }
     try {
-      await tripActions.assignPlaceToDay(tripId, target, placeId, position)
+      const assignment = await tripActions.assignPlaceToDay(tripId, target, placeId, position)
       toast.success(t('trip.toast.assignedToDay'))
       updateRouteForDay(target)
+      if (assignment?.id) {
+        const capturedAssignmentId = assignment.id
+        const capturedTarget = target
+        pushUndo(t('undo.assignPlace'), async () => {
+          await tripActions.removeAssignment(tripId, capturedTarget, capturedAssignmentId)
+        })
+      }
     } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Unknown error') }
-  }, [selectedDayId, tripId, toast, updateRouteForDay])
+  }, [selectedDayId, tripId, toast, updateRouteForDay, pushUndo])
 
   const handleRemoveAssignment = useCallback(async (dayId, assignmentId) => {
+    const state = useTripStore.getState()
+    const capturedAssignment = (state.assignments[String(dayId)] || []).find(a => a.id === assignmentId)
+    const capturedPlaceId = capturedAssignment?.place?.id
+    const capturedOrderIndex = capturedAssignment?.order_index ?? 0
     try {
       await tripActions.removeAssignment(tripId, dayId, assignmentId)
+      if (capturedPlaceId != null) {
+        const capturedDayId = dayId
+        const capturedPos = capturedOrderIndex
+        pushUndo(t('undo.removeAssignment'), async () => {
+          await tripActions.assignPlaceToDay(tripId, capturedDayId, capturedPlaceId, capturedPos)
+        })
+      }
     }
     catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Unknown error') }
-  }, [tripId, toast, updateRouteForDay])
+  }, [tripId, toast, updateRouteForDay, pushUndo])
 
   const handleReorder = useCallback((dayId, orderedIds) => {
+    const prevIds = (useTripStore.getState().assignments[String(dayId)] || [])
+      .slice().sort((a, b) => a.order_index - b.order_index).map(a => a.id)
     try {
-      tripActions.reorderAssignments(tripId, dayId, orderedIds).catch(() => {})
+      tripActions.reorderAssignments(tripId, dayId, orderedIds)
+        .then(() => {
+          const capturedDayId = dayId
+          const capturedPrevIds = prevIds
+          pushUndo(t('undo.reorder'), async () => {
+            await tripActions.reorderAssignments(tripId, capturedDayId, capturedPrevIds)
+          })
+        })
+        .catch(() => {})
       // Update route immediately from orderedIds
       const dayItems = useTripStore.getState().assignments[String(dayId)] || []
       const ordered = orderedIds.map(id => dayItems.find(a => a.id === id)).filter(Boolean)
@@ -312,7 +376,7 @@ export default function TripPlannerPage(): React.ReactElement | null {
       setRouteInfo(null)
     }
     catch { toast.error(t('trip.toast.reorderError')) }
-  }, [tripId, toast])
+  }, [tripId, toast, pushUndo])
 
   const handleUpdateDayTitle = useCallback(async (dayId, title) => {
     try { await tripActions.updateDayTitle(tripId, dayId, title) }
@@ -452,10 +516,12 @@ export default function TripPlannerPage(): React.ReactElement | null {
       }}>
         {TRIP_TABS.map(tab => {
           const isActive = activeTab === tab.id
+          const TabIcon = tab.icon
           return (
             <button
               key={tab.id}
               onClick={() => handleTabChange(tab.id)}
+              title={tab.label}
               style={{
                 flexShrink: 0,
                 padding: '5px 14px', borderRadius: 20, border: 'none', cursor: 'pointer',
@@ -463,13 +529,14 @@ export default function TripPlannerPage(): React.ReactElement | null {
                 background: isActive ? 'var(--accent)' : 'transparent',
                 color: isActive ? 'var(--accent-text)' : 'var(--text-muted)',
                 fontFamily: 'inherit', transition: 'all 0.15s',
+                display: 'flex', alignItems: 'center', gap: 5,
               }}
               onMouseEnter={e => { if (!isActive) e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.color = isActive ? 'var(--accent-text)' : 'var(--text-primary)' }}
               onMouseLeave={e => { if (!isActive) e.currentTarget.style.background = 'transparent'; e.currentTarget.style.color = isActive ? 'var(--accent-text)' : 'var(--text-muted)' }}
-            >{tab.shortLabel
-                ? <><span className="sm:hidden">{tab.shortLabel}</span><span className="hidden sm:inline">{tab.label}</span></>
-                : tab.label
-              }</button>
+            >
+              {TabIcon && <><TabIcon size={20} className="sm:hidden" /><TabIcon size={15} className="hidden sm:block" /></>}
+              <span className="hidden sm:inline">{tab.shortLabel || tab.label}</span>
+            </button>
           )
         })}
       </div>
@@ -550,6 +617,10 @@ export default function TripPlannerPage(): React.ReactElement | null {
                   accommodations={tripAccommodations}
                   onNavigateToFiles={() => handleTabChange('dateien')}
                   onExpandedDaysChange={setExpandedDayIds}
+                  pushUndo={pushUndo}
+                  canUndo={canUndo}
+                  lastActionLabel={lastActionLabel}
+                  onUndo={handleUndo}
                 />
                 {!leftCollapsed && (
                   <div
@@ -610,6 +681,7 @@ export default function TripPlannerPage(): React.ReactElement | null {
                     onEditPlace={(place) => { setEditingPlace(place); setEditingAssignmentId(null); setShowPlaceForm(true) }}
                     onDeletePlace={(placeId) => handleDeletePlace(placeId)}
                     onCategoryFilterChange={setMapCategoryFilter}
+                    pushUndo={pushUndo}
                   />
                 </div>
               </div>
@@ -645,7 +717,7 @@ export default function TripPlannerPage(): React.ReactElement | null {
                   reservations={reservations}
                   lat={geoPlace?.lat}
                   lng={geoPlace?.lng}
-                  onClose={() => setShowDayDetail(null)}
+                  onClose={() => { setShowDayDetail(null); handleSelectDay(null) }}
                   onAccommodationChange={loadAccommodations}
                   leftWidth={isMobile ? 0 : (leftCollapsed ? 0 : leftWidth)}
                   rightWidth={isMobile ? 0 : (rightCollapsed ? 0 : rightWidth)}
@@ -762,8 +834,8 @@ export default function TripPlannerPage(): React.ReactElement | null {
                   </div>
                   <div style={{ flex: 1, overflow: 'auto' }}>
                     {mobileSidebarOpen === 'left'
-                      ? <DayPlanSidebar tripId={tripId} trip={trip} days={days} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} selectedAssignmentId={selectedAssignmentId} onSelectDay={(id) => { handleSelectDay(id); setMobileSidebarOpen(null) }} onPlaceClick={(placeId, assignmentId) => { handlePlaceClick(placeId, assignmentId); setMobileSidebarOpen(null) }} onReorder={handleReorder} onUpdateDayTitle={handleUpdateDayTitle} onAssignToDay={handleAssignToDay} onRouteCalculated={(r) => { if (r) { setRoute(r.coordinates); setRouteInfo({ distance: r.distanceText, duration: r.durationText }) } }} reservations={reservations} onAddReservation={(dayId) => { setEditingReservation(null); tripActions.setSelectedDay(dayId); setShowReservationModal(true); setMobileSidebarOpen(null) }} onDayDetail={(day) => { setShowDayDetail(day); setSelectedPlaceId(null); setSelectedAssignmentId(null); setMobileSidebarOpen(null) }} accommodations={tripAccommodations} onNavigateToFiles={() => { setMobileSidebarOpen(null); handleTabChange('dateien') }} onExpandedDaysChange={setExpandedDayIds} />
-                      : <PlacesSidebar tripId={tripId} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} onPlaceClick={(placeId) => { handlePlaceClick(placeId); setMobileSidebarOpen(null) }} onAddPlace={() => { setEditingPlace(null); setShowPlaceForm(true); setMobileSidebarOpen(null) }} onAssignToDay={handleAssignToDay} onEditPlace={(place) => { setEditingPlace(place); setEditingAssignmentId(null); setShowPlaceForm(true); setMobileSidebarOpen(null) }} onDeletePlace={(placeId) => handleDeletePlace(placeId)} days={days} isMobile onCategoryFilterChange={setMapCategoryFilter} />
+                      ? <DayPlanSidebar tripId={tripId} trip={trip} days={days} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} selectedAssignmentId={selectedAssignmentId} onSelectDay={(id) => { handleSelectDay(id); setMobileSidebarOpen(null) }} onPlaceClick={(placeId, assignmentId) => { handlePlaceClick(placeId, assignmentId); setMobileSidebarOpen(null) }} onReorder={handleReorder} onUpdateDayTitle={handleUpdateDayTitle} onAssignToDay={handleAssignToDay} onRouteCalculated={(r) => { if (r) { setRoute(r.coordinates); setRouteInfo({ distance: r.distanceText, duration: r.durationText }) } }} reservations={reservations} onAddReservation={(dayId) => { setEditingReservation(null); tripActions.setSelectedDay(dayId); setShowReservationModal(true); setMobileSidebarOpen(null) }} onDayDetail={(day) => { setShowDayDetail(day); setSelectedPlaceId(null); setSelectedAssignmentId(null); setMobileSidebarOpen(null) }} accommodations={tripAccommodations} onNavigateToFiles={() => { setMobileSidebarOpen(null); handleTabChange('dateien') }} onExpandedDaysChange={setExpandedDayIds} pushUndo={pushUndo} canUndo={canUndo} lastActionLabel={lastActionLabel} onUndo={handleUndo} />
+                      : <PlacesSidebar tripId={tripId} places={places} categories={categories} assignments={assignments} selectedDayId={selectedDayId} selectedPlaceId={selectedPlaceId} onPlaceClick={(placeId) => { handlePlaceClick(placeId); setMobileSidebarOpen(null) }} onAddPlace={() => { setEditingPlace(null); setShowPlaceForm(true); setMobileSidebarOpen(null) }} onAssignToDay={handleAssignToDay} onEditPlace={(place) => { setEditingPlace(place); setEditingAssignmentId(null); setShowPlaceForm(true); setMobileSidebarOpen(null) }} onDeletePlace={(placeId) => handleDeletePlace(placeId)} days={days} isMobile onCategoryFilterChange={setMapCategoryFilter} pushUndo={pushUndo} />
                     }
                   </div>
                 </div>

client/src/pages/VacayPage.tsx

@@ -41,11 +41,16 @@ export default function VacayPage(): React.ReactElement {
     if (selectedYear) { loadEntries(selectedYear); loadStats(selectedYear); loadHolidays(selectedYear) }
   }, [selectedYear])
 
-  const handleAddYear = () => {
+  const handleAddNextYear = () => {
     const nextYear = years.length > 0 ? Math.max(...years) + 1 : new Date().getFullYear()
     addYear(nextYear)
   }
 
+  const handleAddPrevYear = () => {
+    const prevYear = years.length > 0 ? Math.min(...years) - 1 : new Date().getFullYear()
+    addYear(prevYear)
+  }
+
   if (loading) {
     return (
       <div className="min-h-screen" style={{ background: 'var(--bg-primary)' }}>
@@ -62,20 +67,27 @@ export default function VacayPage(): React.ReactElement {
     <>
       {/* Year Selector */}
       <div className="rounded-xl border p-3" style={{ background: 'var(--bg-card)', borderColor: 'var(--border-primary)' }}>
-        <div className="flex items-center justify-between mb-2">
+        <div className="flex items-center mb-2">
           <span className="text-[11px] font-medium uppercase tracking-wider" style={{ color: 'var(--text-faint)' }}>{t('vacay.year')}</span>
-          <button onClick={handleAddYear} className="p-0.5 rounded transition-colors" style={{ color: 'var(--text-faint)' }} title={t('vacay.addYear')}>
-            <Plus size={14} />
-          </button>
         </div>
         <div className="flex items-center justify-between mb-2">
-          <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx > 0) setSelectedYear(years[idx - 1]) }} disabled={years.indexOf(selectedYear) <= 0} className="p-1 lg:p-1 p-2 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
-            <ChevronLeft size={16} style={{ color: 'var(--text-muted)' }} />
-          </button>
+          <div className="flex items-center gap-1">
+            <button onClick={handleAddPrevYear} className="p-0.5 rounded transition-colors" style={{ color: 'var(--text-faint)' }} title={t('vacay.addPrevYear')}>
+              <Plus size={14} />
+            </button>
+            <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx > 0) setSelectedYear(years[idx - 1]) }} disabled={years.indexOf(selectedYear) <= 0} className="p-1 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
+              <ChevronLeft size={16} style={{ color: 'var(--text-muted)' }} />
+            </button>
+          </div>
           <span className="text-xl font-bold tabular-nums" style={{ color: 'var(--text-primary)' }}>{selectedYear}</span>
-          <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx < years.length - 1) setSelectedYear(years[idx + 1]) }} disabled={years.indexOf(selectedYear) >= years.length - 1} className="p-1 lg:p-1 p-2 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
-            <ChevronRight size={16} style={{ color: 'var(--text-muted)' }} />
-          </button>
+          <div className="flex items-center gap-1">
+            <button onClick={() => { const idx = years.indexOf(selectedYear); if (idx < years.length - 1) setSelectedYear(years[idx + 1]) }} disabled={years.indexOf(selectedYear) >= years.length - 1} className="p-1 rounded-lg disabled:opacity-20 transition-colors" style={{ background: 'var(--bg-secondary)' }}>
+              <ChevronRight size={16} style={{ color: 'var(--text-muted)' }} />
+            </button>
+            <button onClick={handleAddNextYear} className="p-0.5 rounded transition-colors" style={{ color: 'var(--text-faint)' }} title={t('vacay.addYear')}>
+              <Plus size={14} />
+            </button>
+          </div>
         </div>
         <div className="grid grid-cols-4 gap-1">
           {years.map(y => (

client/src/store/authStore.ts

@@ -21,6 +21,7 @@ interface AuthState {
   isLoading: boolean
   error: string | null
   demoMode: boolean
+  devMode: boolean
   hasMapsKey: boolean
   serverTimezone: string
   /** Server policy: all users must enable MFA */
@@ -39,6 +40,7 @@ interface AuthState {
   uploadAvatar: (file: File) => Promise<AvatarResponse>
   deleteAvatar: () => Promise<void>
   setDemoMode: (val: boolean) => void
+  setDevMode: (val: boolean) => void
   setHasMapsKey: (val: boolean) => void
   setServerTimezone: (tz: string) => void
   setAppRequireMfa: (val: boolean) => void
@@ -46,18 +48,23 @@ interface AuthState {
   demoLogin: () => Promise<AuthResponse>
 }
 
+// Sequence counter to prevent stale loadUser responses from overwriting fresh auth state
+let authSequence = 0
+
 export const useAuthStore = create<AuthState>((set, get) => ({
   user: null,
   isAuthenticated: false,
   isLoading: true,
   error: null,
   demoMode: localStorage.getItem('demo_mode') === 'true',
+  devMode: false,
   hasMapsKey: false,
   serverTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
   appRequireMfa: false,
   tripRemindersEnabled: false,
 
   login: async (email: string, password: string) => {
+    authSequence++
     set({ isLoading: true, error: null })
     try {
       const data = await authApi.login({ email, password }) as AuthResponse & { mfa_required?: boolean; mfa_token?: string }
@@ -81,6 +88,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
   },
 
   completeMfaLogin: async (mfaToken: string, code: string) => {
+    authSequence++
     set({ isLoading: true, error: null })
     try {
       const data = await authApi.verifyMfaLogin({ mfa_token: mfaToken, code: code.replace(/\s/g, '') })
@@ -100,6 +108,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
   },
 
   register: async (username: string, email: string, password: string, invite_token?: string) => {
+    authSequence++
     set({ isLoading: true, error: null })
     try {
       const data = await authApi.register({ username, email, password, invite_token })
@@ -135,10 +144,12 @@ export const useAuthStore = create<AuthState>((set, get) => ({
   },
 
   loadUser: async (opts?: { silent?: boolean }) => {
+    const seq = authSequence
     const silent = !!opts?.silent
     if (!silent) set({ isLoading: true })
     try {
       const data = await authApi.me()
+      if (seq !== authSequence) return // stale response — a login/register happened meanwhile
       set({
         user: data.user,
         isAuthenticated: true,
@@ -146,6 +157,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
       })
       connect()
     } catch (err: unknown) {
+      if (seq !== authSequence) return // stale response — ignore
       // Only clear auth state on 401 (invalid/expired token), not on network errors
       const isAuthError = err && typeof err === 'object' && 'response' in err &&
         (err as { response?: { status?: number } }).response?.status === 401
@@ -209,12 +221,14 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     set({ demoMode: val })
   },
 
+  setDevMode: (val: boolean) => set({ devMode: val }),
   setHasMapsKey: (val: boolean) => set({ hasMapsKey: val }),
   setServerTimezone: (tz: string) => set({ serverTimezone: tz }),
   setAppRequireMfa: (val: boolean) => set({ appRequireMfa: val }),
   setTripRemindersEnabled: (val: boolean) => set({ tripRemindersEnabled: val }),
 
   demoLogin: async () => {
+    authSequence++
     set({ isLoading: true, error: null })
     try {
       const data = await authApi.demoLogin()

client/src/store/inAppNotificationStore.ts

@@ -0,0 +1,192 @@
+import { create } from 'zustand'
+import { inAppNotificationsApi } from '../api/client'
+
+export interface InAppNotification {
+  id: number
+  type: 'simple' | 'boolean' | 'navigate'
+  scope: 'trip' | 'user' | 'admin'
+  target: number
+  sender_id: number | null
+  sender_username: string | null
+  sender_avatar: string | null
+  recipient_id: number
+  title_key: string
+  title_params: Record<string, string>
+  text_key: string
+  text_params: Record<string, string>
+  positive_text_key: string | null
+  negative_text_key: string | null
+  response: 'positive' | 'negative' | null
+  navigate_text_key: string | null
+  navigate_target: string | null
+  is_read: boolean
+  created_at: string
+}
+
+interface RawNotification extends Omit<InAppNotification, 'title_params' | 'text_params' | 'is_read'> {
+  title_params: string | Record<string, string>
+  text_params: string | Record<string, string>
+  is_read: number | boolean
+}
+
+function normalizeNotification(raw: RawNotification): InAppNotification {
+  return {
+    ...raw,
+    title_params: typeof raw.title_params === 'string' ? JSON.parse(raw.title_params || '{}') : raw.title_params,
+    text_params: typeof raw.text_params === 'string' ? JSON.parse(raw.text_params || '{}') : raw.text_params,
+    is_read: Boolean(raw.is_read),
+  }
+}
+
+interface NotificationState {
+  notifications: InAppNotification[]
+  unreadCount: number
+  total: number
+  isLoading: boolean
+  hasMore: boolean
+
+  fetchNotifications: (reset?: boolean) => Promise<void>
+  fetchUnreadCount: () => Promise<void>
+  markRead: (id: number) => Promise<void>
+  markUnread: (id: number) => Promise<void>
+  markAllRead: () => Promise<void>
+  deleteNotification: (id: number) => Promise<void>
+  deleteAll: () => Promise<void>
+  respondToBoolean: (id: number, response: 'positive' | 'negative') => Promise<void>
+
+  handleNewNotification: (notification: RawNotification) => void
+  handleUpdatedNotification: (notification: RawNotification) => void
+}
+
+const PAGE_SIZE = 20
+
+export const useInAppNotificationStore = create<NotificationState>((set, get) => ({
+  notifications: [],
+  unreadCount: 0,
+  total: 0,
+  isLoading: false,
+  hasMore: false,
+
+  fetchNotifications: async (reset = false) => {
+    const { notifications, isLoading } = get()
+    if (isLoading) return
+
+    set({ isLoading: true })
+    try {
+      const offset = reset ? 0 : notifications.length
+      const data = await inAppNotificationsApi.list({ limit: PAGE_SIZE, offset })
+      const normalized = (data.notifications as RawNotification[]).map(normalizeNotification)
+
+      set({
+        notifications: reset ? normalized : [...notifications, ...normalized],
+        total: data.total,
+        unreadCount: data.unread_count,
+        hasMore: (reset ? normalized.length : notifications.length + normalized.length) < data.total,
+        isLoading: false,
+      })
+    } catch {
+      set({ isLoading: false })
+    }
+  },
+
+  fetchUnreadCount: async () => {
+    try {
+      const data = await inAppNotificationsApi.unreadCount()
+      set({ unreadCount: data.count })
+    } catch {
+      // best-effort
+    }
+  },
+
+  markRead: async (id: number) => {
+    try {
+      await inAppNotificationsApi.markRead(id)
+      set(state => ({
+        notifications: state.notifications.map(n => n.id === id ? { ...n, is_read: true } : n),
+        unreadCount: Math.max(0, state.unreadCount - (state.notifications.find(n => n.id === id)?.is_read ? 0 : 1)),
+      }))
+    } catch {
+      // best-effort
+    }
+  },
+
+  markUnread: async (id: number) => {
+    try {
+      await inAppNotificationsApi.markUnread(id)
+      set(state => ({
+        notifications: state.notifications.map(n => n.id === id ? { ...n, is_read: false } : n),
+        unreadCount: state.unreadCount + (state.notifications.find(n => n.id === id)?.is_read ? 1 : 0),
+      }))
+    } catch {
+      // best-effort
+    }
+  },
+
+  markAllRead: async () => {
+    try {
+      await inAppNotificationsApi.markAllRead()
+      set(state => ({
+        notifications: state.notifications.map(n => ({ ...n, is_read: true })),
+        unreadCount: 0,
+      }))
+    } catch {
+      // best-effort
+    }
+  },
+
+  deleteNotification: async (id: number) => {
+    const notification = get().notifications.find(n => n.id === id)
+    try {
+      await inAppNotificationsApi.delete(id)
+      set(state => ({
+        notifications: state.notifications.filter(n => n.id !== id),
+        total: Math.max(0, state.total - 1),
+        unreadCount: notification && !notification.is_read ? Math.max(0, state.unreadCount - 1) : state.unreadCount,
+      }))
+    } catch {
+      // best-effort
+    }
+  },
+
+  deleteAll: async () => {
+    try {
+      await inAppNotificationsApi.deleteAll()
+      set({ notifications: [], total: 0, unreadCount: 0, hasMore: false })
+    } catch {
+      // best-effort
+    }
+  },
+
+  respondToBoolean: async (id: number, response: 'positive' | 'negative') => {
+    try {
+      const data = await inAppNotificationsApi.respond(id, response)
+      if (data.notification) {
+        const normalized = normalizeNotification(data.notification as RawNotification)
+        set(state => ({
+          notifications: state.notifications.map(n => n.id === id ? normalized : n),
+          unreadCount: !state.notifications.find(n => n.id === id)?.is_read
+            ? Math.max(0, state.unreadCount - 1)
+            : state.unreadCount,
+        }))
+      }
+    } catch {
+      // best-effort
+    }
+  },
+
+  handleNewNotification: (raw: RawNotification) => {
+    const notification = normalizeNotification(raw)
+    set(state => ({
+      notifications: [notification, ...state.notifications],
+      total: state.total + 1,
+      unreadCount: state.unreadCount + 1,
+    }))
+  },
+
+  handleUpdatedNotification: (raw: RawNotification) => {
+    const notification = normalizeNotification(raw)
+    set(state => ({
+      notifications: state.notifications.map(n => n.id === notification.id ? notification : n),
+    }))
+  },
+}))

client/src/store/vacayStore.ts

@@ -222,7 +222,14 @@ export const useVacayStore = create<VacayState>((set, get) => ({
 
   removeYear: async (year: number) => {
     const data = await api.removeYear(year)
-    set({ years: data.years })
+    const updates: Partial<VacayState> = { years: data.years }
+    if (get().selectedYear === year) {
+      updates.selectedYear = data.years.length > 0
+        ? data.years[data.years.length - 1]
+        : new Date().getFullYear()
+    }
+    set(updates)
+    await get().loadStats()
   },
 
   loadEntries: async (year?: number) => {
@@ -240,6 +247,7 @@ export const useVacayStore = create<VacayState>((set, get) => ({
   toggleCompanyHoliday: async (date: string) => {
     await api.toggleCompanyHoliday(date)
     await get().loadEntries()
+    await get().loadStats()
   },
 
   loadStats: async (year?: number) => {

client/src/utils/formatters.ts

@@ -10,9 +10,9 @@ export function formatDate(dateStr: string | null | undefined, locale: string, t
   if (!dateStr) return null
   const opts: Intl.DateTimeFormatOptions = {
     weekday: 'short', day: 'numeric', month: 'short',
+    timeZone: timeZone || 'UTC',
   }
-  if (timeZone) opts.timeZone = timeZone
-  return new Date(dateStr + 'T00:00:00').toLocaleDateString(locale, opts)
+  return new Date(dateStr + 'T00:00:00Z').toLocaleDateString(locale, opts)
 }
 
 export function formatTime(timeStr: string | null | undefined, locale: string, timeFormat: string): string {

docker-compose.yml

@@ -23,13 +23,22 @@ services:
       - LOG_LEVEL=${LOG_LEVEL:-info} # info = concise user actions; debug = verbose admin-level details
       - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-} # Comma-separated origins for CORS and email notification links
       - FORCE_HTTPS=true # Redirect HTTP to HTTPS when behind a TLS-terminating proxy
+#     - COOKIE_SECURE=false # Uncomment if accessing over plain HTTP (no HTTPS). Not recommended for production.
       - TRUST_PROXY=1 # Number of trusted proxies (for X-Forwarded-For / real client IP)
       - ALLOW_INTERNAL_NETWORK=false # Set to true if Immich or other services are hosted on your local network (RFC-1918 IPs). Loopback and link-local addresses remain blocked regardless.
-      - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
-      - OIDC_CLIENT_ID=trek # OpenID Connect client ID
-      - OIDC_CLIENT_SECRET=supersecret # OpenID Connect client secret
-      - OIDC_DISPLAY_NAME=SSO # Label shown on the SSO login button
-      - OIDC_ONLY=false # Set true to disable local password auth entirely (SSO only)
+#      - APP_URL=https://trek.example.com # Public base URL — required when OIDC is enabled (must match the redirect URI registered with your IdP); also used as base URL for links in email notifications
+#      - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
+#      - OIDC_CLIENT_ID=trek # OpenID Connect client ID
+#      - OIDC_CLIENT_SECRET=supersecret # OpenID Connect client secret
+#      - OIDC_DISPLAY_NAME=SSO # Label shown on the SSO login button
+#      - OIDC_ONLY=false # Set true to disable local password auth entirely (SSO only)
+#      - OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
+#      - OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
+#      - OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
+#      - OIDC_DISCOVERY_URL= # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik)
+#      - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
+#      - ADMIN_PASSWORD=changeme      # Initial admin password — only used on first boot when no users exist
+#      - MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
     volumes:
       - ./data:/app/data
       - ./uploads:/app/uploads

server/.env.example

@@ -10,6 +10,7 @@ LOG_LEVEL=info # info = concise user actions; debug = verbose admin-level detail
 
 ALLOWED_ORIGINS=https://trek.example.com # Comma-separated origins for CORS and email links
 FORCE_HTTPS=false # Redirect HTTP → HTTPS behind a TLS proxy
+COOKIE_SECURE=true # Set to false to allow session cookies over HTTP (e.g. plain-IP or non-HTTPS setups). Defaults to true in production.
 TRUST_PROXY=1 # Number of trusted proxies for X-Forwarded-For
 ALLOW_INTERNAL_NETWORK=false # Allow outbound requests to private/RFC1918 IPs (e.g. Immich hosted on your LAN). Loopback and link-local addresses are always blocked.
 
@@ -22,6 +23,15 @@ OIDC_DISPLAY_NAME=SSO # Label shown on the SSO login button
 OIDC_ONLY=true # Disable local password auth entirely (SSO only)
 OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
 OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
-OIDC_DISCOVERY_URL= # Override the auto-constructed discovery endpoint (e.g. Authentik: https://auth.example.com/application/o/trek/.well-known/openid-configuration)
+OIDC_DISCOVERY_URL= # Override the auto-constructed OIDC discovery endpoint. Useful for providers (e.g. Authentik) that expose it at a non-standard path. Example: https://auth.example.com/application/o/trek/.well-known/openid-configuration
+OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
 
 DEMO_MODE=false # Demo mode - resets data hourly
+
+# MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
+
+# Initial admin account — only used on first boot when no users exist yet.
+# If both are set the admin account is created with these credentials.
+# If either is omitted a random password is generated and printed to the server log.
+# ADMIN_EMAIL=admin@trek.local
+# ADMIN_PASSWORD=changeme

server/package.json

@@ -1,10 +1,16 @@
 {
   "name": "trek-server",
-  "version": "2.7.2",
+  "version": "2.8.3",
   "main": "src/index.ts",
   "scripts": {
     "start": "node --import tsx src/index.ts",
-    "dev": "tsx watch src/index.ts"
+    "dev": "tsx watch src/index.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:unit": "vitest run tests/unit",
+    "test:integration": "vitest run tests/integration",
+    "test:ws": "vitest run tests/websocket",
+    "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
@@ -43,9 +49,13 @@
     "@types/node-cron": "^3.0.11",
     "@types/nodemailer": "^7.0.11",
     "@types/qrcode": "^1.5.5",
+    "@types/supertest": "^6.0.3",
     "@types/unzipper": "^0.10.11",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.18.1",
-    "nodemon": "^3.1.0"
+    "@vitest/coverage-v8": "^3.2.4",
+    "nodemon": "^3.1.0",
+    "supertest": "^7.2.2",
+    "vitest": "^3.2.4"
   }
 }

server/src/app.ts

@@ -0,0 +1,243 @@
+import express, { Request, Response, NextFunction } from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import cookieParser from 'cookie-parser';
+import path from 'node:path';
+import fs from 'node:fs';
+
+import jwt from 'jsonwebtoken';
+import { JWT_SECRET } from './config';
+import { logDebug, logWarn, logError } from './services/auditLog';
+import { enforceGlobalMfaPolicy } from './middleware/mfaPolicy';
+import { authenticate } from './middleware/auth';
+import { db } from './db/database';
+
+import authRoutes from './routes/auth';
+import tripsRoutes from './routes/trips';
+import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './routes/days';
+import placesRoutes from './routes/places';
+import assignmentsRoutes from './routes/assignments';
+import packingRoutes from './routes/packing';
+import tagsRoutes from './routes/tags';
+import categoriesRoutes from './routes/categories';
+import adminRoutes from './routes/admin';
+import mapsRoutes from './routes/maps';
+import filesRoutes from './routes/files';
+import reservationsRoutes from './routes/reservations';
+import dayNotesRoutes from './routes/dayNotes';
+import weatherRoutes from './routes/weather';
+import settingsRoutes from './routes/settings';
+import budgetRoutes from './routes/budget';
+import collabRoutes from './routes/collab';
+import backupRoutes from './routes/backup';
+import oidcRoutes from './routes/oidc';
+import vacayRoutes from './routes/vacay';
+import atlasRoutes from './routes/atlas';
+import immichRoutes from './routes/immich';
+import notificationRoutes from './routes/notifications';
+import shareRoutes from './routes/share';
+import { mcpHandler } from './mcp';
+import { Addon } from './types';
+
+export function createApp(): express.Application {
+  const app = express();
+
+  // Trust first proxy (nginx/Docker) for correct req.ip
+  if (process.env.NODE_ENV === 'production' || process.env.TRUST_PROXY) {
+    app.set('trust proxy', Number.parseInt(process.env.TRUST_PROXY) || 1);
+  }
+
+  const allowedOrigins = process.env.ALLOWED_ORIGINS
+    ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
+    : null;
+
+  let corsOrigin: cors.CorsOptions['origin'];
+  if (allowedOrigins) {
+    corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
+      if (!origin || allowedOrigins.includes(origin)) callback(null, true);
+      else callback(new Error('Not allowed by CORS'));
+    };
+  } else if (process.env.NODE_ENV === 'production') {
+    corsOrigin = false;
+  } else {
+    corsOrigin = true;
+  }
+
+  const shouldForceHttps = process.env.FORCE_HTTPS === 'true';
+
+  app.use(cors({ origin: corsOrigin, credentials: true }));
+  app.use(helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
+        imgSrc: ["'self'", "data:", "blob:", "https:"],
+        connectSrc: [
+          "'self'", "ws:", "wss:",
+          "https://nominatim.openstreetmap.org", "https://overpass-api.de",
+          "https://places.googleapis.com", "https://api.openweathermap.org",
+          "https://en.wikipedia.org", "https://commons.wikimedia.org",
+          "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
+          "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
+          "https://geocoding-api.open-meteo.com", "https://api.exchangerate-api.com",
+          "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/master/geojson/ne_50m_admin_0_countries.geojson"
+        ],
+        fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
+        objectSrc: ["'none'"],
+        frameSrc: ["'none'"],
+        frameAncestors: ["'self'"],
+        upgradeInsecureRequests: shouldForceHttps ? [] : null
+      }
+    },
+    crossOriginEmbedderPolicy: false,
+    hsts: shouldForceHttps ? { maxAge: 31536000, includeSubDomains: false } : false,
+  }));
+
+  if (shouldForceHttps) {
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
+      res.redirect(301, 'https://' + req.headers.host + req.url);
+    });
+  }
+
+  app.use(express.json({ limit: '100kb' }));
+  app.use(express.urlencoded({ extended: true }));
+  app.use(cookieParser());
+  app.use(enforceGlobalMfaPolicy);
+
+  // Request logging with sensitive field redaction
+  {
+    const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
+    const redact = (value: unknown): unknown => {
+      if (!value || typeof value !== 'object') return value;
+      if (Array.isArray(value)) return (value as unknown[]).map(redact);
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v);
+      }
+      return out;
+    };
+
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path === '/api/health') return next();
+      const startedAt = Date.now();
+      res.on('finish', () => {
+        const ms = Date.now() - startedAt;
+        if (res.statusCode >= 500) {
+          logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        } else if (res.statusCode === 401 || res.statusCode === 403) {
+          logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        } else if (res.statusCode >= 400) {
+          logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
+        }
+        const q = Object.keys(req.query).length ? ` query=${JSON.stringify(redact(req.query))}` : '';
+        const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(redact(req.body))}` : '';
+        logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
+      });
+      next();
+    });
+  }
+
+  // Static: avatars and covers are public
+  app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
+  app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
+
+  // Photos require auth or valid share token
+  app.get('/uploads/photos/:filename', (req: Request, res: Response) => {
+    const safeName = path.basename(req.params.filename);
+    const filePath = path.join(__dirname, '../uploads/photos', safeName);
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(path.resolve(__dirname, '../uploads/photos'))) {
+      return res.status(403).send('Forbidden');
+    }
+    if (!fs.existsSync(resolved)) return res.status(404).send('Not found');
+
+    const authHeader = req.headers.authorization;
+    const token = (req.query.token as string) || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
+    if (!token) return res.status(401).send('Authentication required');
+
+    try {
+      jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] });
+    } catch {
+      const shareRow = db.prepare('SELECT id FROM share_tokens WHERE token = ?').get(token);
+      if (!shareRow) return res.status(401).send('Authentication required');
+    }
+    res.sendFile(resolved);
+  });
+
+  // Block direct access to /uploads/files
+  app.use('/uploads/files', (_req: Request, res: Response) => {
+    res.status(401).send('Authentication required');
+  });
+
+  // API Routes
+  app.use('/api/auth', authRoutes);
+  app.use('/api/auth/oidc', oidcRoutes);
+  app.use('/api/trips', tripsRoutes);
+  app.use('/api/trips/:tripId/days', daysRoutes);
+  app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
+  app.use('/api/trips/:tripId/places', placesRoutes);
+  app.use('/api/trips/:tripId/packing', packingRoutes);
+  app.use('/api/trips/:tripId/files', filesRoutes);
+  app.use('/api/trips/:tripId/budget', budgetRoutes);
+  app.use('/api/trips/:tripId/collab', collabRoutes);
+  app.use('/api/trips/:tripId/reservations', reservationsRoutes);
+  app.use('/api/trips/:tripId/days/:dayId/notes', dayNotesRoutes);
+  app.get('/api/health', (_req: Request, res: Response) => res.json({ status: 'ok' }));
+  app.use('/api', assignmentsRoutes);
+  app.use('/api/tags', tagsRoutes);
+  app.use('/api/categories', categoriesRoutes);
+  app.use('/api/admin', adminRoutes);
+
+  // Addons list endpoint
+  app.get('/api/addons', authenticate, (_req: Request, res: Response) => {
+    const addons = db.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
+    res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled })) });
+  });
+
+  // Addon routes
+  app.use('/api/addons/vacay', vacayRoutes);
+  app.use('/api/addons/atlas', atlasRoutes);
+  app.use('/api/integrations/immich', immichRoutes);
+  app.use('/api/maps', mapsRoutes);
+  app.use('/api/weather', weatherRoutes);
+  app.use('/api/settings', settingsRoutes);
+  app.use('/api/backup', backupRoutes);
+  app.use('/api/notifications', notificationRoutes);
+  app.use('/api', shareRoutes);
+
+  // MCP endpoint
+  app.post('/mcp', mcpHandler);
+  app.get('/mcp', mcpHandler);
+  app.delete('/mcp', mcpHandler);
+
+  // Production static file serving
+  if (process.env.NODE_ENV === 'production') {
+    const publicPath = path.join(__dirname, '../public');
+    app.use(express.static(publicPath, {
+      setHeaders: (res, filePath) => {
+        if (filePath.endsWith('index.html')) {
+          res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+        }
+      },
+    }));
+    app.get('*', (_req: Request, res: Response) => {
+      res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+      res.sendFile(path.join(publicPath, 'index.html'));
+    });
+  }
+
+  // Global error handler
+  app.use((err: Error & { status?: number; statusCode?: number }, _req: Request, res: Response, _next: NextFunction) => {
+    if (process.env.NODE_ENV === 'production') {
+      console.error('Unhandled error:', err.message);
+    } else {
+      console.error('Unhandled error:', err);
+    }
+    const status = err.statusCode || 500;
+    res.status(status).json({ error: 'Internal server error' });
+  });
+
+  return app;
+}

server/src/config.ts

@@ -1,6 +1,6 @@
-import crypto from 'crypto';
-import fs from 'fs';
-import path from 'path';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
 
 const dataDir = path.resolve(__dirname, '../data');
 

server/src/db/migrations.ts

@@ -491,6 +491,33 @@ function runMigrations(db: Database.Database): void {
         CREATE INDEX IF NOT EXISTS idx_trip_album_links_trip ON trip_album_links(trip_id);
       `);
     },
+    () => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS notifications (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          type TEXT NOT NULL CHECK(type IN ('simple', 'boolean', 'navigate')),
+          scope TEXT NOT NULL CHECK(scope IN ('trip', 'user', 'admin')),
+          target INTEGER NOT NULL,
+          sender_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+          recipient_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          title_key TEXT NOT NULL,
+          title_params TEXT DEFAULT '{}',
+          text_key TEXT NOT NULL,
+          text_params TEXT DEFAULT '{}',
+          positive_text_key TEXT,
+          negative_text_key TEXT,
+          positive_callback TEXT,
+          negative_callback TEXT,
+          response TEXT CHECK(response IN ('positive', 'negative')),
+          navigate_text_key TEXT,
+          navigate_target TEXT,
+          is_read INTEGER DEFAULT 0,
+          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS idx_notifications_recipient ON notifications(recipient_id, is_read, created_at DESC);
+        CREATE INDEX IF NOT EXISTS idx_notifications_recipient_created ON notifications(recipient_id, created_at DESC);
+      `);
+    },
   ];
 
   if (currentVersion < migrations.length) {

server/src/db/schema.ts

@@ -394,6 +394,30 @@ function createTables(db: Database.Database): void {
       ip TEXT
     );
     CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at DESC);
+
+    CREATE TABLE IF NOT EXISTS notifications (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      type TEXT NOT NULL CHECK(type IN ('simple', 'boolean', 'navigate')),
+      scope TEXT NOT NULL CHECK(scope IN ('trip', 'user', 'admin')),
+      target INTEGER NOT NULL,
+      sender_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+      recipient_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      title_key TEXT NOT NULL,
+      title_params TEXT DEFAULT '{}',
+      text_key TEXT NOT NULL,
+      text_params TEXT DEFAULT '{}',
+      positive_text_key TEXT,
+      negative_text_key TEXT,
+      positive_callback TEXT,
+      negative_callback TEXT,
+      response TEXT CHECK(response IN ('positive', 'negative')),
+      navigate_text_key TEXT,
+      navigate_target TEXT,
+      is_read INTEGER DEFAULT 0,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    CREATE INDEX IF NOT EXISTS idx_notifications_recipient ON notifications(recipient_id, is_read, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_notifications_recipient_created ON notifications(recipient_id, created_at DESC);
   `);
 }
 

server/src/db/seeds.ts

@@ -22,9 +22,21 @@ function seedAdminAccount(db: Database.Database): void {
     }
 
     const bcrypt = require('bcryptjs');
-    const password = crypto.randomBytes(12).toString('base64url');
+
+    const env_admin_email = process.env.ADMIN_EMAIL;
+    const env_admin_pw = process.env.ADMIN_PASSWORD;
+
+    let password;
+    let email;
+    if (env_admin_email && env_admin_pw) {
+      password = env_admin_pw;
+      email = env_admin_email;
+    } else {
+      password = crypto.randomBytes(12).toString('base64url');
+      email = 'admin@trek.local';
+    }
+
     const hash = bcrypt.hashSync(password, 12);
-    const email = 'admin@trek.local';
     const username = 'admin';
 
     db.prepare('INSERT INTO users (username, email, password_hash, role, must_change_password) VALUES (?, ?, ?, ?, 1)').run(username, email, hash, 'admin');

server/src/index.ts

@@ -1,272 +1,29 @@
 import 'dotenv/config';
-import express, { Request, Response, NextFunction } from 'express';
-import { enforceGlobalMfaPolicy } from './middleware/mfaPolicy';
-import cors from 'cors';
-import helmet from 'helmet';
-import cookieParser from 'cookie-parser';
-import path from 'path';
-import fs from 'fs';
+import path from 'node:path';
+import fs from 'node:fs';
+import { createApp } from './app';
 
-const app = express();
-const DEBUG = String(process.env.DEBUG || 'false').toLowerCase() === 'true';
-const LOG_LVL = (process.env.LOG_LEVEL || 'info').toLowerCase();
-
-// Trust first proxy (nginx/Docker) for correct req.ip
-if (process.env.NODE_ENV === 'production' || process.env.TRUST_PROXY) {
-  app.set('trust proxy', parseInt(process.env.TRUST_PROXY as string) || 1);
-}
-
-// Create upload directories on startup
+// Create upload and data directories on startup
 const uploadsDir = path.join(__dirname, '../uploads');
 const photosDir = path.join(uploadsDir, 'photos');
 const filesDir = path.join(uploadsDir, 'files');
 const coversDir = path.join(uploadsDir, 'covers');
+const avatarsDir = path.join(uploadsDir, 'avatars');
 const backupsDir = path.join(__dirname, '../data/backups');
 const tmpDir = path.join(__dirname, '../data/tmp');
 
-[uploadsDir, photosDir, filesDir, coversDir, backupsDir, tmpDir].forEach(dir => {
+[uploadsDir, photosDir, filesDir, coversDir, avatarsDir, backupsDir, tmpDir].forEach(dir => {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 });
 
-// Middleware
-const allowedOrigins = process.env.ALLOWED_ORIGINS
-  ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim()).filter(Boolean)
-  : null;
-
-let corsOrigin: cors.CorsOptions['origin'];
-if (allowedOrigins) {
-  corsOrigin = (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
-    if (!origin || allowedOrigins.includes(origin)) callback(null, true);
-    else callback(new Error('Not allowed by CORS'));
-  };
-} else if (process.env.NODE_ENV === 'production') {
-  corsOrigin = false;
-} else {
-  corsOrigin = true;
-}
-
-const shouldForceHttps = process.env.FORCE_HTTPS === 'true';
-
-app.use(cors({
-  origin: corsOrigin,
-  credentials: true
-}));
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://unpkg.com"],
-      imgSrc: ["'self'", "data:", "blob:", "https:"],
-      connectSrc: [
-        "'self'", "ws:", "wss:",
-        "https://nominatim.openstreetmap.org", "https://overpass-api.de",
-        "https://places.googleapis.com", "https://api.openweathermap.org",
-        "https://en.wikipedia.org", "https://commons.wikimedia.org",
-        "https://*.basemaps.cartocdn.com", "https://*.tile.openstreetmap.org",
-        "https://unpkg.com", "https://open-meteo.com", "https://api.open-meteo.com",
-        "https://geocoding-api.open-meteo.com", "https://api.exchangerate-api.com",
-      ],
-      fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
-      objectSrc: ["'none'"],
-      frameSrc: ["'none'"],
-      frameAncestors: ["'self'"],
-      upgradeInsecureRequests: shouldForceHttps ? [] : null
-    }
-  },
-  crossOriginEmbedderPolicy: false,
-  hsts: shouldForceHttps ? { maxAge: 31536000, includeSubDomains: false } : false,
-}));
-
-// Redirect HTTP to HTTPS (opt-in via FORCE_HTTPS=true)
-if (shouldForceHttps) {
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.secure || req.headers['x-forwarded-proto'] === 'https') return next();
-    res.redirect(301, 'https://' + req.headers.host + req.url);
-  });
-}
-app.use(express.json({ limit: '100kb' }));
-app.use(express.urlencoded({ extended: true }));
-app.use(cookieParser());
-
-app.use(enforceGlobalMfaPolicy);
-
-{
-  const { logInfo: _logInfo, logDebug: _logDebug, logWarn: _logWarn, logError: _logError } = require('./services/auditLog');
-  const SENSITIVE_KEYS = new Set(['password', 'new_password', 'current_password', 'token', 'jwt', 'authorization', 'cookie', 'client_secret', 'mfa_token', 'code', 'smtp_pass']);
-  const _redact = (value: unknown): unknown => {
-    if (!value || typeof value !== 'object') return value;
-    if (Array.isArray(value)) return value.map(_redact);
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-      out[k] = SENSITIVE_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : _redact(v);
-    }
-    return out;
-  };
-
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    if (req.path === '/api/health') return next();
-
-    const startedAt = Date.now();
-    res.on('finish', () => {
-      const ms = Date.now() - startedAt;
-
-      if (res.statusCode >= 500) {
-        _logError(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      } else if (res.statusCode === 401 || res.statusCode === 403) {
-        _logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      } else if (res.statusCode >= 400) {
-        _logWarn(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}`);
-      }
-
-      const q = Object.keys(req.query).length ? ` query=${JSON.stringify(_redact(req.query))}` : '';
-      const b = req.body && Object.keys(req.body).length ? ` body=${JSON.stringify(_redact(req.body))}` : '';
-      _logDebug(`${req.method} ${req.path} ${res.statusCode} ${ms}ms ip=${req.ip}${q}${b}`);
-    });
-    next();
-  });
-}
-
-// Avatars are public (shown on login, sharing screens)
-import { authenticate } from './middleware/auth';
-app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
-app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
-
-// Serve uploaded photos — require auth token or valid share token
-app.get('/uploads/photos/:filename', (req: Request, res: Response) => {
-  const safeName = path.basename(req.params.filename);
-  const filePath = path.join(__dirname, '../uploads/photos', safeName);
-  const resolved = path.resolve(filePath);
-  if (!resolved.startsWith(path.resolve(__dirname, '../uploads/photos'))) {
-    return res.status(403).send('Forbidden');
-  }
-  if (!fs.existsSync(resolved)) return res.status(404).send('Not found');
-
-  // Allow if authenticated or if a valid share token is present
-  const authHeader = req.headers.authorization;
-  const token = req.query.token as string || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
-  if (!token) return res.status(401).send('Authentication required');
-
-  try {
-    const jwt = require('jsonwebtoken');
-    jwt.verify(token, process.env.JWT_SECRET || require('./config').JWT_SECRET);
-  } catch {
-    // Check if it's a share token
-    const shareRow = db.prepare('SELECT id FROM share_tokens WHERE token = ?').get(token);
-    if (!shareRow) return res.status(401).send('Authentication required');
-  }
-  res.sendFile(resolved);
-});
-
-// Block direct access to /uploads/files — served via authenticated /api/trips/:tripId/files/:id/download
-app.use('/uploads/files', (_req: Request, res: Response) => {
-  res.status(401).send('Authentication required');
-});
-
-// Routes
-import authRoutes from './routes/auth';
-import tripsRoutes from './routes/trips';
-import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './routes/days';
-import placesRoutes from './routes/places';
-import assignmentsRoutes from './routes/assignments';
-import packingRoutes from './routes/packing';
-import tagsRoutes from './routes/tags';
-import categoriesRoutes from './routes/categories';
-import adminRoutes from './routes/admin';
-import mapsRoutes from './routes/maps';
-import filesRoutes from './routes/files';
-import reservationsRoutes from './routes/reservations';
-import dayNotesRoutes from './routes/dayNotes';
-import weatherRoutes from './routes/weather';
-import settingsRoutes from './routes/settings';
-import budgetRoutes from './routes/budget';
-import collabRoutes from './routes/collab';
-import backupRoutes from './routes/backup';
-import oidcRoutes from './routes/oidc';
-app.use('/api/auth', authRoutes);
-app.use('/api/auth/oidc', oidcRoutes);
-app.use('/api/trips', tripsRoutes);
-app.use('/api/trips/:tripId/days', daysRoutes);
-app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
-app.use('/api/trips/:tripId/places', placesRoutes);
-app.use('/api/trips/:tripId/packing', packingRoutes);
-app.use('/api/trips/:tripId/files', filesRoutes);
-app.use('/api/trips/:tripId/budget', budgetRoutes);
-app.use('/api/trips/:tripId/collab', collabRoutes);
-app.use('/api/trips/:tripId/reservations', reservationsRoutes);
-app.use('/api/trips/:tripId/days/:dayId/notes', dayNotesRoutes);
-app.get('/api/health', (req: Request, res: Response) => res.json({ status: 'ok' }));
-app.use('/api', assignmentsRoutes);
-app.use('/api/tags', tagsRoutes);
-app.use('/api/categories', categoriesRoutes);
-app.use('/api/admin', adminRoutes);
-
-// Public addons endpoint (authenticated but not admin-only)
-import { authenticate as addonAuth } from './middleware/auth';
-import { db as addonDb } from './db/database';
-import { Addon } from './types';
-app.get('/api/addons', addonAuth, (req: Request, res: Response) => {
-  const addons = addonDb.prepare('SELECT id, name, type, icon, enabled FROM addons WHERE enabled = 1 ORDER BY sort_order').all() as Pick<Addon, 'id' | 'name' | 'type' | 'icon' | 'enabled'>[];
-  res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled })) });
-});
-
-// Addon routes
-import vacayRoutes from './routes/vacay';
-app.use('/api/addons/vacay', vacayRoutes);
-import atlasRoutes from './routes/atlas';
-app.use('/api/addons/atlas', atlasRoutes);
-import immichRoutes from './routes/immich';
-app.use('/api/integrations/immich', immichRoutes);
-
-app.use('/api/maps', mapsRoutes);
-app.use('/api/weather', weatherRoutes);
-app.use('/api/settings', settingsRoutes);
-app.use('/api/backup', backupRoutes);
-
-import notificationRoutes from './routes/notifications';
-app.use('/api/notifications', notificationRoutes);
-
-import shareRoutes from './routes/share';
-app.use('/api', shareRoutes);
-
-// MCP endpoint (Streamable HTTP transport, per-user auth)
-import { mcpHandler, closeMcpSessions } from './mcp';
-app.post('/mcp', mcpHandler);
-app.get('/mcp', mcpHandler);
-app.delete('/mcp', mcpHandler);
-
-// Serve static files in production
-if (process.env.NODE_ENV === 'production') {
-  const publicPath = path.join(__dirname, '../public');
-  app.use(express.static(publicPath, {
-    setHeaders: (res, filePath) => {
-      // Never cache index.html so version updates are picked up immediately
-      if (filePath.endsWith('index.html')) {
-        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-      }
-    },
-  }));
-  app.get('*', (req: Request, res: Response) => {
-    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-    res.sendFile(path.join(publicPath, 'index.html'));
-  });
-}
-
-// Global error handler — do not leak stack traces in production
-app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
-  if (process.env.NODE_ENV !== 'production') {
-    console.error('Unhandled error:', err);
-  } else {
-    console.error('Unhandled error:', err.message);
-  }
-  res.status(500).json({ error: 'Internal server error' });
-});
+const app = createApp();
 
 import * as scheduler from './scheduler';
 
 const PORT = process.env.PORT || 3001;
 const server = app.listen(PORT, () => {
   const { logInfo: sLogInfo, logWarn: sLogWarn } = require('./services/auditLog');
+  const LOG_LVL = (process.env.LOG_LEVEL || 'info').toLowerCase();
   const tz = process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
   const origins = process.env.ALLOWED_ORIGINS || '(same-origin)';
   const banner = [
@@ -300,6 +57,7 @@ const server = app.listen(PORT, () => {
 // Graceful shutdown
 function shutdown(signal: string): void {
   const { logInfo: sLogInfo, logError: sLogError } = require('./services/auditLog');
+  const { closeMcpSessions } = require('./mcp');
   sLogInfo(`${signal} received — shutting down gracefully...`);
   scheduler.stop();
   closeMcpSessions();

server/src/mcp/index.ts

@@ -21,7 +21,8 @@ const sessions = new Map<string, McpSession>();
 const SESSION_TTL_MS = 60 * 60 * 1000; // 1 hour
 const MAX_SESSIONS_PER_USER = 5;
 const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
-const RATE_LIMIT_MAX = 60; // requests per minute per user
+const parsed = Number.parseInt(process.env.MCP_RATE_LIMIT ?? "");
+const RATE_LIMIT_MAX = Number.isFinite(parsed) && parsed > 0 ? parsed : 60; // requests per minute per user
 
 interface RateLimitEntry {
   count: number;

server/src/middleware/auth.ts

@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';
 import { AuthRequest, OptionalAuthRequest, User } from '../types';
 
-function extractToken(req: Request): string | null {
+export function extractToken(req: Request): string | null {
   // Prefer httpOnly cookie; fall back to Authorization: Bearer (MCP, API clients)
   const cookieToken = (req as any).cookies?.trek_session;
   if (cookieToken) return cookieToken;
@@ -16,7 +16,7 @@ const authenticate = (req: Request, res: Response, next: NextFunction): void =>
   const token = extractToken(req);
 
   if (!token) {
-    res.status(401).json({ error: 'Access token required' });
+    res.status(401).json({ error: 'Access token required', code: 'AUTH_REQUIRED' });
     return;
   }
 
@@ -26,13 +26,13 @@ const authenticate = (req: Request, res: Response, next: NextFunction): void =>
       'SELECT id, username, email, role FROM users WHERE id = ?'
     ).get(decoded.id) as User | undefined;
     if (!user) {
-      res.status(401).json({ error: 'User not found' });
+      res.status(401).json({ error: 'User not found', code: 'AUTH_REQUIRED' });
       return;
     }
     (req as AuthRequest).user = user;
     next();
   } catch (err: unknown) {
-    res.status(401).json({ error: 'Invalid or expired token' });
+    res.status(401).json({ error: 'Invalid or expired token', code: 'AUTH_REQUIRED' });
   }
 };
 

server/src/middleware/mfaPolicy.ts

@@ -4,7 +4,7 @@ import { db } from '../db/database';
 import { JWT_SECRET } from '../config';
 
 /** Paths that never require MFA (public or pre-auth). */
-function isPublicApiPath(method: string, pathNoQuery: string): boolean {
+export function isPublicApiPath(method: string, pathNoQuery: string): boolean {
   if (method === 'GET' && pathNoQuery === '/api/health') return true;
   if (method === 'GET' && pathNoQuery === '/api/auth/app-config') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/login') return true;
@@ -17,7 +17,7 @@ function isPublicApiPath(method: string, pathNoQuery: string): boolean {
 }
 
 /** Authenticated paths allowed while MFA is not yet enabled (setup + lockout recovery). */
-function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
+export function isMfaSetupExemptPath(method: string, pathNoQuery: string): boolean {
   if (method === 'GET' && pathNoQuery === '/api/auth/me') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/setup') return true;
   if (method === 'POST' && pathNoQuery === '/api/auth/mfa/enable') return true;

server/src/routes/admin.ts

@@ -1,192 +1,82 @@
 import express, { Request, Response } from 'express';
-import bcrypt from 'bcryptjs';
-import crypto from 'crypto';
-import path from 'path';
-import fs from 'fs';
-import { db } from '../db/database';
 import { authenticate, adminOnly } from '../middleware/auth';
-import { AuthRequest, User, Addon } from '../types';
+import { AuthRequest } from '../types';
 import { writeAudit, getClientIp, logInfo } from '../services/auditLog';
-import { getAllPermissions, savePermissions, PERMISSION_ACTIONS } from '../services/permissions';
-import { revokeUserSessions } from '../mcp';
-import { maybe_encrypt_api_key, decrypt_api_key } from '../services/apiKeyCrypto';
-import { validatePassword } from '../services/passwordPolicy';
-import { updateJwtSecret } from '../config';
+import * as svc from '../services/adminService';
 
 const router = express.Router();
 
 router.use(authenticate, adminOnly);
 
-function utcSuffix(ts: string | null | undefined): string | null {
-  if (!ts) return null;
-  return ts.endsWith('Z') ? ts : ts.replace(' ', 'T') + 'Z';
-}
+// ── User CRUD ──────────────────────────────────────────────────────────────
 
-router.get('/users', (req: Request, res: Response) => {
-  const users = db.prepare(
-    'SELECT id, username, email, role, created_at, updated_at, last_login FROM users ORDER BY created_at DESC'
-  ).all() as Pick<User, 'id' | 'username' | 'email' | 'role' | 'created_at' | 'updated_at' | 'last_login'>[];
-  let onlineUserIds = new Set<number>();
-  try {
-    const { getOnlineUserIds } = require('../websocket');
-    onlineUserIds = getOnlineUserIds();
-  } catch { /* */ }
-  const usersWithStatus = users.map(u => ({
-    ...u,
-    created_at: utcSuffix(u.created_at),
-    updated_at: utcSuffix(u.updated_at as string),
-    last_login: utcSuffix(u.last_login),
-    online: onlineUserIds.has(u.id),
-  }));
-  res.json({ users: usersWithStatus });
+router.get('/users', (_req: Request, res: Response) => {
+  res.json({ users: svc.listUsers() });
 });
 
 router.post('/users', (req: Request, res: Response) => {
-  const { username, email, password, role } = req.body;
-
-  if (!username?.trim() || !email?.trim() || !password?.trim()) {
-    return res.status(400).json({ error: 'Username, email and password are required' });
-  }
-
-  const pwCheck = validatePassword(password.trim());
-  if (!pwCheck.ok) return res.status(400).json({ error: pwCheck.reason });
-
-  if (role && !['user', 'admin'].includes(role)) {
-    return res.status(400).json({ error: 'Invalid role' });
-  }
-
-  const existingUsername = db.prepare('SELECT id FROM users WHERE username = ?').get(username.trim());
-  if (existingUsername) return res.status(409).json({ error: 'Username already taken' });
-
-  const existingEmail = db.prepare('SELECT id FROM users WHERE email = ?').get(email.trim());
-  if (existingEmail) return res.status(409).json({ error: 'Email already taken' });
-
-  const passwordHash = bcrypt.hashSync(password.trim(), 12);
-
-  const result = db.prepare(
-    'INSERT INTO users (username, email, password_hash, role) VALUES (?, ?, ?, ?)'
-  ).run(username.trim(), email.trim(), passwordHash, role || 'user');
-
-  const user = db.prepare(
-    'SELECT id, username, email, role, created_at, updated_at FROM users WHERE id = ?'
-  ).get(result.lastInsertRowid);
-
+  const result = svc.createUser(req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.user_create',
-    resource: String(result.lastInsertRowid),
+    resource: String(result.insertedId),
     ip: getClientIp(req),
-    details: { username: username.trim(), email: email.trim(), role: role || 'user' },
+    details: result.auditDetails,
   });
-  res.status(201).json({ user });
+  res.status(201).json({ user: result.user });
 });
 
 router.put('/users/:id', (req: Request, res: Response) => {
-  const { username, email, role, password } = req.body;
-  const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.params.id) as User | undefined;
-
-  if (!user) return res.status(404).json({ error: 'User not found' });
-
-  if (role && !['user', 'admin'].includes(role)) {
-    return res.status(400).json({ error: 'Invalid role' });
-  }
-
-  if (username && username !== user.username) {
-    const conflict = db.prepare('SELECT id FROM users WHERE username = ? AND id != ?').get(username, req.params.id);
-    if (conflict) return res.status(409).json({ error: 'Username already taken' });
-  }
-  if (email && email !== user.email) {
-    const conflict = db.prepare('SELECT id FROM users WHERE email = ? AND id != ?').get(email, req.params.id);
-    if (conflict) return res.status(409).json({ error: 'Email already taken' });
-  }
-
-  if (password) {
-    const pwCheck = validatePassword(password);
-    if (!pwCheck.ok) return res.status(400).json({ error: pwCheck.reason });
-  }
-  const passwordHash = password ? bcrypt.hashSync(password, 12) : null;
-
-  db.prepare(`
-    UPDATE users SET
-      username = COALESCE(?, username),
-      email = COALESCE(?, email),
-      role = COALESCE(?, role),
-      password_hash = COALESCE(?, password_hash),
-      updated_at = CURRENT_TIMESTAMP
-    WHERE id = ?
-  `).run(username || null, email || null, role || null, passwordHash, req.params.id);
-
-  const updated = db.prepare(
-    'SELECT id, username, email, role, created_at, updated_at FROM users WHERE id = ?'
-  ).get(req.params.id);
-
+  const result = svc.updateUser(req.params.id, req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
-  const changed: string[] = [];
-  if (username) changed.push('username');
-  if (email) changed.push('email');
-  if (role) changed.push('role');
-  if (password) changed.push('password');
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.user_update',
     resource: String(req.params.id),
     ip: getClientIp(req),
-    details: { targetUser: user.email, fields: changed },
+    details: { targetUser: result.previousEmail, fields: result.changed },
   });
-  logInfo(`Admin ${authReq.user.email} edited user ${user.email} (fields: ${changed.join(', ')})`);
-  res.json({ user: updated });
+  logInfo(`Admin ${authReq.user.email} edited user ${result.previousEmail} (fields: ${result.changed.join(', ')})`);
+  res.json({ user: result.user });
 });
 
 router.delete('/users/:id', (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
-  if (parseInt(req.params.id as string) === authReq.user.id) {
-    return res.status(400).json({ error: 'Cannot delete own account' });
-  }
-
-  const userToDel = db.prepare('SELECT id, email FROM users WHERE id = ?').get(req.params.id) as { id: number; email: string } | undefined;
-  if (!userToDel) return res.status(404).json({ error: 'User not found' });
-
-  db.prepare('DELETE FROM users WHERE id = ?').run(req.params.id);
+  const result = svc.deleteUser(req.params.id, authReq.user.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.user_delete',
     resource: String(req.params.id),
     ip: getClientIp(req),
-    details: { targetUser: userToDel.email },
+    details: { targetUser: result.email },
   });
-  logInfo(`Admin ${authReq.user.email} deleted user ${userToDel.email}`);
+  logInfo(`Admin ${authReq.user.email} deleted user ${result.email}`);
   res.json({ success: true });
 });
 
-router.get('/stats', (_req: Request, res: Response) => {
-  const totalUsers = (db.prepare('SELECT COUNT(*) as count FROM users').get() as { count: number }).count;
-  const totalTrips = (db.prepare('SELECT COUNT(*) as count FROM trips').get() as { count: number }).count;
-  const totalPlaces = (db.prepare('SELECT COUNT(*) as count FROM places').get() as { count: number }).count;
-  const totalFiles = (db.prepare('SELECT COUNT(*) as count FROM trip_files').get() as { count: number }).count;
+// ── Stats ──────────────────────────────────────────────────────────────────
 
-  res.json({ totalUsers, totalTrips, totalPlaces, totalFiles });
+router.get('/stats', (_req: Request, res: Response) => {
+  res.json(svc.getStats());
 });
 
-// Permissions management
+// ── Permissions ────────────────────────────────────────────────────────────
+
 router.get('/permissions', (_req: Request, res: Response) => {
-  const current = getAllPermissions();
-  const actions = PERMISSION_ACTIONS.map(a => ({
-    key: a.key,
-    level: current[a.key],
-    defaultLevel: a.defaultLevel,
-    allowedLevels: a.allowedLevels,
-  }));
-  res.json({ permissions: actions });
+  res.json(svc.getPermissions());
 });
 
 router.put('/permissions', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
   const { permissions } = req.body;
   if (!permissions || typeof permissions !== 'object') {
     return res.status(400).json({ error: 'permissions object required' });
   }
-  const { skipped } = savePermissions(permissions);
+  const authReq = req as AuthRequest;
+  const result = svc.savePermissions(permissions);
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.permissions_update',
@@ -194,198 +84,76 @@ router.put('/permissions', (req: Request, res: Response) => {
     ip: getClientIp(req),
     details: permissions,
   });
-  res.json({ success: true, permissions: getAllPermissions(), ...(skipped.length ? { skipped } : {}) });
+  res.json({ success: true, permissions: result.permissions, ...(result.skipped.length ? { skipped: result.skipped } : {}) });
 });
 
+// ── Audit Log ──────────────────────────────────────────────────────────────
+
 router.get('/audit-log', (req: Request, res: Response) => {
-  const limitRaw = parseInt(String(req.query.limit || '100'), 10);
-  const offsetRaw = parseInt(String(req.query.offset || '0'), 10);
-  const limit = Math.min(Math.max(Number.isFinite(limitRaw) ? limitRaw : 100, 1), 500);
-  const offset = Math.max(Number.isFinite(offsetRaw) ? offsetRaw : 0, 0);
-  type Row = {
-    id: number;
-    created_at: string;
-    user_id: number | null;
-    username: string | null;
-    user_email: string | null;
-    action: string;
-    resource: string | null;
-    details: string | null;
-    ip: string | null;
-  };
-  const rows = db.prepare(`
-    SELECT a.id, a.created_at, a.user_id, u.username, u.email as user_email, a.action, a.resource, a.details, a.ip
-    FROM audit_log a
-    LEFT JOIN users u ON u.id = a.user_id
-    ORDER BY a.id DESC
-    LIMIT ? OFFSET ?
-  `).all(limit, offset) as Row[];
-  const total = (db.prepare('SELECT COUNT(*) as c FROM audit_log').get() as { c: number }).c;
-  res.json({
-    entries: rows.map((r) => {
-      let details: Record<string, unknown> | null = null;
-      if (r.details) {
-        try {
-          details = JSON.parse(r.details) as Record<string, unknown>;
-        } catch {
-          details = { _parse_error: true };
-        }
-      }
-      const created_at = r.created_at && !r.created_at.endsWith('Z') ? r.created_at.replace(' ', 'T') + 'Z' : r.created_at;
-      return { ...r, created_at, details };
-    }),
-    total,
-    limit,
-    offset,
-  });
+  res.json(svc.getAuditLog(req.query as { limit?: string; offset?: string }));
 });
 
+// ── OIDC Settings ──────────────────────────────────────────────────────────
+
 router.get('/oidc', (_req: Request, res: Response) => {
-  const get = (key: string) => (db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key) as { value: string } | undefined)?.value || '';
-  const secret = decrypt_api_key(get('oidc_client_secret'));
-  res.json({
-    issuer: get('oidc_issuer'),
-    client_id: get('oidc_client_id'),
-    client_secret_set: !!secret,
-    display_name: get('oidc_display_name'),
-    oidc_only: get('oidc_only') === 'true',
-    discovery_url: get('oidc_discovery_url'),
-  });
+  res.json(svc.getOidcSettings());
 });
 
 router.put('/oidc', (req: Request, res: Response) => {
-  const { issuer, client_id, client_secret, display_name, oidc_only, discovery_url } = req.body;
-  const set = (key: string, val: string) => db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES (?, ?)").run(key, val || '');
-  set('oidc_issuer', issuer);
-  set('oidc_client_id', client_id);
-  if (client_secret !== undefined) set('oidc_client_secret', maybe_encrypt_api_key(client_secret) ?? '');
-  set('oidc_display_name', display_name);
-  set('oidc_only', oidc_only ? 'true' : 'false');
-  set('oidc_discovery_url', discovery_url);
+  svc.updateOidcSettings(req.body);
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.oidc_update',
     ip: getClientIp(req),
-    details: { oidc_only: !!oidc_only, issuer_set: !!issuer },
+    details: { oidc_only: !!req.body.oidc_only, issuer_set: !!req.body.issuer },
   });
   res.json({ success: true });
 });
 
+// ── Demo Baseline ──────────────────────────────────────────────────────────
+
 router.post('/save-demo-baseline', (req: Request, res: Response) => {
-  if (process.env.DEMO_MODE !== 'true') {
-    return res.status(404).json({ error: 'Not found' });
-  }
-  try {
-    const { saveBaseline } = require('../demo/demo-reset');
-    saveBaseline();
-    const authReq = req as AuthRequest;
-    writeAudit({ userId: authReq.user.id, action: 'admin.demo_baseline_save', ip: getClientIp(req) });
-    res.json({ success: true, message: 'Demo baseline saved. Hourly resets will restore to this state.' });
-  } catch (err: unknown) {
-    console.error(err);
-    res.status(500).json({ error: 'Failed to save baseline' });
-  }
+  const result = svc.saveDemoBaseline();
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  const authReq = req as AuthRequest;
+  writeAudit({ userId: authReq.user.id, action: 'admin.demo_baseline_save', ip: getClientIp(req) });
+  res.json({ success: true, message: result.message });
 });
 
-const isDocker = (() => {
-  try {
-    return fs.existsSync('/.dockerenv') || (fs.existsSync('/proc/1/cgroup') && fs.readFileSync('/proc/1/cgroup', 'utf8').includes('docker'));
-  } catch { return false }
-})();
-
-function compareVersions(a: string, b: string): number {
-  const pa = a.split('.').map(Number);
-  const pb = b.split('.').map(Number);
-  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-    const na = pa[i] || 0, nb = pb[i] || 0;
-    if (na > nb) return 1;
-    if (na < nb) return -1;
-  }
-  return 0;
-}
+// ── GitHub / Version ───────────────────────────────────────────────────────
 
 router.get('/github-releases', async (req: Request, res: Response) => {
   const { per_page = '10', page = '1' } = req.query;
-  try {
-    const resp = await fetch(
-      `https://api.github.com/repos/mauriceboe/TREK/releases?per_page=${per_page}&page=${page}`,
-      { headers: { 'Accept': 'application/vnd.github.v3+json', 'User-Agent': 'TREK-Server' } }
-    );
-    if (!resp.ok) return res.json([]);
-    const data = await resp.json();
-    res.json(Array.isArray(data) ? data : []);
-  } catch {
-    res.json([]);
-  }
+  res.json(await svc.getGithubReleases(String(per_page), String(page)));
 });
 
 router.get('/version-check', async (_req: Request, res: Response) => {
-  const { version: currentVersion } = require('../../package.json');
-  try {
-    const resp = await fetch(
-      'https://api.github.com/repos/mauriceboe/TREK/releases/latest',
-      { headers: { 'Accept': 'application/vnd.github.v3+json', 'User-Agent': 'TREK-Server' } }
-    );
-    if (!resp.ok) return res.json({ current: currentVersion, latest: currentVersion, update_available: false });
-    const data = await resp.json() as { tag_name?: string; html_url?: string };
-    const latest = (data.tag_name || '').replace(/^v/, '');
-    const update_available = latest && latest !== currentVersion && compareVersions(latest, currentVersion) > 0;
-    res.json({ current: currentVersion, latest, update_available, release_url: data.html_url || '', is_docker: isDocker });
-  } catch {
-    res.json({ current: currentVersion, latest: currentVersion, update_available: false, is_docker: isDocker });
-  }
+  res.json(await svc.checkVersion());
 });
 
-// ── Invite Tokens ───────────────────────────────────────────────────────────
+// ── Invite Tokens ──────────────────────────────────────────────────────────
 
 router.get('/invites', (_req: Request, res: Response) => {
-  const invites = db.prepare(`
-    SELECT i.*, u.username as created_by_name
-    FROM invite_tokens i
-    JOIN users u ON i.created_by = u.id
-    ORDER BY i.created_at DESC
-  `).all();
-  res.json({ invites });
+  res.json({ invites: svc.listInvites() });
 });
 
 router.post('/invites', (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
-  const { max_uses, expires_in_days } = req.body;
-
-  const rawUses = parseInt(max_uses);
-  const uses = rawUses === 0 ? 0 : Math.min(Math.max(rawUses || 1, 1), 5);
-  const token = crypto.randomBytes(16).toString('hex');
-  const expiresAt = expires_in_days
-    ? new Date(Date.now() + parseInt(expires_in_days) * 86400000).toISOString()
-    : null;
-
-  const ins = db.prepare(
-    'INSERT INTO invite_tokens (token, max_uses, expires_at, created_by) VALUES (?, ?, ?, ?)'
-  ).run(token, uses, expiresAt, authReq.user.id);
-
-  const inviteId = Number(ins.lastInsertRowid);
-  const invite = db.prepare(`
-    SELECT i.*, u.username as created_by_name
-    FROM invite_tokens i
-    JOIN users u ON i.created_by = u.id
-    WHERE i.id = ?
-  `).get(inviteId);
-
+  const result = svc.createInvite(authReq.user.id, req.body);
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.invite_create',
-    resource: String(inviteId),
+    resource: String(result.inviteId),
     ip: getClientIp(req),
-    details: { max_uses: uses, expires_in_days: expires_in_days ?? null },
+    details: { max_uses: result.uses, expires_in_days: result.expiresInDays },
   });
-  res.status(201).json({ invite });
+  res.status(201).json({ invite: result.invite });
 });
 
 router.delete('/invites/:id', (req: Request, res: Response) => {
-  const invite = db.prepare('SELECT id FROM invite_tokens WHERE id = ?').get(req.params.id);
-  if (!invite) return res.status(404).json({ error: 'Invite not found' });
-  db.prepare('DELETE FROM invite_tokens WHERE id = ?').run(req.params.id);
+  const result = svc.deleteInvite(req.params.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,
@@ -396,190 +164,141 @@ router.delete('/invites/:id', (req: Request, res: Response) => {
   res.json({ success: true });
 });
 
-// ── Bag Tracking Setting ────────────────────────────────────────────────────
+// ── Bag Tracking ───────────────────────────────────────────────────────────
 
 router.get('/bag-tracking', (_req: Request, res: Response) => {
-  const row = db.prepare("SELECT value FROM app_settings WHERE key = 'bag_tracking_enabled'").get() as { value: string } | undefined;
-  res.json({ enabled: row?.value === 'true' });
+  res.json(svc.getBagTracking());
 });
 
 router.put('/bag-tracking', (req: Request, res: Response) => {
-  const { enabled } = req.body;
-  db.prepare("INSERT OR REPLACE INTO app_settings (key, value) VALUES ('bag_tracking_enabled', ?)").run(enabled ? 'true' : 'false');
+  const result = svc.updateBagTracking(req.body.enabled);
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.bag_tracking',
     ip: getClientIp(req),
-    details: { enabled: !!enabled },
+    details: { enabled: result.enabled },
   });
-  res.json({ enabled: !!enabled });
+  res.json(result);
 });
 
-// ── Packing Templates ───────────────────────────────────────────────────────
+// ── Packing Templates ──────────────────────────────────────────────────────
 
 router.get('/packing-templates', (_req: Request, res: Response) => {
-  const templates = db.prepare(`
-    SELECT pt.*, u.username as created_by_name,
-      (SELECT COUNT(*) FROM packing_template_items ti JOIN packing_template_categories tc ON ti.category_id = tc.id WHERE tc.template_id = pt.id) as item_count,
-      (SELECT COUNT(*) FROM packing_template_categories WHERE template_id = pt.id) as category_count
-    FROM packing_templates pt
-    JOIN users u ON pt.created_by = u.id
-    ORDER BY pt.created_at DESC
-  `).all();
-  res.json({ templates });
+  res.json({ templates: svc.listPackingTemplates() });
 });
 
-router.get('/packing-templates/:id', (_req: Request, res: Response) => {
-  const template = db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(_req.params.id);
-  if (!template) return res.status(404).json({ error: 'Template not found' });
-  const categories = db.prepare('SELECT * FROM packing_template_categories WHERE template_id = ? ORDER BY sort_order, id').all(_req.params.id) as any[];
-  const items = db.prepare(`
-    SELECT ti.* FROM packing_template_items ti
-    JOIN packing_template_categories tc ON ti.category_id = tc.id
-    WHERE tc.template_id = ? ORDER BY ti.sort_order, ti.id
-  `).all(_req.params.id);
-  res.json({ template, categories, items });
+router.get('/packing-templates/:id', (req: Request, res: Response) => {
+  const result = svc.getPackingTemplate(req.params.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.json(result);
 });
 
 router.post('/packing-templates', (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
-  const { name } = req.body;
-  if (!name?.trim()) return res.status(400).json({ error: 'Name is required' });
-  const result = db.prepare('INSERT INTO packing_templates (name, created_by) VALUES (?, ?)').run(name.trim(), authReq.user.id);
-  const template = db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(result.lastInsertRowid);
-  res.status(201).json({ template });
+  const result = svc.createPackingTemplate(req.body.name, authReq.user.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.status(201).json(result);
 });
 
 router.put('/packing-templates/:id', (req: Request, res: Response) => {
-  const { name } = req.body;
-  const template = db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(req.params.id);
-  if (!template) return res.status(404).json({ error: 'Template not found' });
-  if (name?.trim()) db.prepare('UPDATE packing_templates SET name = ? WHERE id = ?').run(name.trim(), req.params.id);
-  res.json({ template: db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(req.params.id) });
+  const result = svc.updatePackingTemplate(req.params.id, req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.json(result);
 });
 
 router.delete('/packing-templates/:id', (req: Request, res: Response) => {
-  const template = db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(req.params.id);
-  if (!template) return res.status(404).json({ error: 'Template not found' });
-  db.prepare('DELETE FROM packing_templates WHERE id = ?').run(req.params.id);
+  const result = svc.deletePackingTemplate(req.params.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
-  const t = template as { name?: string };
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.packing_template_delete',
     resource: String(req.params.id),
     ip: getClientIp(req),
-    details: { name: t.name },
+    details: { name: result.name },
   });
   res.json({ success: true });
 });
 
 // Template categories
+
 router.post('/packing-templates/:id/categories', (req: Request, res: Response) => {
-  const { name } = req.body;
-  if (!name?.trim()) return res.status(400).json({ error: 'Category name is required' });
-  const template = db.prepare('SELECT * FROM packing_templates WHERE id = ?').get(req.params.id);
-  if (!template) return res.status(404).json({ error: 'Template not found' });
-  const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM packing_template_categories WHERE template_id = ?').get(req.params.id) as { max: number | null };
-  const result = db.prepare('INSERT INTO packing_template_categories (template_id, name, sort_order) VALUES (?, ?, ?)').run(req.params.id, name.trim(), (maxOrder.max ?? -1) + 1);
-  res.status(201).json({ category: db.prepare('SELECT * FROM packing_template_categories WHERE id = ?').get(result.lastInsertRowid) });
+  const result = svc.createTemplateCategory(req.params.id, req.body.name);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.status(201).json(result);
 });
 
 router.put('/packing-templates/:templateId/categories/:catId', (req: Request, res: Response) => {
-  const { name } = req.body;
-  const cat = db.prepare('SELECT * FROM packing_template_categories WHERE id = ? AND template_id = ?').get(req.params.catId, req.params.templateId);
-  if (!cat) return res.status(404).json({ error: 'Category not found' });
-  if (name?.trim()) db.prepare('UPDATE packing_template_categories SET name = ? WHERE id = ?').run(name.trim(), req.params.catId);
-  res.json({ category: db.prepare('SELECT * FROM packing_template_categories WHERE id = ?').get(req.params.catId) });
+  const result = svc.updateTemplateCategory(req.params.templateId, req.params.catId, req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.json(result);
 });
 
-router.delete('/packing-templates/:templateId/categories/:catId', (_req: Request, res: Response) => {
-  const cat = db.prepare('SELECT * FROM packing_template_categories WHERE id = ? AND template_id = ?').get(_req.params.catId, _req.params.templateId);
-  if (!cat) return res.status(404).json({ error: 'Category not found' });
-  db.prepare('DELETE FROM packing_template_categories WHERE id = ?').run(_req.params.catId);
+router.delete('/packing-templates/:templateId/categories/:catId', (req: Request, res: Response) => {
+  const result = svc.deleteTemplateCategory(req.params.templateId, req.params.catId);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   res.json({ success: true });
 });
 
 // Template items
+
 router.post('/packing-templates/:templateId/categories/:catId/items', (req: Request, res: Response) => {
-  const { name } = req.body;
-  if (!name?.trim()) return res.status(400).json({ error: 'Item name is required' });
-  const cat = db.prepare('SELECT * FROM packing_template_categories WHERE id = ? AND template_id = ?').get(req.params.catId, req.params.templateId);
-  if (!cat) return res.status(404).json({ error: 'Category not found' });
-  const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM packing_template_items WHERE category_id = ?').get(req.params.catId) as { max: number | null };
-  const result = db.prepare('INSERT INTO packing_template_items (category_id, name, sort_order) VALUES (?, ?, ?)').run(req.params.catId, name.trim(), (maxOrder.max ?? -1) + 1);
-  res.status(201).json({ item: db.prepare('SELECT * FROM packing_template_items WHERE id = ?').get(result.lastInsertRowid) });
+  const result = svc.createTemplateItem(req.params.templateId, req.params.catId, req.body.name);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.status(201).json(result);
 });
 
 router.put('/packing-templates/:templateId/items/:itemId', (req: Request, res: Response) => {
-  const { name } = req.body;
-  const item = db.prepare('SELECT * FROM packing_template_items WHERE id = ?').get(req.params.itemId);
-  if (!item) return res.status(404).json({ error: 'Item not found' });
-  if (name?.trim()) db.prepare('UPDATE packing_template_items SET name = ? WHERE id = ?').run(name.trim(), req.params.itemId);
-  res.json({ item: db.prepare('SELECT * FROM packing_template_items WHERE id = ?').get(req.params.itemId) });
+  const result = svc.updateTemplateItem(req.params.itemId, req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  res.json(result);
 });
 
-router.delete('/packing-templates/:templateId/items/:itemId', (_req: Request, res: Response) => {
-  const item = db.prepare('SELECT * FROM packing_template_items WHERE id = ?').get(_req.params.itemId);
-  if (!item) return res.status(404).json({ error: 'Item not found' });
-  db.prepare('DELETE FROM packing_template_items WHERE id = ?').run(_req.params.itemId);
+router.delete('/packing-templates/:templateId/items/:itemId', (req: Request, res: Response) => {
+  const result = svc.deleteTemplateItem(req.params.itemId);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   res.json({ success: true });
 });
 
+// ── Addons ─────────────────────────────────────────────────────────────────
+
 router.get('/addons', (_req: Request, res: Response) => {
-  const addons = db.prepare('SELECT * FROM addons ORDER BY sort_order, id').all() as Addon[];
-  res.json({ addons: addons.map(a => ({ ...a, enabled: !!a.enabled, config: JSON.parse(a.config || '{}') })) });
+  res.json({ addons: svc.listAddons() });
 });
 
 router.put('/addons/:id', (req: Request, res: Response) => {
-  const addon = db.prepare('SELECT * FROM addons WHERE id = ?').get(req.params.id);
-  if (!addon) return res.status(404).json({ error: 'Addon not found' });
-  const { enabled, config } = req.body;
-  if (enabled !== undefined) db.prepare('UPDATE addons SET enabled = ? WHERE id = ?').run(enabled ? 1 : 0, req.params.id);
-  if (config !== undefined) db.prepare('UPDATE addons SET config = ? WHERE id = ?').run(JSON.stringify(config), req.params.id);
-  const updated = db.prepare('SELECT * FROM addons WHERE id = ?').get(req.params.id) as Addon;
+  const result = svc.updateAddon(req.params.id, req.body);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.addon_update',
     resource: String(req.params.id),
     ip: getClientIp(req),
-    details: { enabled: enabled !== undefined ? !!enabled : undefined, config_changed: config !== undefined },
+    details: result.auditDetails,
   });
-  res.json({ addon: { ...updated, enabled: !!updated.enabled, config: JSON.parse(updated.config || '{}') } });
+  res.json({ addon: result.addon });
 });
 
-router.get('/mcp-tokens', (req: Request, res: Response) => {
-  const tokens = db.prepare(`
-    SELECT t.id, t.name, t.token_prefix, t.created_at, t.last_used_at, t.user_id, u.username
-    FROM mcp_tokens t
-    JOIN users u ON u.id = t.user_id
-    ORDER BY t.created_at DESC
-  `).all();
-  res.json({ tokens });
+// ── MCP Tokens ─────────────────────────────────────────────────────────────
+
+router.get('/mcp-tokens', (_req: Request, res: Response) => {
+  res.json({ tokens: svc.listMcpTokens() });
 });
 
 router.delete('/mcp-tokens/:id', (req: Request, res: Response) => {
-  const token = db.prepare('SELECT id, user_id FROM mcp_tokens WHERE id = ?').get(req.params.id) as { id: number; user_id: number } | undefined;
-  if (!token) return res.status(404).json({ error: 'Token not found' });
-  db.prepare('DELETE FROM mcp_tokens WHERE id = ?').run(req.params.id);
-  revokeUserSessions(token.user_id);
+  const result = svc.deleteMcpToken(req.params.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
   res.json({ success: true });
 });
 
+// ── JWT Rotation ───────────────────────────────────────────────────────────
+
 router.post('/rotate-jwt-secret', (req: Request, res: Response) => {
+  const result = svc.rotateJwtSecret();
+  if (result.error) return res.status(result.status!).json({ error: result.error });
   const authReq = req as AuthRequest;
-  const newSecret = crypto.randomBytes(32).toString('hex');
-  const dataDir = path.resolve(__dirname, '../../data');
-  const secretFile = path.join(dataDir, '.jwt_secret');
-  try {
-    if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });
-    fs.writeFileSync(secretFile, newSecret, { mode: 0o600 });
-  } catch (err: unknown) {
-    return res.status(500).json({ error: 'Failed to persist new JWT secret to disk' });
-  }
-  updateJwtSecret(newSecret);
   writeAudit({
     user_id: authReq.user?.id ?? null,
     username: authReq.user?.username ?? 'unknown',
@@ -592,4 +311,44 @@ router.post('/rotate-jwt-secret', (req: Request, res: Response) => {
   res.json({ success: true });
 });
 
+// ── Dev-only: test notification endpoints ──────────────────────────────────────
+if (process.env.NODE_ENV === 'development') {
+  const { createNotification } = require('../services/inAppNotifications');
+
+  router.post('/dev/test-notification', (req: Request, res: Response) => {
+    const authReq = req as AuthRequest;
+    const { type, scope, target, title_key, text_key, title_params, text_params,
+            positive_text_key, negative_text_key, positive_callback, negative_callback,
+            navigate_text_key, navigate_target } = req.body;
+
+    const input: Record<string, unknown> = {
+      type: type || 'simple',
+      scope: scope || 'user',
+      target: target ?? authReq.user.id,
+      sender_id: authReq.user.id,
+      title_key: title_key || 'notifications.test.title',
+      title_params: title_params || {},
+      text_key: text_key || 'notifications.test.text',
+      text_params: text_params || {},
+    };
+
+    if (type === 'boolean') {
+      input.positive_text_key = positive_text_key || 'notifications.test.accept';
+      input.negative_text_key = negative_text_key || 'notifications.test.decline';
+      input.positive_callback = positive_callback || { action: 'test_approve', payload: {} };
+      input.negative_callback = negative_callback || { action: 'test_deny', payload: {} };
+    } else if (type === 'navigate') {
+      input.navigate_text_key = navigate_text_key || 'notifications.test.goThere';
+      input.navigate_target = navigate_target || '/dashboard';
+    }
+
+    try {
+      const ids = createNotification(input);
+      res.json({ success: true, notification_ids: ids });
+    } catch (err: any) {
+      res.status(400).json({ error: err.message });
+    }
+  });
+}
+
 export default router;

server/src/routes/assignments.ts

@@ -1,112 +1,33 @@
 import express, { Request, Response } from 'express';
-import { db } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { requireTripAccess } from '../middleware/tripAccess';
 import { broadcast } from '../websocket';
-import { loadTagsByPlaceIds, loadParticipantsByAssignmentIds, formatAssignmentWithPlace } from '../services/queryHelpers';
 import { checkPermission } from '../services/permissions';
-import { AuthRequest, AssignmentRow, DayAssignment, Tag, Participant } from '../types';
+import {
+  getAssignmentWithPlace,
+  listDayAssignments,
+  dayExists,
+  placeExists,
+  createAssignment,
+  assignmentExistsInDay,
+  deleteAssignment,
+  reorderAssignments,
+  getAssignmentForTrip,
+  moveAssignment,
+  getParticipants,
+  updateTime,
+  setParticipants,
+} from '../services/assignmentService';
+import { AuthRequest } from '../types';
 
 const router = express.Router({ mergeParams: true });
 
-function getAssignmentWithPlace(assignmentId: number | bigint) {
-  const a = db.prepare(`
-    SELECT da.*, p.id as place_id, p.name as place_name, p.description as place_description,
-      p.lat, p.lng, p.address, p.category_id, p.price, p.currency as place_currency,
-      COALESCE(da.assignment_time, p.place_time) as place_time,
-      COALESCE(da.assignment_end_time, p.end_time) as end_time,
-      p.duration_minutes, p.notes as place_notes,
-      p.image_url, p.transport_mode, p.google_place_id, p.website, p.phone,
-      c.name as category_name, c.color as category_color, c.icon as category_icon
-    FROM day_assignments da
-    JOIN places p ON da.place_id = p.id
-    LEFT JOIN categories c ON p.category_id = c.id
-    WHERE da.id = ?
-  `).get(assignmentId) as AssignmentRow | undefined;
-
-  if (!a) return null;
-
-  const tags = db.prepare(`
-    SELECT t.* FROM tags t
-    JOIN place_tags pt ON t.id = pt.tag_id
-    WHERE pt.place_id = ?
-  `).all(a.place_id);
-
-  const participants = db.prepare(`
-    SELECT ap.user_id, u.username, u.avatar
-    FROM assignment_participants ap
-    JOIN users u ON ap.user_id = u.id
-    WHERE ap.assignment_id = ?
-  `).all(a.id);
-
-  return {
-    id: a.id,
-    day_id: a.day_id,
-    order_index: a.order_index,
-    notes: a.notes,
-    participants,
-    created_at: a.created_at,
-    place: {
-      id: a.place_id,
-      name: a.place_name,
-      description: a.place_description,
-      lat: a.lat,
-      lng: a.lng,
-      address: a.address,
-      category_id: a.category_id,
-      price: a.price,
-      currency: a.place_currency,
-      place_time: a.place_time,
-      end_time: a.end_time,
-      duration_minutes: a.duration_minutes,
-      notes: a.place_notes,
-      image_url: a.image_url,
-      transport_mode: a.transport_mode,
-      google_place_id: a.google_place_id,
-      website: a.website,
-      phone: a.phone,
-      category: a.category_id ? {
-        id: a.category_id,
-        name: a.category_name,
-        color: a.category_color,
-        icon: a.category_icon,
-      } : null,
-      tags,
-    }
-  };
-}
-
 router.get('/trips/:tripId/days/:dayId/assignments', authenticate, requireTripAccess, (req: Request, res: Response) => {
   const { tripId, dayId } = req.params;
 
-  const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-  if (!day) return res.status(404).json({ error: 'Day not found' });
-
-  const assignments = db.prepare(`
-    SELECT da.*, p.id as place_id, p.name as place_name, p.description as place_description,
-      p.lat, p.lng, p.address, p.category_id, p.price, p.currency as place_currency,
-      COALESCE(da.assignment_time, p.place_time) as place_time,
-      COALESCE(da.assignment_end_time, p.end_time) as end_time,
-      p.duration_minutes, p.notes as place_notes,
-      p.image_url, p.transport_mode, p.google_place_id, p.website, p.phone,
-      c.name as category_name, c.color as category_color, c.icon as category_icon
-    FROM day_assignments da
-    JOIN places p ON da.place_id = p.id
-    LEFT JOIN categories c ON p.category_id = c.id
-    WHERE da.day_id = ?
-    ORDER BY da.order_index ASC, da.created_at ASC
-  `).all(dayId) as AssignmentRow[];
-
-  const placeIds = [...new Set(assignments.map(a => a.place_id))];
-  const tagsByPlaceId = loadTagsByPlaceIds(placeIds, { compact: true });
-
-  const assignmentIds = assignments.map(a => a.id);
-  const participantsByAssignment = loadParticipantsByAssignmentIds(assignmentIds);
-
-  const result = assignments.map(a => {
-    return formatAssignmentWithPlace(a, tagsByPlaceId[a.place_id] || [], participantsByAssignment[a.id] || []);
-  });
+  if (!dayExists(dayId, tripId)) return res.status(404).json({ error: 'Day not found' });
 
+  const result = listDayAssignments(dayId);
   res.json({ assignments: result });
 });
 
@@ -118,20 +39,10 @@ router.post('/trips/:tripId/days/:dayId/assignments', authenticate, requireTripA
   const { tripId, dayId } = req.params;
   const { place_id, notes } = req.body;
 
-  const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-  if (!day) return res.status(404).json({ error: 'Day not found' });
+  if (!dayExists(dayId, tripId)) return res.status(404).json({ error: 'Day not found' });
+  if (!placeExists(place_id, tripId)) return res.status(404).json({ error: 'Place not found' });
 
-  const place = db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId);
-  if (!place) return res.status(404).json({ error: 'Place not found' });
-
-  const maxOrder = db.prepare('SELECT MAX(order_index) as max FROM day_assignments WHERE day_id = ?').get(dayId) as { max: number | null };
-  const orderIndex = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
-
-  const result = db.prepare(
-    'INSERT INTO day_assignments (day_id, place_id, order_index, notes) VALUES (?, ?, ?, ?)'
-  ).run(dayId, place_id, orderIndex, notes || null);
-
-  const assignment = getAssignmentWithPlace(result.lastInsertRowid);
+  const assignment = createAssignment(dayId, place_id, notes);
   res.status(201).json({ assignment });
   broadcast(tripId, 'assignment:created', { assignment }, req.headers['x-socket-id'] as string);
 });
@@ -143,13 +54,9 @@ router.delete('/trips/:tripId/days/:dayId/assignments/:id', authenticate, requir
 
   const { tripId, dayId, id } = req.params;
 
-  const assignment = db.prepare(
-    'SELECT da.id FROM day_assignments da JOIN days d ON da.day_id = d.id WHERE da.id = ? AND da.day_id = ? AND d.trip_id = ?'
-  ).get(id, dayId, tripId);
+  if (!assignmentExistsInDay(id, dayId, tripId)) return res.status(404).json({ error: 'Assignment not found' });
 
-  if (!assignment) return res.status(404).json({ error: 'Assignment not found' });
-
-  db.prepare('DELETE FROM day_assignments WHERE id = ?').run(id);
+  deleteAssignment(id);
   res.json({ success: true });
   broadcast(tripId, 'assignment:deleted', { assignmentId: Number(id), dayId: Number(dayId) }, req.headers['x-socket-id'] as string);
 });
@@ -162,20 +69,9 @@ router.put('/trips/:tripId/days/:dayId/assignments/reorder', authenticate, requi
   const { tripId, dayId } = req.params;
   const { orderedIds } = req.body;
 
-  const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-  if (!day) return res.status(404).json({ error: 'Day not found' });
+  if (!dayExists(dayId, tripId)) return res.status(404).json({ error: 'Day not found' });
 
-  const update = db.prepare('UPDATE day_assignments SET order_index = ? WHERE id = ? AND day_id = ?');
-  db.exec('BEGIN');
-  try {
-    orderedIds.forEach((id: number, index: number) => {
-      update.run(index, id, dayId);
-    });
-    db.exec('COMMIT');
-  } catch (e) {
-    db.exec('ROLLBACK');
-    throw e;
-  }
+  reorderAssignments(dayId, orderedIds);
   res.json({ success: true });
   broadcast(tripId, 'assignment:reordered', { dayId: Number(dayId), orderedIds }, req.headers['x-socket-id'] as string);
 });
@@ -188,35 +84,21 @@ router.put('/trips/:tripId/assignments/:id/move', authenticate, requireTripAcces
   const { tripId, id } = req.params;
   const { new_day_id, order_index } = req.body;
 
-  const assignment = db.prepare(`
-    SELECT da.* FROM day_assignments da
-    JOIN days d ON da.day_id = d.id
-    WHERE da.id = ? AND d.trip_id = ?
-  `).get(id, tripId) as DayAssignment | undefined;
+  const existing = getAssignmentForTrip(id, tripId);
+  if (!existing) return res.status(404).json({ error: 'Assignment not found' });
 
-  if (!assignment) return res.status(404).json({ error: 'Assignment not found' });
+  if (!dayExists(new_day_id, tripId)) return res.status(404).json({ error: 'Target day not found' });
 
-  const newDay = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(new_day_id, tripId);
-  if (!newDay) return res.status(404).json({ error: 'Target day not found' });
-
-  const oldDayId = assignment.day_id;
-  db.prepare('UPDATE day_assignments SET day_id = ?, order_index = ? WHERE id = ?').run(new_day_id, order_index || 0, id);
-
-  const updated = getAssignmentWithPlace(Number(id));
+  const oldDayId = existing.day_id;
+  const { assignment: updated } = moveAssignment(id, new_day_id, order_index, oldDayId);
   res.json({ assignment: updated });
   broadcast(tripId, 'assignment:moved', { assignment: updated, oldDayId: Number(oldDayId), newDayId: Number(new_day_id) }, req.headers['x-socket-id'] as string);
 });
 
 router.get('/trips/:tripId/assignments/:id/participants', authenticate, requireTripAccess, (req: Request, res: Response) => {
-  const { tripId, id } = req.params;
-
-  const participants = db.prepare(`
-    SELECT ap.user_id, u.username, u.avatar
-    FROM assignment_participants ap
-    JOIN users u ON ap.user_id = u.id
-    WHERE ap.assignment_id = ?
-  `).all(id);
+  const { id } = req.params;
 
+  const participants = getParticipants(id);
   res.json({ participants });
 });
 
@@ -227,18 +109,11 @@ router.put('/trips/:tripId/assignments/:id/time', authenticate, requireTripAcces
 
   const { tripId, id } = req.params;
 
-  const assignment = db.prepare(`
-    SELECT da.* FROM day_assignments da
-    JOIN days d ON da.day_id = d.id
-    WHERE da.id = ? AND d.trip_id = ?
-  `).get(id, tripId);
-  if (!assignment) return res.status(404).json({ error: 'Assignment not found' });
+  const existing = getAssignmentForTrip(id, tripId);
+  if (!existing) return res.status(404).json({ error: 'Assignment not found' });
 
   const { place_time, end_time } = req.body;
-  db.prepare('UPDATE day_assignments SET assignment_time = ?, assignment_end_time = ? WHERE id = ?')
-    .run(place_time ?? null, end_time ?? null, id);
-
-  const updated = getAssignmentWithPlace(Number(id));
+  const updated = updateTime(id, place_time, end_time);
   res.json({ assignment: updated });
   broadcast(Number(tripId), 'assignment:updated', { assignment: updated }, req.headers['x-socket-id'] as string);
 });
@@ -249,23 +124,10 @@ router.put('/trips/:tripId/assignments/:id/participants', authenticate, requireT
     return res.status(403).json({ error: 'No permission' });
 
   const { tripId, id } = req.params;
-
   const { user_ids } = req.body;
   if (!Array.isArray(user_ids)) return res.status(400).json({ error: 'user_ids must be an array' });
 
-  db.prepare('DELETE FROM assignment_participants WHERE assignment_id = ?').run(id);
-  if (user_ids.length > 0) {
-    const insert = db.prepare('INSERT OR IGNORE INTO assignment_participants (assignment_id, user_id) VALUES (?, ?)');
-    for (const userId of user_ids) insert.run(id, userId);
-  }
-
-  const participants = db.prepare(`
-    SELECT ap.user_id, u.username, u.avatar
-    FROM assignment_participants ap
-    JOIN users u ON ap.user_id = u.id
-    WHERE ap.assignment_id = ?
-  `).all(id);
-
+  const participants = setParticipants(id, user_ids);
   res.json({ participants });
   broadcast(Number(tripId), 'assignment:participants', { assignmentId: Number(id), participants }, req.headers['x-socket-id'] as string);
 });

server/src/routes/atlas.ts

@@ -1,348 +1,71 @@
 import express, { Request, Response } from 'express';
-import fetch from 'node-fetch';
-import { db } from '../db/database';
 import { authenticate } from '../middleware/auth';
-import { AuthRequest, Trip, Place } from '../types';
+import { AuthRequest } from '../types';
+import {
+  getStats,
+  getCountryPlaces,
+  markCountryVisited,
+  unmarkCountryVisited,
+  listBucketList,
+  createBucketItem,
+  updateBucketItem,
+  deleteBucketItem,
+} from '../services/atlasService';
 
 const router = express.Router();
 router.use(authenticate);
 
-// Geocode cache: rounded coords -> country code
-const geocodeCache = new Map<string, string | null>();
-
-function roundKey(lat: number, lng: number): string {
-  return `${lat.toFixed(3)},${lng.toFixed(3)}`;
-}
-
-async function reverseGeocodeCountry(lat: number, lng: number): Promise<string | null> {
-  const key = roundKey(lat, lng);
-  if (geocodeCache.has(key)) return geocodeCache.get(key)!;
-  try {
-    const res = await fetch(`https://nominatim.openstreetmap.org/reverse?lat=${lat}&lon=${lng}&format=json&zoom=3&accept-language=en`, {
-      headers: { 'User-Agent': 'TREK Travel Planner' },
-    });
-    if (!res.ok) return null;
-    const data = await res.json() as { address?: { country_code?: string } };
-    const code = data.address?.country_code?.toUpperCase() || null;
-    geocodeCache.set(key, code);
-    return code;
-  } catch {
-    return null;
-  }
-}
-
-const COUNTRY_BOXES: Record<string, [number, number, number, number]> = {
-  AF:[60.5,29.4,75,38.5],AL:[19,39.6,21.1,42.7],DZ:[-8.7,19,12,37.1],AD:[1.4,42.4,1.8,42.7],AO:[11.7,-18.1,24.1,-4.4],
-  AR:[-73.6,-55.1,-53.6,-21.8],AM:[43.4,38.8,46.6,41.3],AU:[112.9,-43.6,153.6,-10.7],AT:[9.5,46.4,17.2,49],AZ:[44.8,38.4,50.4,41.9],
-  BD:[88.0,20.7,92.7,26.6],BR:[-73.9,-33.8,-34.8,5.3],BE:[2.5,49.5,6.4,51.5],BG:[22.4,41.2,28.6,44.2],CA:[-141,41.7,-52.6,83.1],CL:[-75.6,-55.9,-66.9,-17.5],
-  CN:[73.6,18.2,134.8,53.6],CO:[-79.1,-4.3,-66.9,12.5],HR:[13.5,42.4,19.5,46.6],CZ:[12.1,48.6,18.9,51.1],DK:[8,54.6,15.2,57.8],
-  EG:[24.7,22,37,31.7],EE:[21.8,57.5,28.2,59.7],FI:[20.6,59.8,31.6,70.1],FR:[-5.1,41.3,9.6,51.1],DE:[5.9,47.3,15.1,55.1],
-  GR:[19.4,34.8,29.7,41.8],HU:[16,45.7,22.9,48.6],IS:[-24.5,63.4,-13.5,66.6],IN:[68.2,6.7,97.4,35.5],ID:[95.3,-11,141,5.9],
-  IR:[44.1,25.1,63.3,39.8],IQ:[38.8,29.1,48.6,37.4],IE:[-10.5,51.4,-6,55.4],IL:[34.3,29.5,35.9,33.3],IT:[6.6,36.6,18.5,47.1],
-  JP:[129.4,31.1,145.5,45.5],KE:[33.9,-4.7,41.9,5.5],KR:[126,33.2,129.6,38.6],LV:[21,55.7,28.2,58.1],LT:[21,53.9,26.8,56.5],
-  LU:[5.7,49.4,6.5,50.2],MY:[99.6,0.9,119.3,7.4],MX:[-118.4,14.5,-86.7,32.7],MA:[-13.2,27.7,-1,35.9],NL:[3.4,50.8,7.2,53.5],
-  NZ:[166.4,-47.3,178.5,-34.4],NO:[4.6,58,31.1,71.2],PK:[60.9,23.7,77.1,37.1],PE:[-81.3,-18.4,-68.7,-0.1],PH:[117,5,126.6,18.5],
-  PL:[14.1,49,24.1,54.9],PT:[-9.5,36.8,-6.2,42.2],RO:[20.2,43.6,29.7,48.3],RU:[19.6,41.2,180,81.9],SA:[34.6,16.4,55.7,32.2],
-  RS:[18.8,42.2,23,46.2],SK:[16.8,47.7,22.6,49.6],SI:[13.4,45.4,16.6,46.9],ZA:[16.5,-34.8,32.9,-22.1],ES:[-9.4,36,-0.2,43.8],
-  SE:[11.1,55.3,24.2,69.1],CH:[6,45.8,10.5,47.8],TH:[97.3,5.6,105.6,20.5],TR:[26,36,44.8,42.1],UA:[22.1,44.4,40.2,52.4],
-  AE:[51.6,22.6,56.4,26.1],GB:[-8,49.9,2,60.9],US:[-125,24.5,-66.9,49.4],VN:[102.1,8.6,109.5,23.4],
-};
-
-function getCountryFromCoords(lat: number, lng: number): string | null {
-  let bestCode: string | null = null;
-  let bestArea = Infinity;
-  for (const [code, [minLng, minLat, maxLng, maxLat]] of Object.entries(COUNTRY_BOXES)) {
-    if (lat >= minLat && lat <= maxLat && lng >= minLng && lng <= maxLng) {
-      const area = (maxLng - minLng) * (maxLat - minLat);
-      if (area < bestArea) {
-        bestArea = area;
-        bestCode = code;
-      }
-    }
-  }
-  return bestCode;
-}
-
-const NAME_TO_CODE: Record<string, string> = {
-  'germany':'DE','deutschland':'DE','france':'FR','frankreich':'FR','spain':'ES','spanien':'ES',
-  'italy':'IT','italien':'IT','united kingdom':'GB','uk':'GB','england':'GB','united states':'US',
-  'usa':'US','netherlands':'NL','niederlande':'NL','austria':'AT','osterreich':'AT','switzerland':'CH',
-  'schweiz':'CH','portugal':'PT','greece':'GR','griechenland':'GR','turkey':'TR','turkei':'TR',
-  'croatia':'HR','kroatien':'HR','czech republic':'CZ','tschechien':'CZ','czechia':'CZ',
-  'poland':'PL','polen':'PL','sweden':'SE','schweden':'SE','norway':'NO','norwegen':'NO',
-  'denmark':'DK','danemark':'DK','finland':'FI','finnland':'FI','belgium':'BE','belgien':'BE',
-  'ireland':'IE','irland':'IE','hungary':'HU','ungarn':'HU','romania':'RO','rumanien':'RO',
-  'bulgaria':'BG','bulgarien':'BG','japan':'JP','china':'CN','australia':'AU','australien':'AU',
-  'canada':'CA','kanada':'CA','mexico':'MX','mexiko':'MX','brazil':'BR','brasilien':'BR',
-  'argentina':'AR','argentinien':'AR','thailand':'TH','indonesia':'ID','indonesien':'ID',
-  'india':'IN','indien':'IN','egypt':'EG','agypten':'EG','morocco':'MA','marokko':'MA',
-  'south africa':'ZA','sudafrika':'ZA','new zealand':'NZ','neuseeland':'NZ','iceland':'IS','island':'IS',
-  'luxembourg':'LU','luxemburg':'LU','slovenia':'SI','slowenien':'SI','slovakia':'SK','slowakei':'SK',
-  'estonia':'EE','estland':'EE','latvia':'LV','lettland':'LV','lithuania':'LT','litauen':'LT',
-  'serbia':'RS','serbien':'RS','israel':'IL','russia':'RU','russland':'RU','ukraine':'UA',
-  'vietnam':'VN','south korea':'KR','sudkorea':'KR','philippines':'PH','philippinen':'PH',
-  'malaysia':'MY','colombia':'CO','kolumbien':'CO','peru':'PE','chile':'CL','iran':'IR',
-  'iraq':'IQ','irak':'IQ','pakistan':'PK','kenya':'KE','kenia':'KE','nigeria':'NG',
-  'saudi arabia':'SA','saudi-arabien':'SA','albania':'AL','albanien':'AL',
-};
-
-function getCountryFromAddress(address: string | null): string | null {
-  if (!address) return null;
-  const parts = address.split(',').map(s => s.trim()).filter(Boolean);
-  if (parts.length === 0) return null;
-  const last = parts[parts.length - 1];
-  const normalized = last.toLowerCase();
-  if (NAME_TO_CODE[normalized]) return NAME_TO_CODE[normalized];
-  if (NAME_TO_CODE[last]) return NAME_TO_CODE[last];
-  if (last.length === 2 && last === last.toUpperCase()) return last;
-  return null;
-}
-
-const CONTINENT_MAP: Record<string, string> = {
-  AF:'Africa',AL:'Europe',DZ:'Africa',AD:'Europe',AO:'Africa',AR:'South America',AM:'Asia',AU:'Oceania',AT:'Europe',AZ:'Asia',
-  BR:'South America',BE:'Europe',BG:'Europe',CA:'North America',CL:'South America',CN:'Asia',CO:'South America',HR:'Europe',CZ:'Europe',DK:'Europe',
-  EG:'Africa',EE:'Europe',FI:'Europe',FR:'Europe',DE:'Europe',GR:'Europe',HU:'Europe',IS:'Europe',IN:'Asia',ID:'Asia',
-  IR:'Asia',IQ:'Asia',IE:'Europe',IL:'Asia',IT:'Europe',JP:'Asia',KE:'Africa',KR:'Asia',LV:'Europe',LT:'Europe',
-  LU:'Europe',MY:'Asia',MX:'North America',MA:'Africa',NL:'Europe',NZ:'Oceania',NO:'Europe',PK:'Asia',PE:'South America',PH:'Asia',
-  PL:'Europe',PT:'Europe',RO:'Europe',RU:'Europe',SA:'Asia',RS:'Europe',SK:'Europe',SI:'Europe',ZA:'Africa',ES:'Europe',
-  SE:'Europe',CH:'Europe',TH:'Asia',TR:'Europe',UA:'Europe',AE:'Asia',GB:'Europe',US:'North America',VN:'Asia',NG:'Africa',
-};
-
 router.get('/stats', async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const userId = authReq.user.id;
-
-  const trips = db.prepare(`
-    SELECT DISTINCT t.* FROM trips t
-    LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ?
-    WHERE t.user_id = ? OR m.user_id = ?
-    ORDER BY t.start_date DESC
-  `).all(userId, userId, userId) as Trip[];
-
-  const tripIds = trips.map(t => t.id);
-  if (tripIds.length === 0) {
-    // Still include manually marked countries even without trips
-    const manualCountries = db.prepare('SELECT country_code FROM visited_countries WHERE user_id = ?').all(userId) as { country_code: string }[];
-    const countries = manualCountries.map(mc => ({ code: mc.country_code, placeCount: 0, tripCount: 0, firstVisit: null, lastVisit: null }));
-    return res.json({ countries, trips: [], stats: { totalTrips: 0, totalPlaces: 0, totalCountries: countries.length, totalDays: 0 } });
-  }
-
-  const placeholders = tripIds.map(() => '?').join(',');
-  const places = db.prepare(`SELECT * FROM places WHERE trip_id IN (${placeholders})`).all(...tripIds) as Place[];
-
-  interface CountryEntry { code: string; places: { id: number; name: string; lat: number | null; lng: number | null }[]; tripIds: Set<number> }
-  const countrySet = new Map<string, CountryEntry>();
-  for (const place of places) {
-    let code = getCountryFromAddress(place.address);
-    if (!code && place.lat && place.lng) {
-      code = await reverseGeocodeCountry(place.lat, place.lng);
-    }
-    if (!code && place.lat && place.lng) {
-      code = getCountryFromCoords(place.lat, place.lng);
-    }
-    if (code) {
-      if (!countrySet.has(code)) {
-        countrySet.set(code, { code, places: [], tripIds: new Set() });
-      }
-      countrySet.get(code)!.places.push({ id: place.id, name: place.name, lat: place.lat, lng: place.lng });
-      countrySet.get(code)!.tripIds.add(place.trip_id);
-    }
-  }
-
-  let totalDays = 0;
-  for (const trip of trips) {
-    if (trip.start_date && trip.end_date) {
-      const start = new Date(trip.start_date);
-      const end = new Date(trip.end_date);
-      const diff = Math.ceil((end.getTime() - start.getTime()) / (1000 * 60 * 60 * 24)) + 1;
-      if (diff > 0) totalDays += diff;
-    }
-  }
-
-  const countries = [...countrySet.values()].map(c => {
-    const countryTrips = trips.filter(t => c.tripIds.has(t.id));
-    const dates = countryTrips.map(t => t.start_date).filter(Boolean).sort();
-    return {
-      code: c.code,
-      placeCount: c.places.length,
-      tripCount: c.tripIds.size,
-      firstVisit: dates[0] || null,
-      lastVisit: dates[dates.length - 1] || null,
-    };
-  });
-
-  const citySet = new Set<string>();
-  for (const place of places) {
-    if (place.address) {
-      const parts = place.address.split(',').map((s: string) => s.trim()).filter(Boolean);
-      let raw = parts.length >= 2 ? parts[parts.length - 2] : parts[0];
-      if (raw) {
-        const city = raw.replace(/[\d\-\u2212\u3012]+/g, '').trim().toLowerCase();
-        if (city) citySet.add(city);
-      }
-    }
-  }
-  const totalCities = citySet.size;
-
-  // Merge manually marked countries
-  const manualCountries = db.prepare('SELECT country_code FROM visited_countries WHERE user_id = ?').all(userId) as { country_code: string }[];
-  for (const mc of manualCountries) {
-    if (!countries.find(c => c.code === mc.country_code)) {
-      countries.push({ code: mc.country_code, placeCount: 0, tripCount: 0, firstVisit: null, lastVisit: null });
-    }
-  }
-
-  const mostVisited = countries.length > 0 ? countries.reduce((a, b) => a.placeCount > b.placeCount ? a : b) : null;
-
-  const continents: Record<string, number> = {};
-  countries.forEach(c => {
-    const cont = CONTINENT_MAP[c.code] || 'Other';
-    continents[cont] = (continents[cont] || 0) + 1;
-  });
-
-  const now = new Date().toISOString().split('T')[0];
-  const pastTrips = trips.filter(t => t.end_date && t.end_date <= now).sort((a, b) => b.end_date.localeCompare(a.end_date));
-  const lastTrip: { id: number; title: string; start_date?: string | null; end_date?: string | null; countryCode?: string } | null = pastTrips[0] ? { id: pastTrips[0].id, title: pastTrips[0].title, start_date: pastTrips[0].start_date, end_date: pastTrips[0].end_date } : null;
-  if (lastTrip) {
-    const lastTripPlaces = places.filter(p => p.trip_id === lastTrip.id);
-    for (const p of lastTripPlaces) {
-      let code = getCountryFromAddress(p.address);
-      if (!code && p.lat && p.lng) code = getCountryFromCoords(p.lat, p.lng);
-      if (code) { lastTrip.countryCode = code; break; }
-    }
-  }
-
-  const futureTrips = trips.filter(t => t.start_date && t.start_date > now).sort((a, b) => a.start_date.localeCompare(b.start_date));
-  const nextTrip: { id: number; title: string; start_date?: string | null; daysUntil?: number } | null = futureTrips[0] ? { id: futureTrips[0].id, title: futureTrips[0].title, start_date: futureTrips[0].start_date } : null;
-  if (nextTrip) {
-    const diff = Math.ceil((new Date(nextTrip.start_date).getTime() - new Date().getTime()) / (1000 * 60 * 60 * 24));
-    nextTrip.daysUntil = Math.max(0, diff);
-  }
-
-  const tripYears = new Set(trips.filter(t => t.start_date).map(t => parseInt(t.start_date.split('-')[0])));
-  let streak = 0;
-  const currentYear = new Date().getFullYear();
-  for (let y = currentYear; y >= 2000; y--) {
-    if (tripYears.has(y)) streak++;
-    else break;
-  }
-  const firstYear = tripYears.size > 0 ? Math.min(...tripYears) : null;
-
-  res.json({
-    countries,
-    stats: {
-      totalTrips: trips.length,
-      totalPlaces: places.length,
-      totalCountries: countries.length,
-      totalDays,
-      totalCities,
-    },
-    mostVisited,
-    continents,
-    lastTrip,
-    nextTrip,
-    streak,
-    firstYear,
-    tripsThisYear: trips.filter(t => t.start_date && t.start_date.startsWith(String(currentYear))).length,
-  });
+  const userId = (req as AuthRequest).user.id;
+  const data = await getStats(userId);
+  res.json(data);
 });
 
 router.get('/country/:code', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const userId = authReq.user.id;
+  const userId = (req as AuthRequest).user.id;
   const code = req.params.code.toUpperCase();
-
-  const trips = db.prepare(`
-    SELECT DISTINCT t.* FROM trips t
-    LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ?
-    WHERE t.user_id = ? OR m.user_id = ?
-  `).all(userId, userId, userId) as Trip[];
-
-  const tripIds = trips.map(t => t.id);
-  if (tripIds.length === 0) return res.json({ places: [], trips: [] });
-
-  const placeholders = tripIds.map(() => '?').join(',');
-  const places = db.prepare(`SELECT * FROM places WHERE trip_id IN (${placeholders})`).all(...tripIds) as Place[];
-
-  const matchingPlaces: { id: number; name: string; address: string | null; lat: number | null; lng: number | null; trip_id: number }[] = [];
-  const matchingTripIds = new Set<number>();
-
-  for (const place of places) {
-    let pCode = getCountryFromAddress(place.address);
-    if (!pCode && place.lat && place.lng) pCode = getCountryFromCoords(place.lat, place.lng);
-    if (pCode === code) {
-      matchingPlaces.push({ id: place.id, name: place.name, address: place.address, lat: place.lat, lng: place.lng, trip_id: place.trip_id });
-      matchingTripIds.add(place.trip_id);
-    }
-  }
-
-  const matchingTrips = trips.filter(t => matchingTripIds.has(t.id)).map(t => ({ id: t.id, title: t.title, start_date: t.start_date, end_date: t.end_date }));
-
-  const isManuallyMarked = !!(db.prepare('SELECT 1 FROM visited_countries WHERE user_id = ? AND country_code = ?').get(userId, code));
-  res.json({ places: matchingPlaces, trips: matchingTrips, manually_marked: isManuallyMarked });
+  res.json(getCountryPlaces(userId, code));
 });
 
-// Mark/unmark country as visited
 router.post('/country/:code/mark', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  db.prepare('INSERT OR IGNORE INTO visited_countries (user_id, country_code) VALUES (?, ?)').run(authReq.user.id, req.params.code.toUpperCase());
+  const userId = (req as AuthRequest).user.id;
+  markCountryVisited(userId, req.params.code.toUpperCase());
   res.json({ success: true });
 });
 
 router.delete('/country/:code/mark', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  db.prepare('DELETE FROM visited_countries WHERE user_id = ? AND country_code = ?').run(authReq.user.id, req.params.code.toUpperCase());
+  const userId = (req as AuthRequest).user.id;
+  unmarkCountryVisited(userId, req.params.code.toUpperCase());
   res.json({ success: true });
 });
 
 // ── Bucket List ─────────────────────────────────────────────────────────────
 
 router.get('/bucket-list', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const items = db.prepare('SELECT * FROM bucket_list WHERE user_id = ? ORDER BY created_at DESC').all(authReq.user.id);
-  res.json({ items });
+  const userId = (req as AuthRequest).user.id;
+  res.json({ items: listBucketList(userId) });
 });
 
 router.post('/bucket-list', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
+  const userId = (req as AuthRequest).user.id;
   const { name, lat, lng, country_code, notes, target_date } = req.body;
   if (!name?.trim()) return res.status(400).json({ error: 'Name is required' });
-  const result = db.prepare('INSERT INTO bucket_list (user_id, name, lat, lng, country_code, notes, target_date) VALUES (?, ?, ?, ?, ?, ?, ?)').run(
-    authReq.user.id, name.trim(), lat ?? null, lng ?? null, country_code ?? null, notes ?? null, target_date ?? null
-  );
-  const item = db.prepare('SELECT * FROM bucket_list WHERE id = ?').get(result.lastInsertRowid);
+  const item = createBucketItem(userId, { name, lat, lng, country_code, notes, target_date });
   res.status(201).json({ item });
 });
 
 router.put('/bucket-list/:id', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
+  const userId = (req as AuthRequest).user.id;
   const { name, notes, lat, lng, country_code, target_date } = req.body;
-  const item = db.prepare('SELECT * FROM bucket_list WHERE id = ? AND user_id = ?').get(req.params.id, authReq.user.id);
+  const item = updateBucketItem(userId, req.params.id, { name, notes, lat, lng, country_code, target_date });
   if (!item) return res.status(404).json({ error: 'Item not found' });
-  db.prepare(`UPDATE bucket_list SET
-    name = COALESCE(?, name),
-    notes = CASE WHEN ? THEN ? ELSE notes END,
-    lat = CASE WHEN ? THEN ? ELSE lat END,
-    lng = CASE WHEN ? THEN ? ELSE lng END,
-    country_code = CASE WHEN ? THEN ? ELSE country_code END,
-    target_date = CASE WHEN ? THEN ? ELSE target_date END
-    WHERE id = ?`).run(
-    name?.trim() || null,
-    notes !== undefined ? 1 : 0, notes !== undefined ? (notes || null) : null,
-    lat !== undefined ? 1 : 0, lat !== undefined ? (lat || null) : null,
-    lng !== undefined ? 1 : 0, lng !== undefined ? (lng || null) : null,
-    country_code !== undefined ? 1 : 0, country_code !== undefined ? (country_code || null) : null,
-    target_date !== undefined ? 1 : 0, target_date !== undefined ? (target_date || null) : null,
-    req.params.id
-  );
-  res.json({ item: db.prepare('SELECT * FROM bucket_list WHERE id = ?').get(req.params.id) });
+  res.json({ item });
 });
 
 router.delete('/bucket-list/:id', (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const item = db.prepare('SELECT * FROM bucket_list WHERE id = ? AND user_id = ?').get(req.params.id, authReq.user.id);
-  if (!item) return res.status(404).json({ error: 'Item not found' });
-  db.prepare('DELETE FROM bucket_list WHERE id = ?').run(req.params.id);
+  const userId = (req as AuthRequest).user.id;
+  const deleted = deleteBucketItem(userId, req.params.id);
+  if (!deleted) return res.status(404).json({ error: 'Item not found' });
   res.json({ success: true });
 });
 

server/src/routes/backup.ts

@@ -1,133 +1,68 @@
 import express, { Request, Response, NextFunction } from 'express';
-import archiver from 'archiver';
-import unzipper from 'unzipper';
 import multer from 'multer';
-import path from 'path';
 import fs from 'fs';
-import Database from 'better-sqlite3';
 import { authenticate, adminOnly } from '../middleware/auth';
-import * as scheduler from '../scheduler';
-import { db, closeDb, reinitialize } from '../db/database';
 import { AuthRequest } from '../types';
 import { writeAudit, getClientIp } from '../services/auditLog';
-
-type RestoreAuditInfo = { userId: number; ip: string | null; source: 'backup.restore' | 'backup.upload_restore'; label: string };
+import {
+  listBackups,
+  createBackup,
+  restoreFromZip,
+  getAutoSettings,
+  updateAutoSettings,
+  deleteBackup,
+  isValidBackupFilename,
+  backupFilePath,
+  backupFileExists,
+  checkRateLimit,
+  getUploadTmpDir,
+  BACKUP_RATE_WINDOW,
+  MAX_BACKUP_UPLOAD_SIZE,
+} from '../services/backupService';
 
 const router = express.Router();
 
 router.use(authenticate, adminOnly);
 
-const BACKUP_RATE_WINDOW = 60 * 60 * 1000; // 1 hour
-const MAX_BACKUP_UPLOAD_SIZE = 500 * 1024 * 1024; // 500 MB
+// ---------------------------------------------------------------------------
+// Rate-limiter middleware (HTTP concern wrapping service-level check)
+// ---------------------------------------------------------------------------
 
-const backupAttempts = new Map<string, { count: number; first: number }>();
 function backupRateLimiter(maxAttempts: number, windowMs: number) {
   return (req: Request, res: Response, next: NextFunction) => {
     const key = req.ip || 'unknown';
-    const now = Date.now();
-    const record = backupAttempts.get(key);
-    if (record && record.count >= maxAttempts && now - record.first < windowMs) {
+    if (!checkRateLimit(key, maxAttempts, windowMs)) {
       return res.status(429).json({ error: 'Too many backup requests. Please try again later.' });
     }
-    if (!record || now - record.first >= windowMs) {
-      backupAttempts.set(key, { count: 1, first: now });
-    } else {
-      record.count++;
-    }
     next();
   };
 }
 
-const dataDir = path.join(__dirname, '../../data');
-const backupsDir = path.join(dataDir, 'backups');
-const uploadsDir = path.join(__dirname, '../../uploads');
-
-function ensureBackupsDir() {
-  if (!fs.existsSync(backupsDir)) fs.mkdirSync(backupsDir, { recursive: true });
-}
-
-function formatSize(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-}
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
 
 router.get('/list', (_req: Request, res: Response) => {
-  ensureBackupsDir();
-
   try {
-    const files = fs.readdirSync(backupsDir)
-      .filter(f => f.endsWith('.zip'))
-      .map(filename => {
-        const filePath = path.join(backupsDir, filename);
-        const stat = fs.statSync(filePath);
-        return {
-          filename,
-          size: stat.size,
-          sizeText: formatSize(stat.size),
-          created_at: stat.birthtime.toISOString(),
-        };
-      })
-      .sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());
-
-    res.json({ backups: files });
+    res.json({ backups: listBackups() });
   } catch (err: unknown) {
     res.status(500).json({ error: 'Error loading backups' });
   }
 });
 
-router.post('/create', backupRateLimiter(3, BACKUP_RATE_WINDOW), async (_req: Request, res: Response) => {
-  ensureBackupsDir();
-
-  const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
-  const filename = `backup-${timestamp}.zip`;
-  const outputPath = path.join(backupsDir, filename);
-
+router.post('/create', backupRateLimiter(3, BACKUP_RATE_WINDOW), async (req: Request, res: Response) => {
   try {
-    try { db.exec('PRAGMA wal_checkpoint(TRUNCATE)'); } catch (e) {}
-
-    await new Promise<void>((resolve, reject) => {
-      const output = fs.createWriteStream(outputPath);
-      const archive = archiver('zip', { zlib: { level: 9 } });
-
-      output.on('close', resolve);
-      archive.on('error', reject);
-
-      archive.pipe(output);
-
-      const dbPath = path.join(dataDir, 'travel.db');
-      if (fs.existsSync(dbPath)) {
-        archive.file(dbPath, { name: 'travel.db' });
-      }
-
-      if (fs.existsSync(uploadsDir)) {
-        archive.directory(uploadsDir, 'uploads');
-      }
-
-      archive.finalize();
-    });
-
-    const stat = fs.statSync(outputPath);
-    const authReq = _req as AuthRequest;
+    const backup = await createBackup();
+    const authReq = req as AuthRequest;
     writeAudit({
       userId: authReq.user.id,
       action: 'backup.create',
-      resource: filename,
-      ip: getClientIp(_req),
-      details: { size: stat.size },
-    });
-    res.json({
-      success: true,
-      backup: {
-        filename,
-        size: stat.size,
-        sizeText: formatSize(stat.size),
-        created_at: stat.birthtime.toISOString(),
-      }
+      resource: backup.filename,
+      ip: getClientIp(req),
+      details: { size: backup.size },
     });
+    res.json({ success: true, backup });
   } catch (err: unknown) {
-    console.error('Backup error:', err);
-    if (fs.existsSync(outputPath)) fs.unlinkSync(outputPath);
     res.status(500).json({ error: 'Error creating backup' });
   }
 });
@@ -135,122 +70,46 @@ router.post('/create', backupRateLimiter(3, BACKUP_RATE_WINDOW), async (_req: Re
 router.get('/download/:filename', (req: Request, res: Response) => {
   const { filename } = req.params;
 
-  if (!/^backup-[\w\-]+\.zip$/.test(filename)) {
+  if (!isValidBackupFilename(filename)) {
     return res.status(400).json({ error: 'Invalid filename' });
   }
-
-  const filePath = path.join(backupsDir, filename);
-  if (!fs.existsSync(filePath)) {
+  if (!backupFileExists(filename)) {
     return res.status(404).json({ error: 'Backup not found' });
   }
 
-  res.download(filePath, filename);
+  res.download(backupFilePath(filename), filename);
 });
 
-async function restoreFromZip(zipPath: string, res: Response, audit?: RestoreAuditInfo) {
-  const extractDir = path.join(dataDir, `restore-${Date.now()}`);
-  try {
-    await fs.createReadStream(zipPath)
-      .pipe(unzipper.Extract({ path: extractDir }))
-      .promise();
-
-    const extractedDb = path.join(extractDir, 'travel.db');
-    if (!fs.existsSync(extractedDb)) {
-      fs.rmSync(extractDir, { recursive: true, force: true });
-      return res.status(400).json({ error: 'Invalid backup: travel.db not found' });
-    }
-
-    let uploadedDb: InstanceType<typeof Database> | null = null;
-    try {
-      uploadedDb = new Database(extractedDb, { readonly: true });
-
-      const integrityResult = uploadedDb.prepare('PRAGMA integrity_check').get() as { integrity_check: string };
-      if (integrityResult.integrity_check !== 'ok') {
-        fs.rmSync(extractDir, { recursive: true, force: true });
-        return res.status(400).json({ error: `Uploaded database failed integrity check: ${integrityResult.integrity_check}` });
-      }
-
-      const requiredTables = ['users', 'trips', 'trip_members', 'places', 'days'];
-      const existingTables = uploadedDb
-        .prepare("SELECT name FROM sqlite_master WHERE type='table'")
-        .all() as { name: string }[];
-      const tableNames = new Set(existingTables.map(t => t.name));
-      for (const table of requiredTables) {
-        if (!tableNames.has(table)) {
-          fs.rmSync(extractDir, { recursive: true, force: true });
-          return res.status(400).json({ error: `Uploaded database is missing required table: ${table}. This does not appear to be a TREK backup.` });
-        }
-      }
-    } catch (err) {
-      fs.rmSync(extractDir, { recursive: true, force: true });
-      return res.status(400).json({ error: 'Uploaded file is not a valid SQLite database' });
-    } finally {
-      uploadedDb?.close();
-    }
-
-    closeDb();
-
-    try {
-      const dbDest = path.join(dataDir, 'travel.db');
-      for (const ext of ['', '-wal', '-shm']) {
-        try { fs.unlinkSync(dbDest + ext); } catch (e) {}
-      }
-      fs.copyFileSync(extractedDb, dbDest);
-
-      const extractedUploads = path.join(extractDir, 'uploads');
-      if (fs.existsSync(extractedUploads)) {
-        for (const sub of fs.readdirSync(uploadsDir)) {
-          const subPath = path.join(uploadsDir, sub);
-          if (fs.statSync(subPath).isDirectory()) {
-            for (const file of fs.readdirSync(subPath)) {
-              try { fs.unlinkSync(path.join(subPath, file)); } catch (e) {}
-            }
-          }
-        }
-        fs.cpSync(extractedUploads, uploadsDir, { recursive: true, force: true });
-      }
-    } finally {
-      reinitialize();
-    }
-
-    fs.rmSync(extractDir, { recursive: true, force: true });
-
-    if (audit) {
-      writeAudit({
-        userId: audit.userId,
-        action: audit.source,
-        resource: audit.label,
-        ip: audit.ip,
-      });
-    }
-    res.json({ success: true });
-  } catch (err: unknown) {
-    console.error('Restore error:', err);
-    if (fs.existsSync(extractDir)) fs.rmSync(extractDir, { recursive: true, force: true });
-    if (!res.headersSent) res.status(500).json({ error: 'Error restoring backup' });
-  }
-}
-
 router.post('/restore/:filename', async (req: Request, res: Response) => {
   const { filename } = req.params;
-  if (!/^backup-[\w\-]+\.zip$/.test(filename)) {
+  if (!isValidBackupFilename(filename)) {
     return res.status(400).json({ error: 'Invalid filename' });
   }
-  const zipPath = path.join(backupsDir, filename);
-  if (!fs.existsSync(zipPath)) {
+  const zipPath = backupFilePath(filename);
+  if (!backupFileExists(filename)) {
     return res.status(404).json({ error: 'Backup not found' });
   }
-  const authReq = req as AuthRequest;
-  await restoreFromZip(zipPath, res, {
-    userId: authReq.user.id,
-    ip: getClientIp(req),
-    source: 'backup.restore',
-    label: filename,
-  });
+
+  try {
+    const result = await restoreFromZip(zipPath);
+    if (!result.success) {
+      return res.status(result.status || 400).json({ error: result.error });
+    }
+    const authReq = req as AuthRequest;
+    writeAudit({
+      userId: authReq.user.id,
+      action: 'backup.restore',
+      resource: filename,
+      ip: getClientIp(req),
+    });
+    res.json({ success: true });
+  } catch (err: unknown) {
+    if (!res.headersSent) res.status(500).json({ error: 'Error restoring backup' });
+  }
 });
 
 const uploadTmp = multer({
-  dest: path.join(dataDir, 'tmp/'),
+  dest: getUploadTmpDir(),
   fileFilter: (_req, file, cb) => {
     if (file.originalname.endsWith('.zip')) cb(null, true);
     else cb(new Error('Only ZIP files allowed'));
@@ -261,62 +120,41 @@ const uploadTmp = multer({
 router.post('/upload-restore', uploadTmp.single('backup'), async (req: Request, res: Response) => {
   if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
   const zipPath = req.file.path;
-  const authReq = req as AuthRequest;
   const origName = req.file.originalname || 'upload.zip';
-  await restoreFromZip(zipPath, res, {
-    userId: authReq.user.id,
-    ip: getClientIp(req),
-    source: 'backup.upload_restore',
-    label: origName,
-  });
-  if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+
+  try {
+    const result = await restoreFromZip(zipPath);
+    if (!result.success) {
+      return res.status(result.status || 400).json({ error: result.error });
+    }
+    const authReq = req as AuthRequest;
+    writeAudit({
+      userId: authReq.user.id,
+      action: 'backup.upload_restore',
+      resource: origName,
+      ip: getClientIp(req),
+    });
+    res.json({ success: true });
+  } catch (err: unknown) {
+    if (!res.headersSent) res.status(500).json({ error: 'Error restoring backup' });
+  } finally {
+    if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+  }
 });
 
 router.get('/auto-settings', (_req: Request, res: Response) => {
   try {
-    const tz = process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
-    res.json({ settings: scheduler.loadSettings(), timezone: tz });
+    const data = getAutoSettings();
+    res.json(data);
   } catch (err: unknown) {
     console.error('[backup] GET auto-settings:', err);
     res.status(500).json({ error: 'Could not load backup settings' });
   }
 });
 
-function parseIntField(raw: unknown, fallback: number): number {
-  if (typeof raw === 'number' && Number.isFinite(raw)) return Math.floor(raw);
-  if (typeof raw === 'string' && raw.trim() !== '') {
-    const n = parseInt(raw, 10);
-    if (Number.isFinite(n)) return n;
-  }
-  return fallback;
-}
-
-function parseAutoBackupBody(body: Record<string, unknown>): {
-  enabled: boolean;
-  interval: string;
-  keep_days: number;
-  hour: number;
-  day_of_week: number;
-  day_of_month: number;
-} {
-  const enabled = body.enabled === true || body.enabled === 'true' || body.enabled === 1;
-  const rawInterval = body.interval;
-  const interval =
-    typeof rawInterval === 'string' && scheduler.VALID_INTERVALS.includes(rawInterval)
-      ? rawInterval
-      : 'daily';
-  const keep_days = Math.max(0, parseIntField(body.keep_days, 7));
-  const hour = Math.min(23, Math.max(0, parseIntField(body.hour, 2)));
-  const day_of_week = Math.min(6, Math.max(0, parseIntField(body.day_of_week, 0)));
-  const day_of_month = Math.min(28, Math.max(1, parseIntField(body.day_of_month, 1)));
-  return { enabled, interval, keep_days, hour, day_of_week, day_of_month };
-}
-
 router.put('/auto-settings', (req: Request, res: Response) => {
   try {
-    const settings = parseAutoBackupBody((req.body || {}) as Record<string, unknown>);
-    scheduler.saveSettings(settings);
-    scheduler.start();
+    const settings = updateAutoSettings((req.body || {}) as Record<string, unknown>);
     const authReq = req as AuthRequest;
     writeAudit({
       userId: authReq.user.id,
@@ -338,16 +176,14 @@ router.put('/auto-settings', (req: Request, res: Response) => {
 router.delete('/:filename', (req: Request, res: Response) => {
   const { filename } = req.params;
 
-  if (!/^backup-[\w\-]+\.zip$/.test(filename)) {
+  if (!isValidBackupFilename(filename)) {
     return res.status(400).json({ error: 'Invalid filename' });
   }
-
-  const filePath = path.join(backupsDir, filename);
-  if (!fs.existsSync(filePath)) {
+  if (!backupFileExists(filename)) {
     return res.status(404).json({ error: 'Backup not found' });
   }
 
-  fs.unlinkSync(filePath);
+  deleteBackup(filename);
   const authReq = req as AuthRequest;
   writeAudit({
     userId: authReq.user.id,

server/src/routes/budget.ts

@@ -1,113 +1,56 @@
 import express, { Request, Response } from 'express';
-import { db, canAccessTrip } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { broadcast } from '../websocket';
 import { checkPermission } from '../services/permissions';
-import { AuthRequest, BudgetItem, BudgetItemMember } from '../types';
+import { AuthRequest } from '../types';
+import {
+  verifyTripAccess,
+  listBudgetItems,
+  createBudgetItem,
+  updateBudgetItem,
+  deleteBudgetItem,
+  updateMembers,
+  toggleMemberPaid,
+  getPerPersonSummary,
+  calculateSettlement,
+} from '../services/budgetService';
 
 const router = express.Router({ mergeParams: true });
 
-function verifyTripOwnership(tripId: string | number, userId: number) {
-  return canAccessTrip(tripId, userId);
-}
-
-function loadItemMembers(itemId: number | string) {
-  return db.prepare(`
-    SELECT bm.user_id, bm.paid, u.username, u.avatar
-    FROM budget_item_members bm
-    JOIN users u ON bm.user_id = u.id
-    WHERE bm.budget_item_id = ?
-  `).all(itemId) as BudgetItemMember[];
-}
-
-function avatarUrl(user: { avatar?: string | null }): string | null {
-  return user.avatar ? `/uploads/avatars/${user.avatar}` : null;
-}
-
 router.get('/', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
-  const items = db.prepare(
-    'SELECT * FROM budget_items WHERE trip_id = ? ORDER BY category ASC, created_at ASC'
-  ).all(tripId) as BudgetItem[];
-
-  const itemIds = items.map(i => i.id);
-  const membersByItem: Record<number, (BudgetItemMember & { avatar_url: string | null })[]> = {};
-  if (itemIds.length > 0) {
-    const allMembers = db.prepare(`
-      SELECT bm.budget_item_id, bm.user_id, bm.paid, u.username, u.avatar
-      FROM budget_item_members bm
-      JOIN users u ON bm.user_id = u.id
-      WHERE bm.budget_item_id IN (${itemIds.map(() => '?').join(',')})
-    `).all(...itemIds) as (BudgetItemMember & { budget_item_id: number })[];
-    for (const m of allMembers) {
-      if (!membersByItem[m.budget_item_id]) membersByItem[m.budget_item_id] = [];
-      membersByItem[m.budget_item_id].push({
-        user_id: m.user_id, paid: m.paid, username: m.username, avatar_url: avatarUrl(m)
-      });
-    }
-  }
-  items.forEach(item => { item.members = membersByItem[item.id] || []; });
-
-  res.json({ items });
+  res.json({ items: listBudgetItems(tripId) });
 });
 
 router.get('/summary/per-person', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
-  if (!canAccessTrip(Number(tripId), authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
-  const summary = db.prepare(`
-    SELECT bm.user_id, u.username, u.avatar,
-      SUM(bi.total_price * 1.0 / (SELECT COUNT(*) FROM budget_item_members WHERE budget_item_id = bi.id)) as total_assigned,
-      SUM(CASE WHEN bm.paid = 1 THEN bi.total_price * 1.0 / (SELECT COUNT(*) FROM budget_item_members WHERE budget_item_id = bi.id) ELSE 0 END) as total_paid,
-      COUNT(bi.id) as items_count
-    FROM budget_item_members bm
-    JOIN budget_items bi ON bm.budget_item_id = bi.id
-    JOIN users u ON bm.user_id = u.id
-    WHERE bi.trip_id = ?
-    GROUP BY bm.user_id
-  `).all(tripId) as { user_id: number; username: string; avatar: string | null; total_assigned: number; total_paid: number; items_count: number }[];
+  if (!verifyTripAccess(Number(tripId), authReq.user.id))
+    return res.status(404).json({ error: 'Trip not found' });
 
-  res.json({ summary: summary.map(s => ({ ...s, avatar_url: avatarUrl(s) })) });
+  res.json({ summary: getPerPersonSummary(tripId) });
 });
 
 router.post('/', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
-  const { category, name, total_price, persons, days, note, expense_date } = req.body;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
   if (!checkPermission('budget_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
+  const { name } = req.body;
   if (!name) return res.status(400).json({ error: 'Name is required' });
 
-  const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM budget_items WHERE trip_id = ?').get(tripId) as { max: number | null };
-  const sortOrder = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
-
-  const result = db.prepare(
-    'INSERT INTO budget_items (trip_id, category, name, total_price, persons, days, note, sort_order, expense_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)'
-  ).run(
-    tripId,
-    category || 'Other',
-    name,
-    total_price || 0,
-    persons != null ? persons : null,
-    days !== undefined && days !== null ? days : null,
-    note || null,
-    sortOrder,
-    expense_date || null
-  );
-
-  const item = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(result.lastInsertRowid) as BudgetItem & { members?: BudgetItemMember[] };
-  item.members = [];
+  const item = createBudgetItem(tripId, req.body);
   res.status(201).json({ item });
   broadcast(tripId, 'budget:created', { item }, req.headers['x-socket-id'] as string);
 });
@@ -115,42 +58,16 @@ router.post('/', authenticate, (req: Request, res: Response) => {
 router.put('/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
-  const { category, name, total_price, persons, days, note, sort_order, expense_date } = req.body;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
   if (!checkPermission('budget_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const item = db.prepare('SELECT * FROM budget_items WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!item) return res.status(404).json({ error: 'Budget item not found' });
+  const updated = updateBudgetItem(id, tripId, req.body);
+  if (!updated) return res.status(404).json({ error: 'Budget item not found' });
 
-  db.prepare(`
-    UPDATE budget_items SET
-      category = COALESCE(?, category),
-      name = COALESCE(?, name),
-      total_price = CASE WHEN ? IS NOT NULL THEN ? ELSE total_price END,
-      persons = CASE WHEN ? IS NOT NULL THEN ? ELSE persons END,
-      days = CASE WHEN ? THEN ? ELSE days END,
-      note = CASE WHEN ? THEN ? ELSE note END,
-      sort_order = CASE WHEN ? IS NOT NULL THEN ? ELSE sort_order END,
-      expense_date = CASE WHEN ? THEN ? ELSE expense_date END
-    WHERE id = ?
-  `).run(
-    category || null,
-    name || null,
-    total_price !== undefined ? 1 : null, total_price !== undefined ? total_price : 0,
-    persons !== undefined ? 1 : null, persons !== undefined ? persons : null,
-    days !== undefined ? 1 : 0, days !== undefined ? days : null,
-    note !== undefined ? 1 : 0, note !== undefined ? note : null,
-    sort_order !== undefined ? 1 : null, sort_order !== undefined ? sort_order : 0,
-    expense_date !== undefined ? 1 : 0, expense_date !== undefined ? (expense_date || null) : null,
-    id
-  );
-
-  const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(id) as BudgetItem & { members?: BudgetItemMember[] };
-  updated.members = loadItemMembers(id);
   res.json({ item: updated });
   broadcast(tripId, 'budget:updated', { item: updated }, req.headers['x-socket-id'] as string);
 });
@@ -158,146 +75,62 @@ router.put('/:id', authenticate, (req: Request, res: Response) => {
 router.put('/:id/members', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
-  const access = canAccessTrip(Number(tripId), authReq.user.id);
+
+  const access = verifyTripAccess(Number(tripId), authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
 
   if (!checkPermission('budget_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const item = db.prepare('SELECT * FROM budget_items WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!item) return res.status(404).json({ error: 'Budget item not found' });
-
   const { user_ids } = req.body;
   if (!Array.isArray(user_ids)) return res.status(400).json({ error: 'user_ids must be an array' });
 
-  const existingPaid: Record<number, number> = {};
-  const existing = db.prepare('SELECT user_id, paid FROM budget_item_members WHERE budget_item_id = ?').all(id) as { user_id: number; paid: number }[];
-  for (const e of existing) existingPaid[e.user_id] = e.paid;
+  const result = updateMembers(id, tripId, user_ids);
+  if (!result) return res.status(404).json({ error: 'Budget item not found' });
 
-  db.prepare('DELETE FROM budget_item_members WHERE budget_item_id = ?').run(id);
-  if (user_ids.length > 0) {
-    const insert = db.prepare('INSERT OR IGNORE INTO budget_item_members (budget_item_id, user_id, paid) VALUES (?, ?, ?)');
-    for (const userId of user_ids) insert.run(id, userId, existingPaid[userId] || 0);
-    db.prepare('UPDATE budget_items SET persons = ? WHERE id = ?').run(user_ids.length, id);
-  } else {
-    db.prepare('UPDATE budget_items SET persons = NULL WHERE id = ?').run(id);
-  }
-
-  const members = loadItemMembers(id).map(m => ({ ...m, avatar_url: avatarUrl(m) }));
-  const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(id);
-  res.json({ members, item: updated });
-  broadcast(Number(tripId), 'budget:members-updated', { itemId: Number(id), members, persons: (updated as BudgetItem).persons }, req.headers['x-socket-id'] as string);
+  res.json({ members: result.members, item: result.item });
+  broadcast(Number(tripId), 'budget:members-updated', { itemId: Number(id), members: result.members, persons: result.item.persons }, req.headers['x-socket-id'] as string);
 });
 
 router.put('/:id/members/:userId/paid', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id, userId } = req.params;
-  const access = canAccessTrip(Number(tripId), authReq.user.id);
+
+  const access = verifyTripAccess(Number(tripId), authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
 
   if (!checkPermission('budget_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
   const { paid } = req.body;
-  db.prepare('UPDATE budget_item_members SET paid = ? WHERE budget_item_id = ? AND user_id = ?')
-    .run(paid ? 1 : 0, id, userId);
-
-  const member = db.prepare(`
-    SELECT bm.user_id, bm.paid, u.username, u.avatar
-    FROM budget_item_members bm JOIN users u ON bm.user_id = u.id
-    WHERE bm.budget_item_id = ? AND bm.user_id = ?
-  `).get(id, userId) as BudgetItemMember | undefined;
-
-  const result = member ? { ...member, avatar_url: avatarUrl(member) } : null;
-  res.json({ member: result });
+  const member = toggleMemberPaid(id, userId, paid);
+  res.json({ member });
   broadcast(Number(tripId), 'budget:member-paid-updated', { itemId: Number(id), userId: Number(userId), paid: paid ? 1 : 0 }, req.headers['x-socket-id'] as string);
 });
 
-// Settlement calculation: who owes whom
 router.get('/settlement', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
-  if (!canAccessTrip(Number(tripId), authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
-  const items = db.prepare('SELECT * FROM budget_items WHERE trip_id = ?').all(tripId) as BudgetItem[];
-  const allMembers = db.prepare(`
-    SELECT bm.budget_item_id, bm.user_id, bm.paid, u.username, u.avatar
-    FROM budget_item_members bm
-    JOIN users u ON bm.user_id = u.id
-    WHERE bm.budget_item_id IN (SELECT id FROM budget_items WHERE trip_id = ?)
-  `).all(tripId) as (BudgetItemMember & { budget_item_id: number })[];
+  if (!verifyTripAccess(Number(tripId), authReq.user.id))
+    return res.status(404).json({ error: 'Trip not found' });
 
-  // Calculate net balance per user: positive = is owed money, negative = owes money
-  const balances: Record<number, { user_id: number; username: string; avatar_url: string | null; balance: number }> = {};
-
-  for (const item of items) {
-    const members = allMembers.filter(m => m.budget_item_id === item.id);
-    if (members.length === 0) continue;
-
-    const payers = members.filter(m => m.paid);
-    if (payers.length === 0) continue; // no one marked as paid
-
-    const sharePerMember = item.total_price / members.length;
-    const paidPerPayer = item.total_price / payers.length;
-
-    for (const m of members) {
-      if (!balances[m.user_id]) {
-        balances[m.user_id] = { user_id: m.user_id, username: m.username, avatar_url: avatarUrl(m), balance: 0 };
-      }
-      // Everyone owes their share
-      balances[m.user_id].balance -= sharePerMember;
-      // Payers get credited what they paid
-      if (m.paid) balances[m.user_id].balance += paidPerPayer;
-    }
-  }
-
-  // Calculate optimized payment flows (greedy algorithm)
-  const people = Object.values(balances).filter(b => Math.abs(b.balance) > 0.01);
-  const debtors = people.filter(p => p.balance < -0.01).map(p => ({ ...p, amount: -p.balance }));
-  const creditors = people.filter(p => p.balance > 0.01).map(p => ({ ...p, amount: p.balance }));
-
-  // Sort by amount descending for efficient matching
-  debtors.sort((a, b) => b.amount - a.amount);
-  creditors.sort((a, b) => b.amount - a.amount);
-
-  const flows: { from: { user_id: number; username: string; avatar_url: string | null }; to: { user_id: number; username: string; avatar_url: string | null }; amount: number }[] = [];
-
-  let di = 0, ci = 0;
-  while (di < debtors.length && ci < creditors.length) {
-    const transfer = Math.min(debtors[di].amount, creditors[ci].amount);
-    if (transfer > 0.01) {
-      flows.push({
-        from: { user_id: debtors[di].user_id, username: debtors[di].username, avatar_url: debtors[di].avatar_url },
-        to: { user_id: creditors[ci].user_id, username: creditors[ci].username, avatar_url: creditors[ci].avatar_url },
-        amount: Math.round(transfer * 100) / 100,
-      });
-    }
-    debtors[di].amount -= transfer;
-    creditors[ci].amount -= transfer;
-    if (debtors[di].amount < 0.01) di++;
-    if (creditors[ci].amount < 0.01) ci++;
-  }
-
-  res.json({
-    balances: Object.values(balances).map(b => ({ ...b, balance: Math.round(b.balance * 100) / 100 })),
-    flows,
-  });
+  res.json(calculateSettlement(tripId));
 });
 
 router.delete('/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
   if (!checkPermission('budget_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const item = db.prepare('SELECT id FROM budget_items WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!item) return res.status(404).json({ error: 'Budget item not found' });
+  if (!deleteBudgetItem(id, tripId))
+    return res.status(404).json({ error: 'Budget item not found' });
 
-  db.prepare('DELETE FROM budget_items WHERE id = ?').run(id);
   res.json({ success: true });
   broadcast(tripId, 'budget:deleted', { itemId: Number(id) }, req.headers['x-socket-id'] as string);
 });

server/src/routes/categories.ts

@@ -1,55 +1,34 @@
 import express, { Request, Response } from 'express';
-import { db } from '../db/database';
 import { authenticate, adminOnly } from '../middleware/auth';
 import { AuthRequest } from '../types';
+import * as categoryService from '../services/categoryService';
 
 const router = express.Router();
 
 router.get('/', authenticate, (_req: Request, res: Response) => {
-  const categories = db.prepare(
-    'SELECT * FROM categories ORDER BY name ASC'
-  ).all();
-  res.json({ categories });
+  res.json({ categories: categoryService.listCategories() });
 });
 
 router.post('/', authenticate, adminOnly, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { name, color, icon } = req.body;
-
   if (!name) return res.status(400).json({ error: 'Category name is required' });
-
-  const result = db.prepare(
-    'INSERT INTO categories (name, color, icon, user_id) VALUES (?, ?, ?, ?)'
-  ).run(name, color || '#6366f1', icon || '\uD83D\uDCCD', authReq.user.id);
-
-  const category = db.prepare('SELECT * FROM categories WHERE id = ?').get(result.lastInsertRowid);
+  const category = categoryService.createCategory(authReq.user.id, name, color, icon);
   res.status(201).json({ category });
 });
 
 router.put('/:id', authenticate, adminOnly, (req: Request, res: Response) => {
   const { name, color, icon } = req.body;
-  const category = db.prepare('SELECT * FROM categories WHERE id = ?').get(req.params.id);
-
-  if (!category) return res.status(404).json({ error: 'Category not found' });
-
-  db.prepare(`
-    UPDATE categories SET
-      name = COALESCE(?, name),
-      color = COALESCE(?, color),
-      icon = COALESCE(?, icon)
-    WHERE id = ?
-  `).run(name || null, color || null, icon || null, req.params.id);
-
-  const updated = db.prepare('SELECT * FROM categories WHERE id = ?').get(req.params.id);
-  res.json({ category: updated });
+  if (!categoryService.getCategoryById(req.params.id))
+    return res.status(404).json({ error: 'Category not found' });
+  const category = categoryService.updateCategory(req.params.id, name, color, icon);
+  res.json({ category });
 });
 
 router.delete('/:id', authenticate, adminOnly, (req: Request, res: Response) => {
-  const category = db.prepare('SELECT * FROM categories WHERE id = ?').get(req.params.id);
-
-  if (!category) return res.status(404).json({ error: 'Category not found' });
-
-  db.prepare('DELETE FROM categories WHERE id = ?').run(req.params.id);
+  if (!categoryService.getCategoryById(req.params.id))
+    return res.status(404).json({ error: 'Category not found' });
+  categoryService.deleteCategory(req.params.id);
   res.json({ success: true });
 });
 

server/src/routes/collab.ts

@@ -3,35 +3,32 @@ import multer from 'multer';
 import path from 'path';
 import fs from 'fs';
 import { v4 as uuidv4 } from 'uuid';
-import { db, canAccessTrip } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { broadcast } from '../websocket';
 import { validateStringLengths } from '../middleware/validate';
 import { checkPermission } from '../services/permissions';
-import { AuthRequest, CollabNote, CollabPoll, CollabMessage, TripFile } from '../types';
-import { checkSsrf, createPinnedAgent } from '../utils/ssrfGuard';
-
-interface ReactionRow {
-  emoji: string;
-  user_id: number;
-  username: string;
-  message_id?: number;
-}
-
-interface PollVoteRow {
-  option_index: number;
-  user_id: number;
-  username: string;
-  avatar: string | null;
-}
-
-interface NoteFileRow {
-  id: number;
-  filename: string;
-  original_name?: string;
-  file_size?: number;
-  mime_type?: string;
-}
+import { AuthRequest } from '../types';
+import { db } from '../db/database';
+import {
+  verifyTripAccess,
+  listNotes,
+  createNote,
+  updateNote,
+  deleteNote,
+  addNoteFile,
+  getFormattedNoteById,
+  deleteNoteFile,
+  listPolls,
+  createPoll,
+  votePoll,
+  closePoll,
+  deletePoll,
+  listMessages,
+  createMessage,
+  deleteMessage,
+  addOrRemoveReaction,
+  fetchLinkPreview,
+} from '../services/collabService';
 
 const MAX_NOTE_FILE_SIZE = 50 * 1024 * 1024; // 50 MB
 const filesDir = path.join(__dirname, '../../uploads/files');
@@ -46,7 +43,9 @@ const noteUpload = multer({
     const ext = path.extname(file.originalname).toLowerCase();
     const BLOCKED = ['.svg', '.html', '.htm', '.xml', '.xhtml', '.js', '.jsx', '.ts', '.exe', '.bat', '.sh', '.cmd', '.msi', '.dll', '.com', '.vbs', '.ps1', '.php'];
     if (BLOCKED.includes(ext) || file.mimetype.includes('svg') || file.mimetype.includes('html') || file.mimetype.includes('javascript')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
     }
     cb(null, true);
   },
@@ -54,59 +53,16 @@ const noteUpload = multer({
 
 const router = express.Router({ mergeParams: true });
 
-function verifyTripAccess(tripId: string | number, userId: number) {
-  return canAccessTrip(tripId, userId);
-}
-
-function avatarUrl(user: { avatar?: string | null }): string | null {
-  return user.avatar ? `/uploads/avatars/${user.avatar}` : null;
-}
-
-function formatNote(note: CollabNote) {
-  const attachments = db.prepare('SELECT id, filename, original_name, file_size, mime_type FROM trip_files WHERE note_id = ?').all(note.id) as NoteFileRow[];
-  return {
-    ...note,
-    avatar_url: avatarUrl(note),
-    attachments: attachments.map(a => ({ ...a, url: `/uploads/${a.filename}` })),
-  };
-}
-
-function loadReactions(messageId: number | string) {
-  return db.prepare(`
-    SELECT r.emoji, r.user_id, u.username
-    FROM collab_message_reactions r
-    JOIN users u ON r.user_id = u.id
-    WHERE r.message_id = ?
-  `).all(messageId) as ReactionRow[];
-}
-
-function groupReactions(reactions: ReactionRow[]) {
-  const map: Record<string, { user_id: number; username: string }[]> = {};
-  for (const r of reactions) {
-    if (!map[r.emoji]) map[r.emoji] = [];
-    map[r.emoji].push({ user_id: r.user_id, username: r.username });
-  }
-  return Object.entries(map).map(([emoji, users]) => ({ emoji, users, count: users.length }));
-}
-
-function formatMessage(msg: CollabMessage, reactions?: { emoji: string; users: { user_id: number; username: string }[]; count: number }[]) {
-  return { ...msg, user_avatar: avatarUrl(msg), avatar_url: avatarUrl(msg), reactions: reactions || [] };
-}
+/* ------------------------------------------------------------------ */
+/*  Notes                                                              */
+/* ------------------------------------------------------------------ */
 
 router.get('/notes', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
   if (!verifyTripAccess(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
-  const notes = db.prepare(`
-    SELECT n.*, u.username, u.avatar
-    FROM collab_notes n
-    JOIN users u ON n.user_id = u.id
-    WHERE n.trip_id = ?
-    ORDER BY n.pinned DESC, n.updated_at DESC
-  `).all(tripId) as CollabNote[];
-
-  res.json({ notes: notes.map(formatNote) });
+  res.json({ notes: listNotes(tripId) });
 });
 
 router.post('/notes', authenticate, (req: Request, res: Response) => {
@@ -119,16 +75,7 @@ router.post('/notes', authenticate, (req: Request, res: Response) => {
     return res.status(403).json({ error: 'No permission' });
   if (!title) return res.status(400).json({ error: 'Title is required' });
 
-  const result = db.prepare(`
-    INSERT INTO collab_notes (trip_id, user_id, title, content, category, color, website)
-    VALUES (?, ?, ?, ?, ?, ?, ?)
-  `).run(tripId, authReq.user.id, title, content || null, category || 'General', color || '#6366f1', website || null);
-
-  const note = db.prepare(`
-    SELECT n.*, u.username, u.avatar FROM collab_notes n JOIN users u ON n.user_id = u.id WHERE n.id = ?
-  `).get(result.lastInsertRowid) as CollabNote;
-
-  const formatted = formatNote(note);
+  const formatted = createNote(tripId, authReq.user.id, { title, content, category, color, website });
   res.status(201).json({ note: formatted });
   broadcast(tripId, 'collab:note:created', { note: formatted }, req.headers['x-socket-id'] as string);
 
@@ -147,34 +94,9 @@ router.put('/notes/:id', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const existing = db.prepare('SELECT * FROM collab_notes WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!existing) return res.status(404).json({ error: 'Note not found' });
+  const formatted = updateNote(tripId, id, { title, content, category, color, pinned, website });
+  if (!formatted) return res.status(404).json({ error: 'Note not found' });
 
-  db.prepare(`
-    UPDATE collab_notes SET
-      title = COALESCE(?, title),
-      content = CASE WHEN ? THEN ? ELSE content END,
-      category = COALESCE(?, category),
-      color = COALESCE(?, color),
-      pinned = CASE WHEN ? IS NOT NULL THEN ? ELSE pinned END,
-      website = CASE WHEN ? THEN ? ELSE website END,
-      updated_at = CURRENT_TIMESTAMP
-    WHERE id = ?
-  `).run(
-    title || null,
-    content !== undefined ? 1 : 0, content !== undefined ? content : null,
-    category || null,
-    color || null,
-    pinned !== undefined ? 1 : null, pinned ? 1 : 0,
-    website !== undefined ? 1 : 0, website !== undefined ? website : null,
-    id
-  );
-
-  const note = db.prepare(`
-    SELECT n.*, u.username, u.avatar FROM collab_notes n JOIN users u ON n.user_id = u.id WHERE n.id = ?
-  `).get(id) as CollabNote;
-
-  const formatted = formatNote(note);
   res.json({ note: formatted });
   broadcast(tripId, 'collab:note:updated', { note: formatted }, req.headers['x-socket-id'] as string);
 });
@@ -187,21 +109,16 @@ router.delete('/notes/:id', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const existing = db.prepare('SELECT id FROM collab_notes WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!existing) return res.status(404).json({ error: 'Note not found' });
+  if (!deleteNote(tripId, id)) return res.status(404).json({ error: 'Note not found' });
 
-  const noteFiles = db.prepare('SELECT id, filename FROM trip_files WHERE note_id = ?').all(id) as NoteFileRow[];
-  for (const f of noteFiles) {
-    const filePath = path.join(__dirname, '../../uploads', f.filename);
-    try { fs.unlinkSync(filePath) } catch {}
-  }
-  db.prepare('DELETE FROM trip_files WHERE note_id = ?').run(id);
-
-  db.prepare('DELETE FROM collab_notes WHERE id = ?').run(id);
   res.json({ success: true });
   broadcast(tripId, 'collab:note:deleted', { noteId: Number(id) }, req.headers['x-socket-id'] as string);
 });
 
+/* ------------------------------------------------------------------ */
+/*  Note files                                                         */
+/* ------------------------------------------------------------------ */
+
 router.post('/notes/:id/files', authenticate, noteUpload.single('file'), (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
@@ -211,16 +128,11 @@ router.post('/notes/:id/files', authenticate, noteUpload.single('file'), (req: R
     return res.status(403).json({ error: 'No permission to upload files' });
   if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
 
-  const note = db.prepare('SELECT id FROM collab_notes WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!note) return res.status(404).json({ error: 'Note not found' });
+  const result = addNoteFile(tripId, id, req.file);
+  if (!result) return res.status(404).json({ error: 'Note not found' });
 
-  const result = db.prepare(
-    'INSERT INTO trip_files (trip_id, note_id, filename, original_name, file_size, mime_type) VALUES (?, ?, ?, ?, ?, ?)'
-  ).run(tripId, id, `files/${req.file.filename}`, req.file.originalname, req.file.size, req.file.mimetype);
-
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ?').get(result.lastInsertRowid) as TripFile;
-  res.status(201).json({ file: { ...file, url: `/uploads/${file.filename}` } });
-  broadcast(Number(tripId), 'collab:note:updated', { note: formatNote(db.prepare('SELECT n.*, u.username, u.avatar FROM collab_notes n JOIN users u ON n.user_id = u.id WHERE n.id = ?').get(id) as CollabNote) }, req.headers['x-socket-id'] as string);
+  res.status(201).json(result);
+  broadcast(Number(tripId), 'collab:note:updated', { note: getFormattedNoteById(id) }, req.headers['x-socket-id'] as string);
 });
 
 router.delete('/notes/:id/files/:fileId', authenticate, (req: Request, res: Response) => {
@@ -231,63 +143,22 @@ router.delete('/notes/:id/files/:fileId', authenticate, (req: Request, res: Resp
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND note_id = ?').get(fileId, id) as TripFile | undefined;
-  if (!file) return res.status(404).json({ error: 'File not found' });
+  if (!deleteNoteFile(id, fileId)) return res.status(404).json({ error: 'File not found' });
 
-  const filePath = path.join(__dirname, '../../uploads', file.filename);
-  try { fs.unlinkSync(filePath) } catch {}
-
-  db.prepare('DELETE FROM trip_files WHERE id = ?').run(fileId);
   res.json({ success: true });
-  broadcast(Number(tripId), 'collab:note:updated', { note: formatNote(db.prepare('SELECT n.*, u.username, u.avatar FROM collab_notes n JOIN users u ON n.user_id = u.id WHERE n.id = ?').get(id) as CollabNote) }, req.headers['x-socket-id'] as string);
+  broadcast(Number(tripId), 'collab:note:updated', { note: getFormattedNoteById(id) }, req.headers['x-socket-id'] as string);
 });
 
-function getPollWithVotes(pollId: number | bigint | string) {
-  const poll = db.prepare(`
-    SELECT p.*, u.username, u.avatar
-    FROM collab_polls p
-    JOIN users u ON p.user_id = u.id
-    WHERE p.id = ?
-  `).get(pollId) as CollabPoll | undefined;
-
-  if (!poll) return null;
-
-  const options: (string | { label: string })[] = JSON.parse(poll.options);
-
-  const votes = db.prepare(`
-    SELECT v.option_index, v.user_id, u.username, u.avatar
-    FROM collab_poll_votes v
-    JOIN users u ON v.user_id = u.id
-    WHERE v.poll_id = ?
-  `).all(pollId) as PollVoteRow[];
-
-  const formattedOptions = options.map((label: string | { label: string }, idx: number) => ({
-    label: typeof label === 'string' ? label : label.label || label,
-    voters: votes
-      .filter(v => v.option_index === idx)
-      .map(v => ({ id: v.user_id, user_id: v.user_id, username: v.username, avatar: v.avatar, avatar_url: avatarUrl(v) })),
-  }));
-
-  return {
-    ...poll,
-    avatar_url: avatarUrl(poll),
-    options: formattedOptions,
-    is_closed: !!poll.closed,
-    multiple_choice: !!poll.multiple,
-  };
-}
+/* ------------------------------------------------------------------ */
+/*  Polls                                                              */
+/* ------------------------------------------------------------------ */
 
 router.get('/polls', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
   if (!verifyTripAccess(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
-  const rows = db.prepare(`
-    SELECT id FROM collab_polls WHERE trip_id = ? ORDER BY created_at DESC
-  `).all(tripId) as { id: number }[];
-
-  const polls = rows.map(row => getPollWithVotes(row.id)).filter(Boolean);
-  res.json({ polls });
+  res.json({ polls: listPolls(tripId) });
 });
 
 router.post('/polls', authenticate, (req: Request, res: Response) => {
@@ -303,14 +174,7 @@ router.post('/polls', authenticate, (req: Request, res: Response) => {
     return res.status(400).json({ error: 'At least 2 options are required' });
   }
 
-  const isMultiple = multiple || multiple_choice;
-
-  const result = db.prepare(`
-    INSERT INTO collab_polls (trip_id, user_id, question, options, multiple, deadline)
-    VALUES (?, ?, ?, ?, ?, ?)
-  `).run(tripId, authReq.user.id, question, JSON.stringify(options), isMultiple ? 1 : 0, deadline || null);
-
-  const poll = getPollWithVotes(result.lastInsertRowid);
+  const poll = createPoll(tripId, authReq.user.id, { question, options, multiple, multiple_choice, deadline });
   res.status(201).json({ poll });
   broadcast(tripId, 'collab:poll:created', { poll }, req.headers['x-socket-id'] as string);
 });
@@ -324,31 +188,13 @@ router.post('/polls/:id/vote', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const poll = db.prepare('SELECT * FROM collab_polls WHERE id = ? AND trip_id = ?').get(id, tripId) as CollabPoll | undefined;
-  if (!poll) return res.status(404).json({ error: 'Poll not found' });
-  if (poll.closed) return res.status(400).json({ error: 'Poll is closed' });
+  const result = votePoll(tripId, id, authReq.user.id, option_index);
+  if (result.error === 'not_found') return res.status(404).json({ error: 'Poll not found' });
+  if (result.error === 'closed') return res.status(400).json({ error: 'Poll is closed' });
+  if (result.error === 'invalid_index') return res.status(400).json({ error: 'Invalid option index' });
 
-  const options = JSON.parse(poll.options);
-  if (option_index < 0 || option_index >= options.length) {
-    return res.status(400).json({ error: 'Invalid option index' });
-  }
-
-  const existingVote = db.prepare(
-    'SELECT id FROM collab_poll_votes WHERE poll_id = ? AND user_id = ? AND option_index = ?'
-  ).get(id, authReq.user.id, option_index) as { id: number } | undefined;
-
-  if (existingVote) {
-    db.prepare('DELETE FROM collab_poll_votes WHERE id = ?').run(existingVote.id);
-  } else {
-    if (!poll.multiple) {
-      db.prepare('DELETE FROM collab_poll_votes WHERE poll_id = ? AND user_id = ?').run(id, authReq.user.id);
-    }
-    db.prepare('INSERT INTO collab_poll_votes (poll_id, user_id, option_index) VALUES (?, ?, ?)').run(id, authReq.user.id, option_index);
-  }
-
-  const updatedPoll = getPollWithVotes(id);
-  res.json({ poll: updatedPoll });
-  broadcast(tripId, 'collab:poll:voted', { poll: updatedPoll }, req.headers['x-socket-id'] as string);
+  res.json({ poll: result.poll });
+  broadcast(tripId, 'collab:poll:voted', { poll: result.poll }, req.headers['x-socket-id'] as string);
 });
 
 router.put('/polls/:id/close', authenticate, (req: Request, res: Response) => {
@@ -359,12 +205,9 @@ router.put('/polls/:id/close', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const poll = db.prepare('SELECT * FROM collab_polls WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!poll) return res.status(404).json({ error: 'Poll not found' });
+  const updatedPoll = closePoll(tripId, id);
+  if (!updatedPoll) return res.status(404).json({ error: 'Poll not found' });
 
-  db.prepare('UPDATE collab_polls SET closed = 1 WHERE id = ?').run(id);
-
-  const updatedPoll = getPollWithVotes(id);
   res.json({ poll: updatedPoll });
   broadcast(tripId, 'collab:poll:closed', { poll: updatedPoll }, req.headers['x-socket-id'] as string);
 });
@@ -377,52 +220,23 @@ router.delete('/polls/:id', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const poll = db.prepare('SELECT id FROM collab_polls WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!poll) return res.status(404).json({ error: 'Poll not found' });
+  if (!deletePoll(tripId, id)) return res.status(404).json({ error: 'Poll not found' });
 
-  db.prepare('DELETE FROM collab_polls WHERE id = ?').run(id);
   res.json({ success: true });
   broadcast(tripId, 'collab:poll:deleted', { pollId: Number(id) }, req.headers['x-socket-id'] as string);
 });
 
+/* ------------------------------------------------------------------ */
+/*  Messages                                                           */
+/* ------------------------------------------------------------------ */
+
 router.get('/messages', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
   const { before } = req.query;
   if (!verifyTripAccess(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
-  const query = `
-    SELECT m.*, u.username, u.avatar,
-      rm.text AS reply_text, ru.username AS reply_username
-    FROM collab_messages m
-    JOIN users u ON m.user_id = u.id
-    LEFT JOIN collab_messages rm ON m.reply_to = rm.id
-    LEFT JOIN users ru ON rm.user_id = ru.id
-    WHERE m.trip_id = ?${before ? ' AND m.id < ?' : ''}
-    ORDER BY m.id DESC
-    LIMIT 100
-  `;
-
-  const messages = before
-    ? db.prepare(query).all(tripId, before) as CollabMessage[]
-    : db.prepare(query).all(tripId) as CollabMessage[];
-
-  messages.reverse();
-  const msgIds = messages.map(m => m.id);
-  const reactionsByMsg: Record<number, ReactionRow[]> = {};
-  if (msgIds.length > 0) {
-    const allReactions = db.prepare(`
-      SELECT r.message_id, r.emoji, r.user_id, u.username
-      FROM collab_message_reactions r
-      JOIN users u ON r.user_id = u.id
-      WHERE r.message_id IN (${msgIds.map(() => '?').join(',')})
-    `).all(...msgIds) as (ReactionRow & { message_id: number })[];
-    for (const r of allReactions) {
-      if (!reactionsByMsg[r.message_id]) reactionsByMsg[r.message_id] = [];
-      reactionsByMsg[r.message_id].push(r);
-    }
-  }
-  res.json({ messages: messages.map(m => formatMessage(m, groupReactions(reactionsByMsg[m.id] || []))) });
+  res.json({ messages: listMessages(tripId, before as string | undefined) });
 });
 
 router.post('/messages', authenticate, validateStringLengths({ text: 5000 }), (req: Request, res: Response) => {
@@ -435,28 +249,11 @@ router.post('/messages', authenticate, validateStringLengths({ text: 5000 }), (r
     return res.status(403).json({ error: 'No permission' });
   if (!text || !text.trim()) return res.status(400).json({ error: 'Message text is required' });
 
-  if (reply_to) {
-    const replyMsg = db.prepare('SELECT id FROM collab_messages WHERE id = ? AND trip_id = ?').get(reply_to, tripId);
-    if (!replyMsg) return res.status(400).json({ error: 'Reply target message not found' });
-  }
+  const result = createMessage(tripId, authReq.user.id, text, reply_to);
+  if (result.error === 'reply_not_found') return res.status(400).json({ error: 'Reply target message not found' });
 
-  const result = db.prepare(`
-    INSERT INTO collab_messages (trip_id, user_id, text, reply_to) VALUES (?, ?, ?, ?)
-  `).run(tripId, authReq.user.id, text.trim(), reply_to || null);
-
-  const message = db.prepare(`
-    SELECT m.*, u.username, u.avatar,
-      rm.text AS reply_text, ru.username AS reply_username
-    FROM collab_messages m
-    JOIN users u ON m.user_id = u.id
-    LEFT JOIN collab_messages rm ON m.reply_to = rm.id
-    LEFT JOIN users ru ON rm.user_id = ru.id
-    WHERE m.id = ?
-  `).get(result.lastInsertRowid) as CollabMessage;
-
-  const formatted = formatMessage(message);
-  res.status(201).json({ message: formatted });
-  broadcast(tripId, 'collab:message:created', { message: formatted }, req.headers['x-socket-id'] as string);
+  res.status(201).json({ message: result.message });
+  broadcast(tripId, 'collab:message:created', { message: result.message }, req.headers['x-socket-id'] as string);
 
   // Notify trip members about new chat message
   import('../services/notifications').then(({ notifyTripMembers }) => {
@@ -466,6 +263,10 @@ router.post('/messages', authenticate, validateStringLengths({ text: 5000 }), (r
   });
 });
 
+/* ------------------------------------------------------------------ */
+/*  Reactions                                                          */
+/* ------------------------------------------------------------------ */
+
 router.post('/messages/:id/react', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
@@ -476,21 +277,17 @@ router.post('/messages/:id/react', authenticate, (req: Request, res: Response) =
     return res.status(403).json({ error: 'No permission' });
   if (!emoji) return res.status(400).json({ error: 'Emoji is required' });
 
-  const msg = db.prepare('SELECT id FROM collab_messages WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!msg) return res.status(404).json({ error: 'Message not found' });
+  const result = addOrRemoveReaction(id, tripId, authReq.user.id, emoji);
+  if (!result.found) return res.status(404).json({ error: 'Message not found' });
 
-  const existing = db.prepare('SELECT id FROM collab_message_reactions WHERE message_id = ? AND user_id = ? AND emoji = ?').get(id, authReq.user.id, emoji) as { id: number } | undefined;
-  if (existing) {
-    db.prepare('DELETE FROM collab_message_reactions WHERE id = ?').run(existing.id);
-  } else {
-    db.prepare('INSERT INTO collab_message_reactions (message_id, user_id, emoji) VALUES (?, ?, ?)').run(id, authReq.user.id, emoji);
-  }
-
-  const reactions = groupReactions(loadReactions(id));
-  res.json({ reactions });
-  broadcast(Number(tripId), 'collab:message:reacted', { messageId: Number(id), reactions }, req.headers['x-socket-id'] as string);
+  res.json({ reactions: result.reactions });
+  broadcast(Number(tripId), 'collab:message:reacted', { messageId: Number(id), reactions: result.reactions }, req.headers['x-socket-id'] as string);
 });
 
+/* ------------------------------------------------------------------ */
+/*  Delete message                                                     */
+/* ------------------------------------------------------------------ */
+
 router.delete('/messages/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
@@ -499,63 +296,27 @@ router.delete('/messages/:id', authenticate, (req: Request, res: Response) => {
   if (!checkPermission('collab_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const message = db.prepare('SELECT * FROM collab_messages WHERE id = ? AND trip_id = ?').get(id, tripId) as CollabMessage | undefined;
-  if (!message) return res.status(404).json({ error: 'Message not found' });
-  if (Number(message.user_id) !== Number(authReq.user.id)) return res.status(403).json({ error: 'You can only delete your own messages' });
+  const result = deleteMessage(tripId, id, authReq.user.id);
+  if (result.error === 'not_found') return res.status(404).json({ error: 'Message not found' });
+  if (result.error === 'not_owner') return res.status(403).json({ error: 'You can only delete your own messages' });
 
-  db.prepare('UPDATE collab_messages SET deleted = 1 WHERE id = ?').run(id);
   res.json({ success: true });
-  broadcast(tripId, 'collab:message:deleted', { messageId: Number(id), username: message.username || authReq.user.username }, req.headers['x-socket-id'] as string);
+  broadcast(tripId, 'collab:message:deleted', { messageId: Number(id), username: result.username || authReq.user.username }, req.headers['x-socket-id'] as string);
 });
 
+/* ------------------------------------------------------------------ */
+/*  Link preview                                                       */
+/* ------------------------------------------------------------------ */
+
 router.get('/link-preview', authenticate, async (req: Request, res: Response) => {
   const { url } = req.query as { url?: string };
   if (!url) return res.status(400).json({ error: 'URL is required' });
 
   try {
-    const parsed = new URL(url);
-    const ssrf = await checkSsrf(url);
-    if (!ssrf.allowed) {
-      return res.status(400).json({ error: ssrf.error });
-    }
-
-    const nodeFetch = require('node-fetch');
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-
-    nodeFetch(url, {
-      redirect: 'error',
-      signal: controller.signal,
-      agent: createPinnedAgent(ssrf.resolvedIp!, parsed.protocol),
-      headers: { 'User-Agent': 'Mozilla/5.0 (compatible; NOMAD/1.0; +https://github.com/mauriceboe/NOMAD)' },
-    })
-      .then((r: { ok: boolean; text: () => Promise<string> }) => {
-        clearTimeout(timeout);
-        if (!r.ok) throw new Error('Fetch failed');
-        return r.text();
-      })
-      .then((html: string) => {
-        const get = (prop: string) => {
-          const m = html.match(new RegExp(`<meta[^>]*property=["']og:${prop}["'][^>]*content=["']([^"']*)["']`, 'i'))
-            || html.match(new RegExp(`<meta[^>]*content=["']([^"']*)["'][^>]*property=["']og:${prop}["']`, 'i'));
-          return m ? m[1] : null;
-        };
-        const titleTag = html.match(/<title[^>]*>([^<]*)<\/title>/i);
-        const descMeta = html.match(/<meta[^>]*name=["']description["'][^>]*content=["']([^"']*)["']/i)
-          || html.match(/<meta[^>]*content=["']([^"']*)["'][^>]*name=["']description["']/i);
-
-        res.json({
-          title: get('title') || (titleTag ? titleTag[1].trim() : null),
-          description: get('description') || (descMeta ? descMeta[1].trim() : null),
-          image: get('image') || null,
-          site_name: get('site_name') || null,
-          url,
-        });
-      })
-      .catch(() => {
-        clearTimeout(timeout);
-        res.json({ title: null, description: null, image: null, url });
-      });
+    const preview = await fetchLinkPreview(url);
+    const asAny = preview as any;
+    if (asAny.error) return res.status(400).json({ error: asAny.error });
+    res.json(preview);
   } catch {
     res.json({ title: null, description: null, image: null, url });
   }

server/src/routes/dayNotes.ts

@@ -1,48 +1,33 @@
 import express, { Request, Response } from 'express';
-import { db, canAccessTrip } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { broadcast } from '../websocket';
 import { validateStringLengths } from '../middleware/validate';
 import { checkPermission } from '../services/permissions';
-import { AuthRequest, DayNote } from '../types';
+import { AuthRequest } from '../types';
+import * as dayNoteService from '../services/dayNoteService';
 
 const router = express.Router({ mergeParams: true });
 
-function verifyAccess(tripId: string | number, userId: number) {
-  return canAccessTrip(tripId, userId);
-}
-
 router.get('/', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, dayId } = req.params;
-  if (!verifyAccess(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
-
-  const notes = db.prepare(
-    'SELECT * FROM day_notes WHERE day_id = ? AND trip_id = ? ORDER BY sort_order ASC, created_at ASC'
-  ).all(dayId, tripId);
-
-  res.json({ notes });
+  if (!dayNoteService.verifyTripAccess(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  res.json({ notes: dayNoteService.listNotes(dayId, tripId) });
 });
 
 router.post('/', authenticate, validateStringLengths({ text: 500, time: 150 }), (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, dayId } = req.params;
-  const access = verifyAccess(tripId, authReq.user.id);
+  const access = dayNoteService.verifyTripAccess(tripId, authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('day_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
-
-  const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-  if (!day) return res.status(404).json({ error: 'Day not found' });
+  if (!dayNoteService.dayExists(dayId, tripId)) return res.status(404).json({ error: 'Day not found' });
 
   const { text, time, icon, sort_order } = req.body;
   if (!text?.trim()) return res.status(400).json({ error: 'Text required' });
 
-  const result = db.prepare(
-    'INSERT INTO day_notes (day_id, trip_id, text, time, icon, sort_order) VALUES (?, ?, ?, ?, ?, ?)'
-  ).run(dayId, tripId, text.trim(), time || null, icon || '\uD83D\uDCDD', sort_order ?? 9999);
-
-  const note = db.prepare('SELECT * FROM day_notes WHERE id = ?').get(result.lastInsertRowid);
+  const note = dayNoteService.createNote(dayId, tripId, text, time, icon, sort_order);
   res.status(201).json({ note });
   broadcast(tripId, 'dayNote:created', { dayId: Number(dayId), note }, req.headers['x-socket-id'] as string);
 });
@@ -50,26 +35,16 @@ router.post('/', authenticate, validateStringLengths({ text: 500, time: 150 }),
 router.put('/:id', authenticate, validateStringLengths({ text: 500, time: 150 }), (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, dayId, id } = req.params;
-  const access = verifyAccess(tripId, authReq.user.id);
+  const access = dayNoteService.verifyTripAccess(tripId, authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('day_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const note = db.prepare('SELECT * FROM day_notes WHERE id = ? AND day_id = ? AND trip_id = ?').get(id, dayId, tripId) as DayNote | undefined;
-  if (!note) return res.status(404).json({ error: 'Note not found' });
+  const current = dayNoteService.getNote(id, dayId, tripId);
+  if (!current) return res.status(404).json({ error: 'Note not found' });
 
   const { text, time, icon, sort_order } = req.body;
-  db.prepare(
-    'UPDATE day_notes SET text = ?, time = ?, icon = ?, sort_order = ? WHERE id = ?'
-  ).run(
-    text !== undefined ? text.trim() : note.text,
-    time !== undefined ? time : note.time,
-    icon !== undefined ? icon : note.icon,
-    sort_order !== undefined ? sort_order : note.sort_order,
-    id
-  );
-
-  const updated = db.prepare('SELECT * FROM day_notes WHERE id = ?').get(id);
+  const updated = dayNoteService.updateNote(id, current, { text, time, icon, sort_order });
   res.json({ note: updated });
   broadcast(tripId, 'dayNote:updated', { dayId: Number(dayId), note: updated }, req.headers['x-socket-id'] as string);
 });
@@ -77,15 +52,13 @@ router.put('/:id', authenticate, validateStringLengths({ text: 500, time: 150 })
 router.delete('/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, dayId, id } = req.params;
-  const access = verifyAccess(tripId, authReq.user.id);
+  const access = dayNoteService.verifyTripAccess(tripId, authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('day_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const note = db.prepare('SELECT id FROM day_notes WHERE id = ? AND day_id = ? AND trip_id = ?').get(id, dayId, tripId);
-  if (!note) return res.status(404).json({ error: 'Note not found' });
-
-  db.prepare('DELETE FROM day_notes WHERE id = ?').run(id);
+  if (!dayNoteService.getNote(id, dayId, tripId)) return res.status(404).json({ error: 'Note not found' });
+  dayNoteService.deleteNote(id);
   res.json({ success: true });
   broadcast(tripId, 'dayNote:deleted', { noteId: Number(id), dayId: Number(dayId) }, req.headers['x-socket-id'] as string);
 });

server/src/routes/days.ts

@@ -1,129 +1,16 @@
 import express, { Request, Response } from 'express';
-import { db } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { requireTripAccess } from '../middleware/tripAccess';
 import { broadcast } from '../websocket';
-import { loadTagsByPlaceIds, loadParticipantsByAssignmentIds, formatAssignmentWithPlace } from '../services/queryHelpers';
 import { checkPermission } from '../services/permissions';
-import { AuthRequest, AssignmentRow, Day, DayNote } from '../types';
+import { AuthRequest } from '../types';
+import * as dayService from '../services/dayService';
 
 const router = express.Router({ mergeParams: true });
 
-function getAssignmentsForDay(dayId: number | string) {
-  const assignments = db.prepare(`
-    SELECT da.*, p.id as place_id, p.name as place_name, p.description as place_description,
-      p.lat, p.lng, p.address, p.category_id, p.price, p.currency as place_currency,
-      COALESCE(da.assignment_time, p.place_time) as place_time,
-      COALESCE(da.assignment_end_time, p.end_time) as end_time,
-      p.duration_minutes, p.notes as place_notes,
-      p.image_url, p.transport_mode, p.google_place_id, p.website, p.phone,
-      c.name as category_name, c.color as category_color, c.icon as category_icon
-    FROM day_assignments da
-    JOIN places p ON da.place_id = p.id
-    LEFT JOIN categories c ON p.category_id = c.id
-    WHERE da.day_id = ?
-    ORDER BY da.order_index ASC, da.created_at ASC
-  `).all(dayId) as AssignmentRow[];
-
-  return assignments.map(a => {
-    const tags = db.prepare(`
-      SELECT t.* FROM tags t
-      JOIN place_tags pt ON t.id = pt.tag_id
-      WHERE pt.place_id = ?
-    `).all(a.place_id);
-
-    return {
-      id: a.id,
-      day_id: a.day_id,
-      order_index: a.order_index,
-      notes: a.notes,
-      created_at: a.created_at,
-      place: {
-        id: a.place_id,
-        name: a.place_name,
-        description: a.place_description,
-        lat: a.lat,
-        lng: a.lng,
-        address: a.address,
-        category_id: a.category_id,
-        price: a.price,
-        currency: a.place_currency,
-        place_time: a.place_time,
-        end_time: a.end_time,
-        duration_minutes: a.duration_minutes,
-        notes: a.place_notes,
-        image_url: a.image_url,
-        transport_mode: a.transport_mode,
-        google_place_id: a.google_place_id,
-        website: a.website,
-        phone: a.phone,
-        category: a.category_id ? {
-          id: a.category_id,
-          name: a.category_name,
-          color: a.category_color,
-          icon: a.category_icon,
-        } : null,
-        tags,
-      }
-    };
-  });
-}
-
 router.get('/', authenticate, requireTripAccess, (req: Request, res: Response) => {
   const { tripId } = req.params;
-
-  const days = db.prepare('SELECT * FROM days WHERE trip_id = ? ORDER BY day_number ASC').all(tripId) as Day[];
-
-  if (days.length === 0) {
-    return res.json({ days: [] });
-  }
-
-  const dayIds = days.map(d => d.id);
-  const dayPlaceholders = dayIds.map(() => '?').join(',');
-
-  const allAssignments = db.prepare(`
-    SELECT da.*, p.id as place_id, p.name as place_name, p.description as place_description,
-      p.lat, p.lng, p.address, p.category_id, p.price, p.currency as place_currency,
-      COALESCE(da.assignment_time, p.place_time) as place_time,
-      COALESCE(da.assignment_end_time, p.end_time) as end_time,
-      p.duration_minutes, p.notes as place_notes,
-      p.image_url, p.transport_mode, p.google_place_id, p.website, p.phone,
-      c.name as category_name, c.color as category_color, c.icon as category_icon
-    FROM day_assignments da
-    JOIN places p ON da.place_id = p.id
-    LEFT JOIN categories c ON p.category_id = c.id
-    WHERE da.day_id IN (${dayPlaceholders})
-    ORDER BY da.order_index ASC, da.created_at ASC
-  `).all(...dayIds) as AssignmentRow[];
-
-  const placeIds = [...new Set(allAssignments.map(a => a.place_id))];
-  const tagsByPlaceId = loadTagsByPlaceIds(placeIds, { compact: true });
-
-  const allAssignmentIds = allAssignments.map(a => a.id);
-  const participantsByAssignment = loadParticipantsByAssignmentIds(allAssignmentIds);
-
-  const assignmentsByDayId: Record<number, ReturnType<typeof formatAssignmentWithPlace>[]> = {};
-  for (const a of allAssignments) {
-    if (!assignmentsByDayId[a.day_id]) assignmentsByDayId[a.day_id] = [];
-    assignmentsByDayId[a.day_id].push(formatAssignmentWithPlace(a, tagsByPlaceId[a.place_id] || [], participantsByAssignment[a.id] || []));
-  }
-
-  const allNotes = db.prepare(
-    `SELECT * FROM day_notes WHERE day_id IN (${dayPlaceholders}) ORDER BY sort_order ASC, created_at ASC`
-  ).all(...dayIds) as DayNote[];
-  const notesByDayId: Record<number, DayNote[]> = {};
-  for (const note of allNotes) {
-    if (!notesByDayId[note.day_id]) notesByDayId[note.day_id] = [];
-    notesByDayId[note.day_id].push(note);
-  }
-
-  const daysWithAssignments = days.map(day => ({
-    ...day,
-    assignments: assignmentsByDayId[day.id] || [],
-    notes_items: notesByDayId[day.id] || [],
-  }));
-
-  res.json({ days: daysWithAssignments });
+  res.json(dayService.listDays(tripId));
 });
 
 router.post('/', authenticate, requireTripAccess, (req: Request, res: Response) => {
@@ -134,18 +21,9 @@ router.post('/', authenticate, requireTripAccess, (req: Request, res: Response)
   const { tripId } = req.params;
   const { date, notes } = req.body;
 
-  const maxDay = db.prepare('SELECT MAX(day_number) as max FROM days WHERE trip_id = ?').get(tripId) as { max: number | null };
-  const dayNumber = (maxDay.max || 0) + 1;
-
-  const result = db.prepare(
-    'INSERT INTO days (trip_id, day_number, date, notes) VALUES (?, ?, ?, ?)'
-  ).run(tripId, dayNumber, date || null, notes || null);
-
-  const day = db.prepare('SELECT * FROM days WHERE id = ?').get(result.lastInsertRowid) as Day;
-
-  const dayResult = { ...day, assignments: [] };
-  res.status(201).json({ day: dayResult });
-  broadcast(tripId, 'day:created', { day: dayResult }, req.headers['x-socket-id'] as string);
+  const day = dayService.createDay(tripId, date, notes);
+  res.status(201).json({ day });
+  broadcast(tripId, 'day:created', { day }, req.headers['x-socket-id'] as string);
 });
 
 router.put('/:id', authenticate, requireTripAccess, (req: Request, res: Response) => {
@@ -155,18 +33,13 @@ router.put('/:id', authenticate, requireTripAccess, (req: Request, res: Response
 
   const { tripId, id } = req.params;
 
-  const day = db.prepare('SELECT * FROM days WHERE id = ? AND trip_id = ?').get(id, tripId) as Day | undefined;
-  if (!day) {
-    return res.status(404).json({ error: 'Day not found' });
-  }
+  const current = dayService.getDay(id, tripId);
+  if (!current) return res.status(404).json({ error: 'Day not found' });
 
   const { notes, title } = req.body;
-  db.prepare('UPDATE days SET notes = ?, title = ? WHERE id = ?').run(notes || null, title !== undefined ? title : day.title, id);
-
-  const updatedDay = db.prepare('SELECT * FROM days WHERE id = ?').get(id) as Day;
-  const dayWithAssignments = { ...updatedDay, assignments: getAssignmentsForDay(id) };
-  res.json({ day: dayWithAssignments });
-  broadcast(tripId, 'day:updated', { day: dayWithAssignments }, req.headers['x-socket-id'] as string);
+  const day = dayService.updateDay(id, current, { notes, title });
+  res.json({ day });
+  broadcast(tripId, 'day:updated', { day }, req.headers['x-socket-id'] as string);
 });
 
 router.delete('/:id', authenticate, requireTripAccess, (req: Request, res: Response) => {
@@ -176,39 +49,22 @@ router.delete('/:id', authenticate, requireTripAccess, (req: Request, res: Respo
 
   const { tripId, id } = req.params;
 
-  const day = db.prepare('SELECT * FROM days WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!day) {
-    return res.status(404).json({ error: 'Day not found' });
-  }
+  if (!dayService.getDay(id, tripId)) return res.status(404).json({ error: 'Day not found' });
 
-  db.prepare('DELETE FROM days WHERE id = ?').run(id);
+  dayService.deleteDay(id);
   res.json({ success: true });
   broadcast(tripId, 'day:deleted', { dayId: Number(id) }, req.headers['x-socket-id'] as string);
 });
 
-const accommodationsRouter = express.Router({ mergeParams: true });
+// ---------------------------------------------------------------------------
+// Accommodations sub-router
+// ---------------------------------------------------------------------------
 
-function getAccommodationWithPlace(id: number | bigint) {
-  return db.prepare(`
-    SELECT a.*, p.name as place_name, p.address as place_address, p.image_url as place_image, p.lat as place_lat, p.lng as place_lng
-    FROM day_accommodations a
-    JOIN places p ON a.place_id = p.id
-    WHERE a.id = ?
-  `).get(id);
-}
+const accommodationsRouter = express.Router({ mergeParams: true });
 
 accommodationsRouter.get('/', authenticate, requireTripAccess, (req: Request, res: Response) => {
   const { tripId } = req.params;
-
-  const accommodations = db.prepare(`
-    SELECT a.*, p.name as place_name, p.address as place_address, p.image_url as place_image, p.lat as place_lat, p.lng as place_lng
-    FROM day_accommodations a
-    JOIN places p ON a.place_id = p.id
-    WHERE a.trip_id = ?
-    ORDER BY a.created_at ASC
-  `).all(tripId);
-
-  res.json({ accommodations });
+  res.json({ accommodations: dayService.listAccommodations(tripId) });
 });
 
 accommodationsRouter.post('/', authenticate, requireTripAccess, (req: Request, res: Response) => {
@@ -223,37 +79,10 @@ accommodationsRouter.post('/', authenticate, requireTripAccess, (req: Request, r
     return res.status(400).json({ error: 'place_id, start_day_id, and end_day_id are required' });
   }
 
-  const place = db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId);
-  if (!place) return res.status(404).json({ error: 'Place not found' });
+  const errors = dayService.validateAccommodationRefs(tripId, place_id, start_day_id, end_day_id);
+  if (errors.length > 0) return res.status(404).json({ error: errors[0].message });
 
-  const startDay = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(start_day_id, tripId);
-  if (!startDay) return res.status(404).json({ error: 'Start day not found' });
-
-  const endDay = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(end_day_id, tripId);
-  if (!endDay) return res.status(404).json({ error: 'End day not found' });
-
-  const result = db.prepare(
-    'INSERT INTO day_accommodations (trip_id, place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'
-  ).run(tripId, place_id, start_day_id, end_day_id, check_in || null, check_out || null, confirmation || null, notes || null);
-
-  const accommodationId = result.lastInsertRowid;
-
-  // Auto-create linked reservation for this accommodation
-  const placeName = (db.prepare('SELECT name FROM places WHERE id = ?').get(place_id) as { name: string } | undefined)?.name || 'Hotel';
-  const startDayDate = (db.prepare('SELECT date FROM days WHERE id = ?').get(start_day_id) as { date: string } | undefined)?.date || null;
-  const meta: Record<string, string> = {};
-  if (check_in) meta.check_in_time = check_in;
-  if (check_out) meta.check_out_time = check_out;
-  db.prepare(`
-    INSERT INTO reservations (trip_id, day_id, title, reservation_time, location, confirmation_number, notes, status, type, accommodation_id, metadata)
-    VALUES (?, ?, ?, ?, ?, ?, ?, 'confirmed', 'hotel', ?, ?)
-  `).run(
-    tripId, start_day_id, placeName, startDayDate || null, null,
-    confirmation || null, notes || null, accommodationId,
-    Object.keys(meta).length > 0 ? JSON.stringify(meta) : null
-  );
-
-  const accommodation = getAccommodationWithPlace(accommodationId);
+  const accommodation = dayService.createAccommodation(tripId, { place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes });
   res.status(201).json({ accommodation });
   broadcast(tripId, 'accommodation:created', { accommodation }, req.headers['x-socket-id'] as string);
   broadcast(tripId, 'reservation:created', {}, req.headers['x-socket-id'] as string);
@@ -266,50 +95,15 @@ accommodationsRouter.put('/:id', authenticate, requireTripAccess, (req: Request,
 
   const { tripId, id } = req.params;
 
-  interface DayAccommodation { id: number; trip_id: number; place_id: number; start_day_id: number; end_day_id: number; check_in: string | null; check_out: string | null; confirmation: string | null; notes: string | null; }
-  const existing = db.prepare('SELECT * FROM day_accommodations WHERE id = ? AND trip_id = ?').get(id, tripId) as DayAccommodation | undefined;
+  const existing = dayService.getAccommodation(id, tripId);
   if (!existing) return res.status(404).json({ error: 'Accommodation not found' });
 
   const { place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes } = req.body;
 
-  const newPlaceId = place_id !== undefined ? place_id : existing.place_id;
-  const newStartDayId = start_day_id !== undefined ? start_day_id : existing.start_day_id;
-  const newEndDayId = end_day_id !== undefined ? end_day_id : existing.end_day_id;
-  const newCheckIn = check_in !== undefined ? check_in : existing.check_in;
-  const newCheckOut = check_out !== undefined ? check_out : existing.check_out;
-  const newConfirmation = confirmation !== undefined ? confirmation : existing.confirmation;
-  const newNotes = notes !== undefined ? notes : existing.notes;
+  const errors = dayService.validateAccommodationRefs(tripId, place_id, start_day_id, end_day_id);
+  if (errors.length > 0) return res.status(404).json({ error: errors[0].message });
 
-  if (place_id !== undefined) {
-    const place = db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId);
-    if (!place) return res.status(404).json({ error: 'Place not found' });
-  }
-
-  if (start_day_id !== undefined) {
-    const startDay = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(start_day_id, tripId);
-    if (!startDay) return res.status(404).json({ error: 'Start day not found' });
-  }
-
-  if (end_day_id !== undefined) {
-    const endDay = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(end_day_id, tripId);
-    if (!endDay) return res.status(404).json({ error: 'End day not found' });
-  }
-
-  db.prepare(
-    'UPDATE day_accommodations SET place_id = ?, start_day_id = ?, end_day_id = ?, check_in = ?, check_out = ?, confirmation = ?, notes = ? WHERE id = ?'
-  ).run(newPlaceId, newStartDayId, newEndDayId, newCheckIn, newCheckOut, newConfirmation, newNotes, id);
-
-  // Sync check-in/out/confirmation to linked reservation
-  const linkedRes = db.prepare('SELECT id, metadata FROM reservations WHERE accommodation_id = ?').get(Number(id)) as { id: number; metadata: string | null } | undefined;
-  if (linkedRes) {
-    const meta = linkedRes.metadata ? JSON.parse(linkedRes.metadata) : {};
-    if (newCheckIn) meta.check_in_time = newCheckIn;
-    if (newCheckOut) meta.check_out_time = newCheckOut;
-    db.prepare('UPDATE reservations SET metadata = ?, confirmation_number = COALESCE(?, confirmation_number) WHERE id = ?')
-      .run(JSON.stringify(meta), newConfirmation || null, linkedRes.id);
-  }
-
-  const accommodation = getAccommodationWithPlace(Number(id));
+  const accommodation = dayService.updateAccommodation(id, existing, { place_id, start_day_id, end_day_id, check_in, check_out, confirmation, notes });
   res.json({ accommodation });
   broadcast(tripId, 'accommodation:updated', { accommodation }, req.headers['x-socket-id'] as string);
 });
@@ -321,17 +115,13 @@ accommodationsRouter.delete('/:id', authenticate, requireTripAccess, (req: Reque
 
   const { tripId, id } = req.params;
 
-  const existing = db.prepare('SELECT * FROM day_accommodations WHERE id = ? AND trip_id = ?').get(id, tripId);
-  if (!existing) return res.status(404).json({ error: 'Accommodation not found' });
+  if (!dayService.getAccommodation(id, tripId)) return res.status(404).json({ error: 'Accommodation not found' });
 
-  // Delete linked reservation
-  const linkedRes = db.prepare('SELECT id FROM reservations WHERE accommodation_id = ?').get(Number(id)) as { id: number } | undefined;
-  if (linkedRes) {
-    db.prepare('DELETE FROM reservations WHERE id = ?').run(linkedRes.id);
-    broadcast(tripId, 'reservation:deleted', { reservationId: linkedRes.id }, req.headers['x-socket-id'] as string);
+  const { linkedReservationId } = dayService.deleteAccommodation(id);
+  if (linkedReservationId) {
+    broadcast(tripId, 'reservation:deleted', { reservationId: linkedReservationId }, req.headers['x-socket-id'] as string);
   }
 
-  db.prepare('DELETE FROM day_accommodations WHERE id = ?').run(id);
   res.json({ success: true });
   broadcast(tripId, 'accommodation:deleted', { accommodationId: Number(id) }, req.headers['x-socket-id'] as string);
 });

server/src/routes/files.ts

@@ -3,20 +3,41 @@ import multer from 'multer';
 import path from 'path';
 import fs from 'fs';
 import { v4 as uuidv4 } from 'uuid';
-import jwt from 'jsonwebtoken';
-import { JWT_SECRET } from '../config';
-import { db, canAccessTrip } from '../db/database';
-import { consumeEphemeralToken } from '../services/ephemeralTokens';
 import { authenticate, demoUploadBlock } from '../middleware/auth';
 import { requireTripAccess } from '../middleware/tripAccess';
 import { broadcast } from '../websocket';
-import { AuthRequest, TripFile } from '../types';
+import { AuthRequest } from '../types';
 import { checkPermission } from '../services/permissions';
+import {
+  MAX_FILE_SIZE,
+  BLOCKED_EXTENSIONS,
+  filesDir,
+  getAllowedExtensions,
+  verifyTripAccess,
+  formatFile,
+  resolveFilePath,
+  authenticateDownload,
+  listFiles,
+  getFileById,
+  getFileByIdFull,
+  getDeletedFile,
+  createFile,
+  updateFile,
+  toggleStarred,
+  softDeleteFile,
+  restoreFile,
+  permanentDeleteFile,
+  emptyTrash,
+  createFileLink,
+  deleteFileLink,
+  getFileLinks,
+} from '../services/fileService';
 
 const router = express.Router({ mergeParams: true });
 
-const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50 MB
-const filesDir = path.join(__dirname, '../../uploads/files');
+// ---------------------------------------------------------------------------
+// Multer setup (HTTP middleware — stays in route)
+// ---------------------------------------------------------------------------
 
 const storage = multer.diskStorage({
   destination: (_req, _file, cb) => {
@@ -29,16 +50,6 @@ const storage = multer.diskStorage({
   },
 });
 
-const DEFAULT_ALLOWED_EXTENSIONS = 'jpg,jpeg,png,gif,webp,heic,pdf,doc,docx,xls,xlsx,txt,csv';
-const BLOCKED_EXTENSIONS = ['.svg', '.html', '.htm', '.xml'];
-
-function getAllowedExtensions(): string {
-  try {
-    const row = db.prepare("SELECT value FROM app_settings WHERE key = 'allowed_file_types'").get() as { value: string } | undefined;
-    return row?.value || DEFAULT_ALLOWED_EXTENSIONS;
-  } catch { return DEFAULT_ALLOWED_EXTENSIONS; }
-}
-
 const upload = multer({
   storage,
   limits: { fileSize: MAX_FILE_SIZE },
@@ -46,121 +57,60 @@ const upload = multer({
   fileFilter: (_req, file, cb) => {
     const ext = path.extname(file.originalname).toLowerCase();
     if (BLOCKED_EXTENSIONS.includes(ext) || file.mimetype.includes('svg')) {
-      return cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      return cb(err);
     }
     const allowed = getAllowedExtensions().split(',').map(e => e.trim().toLowerCase());
     const fileExt = ext.replace('.', '');
     if (allowed.includes(fileExt) || (allowed.includes('*') && !BLOCKED_EXTENSIONS.includes(ext))) {
       cb(null, true);
     } else {
-      cb(new Error('File type not allowed'));
+      const err: Error & { statusCode?: number } = new Error('File type not allowed');
+      err.statusCode = 400;
+      cb(err);
     }
   },
 });
 
-function verifyTripOwnership(tripId: string | number, userId: number) {
-  return canAccessTrip(tripId, userId);
-}
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
 
-const FILE_SELECT = `
-  SELECT f.*, r.title as reservation_title, u.username as uploaded_by_name, u.avatar as uploaded_by_avatar
-  FROM trip_files f
-  LEFT JOIN reservations r ON f.reservation_id = r.id
-  LEFT JOIN users u ON f.uploaded_by = u.id
-`;
-
-function formatFile(file: TripFile & { trip_id?: number }) {
-  const tripId = file.trip_id;
-  return {
-    ...file,
-    url: `/api/trips/${tripId}/files/${file.id}/download`,
-  };
-}
-
-function getPlaceFiles(tripId: string | number, placeId: number) {
-  return (db.prepare('SELECT * FROM trip_files WHERE trip_id = ? AND place_id = ? AND deleted_at IS NULL ORDER BY created_at DESC').all(tripId, placeId) as (TripFile & { trip_id: number })[]).map(formatFile);
-}
-
-// Authenticated file download (supports Bearer header or ?token= query param for direct links)
+// Authenticated file download (supports Bearer header or ?token= query param)
 router.get('/:id/download', (req: Request, res: Response) => {
   const { tripId, id } = req.params;
 
-  // Accept token from Authorization header (JWT) or query parameter (ephemeral token)
   const authHeader = req.headers['authorization'];
   const bearerToken = authHeader && authHeader.split(' ')[1];
   const queryToken = req.query.token as string | undefined;
 
-  if (!bearerToken && !queryToken) return res.status(401).json({ error: 'Authentication required' });
+  const auth = authenticateDownload(bearerToken, queryToken);
+  if ('error' in auth) return res.status(auth.status).json({ error: auth.error });
 
-  let userId: number;
-  if (bearerToken) {
-    try {
-      const decoded = jwt.verify(bearerToken, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
-      userId = decoded.id;
-    } catch {
-      return res.status(401).json({ error: 'Invalid or expired token' });
-    }
-  } else {
-    const uid = consumeEphemeralToken(queryToken!, 'download');
-    if (!uid) return res.status(401).json({ error: 'Invalid or expired token' });
-    userId = uid;
-  }
-
-  const trip = verifyTripOwnership(tripId, userId);
+  const trip = verifyTripAccess(tripId, auth.userId);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId) as TripFile | undefined;
+  const file = getFileById(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found' });
 
-  const safeName = path.basename(file.filename);
-  const filePath = path.join(filesDir, safeName);
-  const resolved = path.resolve(filePath);
-  if (!resolved.startsWith(path.resolve(filesDir))) {
-    return res.status(403).json({ error: 'Forbidden' });
-  }
-
+  const { resolved, safe } = resolveFilePath(file.filename);
+  if (!safe) return res.status(403).json({ error: 'Forbidden' });
   if (!fs.existsSync(resolved)) return res.status(404).json({ error: 'File not found' });
+
   res.sendFile(resolved);
 });
 
 // List files (excludes soft-deleted by default)
-interface FileLink {
-  file_id: number;
-  reservation_id: number | null;
-  place_id: number | null;
-}
-
 router.get('/', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
   const showTrash = req.query.trash === 'true';
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
-  const where = showTrash ? 'f.trip_id = ? AND f.deleted_at IS NOT NULL' : 'f.trip_id = ? AND f.deleted_at IS NULL';
-  const files = db.prepare(`${FILE_SELECT} WHERE ${where} ORDER BY f.starred DESC, f.created_at DESC`).all(tripId) as TripFile[];
-
-  // Get all file_links for this trip's files
-  const fileIds = files.map(f => f.id);
-  let linksMap: Record<number, FileLink[]> = {};
-  if (fileIds.length > 0) {
-    const placeholders = fileIds.map(() => '?').join(',');
-    const links = db.prepare(`SELECT file_id, reservation_id, place_id FROM file_links WHERE file_id IN (${placeholders})`).all(...fileIds) as FileLink[];
-    for (const link of links) {
-      if (!linksMap[link.file_id]) linksMap[link.file_id] = [];
-      linksMap[link.file_id].push(link);
-    }
-  }
-
-  res.json({ files: files.map(f => {
-    const fileLinks = linksMap[f.id] || [];
-    return {
-      ...formatFile(f),
-      linked_reservation_ids: fileLinks.filter(l => l.reservation_id).map(l => l.reservation_id),
-      linked_place_ids: fileLinks.filter(l => l.place_id).map(l => l.place_id),
-    };
-  })});
+  res.json({ files: listFiles(tripId, showTrash) });
 });
 
 // Upload file
@@ -170,30 +120,13 @@ router.post('/', authenticate, requireTripAccess, demoUploadBlock, upload.single
   const { user_id: tripOwnerId } = authReq.trip!;
   if (!checkPermission('file_upload', authReq.user.role, tripOwnerId, authReq.user.id, tripOwnerId !== authReq.user.id))
     return res.status(403).json({ error: 'No permission to upload files' });
+
+  if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
+
   const { place_id, description, reservation_id } = req.body;
-
-  if (!req.file) {
-    return res.status(400).json({ error: 'No file uploaded' });
-  }
-
-  const result = db.prepare(`
-    INSERT INTO trip_files (trip_id, place_id, reservation_id, filename, original_name, file_size, mime_type, description, uploaded_by)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(
-    tripId,
-    place_id || null,
-    reservation_id || null,
-    req.file.filename,
-    req.file.originalname,
-    req.file.size,
-    req.file.mimetype,
-    description || null,
-    authReq.user.id
-  );
-
-  const file = db.prepare(`${FILE_SELECT} WHERE f.id = ?`).get(result.lastInsertRowid) as TripFile;
-  res.status(201).json({ file: formatFile(file) });
-  broadcast(tripId, 'file:created', { file: formatFile(file) }, req.headers['x-socket-id'] as string);
+  const created = createFile(tripId, req.file, authReq.user.id, { place_id, description, reservation_id });
+  res.status(201).json({ file: created });
+  broadcast(tripId, 'file:created', { file: created }, req.headers['x-socket-id'] as string);
 });
 
 // Update file metadata
@@ -202,30 +135,17 @@ router.put('/:id', authenticate, (req: Request, res: Response) => {
   const { tripId, id } = req.params;
   const { description, place_id, reservation_id } = req.body;
 
-  const access = canAccessTrip(tripId, authReq.user.id);
+  const access = verifyTripAccess(tripId, authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_edit', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission to edit files' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId) as TripFile | undefined;
+  const file = getFileById(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found' });
 
-  db.prepare(`
-    UPDATE trip_files SET
-      description = ?,
-      place_id = ?,
-      reservation_id = ?
-    WHERE id = ?
-  `).run(
-    description !== undefined ? description : file.description,
-    place_id !== undefined ? (place_id || null) : file.place_id,
-    reservation_id !== undefined ? (reservation_id || null) : file.reservation_id,
-    id
-  );
-
-  const updated = db.prepare(`${FILE_SELECT} WHERE f.id = ?`).get(id) as TripFile;
-  res.json({ file: formatFile(updated) });
-  broadcast(tripId, 'file:updated', { file: formatFile(updated) }, req.headers['x-socket-id'] as string);
+  const updated = updateFile(id, file, { description, place_id, reservation_id });
+  res.json({ file: updated });
+  broadcast(tripId, 'file:updated', { file: updated }, req.headers['x-socket-id'] as string);
 });
 
 // Toggle starred
@@ -233,20 +153,17 @@ router.patch('/:id/star', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId) as TripFile | undefined;
+  const file = getFileById(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found' });
 
-  const newStarred = file.starred ? 0 : 1;
-  db.prepare('UPDATE trip_files SET starred = ? WHERE id = ?').run(newStarred, id);
-
-  const updated = db.prepare(`${FILE_SELECT} WHERE f.id = ?`).get(id) as TripFile;
-  res.json({ file: formatFile(updated) });
-  broadcast(tripId, 'file:updated', { file: formatFile(updated) }, req.headers['x-socket-id'] as string);
+  const updated = toggleStarred(id, file.starred);
+  res.json({ file: updated });
+  broadcast(tripId, 'file:updated', { file: updated }, req.headers['x-socket-id'] as string);
 });
 
 // Soft-delete (move to trash)
@@ -254,15 +171,15 @@ router.delete('/:id', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const access = canAccessTrip(tripId, authReq.user.id);
+  const access = verifyTripAccess(tripId, authReq.user.id);
   if (!access) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_delete', authReq.user.role, access.user_id, authReq.user.id, access.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission to delete files' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId) as TripFile | undefined;
+  const file = getFileById(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found' });
 
-  db.prepare('UPDATE trip_files SET deleted_at = CURRENT_TIMESTAMP WHERE id = ?').run(id);
+  softDeleteFile(id);
   res.json({ success: true });
   broadcast(tripId, 'file:deleted', { fileId: Number(id) }, req.headers['x-socket-id'] as string);
 });
@@ -272,19 +189,17 @@ router.post('/:id/restore', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_delete', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ? AND deleted_at IS NOT NULL').get(id, tripId) as TripFile | undefined;
+  const file = getDeletedFile(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found in trash' });
 
-  db.prepare('UPDATE trip_files SET deleted_at = NULL WHERE id = ?').run(id);
-
-  const restored = db.prepare(`${FILE_SELECT} WHERE f.id = ?`).get(id) as TripFile;
-  res.json({ file: formatFile(restored) });
-  broadcast(tripId, 'file:created', { file: formatFile(restored) }, req.headers['x-socket-id'] as string);
+  const restored = restoreFile(id);
+  res.json({ file: restored });
+  broadcast(tripId, 'file:created', { file: restored }, req.headers['x-socket-id'] as string);
 });
 
 // Permanently delete from trash
@@ -292,20 +207,15 @@ router.delete('/:id/permanent', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_delete', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ? AND deleted_at IS NOT NULL').get(id, tripId) as TripFile | undefined;
+  const file = getDeletedFile(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found in trash' });
 
-  const filePath = path.join(filesDir, file.filename);
-  if (fs.existsSync(filePath)) {
-    try { fs.unlinkSync(filePath); } catch (e) { console.error('Error deleting file:', e); }
-  }
-
-  db.prepare('DELETE FROM trip_files WHERE id = ?').run(id);
+  permanentDeleteFile(file);
   res.json({ success: true });
   broadcast(tripId, 'file:deleted', { fileId: Number(id) }, req.headers['x-socket-id'] as string);
 });
@@ -315,21 +225,13 @@ router.delete('/trash/empty', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_delete', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const trashed = db.prepare('SELECT * FROM trip_files WHERE trip_id = ? AND deleted_at IS NOT NULL').all(tripId) as TripFile[];
-  for (const file of trashed) {
-    const filePath = path.join(filesDir, file.filename);
-    if (fs.existsSync(filePath)) {
-      try { fs.unlinkSync(filePath); } catch (e) { console.error('Error deleting file:', e); }
-    }
-  }
-
-  db.prepare('DELETE FROM trip_files WHERE trip_id = ? AND deleted_at IS NOT NULL').run(tripId);
-  res.json({ success: true, deleted: trashed.length });
+  const deleted = emptyTrash(tripId);
+  res.json({ success: true, deleted });
 });
 
 // Link a file to a reservation (many-to-many)
@@ -338,23 +240,15 @@ router.post('/:id/link', authenticate, (req: Request, res: Response) => {
   const { tripId, id } = req.params;
   const { reservation_id, assignment_id, place_id } = req.body;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  const file = db.prepare('SELECT * FROM trip_files WHERE id = ? AND trip_id = ?').get(id, tripId);
+  const file = getFileById(id, tripId);
   if (!file) return res.status(404).json({ error: 'File not found' });
 
-  try {
-    db.prepare('INSERT OR IGNORE INTO file_links (file_id, reservation_id, assignment_id, place_id) VALUES (?, ?, ?, ?)').run(
-      id, reservation_id || null, assignment_id || null, place_id || null
-    );
-  } catch (err) {
-    console.error('[Files] Error creating file link:', err instanceof Error ? err.message : err);
-  }
-
-  const links = db.prepare('SELECT * FROM file_links WHERE file_id = ?').all(id);
+  const links = createFileLink(id, { reservation_id, assignment_id, place_id });
   res.json({ success: true, links });
 });
 
@@ -363,12 +257,12 @@ router.delete('/:id/link/:linkId', authenticate, (req: Request, res: Response) =
   const authReq = req as AuthRequest;
   const { tripId, id, linkId } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
   if (!checkPermission('file_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
     return res.status(403).json({ error: 'No permission' });
 
-  db.prepare('DELETE FROM file_links WHERE id = ? AND file_id = ?').run(linkId, id);
+  deleteFileLink(linkId, id);
   res.json({ success: true });
 });
 
@@ -377,15 +271,10 @@ router.get('/:id/links', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, id } = req.params;
 
-  const trip = verifyTripOwnership(tripId, authReq.user.id);
+  const trip = verifyTripAccess(tripId, authReq.user.id);
   if (!trip) return res.status(404).json({ error: 'Trip not found' });
 
-  const links = db.prepare(`
-    SELECT fl.*, r.title as reservation_title
-    FROM file_links fl
-    LEFT JOIN reservations r ON fl.reservation_id = r.id
-    WHERE fl.file_id = ?
-  `).all(id);
+  const links = getFileLinks(id);
   res.json({ links });
 });
 

server/src/routes/immich.ts

@@ -4,295 +4,34 @@ import { authenticate } from '../middleware/auth';
 import { broadcast } from '../websocket';
 import { AuthRequest } from '../types';
 import { consumeEphemeralToken } from '../services/ephemeralTokens';
-import { maybe_encrypt_api_key, decrypt_api_key } from '../services/apiKeyCrypto';
-import { checkSsrf } from '../utils/ssrfGuard';
-import { writeAudit, getClientIp } from '../services/auditLog';
+import { getClientIp } from '../services/auditLog';
+import {
+  getConnectionSettings,
+  saveImmichSettings,
+  testConnection,
+  getConnectionStatus,
+  browseTimeline,
+  searchPhotos,
+  listTripPhotos,
+  addTripPhotos,
+  removeTripPhoto,
+  togglePhotoSharing,
+  getAssetInfo,
+  proxyThumbnail,
+  proxyOriginal,
+  isValidAssetId,
+  canAccessUserPhoto,
+  listAlbums,
+  listAlbumLinks,
+  createAlbumLink,
+  deleteAlbumLink,
+  syncAlbumAssets,
+} from '../services/immichService';
 
 const router = express.Router();
 
-function getImmichCredentials(userId: number) {
-  const user = db.prepare('SELECT immich_url, immich_api_key FROM users WHERE id = ?').get(userId) as any;
-  if (!user?.immich_url || !user?.immich_api_key) return null;
-  return { immich_url: user.immich_url as string, immich_api_key: decrypt_api_key(user.immich_api_key) as string };
-}
+// ── Dual auth middleware (JWT or ephemeral token for <img> src) ─────────────
 
-/** Validate that an asset ID is a safe UUID-like string (no path traversal). */
-function isValidAssetId(id: string): boolean {
-  return /^[a-zA-Z0-9_-]+$/.test(id) && id.length <= 100;
-}
-
-// ── Immich Connection Settings ──────────────────────────────────────────────
-
-router.get('/settings', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const creds = getImmichCredentials(authReq.user.id);
-  res.json({
-    immich_url: creds?.immich_url || '',
-    connected: !!(creds?.immich_url && creds?.immich_api_key),
-  });
-});
-
-router.put('/settings', authenticate, async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { immich_url, immich_api_key } = req.body;
-
-  if (immich_url) {
-    const ssrf = await checkSsrf(immich_url.trim());
-    if (!ssrf.allowed) {
-      return res.status(400).json({ error: `Invalid Immich URL: ${ssrf.error}` });
-    }
-    db.prepare('UPDATE users SET immich_url = ?, immich_api_key = ? WHERE id = ?').run(
-      immich_url.trim(),
-      maybe_encrypt_api_key(immich_api_key),
-      authReq.user.id
-    );
-    if (ssrf.isPrivate) {
-      writeAudit({
-        userId: authReq.user.id,
-        action: 'immich.private_ip_configured',
-        ip: getClientIp(req),
-        details: { immich_url: immich_url.trim(), resolved_ip: ssrf.resolvedIp },
-      });
-      return res.json({
-        success: true,
-        warning: `Immich URL resolves to a private IP address (${ssrf.resolvedIp}). Make sure this is intentional.`,
-      });
-    }
-  } else {
-    db.prepare('UPDATE users SET immich_url = ?, immich_api_key = ? WHERE id = ?').run(
-      null,
-      maybe_encrypt_api_key(immich_api_key),
-      authReq.user.id
-    );
-  }
-
-  res.json({ success: true });
-});
-
-router.get('/status', authenticate, async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) {
-    return res.json({ connected: false, error: 'Not configured' });
-  }
-  try {
-    const resp = await fetch(`${creds.immich_url}/api/users/me`, {
-      headers: { 'x-api-key': creds.immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!resp.ok) return res.json({ connected: false, error: `HTTP ${resp.status}` });
-    const data = await resp.json() as { name?: string; email?: string };
-    res.json({ connected: true, user: { name: data.name, email: data.email } });
-  } catch (err: unknown) {
-    res.json({ connected: false, error: err instanceof Error ? err.message : 'Connection failed' });
-  }
-});
-
-// Test connection with provided credentials (without saving)
-router.post('/test', authenticate, async (req: Request, res: Response) => {
-  const { immich_url, immich_api_key } = req.body;
-  if (!immich_url || !immich_api_key) return res.json({ connected: false, error: 'URL and API key required' });
-  const ssrf = await checkSsrf(immich_url);
-  if (!ssrf.allowed) return res.json({ connected: false, error: ssrf.error ?? 'Invalid Immich URL' });
-  try {
-    const resp = await fetch(`${immich_url}/api/users/me`, {
-      headers: { 'x-api-key': immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!resp.ok) return res.json({ connected: false, error: `HTTP ${resp.status}` });
-    const data = await resp.json() as { name?: string; email?: string };
-    res.json({ connected: true, user: { name: data.name, email: data.email } });
-  } catch (err: unknown) {
-    res.json({ connected: false, error: err instanceof Error ? err.message : 'Connection failed' });
-  }
-});
-
-// ── Browse Immich Library (for photo picker) ────────────────────────────────
-
-router.get('/browse', authenticate, async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { page = '1', size = '50' } = req.query;
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) return res.status(400).json({ error: 'Immich not configured' });
-
-  try {
-    const resp = await fetch(`${creds.immich_url}/api/timeline/buckets`, {
-      method: 'GET',
-      headers: { 'x-api-key': creds.immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(15000),
-    });
-    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed to fetch from Immich' });
-    const buckets = await resp.json();
-    res.json({ buckets });
-  } catch (err: unknown) {
-    res.status(502).json({ error: 'Could not reach Immich' });
-  }
-});
-
-// Search photos by date range (for the date-filter in picker)
-router.post('/search', authenticate, async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { from, to } = req.body;
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) return res.status(400).json({ error: 'Immich not configured' });
-
-  try {
-    // Paginate through all results (Immich limits per-page to 1000)
-    const allAssets: any[] = [];
-    let page = 1;
-    const pageSize = 1000;
-    while (true) {
-      const resp = await fetch(`${creds.immich_url}/api/search/metadata`, {
-        method: 'POST',
-        headers: { 'x-api-key': creds.immich_api_key, 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          takenAfter: from ? `${from}T00:00:00.000Z` : undefined,
-          takenBefore: to ? `${to}T23:59:59.999Z` : undefined,
-          type: 'IMAGE',
-          size: pageSize,
-          page,
-        }),
-        signal: AbortSignal.timeout(15000),
-      });
-      if (!resp.ok) return res.status(resp.status).json({ error: 'Search failed' });
-      const data = await resp.json() as { assets?: { items?: any[] } };
-      const items = data.assets?.items || [];
-      allAssets.push(...items);
-      if (items.length < pageSize) break; // Last page
-      page++;
-      if (page > 20) break; // Safety limit (20k photos max)
-    }
-    const assets = allAssets.map((a: any) => ({
-      id: a.id,
-      takenAt: a.fileCreatedAt || a.createdAt,
-      city: a.exifInfo?.city || null,
-      country: a.exifInfo?.country || null,
-    }));
-    res.json({ assets });
-  } catch {
-    res.status(502).json({ error: 'Could not reach Immich' });
-  }
-});
-
-// ── Trip Photos (selected by user) ──────────────────────────────────────────
-
-// Get all photos for a trip (own + shared by others)
-router.get('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { tripId } = req.params;
-  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
-
-  const photos = db.prepare(`
-    SELECT tp.immich_asset_id, tp.user_id, tp.shared, tp.added_at,
-           u.username, u.avatar, u.immich_url
-    FROM trip_photos tp
-    JOIN users u ON tp.user_id = u.id
-    WHERE tp.trip_id = ?
-    AND (tp.user_id = ? OR tp.shared = 1)
-    ORDER BY tp.added_at ASC
-  `).all(tripId, authReq.user.id);
-
-  res.json({ photos });
-});
-
-// Add photos to a trip
-router.post('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { tripId } = req.params;
-  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
-  const { asset_ids, shared = true } = req.body;
-
-  if (!Array.isArray(asset_ids) || asset_ids.length === 0) {
-    return res.status(400).json({ error: 'asset_ids required' });
-  }
-
-  const insert = db.prepare(
-    'INSERT OR IGNORE INTO trip_photos (trip_id, user_id, immich_asset_id, shared) VALUES (?, ?, ?, ?)'
-  );
-  let added = 0;
-  for (const assetId of asset_ids) {
-    const result = insert.run(tripId, authReq.user.id, assetId, shared ? 1 : 0);
-    if (result.changes > 0) added++;
-  }
-
-  res.json({ success: true, added });
-  broadcast(tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
-
-  // Notify trip members about shared photos
-  if (shared && added > 0) {
-    import('../services/notifications').then(({ notifyTripMembers }) => {
-      const tripInfo = db.prepare('SELECT title FROM trips WHERE id = ?').get(tripId) as { title: string } | undefined;
-      notifyTripMembers(Number(tripId), authReq.user.id, 'photos_shared', { trip: tripInfo?.title || 'Untitled', actor: authReq.user.email, count: String(added) }).catch(() => {});
-    });
-  }
-});
-
-// Remove a photo from a trip (own photos only)
-router.delete('/trips/:tripId/photos/:assetId', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
-  db.prepare('DELETE FROM trip_photos WHERE trip_id = ? AND user_id = ? AND immich_asset_id = ?')
-    .run(req.params.tripId, authReq.user.id, req.params.assetId);
-  res.json({ success: true });
-  broadcast(req.params.tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
-});
-
-// Toggle sharing for a specific photo
-router.put('/trips/:tripId/photos/:assetId/sharing', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
-  const { shared } = req.body;
-  db.prepare('UPDATE trip_photos SET shared = ? WHERE trip_id = ? AND user_id = ? AND immich_asset_id = ?')
-    .run(shared ? 1 : 0, req.params.tripId, authReq.user.id, req.params.assetId);
-  res.json({ success: true });
-  broadcast(req.params.tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
-});
-
-// ── Asset Details ───────────────────────────────────────────────────────────
-
-router.get('/assets/:assetId/info', authenticate, async (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  const { assetId } = req.params;
-  if (!isValidAssetId(assetId)) return res.status(400).json({ error: 'Invalid asset ID' });
-
-  // Only allow accessing own Immich credentials — prevent leaking other users' API keys
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) return res.status(404).json({ error: 'Not found' });
-
-  try {
-    const resp = await fetch(`${creds.immich_url}/api/assets/${assetId}`, {
-      headers: { 'x-api-key': creds.immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed' });
-    const asset = await resp.json() as any;
-    res.json({
-      id: asset.id,
-      takenAt: asset.fileCreatedAt || asset.createdAt,
-      width: asset.exifInfo?.exifImageWidth || null,
-      height: asset.exifInfo?.exifImageHeight || null,
-      camera: asset.exifInfo?.make && asset.exifInfo?.model ? `${asset.exifInfo.make} ${asset.exifInfo.model}` : null,
-      lens: asset.exifInfo?.lensModel || null,
-      focalLength: asset.exifInfo?.focalLength ? `${asset.exifInfo.focalLength}mm` : null,
-      aperture: asset.exifInfo?.fNumber ? `f/${asset.exifInfo.fNumber}` : null,
-      shutter: asset.exifInfo?.exposureTime || null,
-      iso: asset.exifInfo?.iso || null,
-      city: asset.exifInfo?.city || null,
-      state: asset.exifInfo?.state || null,
-      country: asset.exifInfo?.country || null,
-      lat: asset.exifInfo?.latitude || null,
-      lng: asset.exifInfo?.longitude || null,
-      fileSize: asset.exifInfo?.fileSizeInByte || null,
-      fileName: asset.originalFileName || null,
-    });
-  } catch {
-    res.status(502).json({ error: 'Proxy error' });
-  }
-});
-
-// ── Proxy Immich Assets ─────────────────────────────────────────────────────
-
-// Asset proxy routes accept ephemeral token via query param (for <img> src usage)
 function authFromQuery(req: Request, res: Response, next: NextFunction) {
   const queryToken = req.query.token as string | undefined;
   if (queryToken) {
@@ -306,160 +45,189 @@ function authFromQuery(req: Request, res: Response, next: NextFunction) {
   return (authenticate as any)(req, res, next);
 }
 
+// ── Immich Connection Settings ─────────────────────────────────────────────
+
+router.get('/settings', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  res.json(getConnectionSettings(authReq.user.id));
+});
+
+router.put('/settings', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { immich_url, immich_api_key } = req.body;
+  const result = await saveImmichSettings(authReq.user.id, immich_url, immich_api_key, getClientIp(req));
+  if (!result.success) return res.status(400).json({ error: result.error });
+  if (result.warning) return res.json({ success: true, warning: result.warning });
+  res.json({ success: true });
+});
+
+router.get('/status', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  res.json(await getConnectionStatus(authReq.user.id));
+});
+
+router.post('/test', authenticate, async (req: Request, res: Response) => {
+  const { immich_url, immich_api_key } = req.body;
+  if (!immich_url || !immich_api_key) return res.json({ connected: false, error: 'URL and API key required' });
+  res.json(await testConnection(immich_url, immich_api_key));
+});
+
+// ── Browse Immich Library (for photo picker) ───────────────────────────────
+
+router.get('/browse', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const result = await browseTimeline(authReq.user.id);
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  res.json({ buckets: result.buckets });
+});
+
+router.post('/search', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { from, to } = req.body;
+  const result = await searchPhotos(authReq.user.id, from, to);
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  res.json({ assets: result.assets });
+});
+
+// ── Trip Photos (selected by user) ────────────────────────────────────────
+
+router.get('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  res.json({ photos: listTripPhotos(tripId, authReq.user.id) });
+});
+
+router.post('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  const { asset_ids, shared = true } = req.body;
+
+  if (!Array.isArray(asset_ids) || asset_ids.length === 0) {
+    return res.status(400).json({ error: 'asset_ids required' });
+  }
+
+  const added = addTripPhotos(tripId, authReq.user.id, asset_ids, shared);
+  res.json({ success: true, added });
+  broadcast(tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
+
+  // Notify trip members about shared photos
+  if (shared && added > 0) {
+    import('../services/notifications').then(({ notifyTripMembers }) => {
+      const tripInfo = db.prepare('SELECT title FROM trips WHERE id = ?').get(tripId) as { title: string } | undefined;
+      notifyTripMembers(Number(tripId), authReq.user.id, 'photos_shared', { trip: tripInfo?.title || 'Untitled', actor: authReq.user.email, count: String(added) }).catch(() => {});
+    });
+  }
+});
+
+router.delete('/trips/:tripId/photos/:assetId', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  removeTripPhoto(req.params.tripId, authReq.user.id, req.params.assetId);
+  res.json({ success: true });
+  broadcast(req.params.tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
+});
+
+router.put('/trips/:tripId/photos/:assetId/sharing', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  const { shared } = req.body;
+  togglePhotoSharing(req.params.tripId, authReq.user.id, req.params.assetId, shared);
+  res.json({ success: true });
+  broadcast(req.params.tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
+});
+
+// ── Asset Details ──────────────────────────────────────────────────────────
+
+router.get('/assets/:assetId/info', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { assetId } = req.params;
+  if (!isValidAssetId(assetId)) return res.status(400).json({ error: 'Invalid asset ID' });
+  const queryUserId = req.query.userId ? Number(req.query.userId) : undefined;
+  const ownerUserId = queryUserId && queryUserId !== authReq.user.id ? queryUserId : undefined;
+  if (ownerUserId && !canAccessUserPhoto(authReq.user.id, ownerUserId, assetId)) {
+    return res.status(403).json({ error: 'Forbidden' });
+  }
+  const result = await getAssetInfo(authReq.user.id, assetId, ownerUserId);
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  res.json(result.data);
+});
+
+// ── Proxy Immich Assets ────────────────────────────────────────────────────
+
 router.get('/assets/:assetId/thumbnail', authFromQuery, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { assetId } = req.params;
   if (!isValidAssetId(assetId)) return res.status(400).send('Invalid asset ID');
-
-  // Only allow accessing own Immich credentials — prevent leaking other users' API keys
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) return res.status(404).send('Not found');
-
-  try {
-    const resp = await fetch(`${creds.immich_url}/api/assets/${assetId}/thumbnail`, {
-      headers: { 'x-api-key': creds.immich_api_key },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!resp.ok) return res.status(resp.status).send('Failed');
-    res.set('Content-Type', resp.headers.get('content-type') || 'image/webp');
-    res.set('Cache-Control', 'public, max-age=86400');
-    const buffer = Buffer.from(await resp.arrayBuffer());
-    res.send(buffer);
-  } catch {
-    res.status(502).send('Proxy error');
+  const queryUserId = req.query.userId ? Number(req.query.userId) : undefined;
+  const ownerUserId = queryUserId && queryUserId !== authReq.user.id ? queryUserId : undefined;
+  if (ownerUserId && !canAccessUserPhoto(authReq.user.id, ownerUserId, assetId)) {
+    return res.status(403).send('Forbidden');
   }
+  const result = await proxyThumbnail(authReq.user.id, assetId, ownerUserId);
+  if (result.error) return res.status(result.status!).send(result.error);
+  res.set('Content-Type', result.contentType!);
+  res.set('Cache-Control', 'public, max-age=86400');
+  res.send(result.buffer);
 });
 
 router.get('/assets/:assetId/original', authFromQuery, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { assetId } = req.params;
   if (!isValidAssetId(assetId)) return res.status(400).send('Invalid asset ID');
-
-  // Only allow accessing own Immich credentials — prevent leaking other users' API keys
-  const creds = getImmichCredentials(authReq.user.id);
-  if (!creds) return res.status(404).send('Not found');
-
-  try {
-    const resp = await fetch(`${creds.immich_url}/api/assets/${assetId}/original`, {
-      headers: { 'x-api-key': creds.immich_api_key },
-      signal: AbortSignal.timeout(30000),
-    });
-    if (!resp.ok) return res.status(resp.status).send('Failed');
-    res.set('Content-Type', resp.headers.get('content-type') || 'image/jpeg');
-    res.set('Cache-Control', 'public, max-age=86400');
-    const buffer = Buffer.from(await resp.arrayBuffer());
-    res.send(buffer);
-  } catch {
-    res.status(502).send('Proxy error');
+  const queryUserId = req.query.userId ? Number(req.query.userId) : undefined;
+  const ownerUserId = queryUserId && queryUserId !== authReq.user.id ? queryUserId : undefined;
+  if (ownerUserId && !canAccessUserPhoto(authReq.user.id, ownerUserId, assetId)) {
+    return res.status(403).send('Forbidden');
   }
+  const result = await proxyOriginal(authReq.user.id, assetId, ownerUserId);
+  if (result.error) return res.status(result.status!).send(result.error);
+  res.set('Content-Type', result.contentType!);
+  res.set('Cache-Control', 'public, max-age=86400');
+  res.send(result.buffer);
 });
 
 // ── Album Linking ──────────────────────────────────────────────────────────
 
-// List user's Immich albums
 router.get('/albums', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
-  const user = db.prepare('SELECT immich_url, immich_api_key FROM users WHERE id = ?').get(authReq.user.id) as any;
-  if (!user?.immich_url || !user?.immich_api_key) return res.status(400).json({ error: 'Immich not configured' });
-
-  try {
-    const resp = await fetch(`${user.immich_url}/api/albums`, {
-      headers: { 'x-api-key': user.immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed to fetch albums' });
-    const albums = (await resp.json() as any[]).map((a: any) => ({
-      id: a.id,
-      albumName: a.albumName,
-      assetCount: a.assetCount || 0,
-      startDate: a.startDate,
-      endDate: a.endDate,
-      albumThumbnailAssetId: a.albumThumbnailAssetId,
-    }));
-    res.json({ albums });
-  } catch {
-    res.status(502).json({ error: 'Could not reach Immich' });
-  }
+  const result = await listAlbums(authReq.user.id);
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  res.json({ albums: result.albums });
 });
 
-// Get album links for a trip
 router.get('/trips/:tripId/album-links', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
-  if (!canAccessTrip(req.params.tripId, (authReq as AuthRequest).user.id)) return res.status(404).json({ error: 'Trip not found' });
-  const links = db.prepare(`
-    SELECT tal.*, u.username
-    FROM trip_album_links tal
-    JOIN users u ON tal.user_id = u.id
-    WHERE tal.trip_id = ?
-    ORDER BY tal.created_at ASC
-  `).all(req.params.tripId);
-  res.json({ links });
+  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  res.json({ links: listAlbumLinks(req.params.tripId) });
 });
 
-// Link an album to a trip
 router.post('/trips/:tripId/album-links', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
   if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
   const { album_id, album_name } = req.body;
   if (!album_id) return res.status(400).json({ error: 'album_id required' });
-
-  try {
-    db.prepare(
-      'INSERT OR IGNORE INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?)'
-    ).run(tripId, authReq.user.id, album_id, album_name || '');
-    res.json({ success: true });
-  } catch (err: any) {
-    res.status(400).json({ error: 'Album already linked' });
-  }
-});
-
-// Remove album link
-router.delete('/trips/:tripId/album-links/:linkId', authenticate, (req: Request, res: Response) => {
-  const authReq = req as AuthRequest;
-  db.prepare('DELETE FROM trip_album_links WHERE id = ? AND trip_id = ? AND user_id = ?')
-    .run(req.params.linkId, req.params.tripId, authReq.user.id);
+  const result = createAlbumLink(tripId, authReq.user.id, album_id, album_name);
+  if (!result.success) return res.status(400).json({ error: result.error });
+  res.json({ success: true });
+});
+
+router.delete('/trips/:tripId/album-links/:linkId', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  deleteAlbumLink(req.params.linkId, req.params.tripId, authReq.user.id);
   res.json({ success: true });
 });
 
-// Sync album — fetch all assets from Immich album and add missing ones to trip
 router.post('/trips/:tripId/album-links/:linkId/sync', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId, linkId } = req.params;
-
-  const link = db.prepare('SELECT * FROM trip_album_links WHERE id = ? AND trip_id = ? AND user_id = ?')
-    .get(linkId, tripId, authReq.user.id) as any;
-  if (!link) return res.status(404).json({ error: 'Album link not found' });
-
-  const user = db.prepare('SELECT immich_url, immich_api_key FROM users WHERE id = ?').get(authReq.user.id) as any;
-  if (!user?.immich_url || !user?.immich_api_key) return res.status(400).json({ error: 'Immich not configured' });
-
-  try {
-    const resp = await fetch(`${user.immich_url}/api/albums/${link.immich_album_id}`, {
-      headers: { 'x-api-key': user.immich_api_key, 'Accept': 'application/json' },
-      signal: AbortSignal.timeout(15000),
-    });
-    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed to fetch album' });
-    const albumData = await resp.json() as { assets?: any[] };
-    const assets = (albumData.assets || []).filter((a: any) => a.type === 'IMAGE');
-
-    const insert = db.prepare(
-      'INSERT OR IGNORE INTO trip_photos (trip_id, user_id, immich_asset_id, shared) VALUES (?, ?, ?, 1)'
-    );
-    let added = 0;
-    for (const asset of assets) {
-      const r = insert.run(tripId, authReq.user.id, asset.id);
-      if (r.changes > 0) added++;
-    }
-
-    db.prepare('UPDATE trip_album_links SET last_synced_at = CURRENT_TIMESTAMP WHERE id = ?').run(linkId);
-
-    res.json({ success: true, added, total: assets.length });
-    if (added > 0) {
-      broadcast(tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
-    }
-  } catch {
-    res.status(502).json({ error: 'Could not reach Immich' });
+  const result = await syncAlbumAssets(tripId, linkId, authReq.user.id);
+  if (result.error) return res.status(result.status!).json({ error: result.error });
+  res.json({ success: true, added: result.added, total: result.total });
+  if (result.added! > 0) {
+    broadcast(tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
   }
 });
 

server/src/routes/maps.ts

@@ -1,556 +1,94 @@
 import express, { Request, Response } from 'express';
-import fetch from 'node-fetch';
-import { db } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { AuthRequest } from '../types';
-import { decrypt_api_key } from '../services/apiKeyCrypto';
-
-interface NominatimResult {
-  osm_type: string;
-  osm_id: string;
-  name?: string;
-  display_name?: string;
-  lat: string;
-  lon: string;
-}
-
-interface OverpassElement {
-  tags?: Record<string, string>;
-}
-
-interface WikiCommonsPage {
-  imageinfo?: { url?: string; extmetadata?: { Artist?: { value?: string } } }[];
-}
-
-const UA = 'TREK Travel Planner (https://github.com/mauriceboe/NOMAD)';
-
-// ── OSM Enrichment: Overpass API for details ──────────────────────────────────
-
-async function fetchOverpassDetails(osmType: string, osmId: string): Promise<OverpassElement | null> {
-  const typeMap: Record<string, string> = { node: 'node', way: 'way', relation: 'rel' };
-  const oType = typeMap[osmType];
-  if (!oType) return null;
-  const query = `[out:json][timeout:5];${oType}(${osmId});out tags;`;
-  try {
-    const res = await fetch('https://overpass-api.de/api/interpreter', {
-      method: 'POST',
-      headers: { 'User-Agent': UA, 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: `data=${encodeURIComponent(query)}`,
-    });
-    if (!res.ok) return null;
-    const data = await res.json() as { elements?: OverpassElement[] };
-    return data.elements?.[0] || null;
-  } catch { return null; }
-}
-
-function parseOpeningHours(ohString: string): { weekdayDescriptions: string[]; openNow: boolean | null } {
-  const DAYS = ['Mo', 'Tu', 'We', 'Th', 'Fr', 'Sa', 'Su'];
-  const LONG = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday'];
-  const result: string[] = LONG.map(d => `${d}: ?`);
-
-  // Parse segments like "Mo-Fr 09:00-18:00; Sa 10:00-14:00"
-  for (const segment of ohString.split(';')) {
-    const trimmed = segment.trim();
-    if (!trimmed) continue;
-    const match = trimmed.match(/^((?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?(?:\s*,\s*(?:Mo|Tu|We|Th|Fr|Sa|Su)(?:\s*-\s*(?:Mo|Tu|We|Th|Fr|Sa|Su))?)*)\s+(.+)$/i);
-    if (!match) continue;
-    const [, daysPart, timePart] = match;
-    const dayIndices = new Set<number>();
-    for (const range of daysPart.split(',')) {
-      const parts = range.trim().split('-').map(d => DAYS.indexOf(d.trim()));
-      if (parts.length === 2 && parts[0] >= 0 && parts[1] >= 0) {
-        for (let i = parts[0]; i !== (parts[1] + 1) % 7; i = (i + 1) % 7) dayIndices.add(i);
-        dayIndices.add(parts[1]);
-      } else if (parts[0] >= 0) {
-        dayIndices.add(parts[0]);
-      }
-    }
-    for (const idx of dayIndices) {
-      result[idx] = `${LONG[idx]}: ${timePart.trim()}`;
-    }
-  }
-
-  // Compute openNow
-  let openNow: boolean | null = null;
-  try {
-    const now = new Date();
-    const jsDay = now.getDay();
-    const dayIdx = jsDay === 0 ? 6 : jsDay - 1;
-    const todayLine = result[dayIdx];
-    const timeRanges = [...todayLine.matchAll(/(\d{1,2}):(\d{2})\s*-\s*(\d{1,2}):(\d{2})/g)];
-    if (timeRanges.length > 0) {
-      const nowMins = now.getHours() * 60 + now.getMinutes();
-      openNow = timeRanges.some(m => {
-        const start = parseInt(m[1]) * 60 + parseInt(m[2]);
-        const end = parseInt(m[3]) * 60 + parseInt(m[4]);
-        return end > start ? nowMins >= start && nowMins < end : nowMins >= start || nowMins < end;
-      });
-    }
-  } catch { /* best effort */ }
-
-  return { weekdayDescriptions: result, openNow };
-}
-
-function buildOsmDetails(tags: Record<string, string>, osmType: string, osmId: string) {
-  let opening_hours: string[] | null = null;
-  let open_now: boolean | null = null;
-  if (tags.opening_hours) {
-    const parsed = parseOpeningHours(tags.opening_hours);
-    const hasData = parsed.weekdayDescriptions.some(line => !line.endsWith('?'));
-    if (hasData) {
-      opening_hours = parsed.weekdayDescriptions;
-      open_now = parsed.openNow;
-    }
-  }
-  return {
-    website: tags['contact:website'] || tags.website || null,
-    phone: tags['contact:phone'] || tags.phone || null,
-    opening_hours,
-    open_now,
-    osm_url: `https://www.openstreetmap.org/${osmType}/${osmId}`,
-    summary: tags.description || null,
-    source: 'openstreetmap' as const,
-  };
-}
-
-// ── Wikimedia Commons: Free place photos ──────────────────────────────────────
-
-async function fetchWikimediaPhoto(lat: number, lng: number, name?: string): Promise<{ photoUrl: string; attribution: string | null } | null> {
-  // Strategy 1: Search Wikipedia for the place name → get the article image
-  if (name) {
-    try {
-      const searchParams = new URLSearchParams({
-        action: 'query', format: 'json',
-        titles: name,
-        prop: 'pageimages',
-        piprop: 'thumbnail',
-        pithumbsize: '400',
-        pilimit: '1',
-        redirects: '1',
-      });
-      const res = await fetch(`https://en.wikipedia.org/w/api.php?${searchParams}`, { headers: { 'User-Agent': UA } });
-      if (res.ok) {
-        const data = await res.json() as { query?: { pages?: Record<string, { thumbnail?: { source?: string } }> } };
-        const pages = data.query?.pages;
-        if (pages) {
-          for (const page of Object.values(pages)) {
-            if (page.thumbnail?.source) {
-              return { photoUrl: page.thumbnail.source, attribution: 'Wikipedia' };
-            }
-          }
-        }
-      }
-    } catch { /* fall through to geosearch */ }
-  }
-
-  // Strategy 2: Wikimedia Commons geosearch by coordinates
-  const params = new URLSearchParams({
-    action: 'query', format: 'json',
-    generator: 'geosearch',
-    ggsprimary: 'all',
-    ggsnamespace: '6',
-    ggsradius: '300',
-    ggscoord: `${lat}|${lng}`,
-    ggslimit: '5',
-    prop: 'imageinfo',
-    iiprop: 'url|extmetadata|mime',
-    iiurlwidth: '400',
-  });
-  try {
-    const res = await fetch(`https://commons.wikimedia.org/w/api.php?${params}`, { headers: { 'User-Agent': UA } });
-    if (!res.ok) return null;
-    const data = await res.json() as { query?: { pages?: Record<string, WikiCommonsPage & { imageinfo?: { mime?: string }[] }> } };
-    const pages = data.query?.pages;
-    if (!pages) return null;
-    for (const page of Object.values(pages)) {
-      const info = page.imageinfo?.[0];
-      // Only use actual photos (JPEG/PNG), skip SVGs and PDFs
-      const mime = (info as { mime?: string })?.mime || '';
-      if (info?.url && (mime.startsWith('image/jpeg') || mime.startsWith('image/png'))) {
-        const attribution = info.extmetadata?.Artist?.value?.replace(/<[^>]+>/g, '').trim() || null;
-        return { photoUrl: info.url, attribution };
-      }
-    }
-    return null;
-  } catch { return null; }
-}
-
-interface GooglePlaceResult {
-  id: string;
-  displayName?: { text: string };
-  formattedAddress?: string;
-  location?: { latitude: number; longitude: number };
-  rating?: number;
-  websiteUri?: string;
-  nationalPhoneNumber?: string;
-  types?: string[];
-}
-
-interface GooglePlaceDetails extends GooglePlaceResult {
-  userRatingCount?: number;
-  regularOpeningHours?: { weekdayDescriptions?: string[]; openNow?: boolean };
-  googleMapsUri?: string;
-  editorialSummary?: { text: string };
-  reviews?: { authorAttribution?: { displayName?: string; photoUri?: string }; rating?: number; text?: { text?: string }; relativePublishTimeDescription?: string }[];
-  photos?: { name: string; authorAttributions?: { displayName?: string }[] }[];
-}
+import {
+  searchPlaces,
+  getPlaceDetails,
+  getPlacePhoto,
+  reverseGeocode,
+  resolveGoogleMapsUrl,
+} from '../services/mapsService';
 
 const router = express.Router();
 
-function getMapsKey(userId: number): string | null {
-  const user = db.prepare('SELECT maps_api_key FROM users WHERE id = ?').get(userId) as { maps_api_key: string | null } | undefined;
-  const user_key = decrypt_api_key(user?.maps_api_key);
-  if (user_key) return user_key;
-  const admin = db.prepare("SELECT maps_api_key FROM users WHERE role = 'admin' AND maps_api_key IS NOT NULL AND maps_api_key != '' LIMIT 1").get() as { maps_api_key: string } | undefined;
-  return decrypt_api_key(admin?.maps_api_key) || null;
-}
-
-const photoCache = new Map<string, { photoUrl: string; attribution: string | null; fetchedAt: number; error?: boolean }>();
-const PHOTO_TTL = 12 * 60 * 60 * 1000; // 12 hours
-const CACHE_MAX_ENTRIES = 1000;
-const CACHE_PRUNE_TARGET = 500;
-const CACHE_CLEANUP_INTERVAL = 5 * 60 * 1000; // 5 minutes
-
-setInterval(() => {
-  const now = Date.now();
-  for (const [key, entry] of photoCache) {
-    if (now - entry.fetchedAt > PHOTO_TTL) photoCache.delete(key);
-  }
-  if (photoCache.size > CACHE_MAX_ENTRIES) {
-    const entries = [...photoCache.entries()].sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
-    const toDelete = entries.slice(0, entries.length - CACHE_PRUNE_TARGET);
-    toDelete.forEach(([key]) => photoCache.delete(key));
-  }
-}, CACHE_CLEANUP_INTERVAL);
-
-async function searchNominatim(query: string, lang?: string) {
-  const params = new URLSearchParams({
-    q: query,
-    format: 'json',
-    addressdetails: '1',
-    limit: '10',
-    'accept-language': lang || 'en',
-  });
-  const response = await fetch(`https://nominatim.openstreetmap.org/search?${params}`, {
-    headers: { 'User-Agent': 'TREK Travel Planner (https://github.com/mauriceboe/NOMAD)' },
-  });
-  if (!response.ok) throw new Error('Nominatim API error');
-  const data = await response.json() as NominatimResult[];
-  return data.map(item => ({
-    google_place_id: null,
-    osm_id: `${item.osm_type}:${item.osm_id}`,
-    name: item.name || item.display_name?.split(',')[0] || '',
-    address: item.display_name || '',
-    lat: parseFloat(item.lat) || null,
-    lng: parseFloat(item.lon) || null,
-    rating: null,
-    website: null,
-    phone: null,
-    source: 'openstreetmap',
-  }));
-}
-
+// POST /search
 router.post('/search', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { query } = req.body;
 
   if (!query) return res.status(400).json({ error: 'Search query is required' });
 
-  const apiKey = getMapsKey(authReq.user.id);
-
-  if (!apiKey) {
-    try {
-      const places = await searchNominatim(query, req.query.lang as string);
-      return res.json({ places, source: 'openstreetmap' });
-    } catch (err: unknown) {
-      console.error('Nominatim search error:', err);
-      return res.status(500).json({ error: 'OpenStreetMap search error' });
-    }
-  }
-
   try {
-    const response = await fetch('https://places.googleapis.com/v1/places:searchText', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Goog-Api-Key': apiKey,
-        'X-Goog-FieldMask': 'places.id,places.displayName,places.formattedAddress,places.location,places.rating,places.websiteUri,places.nationalPhoneNumber,places.types',
-      },
-      body: JSON.stringify({ textQuery: query, languageCode: (req.query.lang as string) || 'en' }),
-    });
-
-    const data = await response.json() as { places?: GooglePlaceResult[]; error?: { message?: string } };
-
-    if (!response.ok) {
-      return res.status(response.status).json({ error: data.error?.message || 'Google Places API error' });
-    }
-
-    const places = (data.places || []).map((p: GooglePlaceResult) => ({
-      google_place_id: p.id,
-      name: p.displayName?.text || '',
-      address: p.formattedAddress || '',
-      lat: p.location?.latitude || null,
-      lng: p.location?.longitude || null,
-      rating: p.rating || null,
-      website: p.websiteUri || null,
-      phone: p.nationalPhoneNumber || null,
-      source: 'google',
-    }));
-
-    res.json({ places, source: 'google' });
+    const result = await searchPlaces(authReq.user.id, query, req.query.lang as string);
+    res.json(result);
   } catch (err: unknown) {
+    const status = (err as { status?: number }).status || 500;
+    const message = err instanceof Error ? err.message : 'Search error';
     console.error('Maps search error:', err);
-    res.status(500).json({ error: 'Google Places search error' });
+    res.status(status).json({ error: message });
   }
 });
 
+// GET /details/:placeId
 router.get('/details/:placeId', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { placeId } = req.params;
 
-  // OSM details: placeId is "node:123456" or "way:123456" etc.
-  if (placeId.includes(':')) {
-    const [osmType, osmId] = placeId.split(':');
-    try {
-      const element = await fetchOverpassDetails(osmType, osmId);
-      if (!element?.tags) return res.json({ place: buildOsmDetails({}, osmType, osmId) });
-      res.json({ place: buildOsmDetails(element.tags, osmType, osmId) });
-    } catch (err: unknown) {
-      console.error('OSM details error:', err);
-      res.status(500).json({ error: 'Error fetching OSM details' });
-    }
-    return;
-  }
-
-  // Google details
-  const apiKey = getMapsKey(authReq.user.id);
-  if (!apiKey) {
-    return res.status(400).json({ error: 'Google Maps API key not configured' });
-  }
-
   try {
-    const lang = (req.query.lang as string) || 'de';
-    const response = await fetch(`https://places.googleapis.com/v1/places/${placeId}?languageCode=${lang}`, {
-      method: 'GET',
-      headers: {
-        'X-Goog-Api-Key': apiKey,
-        'X-Goog-FieldMask': 'id,displayName,formattedAddress,location,rating,userRatingCount,websiteUri,nationalPhoneNumber,regularOpeningHours,googleMapsUri,reviews,editorialSummary',
-      },
-    });
-
-    const data = await response.json() as GooglePlaceDetails & { error?: { message?: string } };
-
-    if (!response.ok) {
-      return res.status(response.status).json({ error: data.error?.message || 'Google Places API error' });
-    }
-
-    const place = {
-      google_place_id: data.id,
-      name: data.displayName?.text || '',
-      address: data.formattedAddress || '',
-      lat: data.location?.latitude || null,
-      lng: data.location?.longitude || null,
-      rating: data.rating || null,
-      rating_count: data.userRatingCount || null,
-      website: data.websiteUri || null,
-      phone: data.nationalPhoneNumber || null,
-      opening_hours: data.regularOpeningHours?.weekdayDescriptions || null,
-      open_now: data.regularOpeningHours?.openNow ?? null,
-      google_maps_url: data.googleMapsUri || null,
-      summary: data.editorialSummary?.text || null,
-      reviews: (data.reviews || []).slice(0, 5).map((r: NonNullable<GooglePlaceDetails['reviews']>[number]) => ({
-        author: r.authorAttribution?.displayName || null,
-        rating: r.rating || null,
-        text: r.text?.text || null,
-        time: r.relativePublishTimeDescription || null,
-        photo: r.authorAttribution?.photoUri || null,
-      })),
-      source: 'google' as const,
-    };
-
-    res.json({ place });
+    const result = await getPlaceDetails(authReq.user.id, placeId, req.query.lang as string);
+    res.json(result);
   } catch (err: unknown) {
+    const status = (err as { status?: number }).status || 500;
+    const message = err instanceof Error ? err.message : 'Error fetching place details';
     console.error('Maps details error:', err);
-    res.status(500).json({ error: 'Error fetching place details' });
+    res.status(status).json({ error: message });
   }
 });
 
+// GET /place-photo/:placeId
 router.get('/place-photo/:placeId', authenticate, async (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { placeId } = req.params;
-
-  const cached = photoCache.get(placeId);
-  const ERROR_TTL = 5 * 60 * 1000; // 5 min for errors
-  if (cached) {
-    const ttl = cached.error ? ERROR_TTL : PHOTO_TTL;
-    if (Date.now() - cached.fetchedAt < ttl) {
-      if (cached.error) return res.status(404).json({ error: `(Cache) No photo available` });
-      return res.json({ photoUrl: cached.photoUrl, attribution: cached.attribution });
-    }
-    photoCache.delete(placeId);
-  }
-
-  // Wikimedia Commons fallback for OSM places (using lat/lng query params)
   const lat = parseFloat(req.query.lat as string);
   const lng = parseFloat(req.query.lng as string);
 
-  const apiKey = getMapsKey(authReq.user.id);
-  const isCoordLookup = placeId.startsWith('coords:');
-
-  // No Google key or coordinate-only lookup → try Wikimedia
-  if (!apiKey || isCoordLookup) {
-    if (!isNaN(lat) && !isNaN(lng)) {
-      try {
-        const wiki = await fetchWikimediaPhoto(lat, lng, req.query.name as string);
-        if (wiki) {
-          photoCache.set(placeId, { ...wiki, fetchedAt: Date.now() });
-          return res.json(wiki);
-        } else {
-          photoCache.set(placeId, { photoUrl: '', attribution: null, fetchedAt: Date.now(), error: true });
-        }
-      } catch { /* fall through */ }
-    }
-    return res.status(404).json({ error: '(Wikimedia) No photo available' });
-  }
-
-  // Google Photos
   try {
-    const detailsRes = await fetch(`https://places.googleapis.com/v1/places/${placeId}`, {
-      headers: {
-        'X-Goog-Api-Key': apiKey,
-        'X-Goog-FieldMask': 'photos',
-      },
-    });
-    const details = await detailsRes.json() as GooglePlaceDetails & { error?: { message?: string } };
-
-    if (!detailsRes.ok) {
-      console.error('Google Places photo details error:', details.error?.message || detailsRes.status);
-      photoCache.set(placeId, { photoUrl: '', attribution: null, fetchedAt: Date.now(), error: true });
-      return res.status(404).json({ error: '(Google Places) Photo could not be retrieved' });
-    }
-
-    if (!details.photos?.length) {
-      photoCache.set(placeId, { photoUrl: '', attribution: null, fetchedAt: Date.now(), error: true });
-      return res.status(404).json({ error: '(Google Places) No photo available' });
-    }
-
-    const photo = details.photos[0];
-    const photoName = photo.name;
-    const attribution = photo.authorAttributions?.[0]?.displayName || null;
-
-    const mediaRes = await fetch(
-      `https://places.googleapis.com/v1/${photoName}/media?maxHeightPx=400&skipHttpRedirect=true`,
-      { headers: { 'X-Goog-Api-Key': apiKey } }
-    );
-    const mediaData = await mediaRes.json() as { photoUri?: string };
-    const photoUrl = mediaData.photoUri;
-
-    if (!photoUrl) {
-      photoCache.set(placeId, { photoUrl: '', attribution, fetchedAt: Date.now(), error: true });
-      return res.status(404).json({ error: '(Google Places) Photo URL not available' });
-    }
-
-    photoCache.set(placeId, { photoUrl, attribution, fetchedAt: Date.now() });
-
-    try {
-      db.prepare(
-        'UPDATE places SET image_url = ?, updated_at = CURRENT_TIMESTAMP WHERE google_place_id = ? AND (image_url IS NULL OR image_url = ?)'
-      ).run(photoUrl, placeId, '');
-    } catch (dbErr) {
-      console.error('Failed to persist photo URL to database:', dbErr);
-    }
-
-    res.json({ photoUrl, attribution });
+    const result = await getPlacePhoto(authReq.user.id, placeId, lat, lng, req.query.name as string);
+    res.json(result);
   } catch (err: unknown) {
-    console.error('Place photo error:', err);
-    photoCache.set(placeId, { photoUrl: '', attribution: null, fetchedAt: Date.now(), error: true });
-    res.status(500).json({ error: 'Error fetching photo' });
+    const status = (err as { status?: number }).status || 500;
+    const message = err instanceof Error ? err.message : 'Error fetching photo';
+    if (status >= 500) console.error('Place photo error:', err);
+    res.status(status).json({ error: message });
   }
 });
 
-// Reverse geocoding via Nominatim
+// GET /reverse
 router.get('/reverse', authenticate, async (req: Request, res: Response) => {
   const { lat, lng, lang } = req.query as { lat: string; lng: string; lang?: string };
   if (!lat || !lng) return res.status(400).json({ error: 'lat and lng required' });
+
   try {
-    const params = new URLSearchParams({
-      lat, lon: lng, format: 'json', addressdetails: '1', zoom: '18',
-      'accept-language': lang || 'en',
-    });
-    const response = await fetch(`https://nominatim.openstreetmap.org/reverse?${params}`, {
-      headers: { 'User-Agent': UA },
-    });
-    if (!response.ok) return res.json({ name: null, address: null });
-    const data = await response.json() as { name?: string; display_name?: string; address?: Record<string, string> };
-    const addr = data.address || {};
-    const name = data.name || addr.tourism || addr.amenity || addr.shop || addr.building || addr.road || null;
-    res.json({ name, address: data.display_name || null });
+    const result = await reverseGeocode(lat, lng, lang);
+    res.json(result);
   } catch {
     res.json({ name: null, address: null });
   }
 });
 
-// Resolve a Google Maps URL to place data (coordinates, name, address)
+// POST /resolve-url
 router.post('/resolve-url', authenticate, async (req: Request, res: Response) => {
   const { url } = req.body;
   if (!url || typeof url !== 'string') return res.status(400).json({ error: 'URL is required' });
 
   try {
-    let resolvedUrl = url;
-
-    // Follow redirects for short URLs (goo.gl, maps.app.goo.gl)
-    if (url.includes('goo.gl') || url.includes('maps.app')) {
-      const redirectRes = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(10000) });
-      resolvedUrl = redirectRes.url;
-    }
-
-    // Extract coordinates from Google Maps URL patterns:
-    // /@48.8566,2.3522,15z  or  /place/.../@48.8566,2.3522
-    // ?q=48.8566,2.3522  or  ?ll=48.8566,2.3522
-    let lat: number | null = null;
-    let lng: number | null = null;
-    let placeName: string | null = null;
-
-    // Pattern: /@lat,lng
-    const atMatch = resolvedUrl.match(/@(-?\d+\.?\d*),(-?\d+\.?\d*)/);
-    if (atMatch) { lat = parseFloat(atMatch[1]); lng = parseFloat(atMatch[2]); }
-
-    // Pattern: !3dlat!4dlng (Google Maps data params)
-    if (!lat) {
-      const dataMatch = resolvedUrl.match(/!3d(-?\d+\.?\d*)!4d(-?\d+\.?\d*)/);
-      if (dataMatch) { lat = parseFloat(dataMatch[1]); lng = parseFloat(dataMatch[2]); }
-    }
-
-    // Pattern: ?q=lat,lng or &q=lat,lng
-    if (!lat) {
-      const qMatch = resolvedUrl.match(/[?&]q=(-?\d+\.?\d*),(-?\d+\.?\d*)/);
-      if (qMatch) { lat = parseFloat(qMatch[1]); lng = parseFloat(qMatch[2]); }
-    }
-
-    // Extract place name from URL path: /place/Place+Name/@...
-    const placeMatch = resolvedUrl.match(/\/place\/([^/@]+)/);
-    if (placeMatch) {
-      placeName = decodeURIComponent(placeMatch[1].replace(/\+/g, ' '));
-    }
-
-    if (!lat || !lng || isNaN(lat) || isNaN(lng)) {
-      return res.status(400).json({ error: 'Could not extract coordinates from URL' });
-    }
-
-    // Reverse geocode to get address
-    const nominatimRes = await fetch(
-      `https://nominatim.openstreetmap.org/reverse?lat=${lat}&lon=${lng}&format=json&addressdetails=1`,
-      { headers: { 'User-Agent': 'TREK-Travel-Planner/1.0' }, signal: AbortSignal.timeout(8000) }
-    );
-    const nominatim = await nominatimRes.json() as { display_name?: string; name?: string; address?: Record<string, string> };
-
-    const name = placeName || nominatim.name || nominatim.address?.tourism || nominatim.address?.building || null;
-    const address = nominatim.display_name || null;
-
-    res.json({ lat, lng, name, address });
+    const result = await resolveGoogleMapsUrl(url);
+    res.json(result);
   } catch (err: unknown) {
-    console.error('[Maps] URL resolve error:', err instanceof Error ? err.message : err);
-    res.status(400).json({ error: 'Failed to resolve URL' });
+    const status = (err as { status?: number }).status || 400;
+    const message = err instanceof Error ? err.message : 'Failed to resolve URL';
+    console.error('[Maps] URL resolve error:', message);
+    res.status(status).json({ error: message });
   }
 });