Merge d30132197e into 71aa8f8051

Update client/src/i18n/translations/ja.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-06-22 06:41:46 +00:00 · 2026-04-22 14:00:59 +00:00 · 2026-04-22 23:00:56 +09:00 · 2026-04-22 21:59:16 +09:00 · 2026-04-22 21:56:52 +09:00 · 2026-04-22 21:55:47 +09:00
45 changed files with 2626 additions and 837 deletions
@@ -23,4 +23,4 @@ jobs:
      - name: Publish to GitHub wiki
        uses: Andrew-Chen-Wang/github-wiki-action@v5
        with:
-          strategy: clone
+          strategy: init
@@ -127,23 +127,19 @@ A self-hosted, real-time collaborative travel planner — with maps, budgets, pa

 #### 🧩 Addons (admin-toggleable)

- **Lists** — packing lists + to-dos with templates, member assignments, optional bag tracking
- **Budget** — expense tracker with splits, pie chart, multi-currency
- **Documents** — file attachments on trips, places, and reservations
- **Collab** — chat, notes, polls, day-by-day attendance
 - **Vacay** — personal vacation planner with calendar, 100+ country holidays, carry-over tracking
 - **Atlas** — world map of visited countries, bucket list, travel stats, streak tracking, liquid-glass UI
- **Journey** — magazine-style travel journal with entries, photos (Immich/Synology), maps, moods
- **Naver List Import** — one-click import from shared Naver Maps lists
- **MCP** — expose TREK to AI assistants via OAuth 2.1
+- **Collab** — chat, notes, polls, day-by-day attendance
+- **Journey** — magazine-style travel journal with entries, photos, maps, moods
+- **Dashboard widgets** — currency converter and timezone clocks

 </td>
 <td width="50%" valign="top">

 #### 🤖 AI / MCP

- **Built-in MCP server** — OAuth 2.1 authenticated. 150+ tools, 30 resources
- **Granular scopes** — 27 OAuth scopes across 13 permission groups
+- **Built-in MCP server** — OAuth 2.1 authenticated. 80+ tools, 27 resources
+- **Granular scopes** — 24 OAuth scopes across 13 permission groups
 - **Full automation** — AI can create trips, plan days, build packing lists, manage budgets, mark countries visited
 - **Pre-built prompts** — `trip-summary`, `packing-list`, `budget-overview`
 - **Addon-aware** — exposes Atlas, Collab, Vacay when those addons are on
@@ -156,7 +152,7 @@ A self-hosted, real-time collaborative travel planner — with maps, budgets, pa
 #### ⚙️ Admin & customisation

 - **Dashboard views** — card grid or compact list · **Dark mode** — full theme with matching status bar
- **15 languages** — EN, DE, ES, FR, IT, NL, HU, RU, ZH, ZH-TW, PL, CS, AR (RTL), BR, ID
+- **14 languages** — EN, DE, ES, FR, IT, NL, HU, RU, ZH, ZH-TW, PL, CS, AR (RTL), BR, ID
 - **Admin panel** — users, invites, packing templates, categories, addons, API keys, backups, GitHub history
 - **Auto-backups** — scheduled with configurable retention · **Units** — °C/°F, 12h/24h, map tile sources, default coordinates

@@ -176,7 +172,7 @@ ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d -p 3000:3000 \
  -v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek
 ```

-Open `http://localhost:3000`. On first boot TREK seeds an admin account — if you set `ADMIN_EMAIL`/`ADMIN_PASSWORD` those are used, otherwise the credentials are printed to the container log (`docker logs trek`).
+Open `http://localhost:3000`. The first user to register becomes admin.

 <div align="center">

@@ -342,8 +338,7 @@ server {
    ssl_certificate     /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/privkey.pem;

-    # 500 MB covers backup-restore uploads (capped at 500 MB server-side).
-    client_max_body_size 500m;
+    client_max_body_size 50m;

    location / {
        proxy_pass http://localhost:3000;
@@ -360,7 +355,6 @@ server {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
-        proxy_read_timeout 86400;
    }
 }
 ```
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 3.0.7
+version: 2.9.14
 description: Minimal Helm chart for TREK app
-appVersion: "3.0.7"
+appVersion: "2.9.14"
@@ -1,12 +1,12 @@
 {
  "name": "trek-client",
-  "version": "3.0.7",
+  "version": "2.9.14",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "trek-client",
-      "version": "3.0.7",
+      "version": "2.9.14",
      "dependencies": {
        "@react-pdf/renderer": "^4.3.2",
        "axios": "^1.6.7",
@@ -1,6 +1,6 @@
 {
  "name": "trek-client",
-  "version": "3.0.7",
+  "version": "2.9.14",
  "private": true,
  "type": "module",
  "scripts": {
@@ -78,7 +78,6 @@ const transportReservation = {
  id: 400,
  title: 'Flight to Rome',
  type: 'flight',
-  day_id: 10,
  reservation_time: '2025-06-01T14:30:00',
  confirmation_number: 'ABC123',
  metadata: JSON.stringify({ airline: 'Air Italia', flight_number: 'AI123', departure_airport: 'CDG', arrival_airport: 'FCO' }),
@@ -140,58 +140,23 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
  const totalCost = Object.values(assignments || {})
    .flatMap(a => a).reduce((s, a) => s + (parseFloat(a.place?.price) || 0), 0)

-  // Span helpers for multi-day transport (mirrors DayPlanSidebar logic)
-  const pdfGetDayOrder = (d: Day) => d.day_number
-  const pdfGetSpanPhase = (r: any, dayId: number): 'single' | 'start' | 'middle' | 'end' => {
-    const startId = r.day_id
-    const endId = r.end_day_id ?? startId
-    if (!startId || startId === endId) return 'single'
-    if (dayId === startId) return 'start'
-    if (dayId === endId) return 'end'
-    return 'middle'
-  }
-  const pdfGetDisplayTime = (r: any, dayId: number): string | null => {
-    const phase = pdfGetSpanPhase(r, dayId)
-    if (phase === 'end') return r.reservation_end_time || null
-    if (phase === 'middle') return null
-    return r.reservation_time || null
-  }
-  const pdfGetSpanLabel = (r: any, phase: string): string | null => {
-    if (phase === 'single') return null
-    if (r.type === 'flight') return tr(`reservations.span.${phase === 'start' ? 'departure' : phase === 'end' ? 'arrival' : 'inTransit'}`)
-    if (r.type === 'car') return tr(`reservations.span.${phase === 'start' ? 'pickup' : phase === 'end' ? 'return' : 'active'}`)
-    return tr(`reservations.span.${phase === 'start' ? 'start' : phase === 'end' ? 'end' : 'ongoing'}`)
-  }
-  const pdfGetTransportForDay = (dayId: number) => (reservations || []).filter(r => {
-    if (r.type === 'hotel') return false
-    const startId = r.day_id
-    const endId = r.end_day_id ?? startId
-    if (startId == null) return false
-    if (endId !== startId) {
-      const startDay = sorted.find(d => d.id === startId)
-      const endDay = sorted.find(d => d.id === endId)
-      const thisDay = sorted.find(d => d.id === dayId)
-      if (!startDay || !endDay || !thisDay) return false
-      return pdfGetDayOrder(thisDay) >= pdfGetDayOrder(startDay) && pdfGetDayOrder(thisDay) <= pdfGetDayOrder(endDay)
-    }
-    return startId === dayId
-  })
-
  // Build day HTML
  const daysHtml = sorted.map((day, di) => {
    const assigned = assignments[String(day.id)] || []
    const notes = (dayNotes || []).filter(n => n.day_id === day.id)
    const cost = dayCost(assignments, day.id, loc)

-    // Reservations for this day (hotel rendered via accommodations block; car middle-phase rendered in sidebar header only)
-    const dayReservations = pdfGetTransportForDay(day.id)
-      .filter(r => !(r.type === 'car' && pdfGetSpanPhase(r, day.id) === 'middle'))
+    // Reservations for this day (hotel rendered via accommodations block)
+    const dayReservations = (reservations || []).filter(r => {
+      if (!r.reservation_time || r.type === 'hotel') return false
+      return day.date && r.reservation_time.split('T')[0] === day.date
+    })

    const merged = []
    assigned.forEach(a => merged.push({ type: 'place', k: a.order_index ?? a.sort_order ?? 0, data: a }))
    notes.forEach(n    => merged.push({ type: 'note',  k: n.sort_order ?? 0, data: n }))
    dayReservations.forEach(r => {
-      const pos = r.day_positions?.[day.id] ?? r.day_positions?.[String(day.id)] ?? r.day_plan_position ?? (merged.length > 0 ? Math.max(...merged.map(m => m.k)) + 0.5 : 0.5)
+      const pos = r.day_plan_position ?? (merged.length > 0 ? Math.max(...merged.map(m => m.k)) + 0.5 : 0.5)
      merged.push({ type: 'reservation', k: pos, data: r })
    })
    merged.sort((a, b) => a.k - b.k)
@@ -212,17 +177,13 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
            else if (r.type === 'event') subtitle = [meta.venue].filter(Boolean).join(' · ')
            else if (r.type === 'tour') subtitle = [meta.operator].filter(Boolean).join(' · ')
            const locationLine = r.location || meta.location || ''
-            const phase = pdfGetSpanPhase(r, day.id)
-            const spanLabel = pdfGetSpanLabel(r, phase)
-            const displayTime = pdfGetDisplayTime(r, day.id)
-            const time = displayTime?.includes('T') ? displayTime.split('T')[1]?.substring(0, 5) : ''
-            const titleHtml = `${spanLabel ? escHtml(spanLabel) + ': ' : ''}${escHtml(r.title)}`
+            const time = r.reservation_time?.includes('T') ? r.reservation_time.split('T')[1]?.substring(0, 5) : ''
            return `
              <div class="note-card" style="border-left: 3px solid ${color};">
                <div class="note-line" style="background: ${color};"></div>
                <span class="note-icon">${icon}</span>
                <div class="note-body">
-                  <div class="note-text" style="font-weight: 600;">${titleHtml}${time ? ` <span style="color:#6b7280;font-weight:400;font-size:10px;">${time}</span>` : ''}</div>
+                  <div class="note-text" style="font-weight: 600;">${escHtml(r.title)}${time ? ` <span style="color:#6b7280;font-weight:400;font-size:10px;">${time}</span>` : ''}</div>
                  ${subtitle ? `<div class="note-time">${escHtml(subtitle)}</div>` : ''}
                  ${locationLine ? `<div class="note-time">${escHtml(locationLine)}</div>` : ''}
                  ${r.confirmation_number ? `<div class="note-time" style="font-size:9px;">Code: ${escHtml(r.confirmation_number)}</div>` : ''}
@@ -1,4 +1,4 @@
-import { useState, useEffect, useMemo } from 'react'
+import { useState, useEffect } from 'react'
 import { Plane, Train, Car, Ship } from 'lucide-react'
 import Modal from '../shared/Modal'
 import CustomSelect from '../shared/CustomSelect'
@@ -7,8 +7,6 @@ import AirportSelect, { type Airport } from './AirportSelect'
 import LocationSelect, { type LocationPoint } from './LocationSelect'
 import { useTranslation } from '../../i18n'
 import { useToast } from '../shared/Toast'
-import { useTripStore } from '../../store/tripStore'
-import { useAddonStore } from '../../store/addonStore'
 import { formatDate } from '../../utils/formatters'
 import type { Day, Reservation, ReservationEndpoint } from '../../types'

@@ -77,8 +75,6 @@ const defaultForm = {
  arrival_time: '',
  confirmation_number: '',
  notes: '',
-  price: '',
-  budget_category: '',
  meta_airline: '',
  meta_flight_number: '',
  meta_train_number: '',
@@ -98,13 +94,6 @@ interface TransportModalProps {
 export function TransportModal({ isOpen, onClose, onSave, reservation, days, selectedDayId }: TransportModalProps) {
  const { t, locale } = useTranslation()
  const toast = useToast()
-  const isBudgetEnabled = useAddonStore(s => s.isEnabled('budget'))
-  const budgetItems = useTripStore(s => s.budgetItems)
-  const budgetCategories = useMemo(() => {
-    const cats = new Set<string>()
-    budgetItems.forEach(i => { if (i.category) cats.add(i.category) })
-    return Array.from(cats).sort()
-  }, [budgetItems])
  const [form, setForm] = useState({ ...defaultForm })
  const [isSaving, setIsSaving] = useState(false)
  const [fromPick, setFromPick] = useState<EndpointPick>({})
@@ -137,8 +126,6 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
        meta_train_number: meta.train_number || '',
        meta_platform: meta.platform || '',
        meta_seat: meta.seat || '',
-        price: meta.price || '',
-        budget_category: (meta.budget_category && budgetItems.some(i => i.category === meta.budget_category)) ? meta.budget_category : '',
      })
      if (type === 'flight') {
        setFromPick({ airport: airportFromEndpoint(from) || undefined })
@@ -152,7 +139,7 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
      setFromPick({})
      setToPick({})
    }
-  }, [isOpen, reservation, selectedDayId, budgetItems])
+  }, [isOpen, reservation, selectedDayId])

  const set = (field: string, value: any) => setForm(prev => ({ ...prev, [field]: value }))

@@ -186,10 +173,6 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
        if (form.meta_platform) metadata.platform = form.meta_platform
        if (form.meta_seat) metadata.seat = form.meta_seat
      }
-      if (isBudgetEnabled) {
-        if (form.price) metadata.price = form.price
-        if (form.budget_category) metadata.budget_category = form.budget_category
-      }

      const startDate = startDay?.date ?? null
      const endDate = (endDay ?? startDay)?.date ?? null
@@ -217,11 +200,6 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
        endpoints,
        needs_review: false,
      }
-      if (isBudgetEnabled) {
-        (payload as any).create_budget_entry = form.price && parseFloat(form.price) > 0
-          ? { total_price: parseFloat(form.price), category: form.budget_category || t(`reservations.type.${form.type}`) || 'Other' }
-          : { total_price: 0 }
-      }
      await onSave(payload)
    } catch (err: unknown) {
      toast.error(err instanceof Error ? err.message : t('common.unknownError'))
@@ -444,40 +422,6 @@ export function TransportModal({ isOpen, onClose, onSave, reservation, days, sel
            style={{ ...inputStyle, resize: 'none', lineHeight: 1.5 }} />
        </div>

-        {/* Price + Budget Category */}
-        {isBudgetEnabled && (
-          <>
-            <div style={{ display: 'flex', gap: 8 }}>
-              <div style={{ flex: 1, minWidth: 0 }}>
-                <label style={labelStyle}>{t('reservations.price')}</label>
-                <input type="text" inputMode="decimal" value={form.price}
-                  onChange={e => { const v = e.target.value; if (v === '' || /^\d*[.,]?\d{0,2}$/.test(v)) set('price', v.replace(',', '.')) }}
-                  onPaste={e => { e.preventDefault(); let txt = e.clipboardData.getData('text').trim().replace(/[^\d.,-]/g, ''); const lc = txt.lastIndexOf(','), ld = txt.lastIndexOf('.'), dp = Math.max(lc, ld); if (dp > -1) { txt = txt.substring(0, dp).replace(/[.,]/g, '') + '.' + txt.substring(dp + 1) } else { txt = txt.replace(/[.,]/g, '') } set('price', txt) }}
-                  placeholder="0.00"
-                  style={inputStyle} />
-              </div>
-              <div style={{ flex: 1, minWidth: 0 }}>
-                <label style={labelStyle}>{t('reservations.budgetCategory')}</label>
-                <CustomSelect
-                  value={form.budget_category}
-                  onChange={v => set('budget_category', v)}
-                  options={[
-                    { value: '', label: t('reservations.budgetCategoryAuto') },
-                    ...budgetCategories.map(c => ({ value: c, label: c })),
-                  ]}
-                  placeholder={t('reservations.budgetCategoryAuto')}
-                  size="sm"
-                />
-              </div>
-            </div>
-            {form.price && parseFloat(form.price) > 0 && (
-              <div style={{ fontSize: 11, color: 'var(--text-faint)', marginTop: -4 }}>
-                {t('reservations.budgetHint')}
-              </div>
-            )}
-          </>
-        )}
-
      </form>
    </Modal>
  )
@@ -41,7 +41,7 @@ export default function ConfirmDialog({
  return (
    <div
      className="fixed inset-0 z-[10000] flex items-center justify-center px-4 trek-backdrop-enter"
-      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)', paddingBottom: 'var(--bottom-nav-h)' }}
+      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)' }}
      onClick={onClose}
    >
      <div
@@ -42,7 +42,7 @@ export default function CopyTripDialog({ isOpen, tripTitle, onClose, onConfirm }
  return (
    <div
      className="fixed inset-0 z-[10000] flex items-center justify-center px-4 trek-backdrop-enter"
-      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)', paddingBottom: 'var(--bottom-nav-h)' }}
+      style={{ backgroundColor: 'rgba(15, 23, 42, 0.5)' }}
      onClick={onClose}
    >
      <div
@@ -15,6 +15,7 @@ import ar from './translations/ar'
 import br from './translations/br'
 import cs from './translations/cs'
 import pl from './translations/pl'
+import ja from './translations/ja'
 import { SUPPORTED_LANGUAGES, SupportedLanguageCode } from './supportedLanguages'

 export { SUPPORTED_LANGUAGES }
@@ -23,7 +24,7 @@ type TranslationStrings = Record<string, string | { name: string; category: stri

 // Keyed by SupportedLanguageCode so TypeScript enforces all languages have a translation.
 const translations: Record<SupportedLanguageCode, TranslationStrings> = {
-  de, en, es, fr, hu, it, ru, zh, 'zh-TW': zhTw, nl, id, ar, br, cs, pl,
+  de, en, es, fr, hu, it, ru, zh, 'zh-TW': zhTw, nl, id, ar, br, cs, pl, ja,
 }

 // Derived from SUPPORTED_LANGUAGES — add new languages there, not here.
@@ -38,7 +39,7 @@ export function getLocaleForLanguage(language: string): string {

 export function getIntlLanguage(language: string): string {
  if (language === 'br') return 'pt-BR'
-  return ['de', 'es', 'fr', 'hu', 'it', 'ru', 'zh', 'zh-TW', 'nl', 'ar', 'cs', 'pl', 'id'].includes(language) ? language : 'en'
+  return ['de', 'es', 'fr', 'hu', 'it', 'ru', 'zh', 'zh-TW', 'nl', 'ar', 'cs', 'pl', 'id', 'ja' ].includes(language) ? language : 'en'
 }

 export function isRtlLanguage(language: string): boolean {
@@ -12,8 +12,9 @@ export const SUPPORTED_LANGUAGES = [
  { value: 'zh',    label: '简体中文',              locale: 'zh-CN' },
  { value: 'zh-TW', label: '繁體中文',              locale: 'zh-TW' },
  { value: 'it',    label: 'Italiano',             locale: 'it-IT' },
-  { value: 'ar',    label: 'العربية',              locale: 'ar-SA' },
+  { value: 'ar',    label: 'العربية',                 locale: 'ar-SA' },
  { value: 'id',    label: 'Bahasa Indonesia',     locale: 'id-ID' },
+  { value: 'ja',    label: '日本語',                locale: 'ja-JP' },
 ] as const

 export type SupportedLanguageCode = typeof SUPPORTED_LANGUAGES[number]['value']
@@ -317,7 +317,7 @@ export default function JourneyPublicPage() {
                    )}

                    {/* Content */}
-                    <div className="px-5 pt-4 pb-5 cursor-pointer" onClick={() => setViewingEntry(entry)}>
+                    <div className="px-5 pt-4 pb-5">
                      {/* Title (only when no single photo — photo has it in overlay) */}
                      {photos.length !== 1 && entry.title && (
                        <h3 className="text-[16px] font-semibold text-zinc-900 dark:text-white tracking-tight leading-snug mb-2">{entry.title}</h3>
@@ -448,7 +448,7 @@ export default function JourneyPublicPage() {
  return (
    <div className="min-h-screen bg-zinc-50 dark:bg-zinc-950">
      {/* Hero */}
-      <div className="relative text-center text-white" style={{ background: 'linear-gradient(135deg, #000 0%, #0f172a 50%, #1e293b 100%)', padding: '32px 20px 28px', overflow: 'hidden' }}>
+      <div className="relative text-center text-white" style={{ background: 'linear-gradient(135deg, #000 0%, #0f172a 50%, #1e293b 100%)', padding: '32px 20px 28px' }}>
        {journey.cover_image && (
          <div style={{ position: 'absolute', inset: 0, backgroundImage: `url(/uploads/${journey.cover_image})`, backgroundSize: 'cover', backgroundPosition: 'center', opacity: 0.15 }} />
        )}
@@ -355,37 +355,6 @@ describe('journeyStore', () => {
    expect(useJourneyStore.getState().loading).toBe(false);
  });

-  // ── reorderEntries ───────────────────────────────────────────────────────
-
-  it('FE-STORE-JOURNEY-018: reorderEntries reorders by sort_order not entry_time', async () => {
-    const a = buildEntry({ id: 201, entry_date: '2026-04-01', entry_time: '09:00', sort_order: 0 });
-    const b = buildEntry({ id: 202, entry_date: '2026-04-01', entry_time: '11:00', sort_order: 1 });
-    const c = buildEntry({ id: 203, entry_date: '2026-04-01', entry_time: '14:00', sort_order: 2 });
-    const detail = buildJourneyDetail({ id: 55, entries: [a, b, c] });
-    useJourneyStore.setState({ current: detail });
-
-    server.use(
-      http.put('/api/journeys/55/entries/reorder', () => HttpResponse.json({ success: true }))
-    );
-    await useJourneyStore.getState().reorderEntries(55, [202, 201, 203]);
-    const ids = useJourneyStore.getState().current?.entries.map(e => e.id);
-    expect(ids).toEqual([202, 201, 203]);
-  });
-
-  it('FE-STORE-JOURNEY-019: reorderEntries rolls back on API failure', async () => {
-    const a = buildEntry({ id: 211, entry_date: '2026-04-01', sort_order: 0 });
-    const b = buildEntry({ id: 212, entry_date: '2026-04-01', sort_order: 1 });
-    const detail = buildJourneyDetail({ id: 56, entries: [a, b] });
-    useJourneyStore.setState({ current: detail });
-
-    server.use(
-      http.put('/api/journeys/56/entries/reorder', () => HttpResponse.json({}, { status: 403 }))
-    );
-    await expect(useJourneyStore.getState().reorderEntries(56, [212, 211])).rejects.toBeTruthy();
-    const ids = useJourneyStore.getState().current?.entries.map(e => e.id);
-    expect(ids).toEqual([211, 212]);
-  });
-
  // ── clear ────────────────────────────────────────────────────────────────

  it('FE-STORE-JOURNEY-015: clear resets state', () => {
@@ -223,8 +223,10 @@ export const useJourneyStore = create<JourneyState>((set, get) => ({
      )
      entries.sort((a, b) => {
        if (a.entry_date !== b.entry_date) return a.entry_date.localeCompare(b.entry_date)
-        if (a.sort_order !== b.sort_order) return (a.sort_order || 0) - (b.sort_order || 0)
-        return a.id - b.id
+        const atime = a.entry_time || ''
+        const btime = b.entry_time || ''
+        if (atime !== btime) return atime.localeCompare(btime)
+        return (a.sort_order || 0) - (b.sort_order || 0)
      })
      return { current: { ...s.current, entries } }
    })
@@ -32,13 +32,6 @@ function triggerAnchorDownload(blobUrl: string, filename?: string): void {
  setTimeout(() => { URL.revokeObjectURL(blobUrl); a.remove() }, 100)
 }

-// navigator.standalone is true only on iOS when running as an
-// add-to-home-screen PWA. In that context, target="_blank" hands off to
-// Safari, which cannot access blob URLs sandboxed to the WebView.
-function isIosStandalone(): boolean {
-  return (navigator as any).standalone === true
-}
-
 /**
 * Fetches a protected file using cookie auth (credentials: include) and
 * triggers a browser download. Works inside PWA standalone mode because the
@@ -63,13 +56,7 @@ export async function downloadFile(url: string, filename?: string): Promise<void
 * (including text/html and image/svg+xml which can execute script) are forced
 * to download so that an uploaded file cannot run code in the TREK origin.
 *
- * Uses a synthetic <a target="_blank" rel="noopener noreferrer"> click rather
- * than window.open(). window.open() called with the "noreferrer"/"noopener"
- * window feature returns null per spec, which previously made the popup-block
- * fallback trigger a download in the *current* tab on top of the new-tab open
- * — i.e. the file opened twice. The anchor approach avoids that ambiguity:
- * the new tab is opened by the browser's normal link-handling path, and no
- * spurious in-page download is triggered.
+ * Falls back to a download trigger if the popup is blocked.
 */
 export async function openFile(url: string, filename?: string): Promise<void> {
  assertRelativeUrl(url)
@@ -84,19 +71,11 @@ export async function openFile(url: string, filename?: string): Promise<void> {
    return
  }

-  // iOS PWA: target="_blank" would open Safari, which can't access the blob
-  if (isIosStandalone()) {
+  const win = window.open(blobUrl, '_blank', 'noreferrer')
+  if (win) {
+    setTimeout(() => URL.revokeObjectURL(blobUrl), 30_000)
+  } else {
+    // Popup blocked — fall back to download
    triggerAnchorDownload(blobUrl, filename)
-    return
  }
-
-  const a = document.createElement('a')
-  a.href = blobUrl
-  a.target = '_blank'
-  a.rel = 'noopener noreferrer'
-  document.body.appendChild(a)
-  a.click()
-  // Keep the blob URL alive long enough for the new tab to load it, then
-  // clean up the DOM node and revoke the URL.
-  setTimeout(() => { URL.revokeObjectURL(blobUrl); a.remove() }, 30_000)
 }
@@ -74,42 +74,32 @@ describe('downloadFile', () => {
 })

 describe('openFile', () => {
-  it('fetches with credentials:include and opens blob URL via target=_blank anchor', async () => {
+  it('fetches with credentials:include and opens blob URL in new tab', async () => {
    vi.stubGlobal('fetch', makeFetchMock(200))
-    const openSpy = vi.spyOn(window, 'open').mockReturnValue(null)
-    const clickSpy = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => {})
+    const mockWin = { closed: false }
+    const openSpy = vi.spyOn(window, 'open').mockReturnValue(mockWin as Window)

    await openFile('/uploads/files/doc.pdf')

    expect(window.fetch).toHaveBeenCalledWith('/uploads/files/doc.pdf', { credentials: 'include' })
    expect(URL.createObjectURL).toHaveBeenCalled()
-    // Must NOT call window.open — that path returns null when noreferrer is
-    // set, which previously caused the file to also open in the current tab.
-    expect(openSpy).not.toHaveBeenCalled()
-    expect(clickSpy).toHaveBeenCalledTimes(1)
-
-    // The anchor used to open the new tab must be target=_blank, must NOT
-    // carry a `download` attribute (otherwise it would download in-page
-    // instead of opening), and must use rel=noopener noreferrer.
-    const appendCalls = (document.body.appendChild as ReturnType<typeof vi.fn>).mock.calls
-    const anchor = appendCalls[0]?.[0] as HTMLAnchorElement
-    expect(anchor.target).toBe('_blank')
-    expect(anchor.rel).toBe('noopener noreferrer')
-    expect(anchor.hasAttribute('download')).toBe(false)
+    expect(openSpy).toHaveBeenCalledWith('blob:mock-url', '_blank', 'noreferrer')

    // Revoke happens after 30s timeout
    vi.runAllTimers()
    expect(URL.revokeObjectURL).toHaveBeenCalledWith('blob:mock-url')
  })

-  it('does not trigger a second in-page action for safe inline types (regression: no double-open)', async () => {
+  it('falls back to anchor download when popup is blocked', async () => {
    vi.stubGlobal('fetch', makeFetchMock(200))
+    vi.spyOn(window, 'open').mockReturnValue(null)
    const clickSpy = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => {})

-    await openFile('/uploads/files/doc.pdf', 'doc.pdf')
+    await openFile('/uploads/files/doc.pdf')

-    // Exactly ONE anchor click — opening the new tab. No fallback download.
-    expect(clickSpy).toHaveBeenCalledTimes(1)
+    expect(clickSpy).toHaveBeenCalled()
+    vi.runAllTimers()
+    expect(URL.revokeObjectURL).toHaveBeenCalledWith('blob:mock-url')
  })

  it('throws on 401 response', async () => {
@@ -118,55 +108,28 @@ describe('openFile', () => {
    expect(URL.createObjectURL).not.toHaveBeenCalled()
  })

-  it('forces download for unsafe MIME types (HTML) instead of opening inline', async () => {
+  it('forces download for unsafe MIME types (HTML, SVG) instead of opening inline', async () => {
    const htmlBlob = new Blob(['<script>alert(1)</script>'], { type: 'text/html' })
    vi.stubGlobal('fetch', makeFetchMock(200, htmlBlob))
    const openSpy = vi.spyOn(window, 'open').mockReturnValue({} as Window)
    const clickSpy = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => {})

-    await openFile('/uploads/files/malicious.html', 'malicious.html')
+    await openFile('/uploads/files/malicious.html')

    // Must NOT open inline — download anchor clicked instead
    expect(openSpy).not.toHaveBeenCalled()
-    expect(clickSpy).toHaveBeenCalledTimes(1)
-
-    const appendCalls = (document.body.appendChild as ReturnType<typeof vi.fn>).mock.calls
-    const anchor = appendCalls[0]?.[0] as HTMLAnchorElement
-    expect(anchor.download).toBe('malicious.html')
+    expect(clickSpy).toHaveBeenCalled()
  })

  it('forces download for SVG MIME type', async () => {
    const svgBlob = new Blob(['<svg><script>alert(1)</script></svg>'], { type: 'image/svg+xml' })
    vi.stubGlobal('fetch', makeFetchMock(200, svgBlob))
-    const openSpy = vi.spyOn(window, 'open').mockReturnValue({} as Window)
+    vi.spyOn(window, 'open').mockReturnValue({} as Window)
    const clickSpy = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => {})

    await openFile('/uploads/files/malicious.svg')

-    expect(openSpy).not.toHaveBeenCalled()
-    expect(clickSpy).toHaveBeenCalledTimes(1)
-  })
-
-  it('falls back to download in iOS PWA standalone mode (blob URL inaccessible to Safari)', async () => {
-    vi.stubGlobal('fetch', makeFetchMock(200))
-    const clickSpy = vi.spyOn(HTMLAnchorElement.prototype, 'click').mockImplementation(() => {})
-    // Simulate iOS PWA (Add-to-Home-Screen) context
-    Object.defineProperty(navigator, 'standalone', { configurable: true, value: true })
-
-    try {
-      await openFile('/uploads/files/doc.pdf', 'doc.pdf')
-
-      // Single anchor click — and it must be a DOWNLOAD anchor (no target=_blank),
-      // because target="_blank" in iOS PWA would hand off to Safari which cannot
-      // read the in-WebView blob URL.
-      expect(clickSpy).toHaveBeenCalledTimes(1)
-      const appendCalls = (document.body.appendChild as ReturnType<typeof vi.fn>).mock.calls
-      const anchor = appendCalls[0]?.[0] as HTMLAnchorElement
-      expect(anchor.target).toBe('')
-      expect(anchor.download).toBe('doc.pdf')
-    } finally {
-      // Clean up the non-standard iOS-only property we forced above.
-      delete (navigator as any).standalone
-    }
+    expect(window.open).not.toHaveBeenCalled()
+    expect(clickSpy).toHaveBeenCalled()
  })
 })
@@ -1,12 +1,12 @@
 {
  "name": "trek-server",
-  "version": "3.0.7",
+  "version": "2.9.14",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "trek-server",
-      "version": "3.0.7",
+      "version": "2.9.14",
      "dependencies": {
        "@modelcontextprotocol/sdk": "^1.28.0",
        "archiver": "^6.0.1",
@@ -30,7 +30,7 @@
        "typescript": "^6.0.2",
        "undici": "^7.0.0",
        "unzipper": "^0.12.3",
-        "uuid": "^14.0.0",
+        "uuid": "^9.0.0",
        "ws": "^8.19.0",
        "zod": "^4.3.6"
      },
@@ -663,6 +663,9 @@
      "cpu": [
        "arm"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -679,6 +682,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -695,6 +701,9 @@
      "cpu": [
        "ppc64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -711,6 +720,9 @@
      "cpu": [
        "riscv64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -727,6 +739,9 @@
      "cpu": [
        "s390x"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -743,6 +758,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -759,6 +777,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -775,6 +796,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -791,6 +815,9 @@
      "cpu": [
        "arm"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -813,6 +840,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -835,6 +865,9 @@
      "cpu": [
        "ppc64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -857,6 +890,9 @@
      "cpu": [
        "riscv64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -879,6 +915,9 @@
      "cpu": [
        "s390x"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -901,6 +940,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -923,6 +965,9 @@
      "cpu": [
        "arm64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -945,6 +990,9 @@
      "cpu": [
        "x64"
      ],
+      "libc": [
+        "musl"
+      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1503,18 +1551,6 @@
        "url": "https://paulmillr.com/funding/"
      }
    },
-    "node_modules/@nodable/entities": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
-      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodable"
-        }
-      ],
-      "license": "MIT"
-    },
    "node_modules/@otplib/core": {
      "version": "12.0.1",
      "resolved": "https://registry.npmjs.org/@otplib/core/-/core-12.0.1.tgz",
@@ -3731,9 +3767,9 @@
      "license": "BSD-3-Clause"
    },
    "node_modules/fast-xml-builder": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.5.tgz",
-      "integrity": "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
      "funding": [
        {
          "type": "github",
@@ -3746,9 +3782,9 @@
      }
    },
    "node_modules/fast-xml-parser": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.1.tgz",
-      "integrity": "sha512-8Cc3f8GUGUULg34pBch/KGyPLglS+OFs05deyOlY7fL2MTagYPKrVQNmR1fLF/yJ9PH5ZSTd3YDF6pnmeZU+zA==",
+      "version": "5.5.12",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.12.tgz",
+      "integrity": "sha512-nUR0q8PPfoA/svPM43Gup7vLOZWppaNrYgGmrVqrAVJa7cOH4hMG6FX9M4mQ8dZA1/ObGZHzES7Ed88hxEBSJg==",
      "funding": [
        {
          "type": "github",
@@ -3757,8 +3793,7 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "@nodable/entities": "^2.1.0",
-        "fast-xml-builder": "^1.1.5",
+        "fast-xml-builder": "^1.1.4",
        "path-expression-matcher": "^1.5.0",
        "strnum": "^2.2.3"
      },
@@ -6446,16 +6481,16 @@
      }
    },
    "node_modules/uuid": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
-      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
+      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
      "funding": [
        "https://github.com/sponsors/broofa",
        "https://github.com/sponsors/ctavan"
      ],
      "license": "MIT",
      "bin": {
-        "uuid": "dist-node/bin/uuid"
+        "uuid": "dist/bin/uuid"
      }
    },
    "node_modules/vary": {
@@ -1,6 +1,6 @@
 {
  "name": "trek-server",
-  "version": "3.0.7",
+  "version": "2.9.14",
  "main": "src/index.ts",
  "scripts": {
    "start": "node --import tsx src/index.ts",
@@ -35,7 +35,7 @@
    "typescript": "^6.0.2",
    "undici": "^7.0.0",
    "unzipper": "^0.12.3",
-    "uuid": "^14.0.0",
+    "uuid": "^9.0.0",
    "ws": "^8.19.0",
    "zod": "^4.3.6"
  },
@@ -372,10 +372,8 @@ export function createApp(): express.Application {
    } else {
      console.error('Unhandled error:', err);
    }
-    const status = err.statusCode || err.status || 500;
-    // Expose the message for client errors (4xx); keep 'Internal server error' for 5xx.
-    const message = status < 500 ? err.message : 'Internal server error';
-    res.status(status).json({ error: message });
+    const status = err.statusCode || 500;
+    res.status(status).json({ error: 'Internal server error' });
  });

  return app;
@@ -2043,93 +2043,6 @@ function runMigrations(db: Database.Database): void {
      db.exec('CREATE INDEX IF NOT EXISTS idx_journey_entry_photos_entry   ON journey_entry_photos(entry_id)');
      db.exec('CREATE INDEX IF NOT EXISTS idx_journey_entry_photos_photo   ON journey_entry_photos(journey_photo_id)');
    },
-    // Migration 122: Correct stale day_id / end_day_id on non-transport
-    // reservations. Migration 110 only backfilled transport types; tours,
-    // restaurants, events and "other" bookings kept a stale day_id from
-    // older code paths that often defaulted to the first day of the trip.
-    // Starting with v3.0.0 the planner renders reservations by day_id
-    // instead of reservation_time, so those stale rows show up on the
-    // wrong day. This migration nulls out day_id / end_day_id values that
-    // don't match the reservation's time and then backfills them from
-    // reservation_time / reservation_end_time.
-    () => {
-      db.exec(`
-        UPDATE reservations
-        SET day_id = NULL
-        WHERE reservation_time IS NOT NULL
-          AND day_id IS NOT NULL
-          AND type != 'hotel'
-          AND NOT EXISTS (
-            SELECT 1 FROM days d
-            WHERE d.id = reservations.day_id
-              AND d.date = substr(reservations.reservation_time, 1, 10)
-          )
-      `);
-
-      db.exec(`
-        UPDATE reservations
-        SET end_day_id = NULL
-        WHERE reservation_end_time IS NOT NULL
-          AND end_day_id IS NOT NULL
-          AND type != 'hotel'
-          AND NOT EXISTS (
-            SELECT 1 FROM days d
-            WHERE d.id = reservations.end_day_id
-              AND d.date = substr(reservations.reservation_end_time, 1, 10)
-          )
-      `);
-
-      db.exec(`
-        UPDATE reservations
-        SET day_id = (
-          SELECT d.id FROM days d
-          WHERE d.trip_id = reservations.trip_id
-            AND d.date = substr(reservations.reservation_time, 1, 10)
-          LIMIT 1
-        )
-        WHERE type != 'hotel'
-          AND reservation_time IS NOT NULL
-          AND day_id IS NULL
-      `);
-
-      db.exec(`
-        UPDATE reservations
-        SET end_day_id = (
-          SELECT d.id FROM days d
-          WHERE d.trip_id = reservations.trip_id
-            AND d.date = substr(reservations.reservation_end_time, 1, 10)
-          LIMIT 1
-        )
-        WHERE type != 'hotel'
-          AND reservation_end_time IS NOT NULL
-          AND end_day_id IS NULL
-          AND substr(reservations.reservation_end_time, 1, 10)
-              != substr(reservations.reservation_time, 1, 10)
-      `);
-    },
-    // #846: make sort_order authoritative within a day. Previous ORDER BY put
-    // entry_time before sort_order, silently ignoring reorder clicks when two
-    // same-date entries had different times. Backfill renumbers using the old
-    // effective key (entry_time ASC, id ASC) so existing journeys retain their
-    // current visual order.
-    () => {
-      db.exec(`
-        WITH ranked AS (
-          SELECT id,
-                 ROW_NUMBER() OVER (
-                   PARTITION BY journey_id, entry_date
-                   ORDER BY entry_time ASC, id ASC
-                 ) - 1 AS rn
-          FROM journey_entries
-        )
-        UPDATE journey_entries
-        SET sort_order = (SELECT rn FROM ranked WHERE ranked.id = journey_entries.id)
-      `);
-      db.exec(
-        'CREATE INDEX IF NOT EXISTS idx_journey_entries_order ' +
-        'ON journey_entries(journey_id, entry_date, sort_order)'
-      );
-    },
  ];

  if (currentVersion < migrations.length) {
@@ -9,7 +9,6 @@ import * as svc from '../services/journeyService';
 import { db } from '../db/database';
 import { createOrUpdateJourneyShareLink, getJourneyShareLink, deleteJourneyShareLink, getPublicJourney } from '../services/journeyShareService';
 import { uploadToImmich } from '../services/memories/immichService';
-import { getAllowedExtensions } from '../services/fileService';

 const router = express.Router();

@@ -26,26 +25,9 @@ const storage = multer.diskStorage({
  },
 });

-const imageFilter: multer.Options['fileFilter'] = (_req, file, cb) => {
-  if (!file.mimetype.startsWith('image/') || file.mimetype.includes('svg')) {
-    const err: Error & { statusCode?: number } = new Error('Only image files are allowed');
-    err.statusCode = 400;
-    return cb(err);
-  }
-  const ext = path.extname(file.originalname).toLowerCase().replace('.', '');
-  const allowed = getAllowedExtensions().split(',').map(e => e.trim().toLowerCase());
-  if (!allowed.includes('*') && !allowed.includes(ext)) {
-    const err: Error & { statusCode?: number } = new Error(`File type .${ext} is not allowed`);
-    err.statusCode = 400;
-    return cb(err);
-  }
-  cb(null, true);
-};
-
 const upload = multer({
  storage,
  limits: { fileSize: 20 * 1024 * 1024 },
-  fileFilter: imageFilter,
 });

 // ── Static prefix routes (MUST come before /:id) ─────────────────────────
@@ -112,7 +112,7 @@ router.get('/callback', async (req: Request, res: Response) => {
      tokenData.id_token,
      doc,
      config.clientId,
-      (doc.issuer ?? '').replace(/\/+$/, '') || config.issuer,
+      config.issuer,
    );
    if (idVerify.ok !== true) {
      const reason = 'error' in idVerify ? idVerify.error : 'unknown';
@@ -120,7 +120,7 @@ export function getJourneyFull(journeyId: number, userId: number) {
  if (!journey) return null;

  const entries = db.prepare(
-    'SELECT * FROM journey_entries WHERE journey_id = ? ORDER BY entry_date ASC, sort_order ASC, id ASC'
+    'SELECT * FROM journey_entries WHERE journey_id = ? ORDER BY entry_date ASC, entry_time ASC, sort_order ASC'
  ).all(journeyId) as JourneyEntry[];

  const photos = db.prepare(
@@ -306,21 +306,12 @@ export function syncTripPlaces(journeyId: number, tripId: number, authorId: numb
  ).all(journeyId, tripId) as { source_place_id: number }[];
  const existingPlaceIds = new Set(existing.map(e => e.source_place_id));

-  // Track next sort_order per date so synced skeletons get unique, sequential positions.
-  const dateMaxOrder = new Map<string, number>();
-  const maxRows = db.prepare(
-    'SELECT entry_date, COALESCE(MAX(sort_order), -1) AS m FROM journey_entries WHERE journey_id = ? GROUP BY entry_date'
-  ).all(journeyId) as { entry_date: string; m: number }[];
-  for (const row of maxRows) dateMaxOrder.set(row.entry_date, row.m);
-
  for (const place of places) {
    if (existingPlaceIds.has(place.id)) continue;
    existingPlaceIds.add(place.id);

    const entryDate = place.day_date || new Date().toISOString().split('T')[0];
    const entryTime = place.assignment_time || place.place_time || null;
-    const nextOrder = (dateMaxOrder.get(entryDate) ?? -1) + 1;
-    dateMaxOrder.set(entryDate, nextOrder);

    db.prepare(`
      INSERT INTO journey_entries (journey_id, source_trip_id, source_place_id, author_id, type, title, entry_date, entry_time, location_name, location_lat, location_lng, sort_order, created_at, updated_at)
@@ -329,7 +320,7 @@ export function syncTripPlaces(journeyId: number, tripId: number, authorId: numb
      journeyId, tripId, place.id, authorId,
      place.name, entryDate, entryTime,
      place.address || place.name, place.lat || null, place.lng || null,
-      nextOrder, now, now
+      place.day_number || 0, now, now
    );
  }
 }
@@ -376,19 +367,15 @@ export function onPlaceCreated(tripId: number, placeId: number) {

    const journey = db.prepare('SELECT user_id FROM journeys WHERE id = ?').get(link.journey_id) as { user_id: number };
    const entryDate = place.day_date;
-    const maxOrder = db.prepare(
-      'SELECT MAX(sort_order) AS m FROM journey_entries WHERE journey_id = ? AND entry_date = ?'
-    ).get(link.journey_id, entryDate) as { m: number | null };
-    const nextOrder = (maxOrder?.m ?? -1) + 1;

    db.prepare(`
      INSERT INTO journey_entries (journey_id, source_trip_id, source_place_id, author_id, type, title, entry_date, entry_time, location_name, location_lat, location_lng, sort_order, created_at, updated_at)
-      VALUES (?, ?, ?, ?, 'skeleton', ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, 'skeleton', ?, ?, ?, ?, ?, ?, 0, ?, ?)
    `).run(
      link.journey_id, tripId, placeId, journey.user_id,
      place.name, entryDate, place.assignment_time || place.place_time || null,
      place.address || place.name, place.lat || null, place.lng || null,
-      nextOrder, now, now
+      now, now
    );
  }
 }
@@ -464,7 +451,7 @@ export function listEntries(journeyId: number, userId: number) {
  if (!canAccessJourney(journeyId, userId)) return null;

  const entries = db.prepare(
-    'SELECT * FROM journey_entries WHERE journey_id = ? ORDER BY entry_date ASC, sort_order ASC, id ASC'
+    'SELECT * FROM journey_entries WHERE journey_id = ? ORDER BY entry_date ASC, entry_time ASC, sort_order ASC'
  ).all(journeyId) as JourneyEntry[];

  const photos = db.prepare(
@@ -794,20 +781,22 @@ export function updatePhoto(photoId: number, userId: number, data: { caption?: s
  if (!row) return null;
  if (!canEdit(row.journey_id, userId)) return null;

-  // caption lives on the gallery row; sort_order lives on the junction table
-  // (JP_SELECT reads jep.sort_order, so updating journey_photos.sort_order
-  // would not be reflected in the returned row).
-  if (data.caption !== undefined) {
-    db.prepare('UPDATE journey_photos SET caption = ? WHERE id = ?').run(data.caption, photoId);
-  }
-  if (data.sort_order !== undefined) {
-    db.prepare('UPDATE journey_entry_photos SET sort_order = ? WHERE journey_photo_id = ?').run(data.sort_order, photoId);
+  const fields: string[] = [];
+  const values: unknown[] = [];
+  if (data.caption !== undefined) { fields.push('caption = ?'); values.push(data.caption); }
+  if (data.sort_order !== undefined) { fields.push('sort_order = ?'); values.push(data.sort_order); }
+  if (!fields.length) {
+    // no-op: return some photo row for this gallery item (first entry link)
+    return db.prepare(`SELECT ${JP_SELECT} FROM ${JP_JOIN} WHERE gp.id = ? LIMIT 1`).get(photoId) as JourneyPhoto | null;
  }
+
+  values.push(photoId);
+  db.prepare(`UPDATE journey_photos SET ${fields.join(', ')} WHERE id = ?`).run(...values);
  return db.prepare(`SELECT ${JP_SELECT} FROM ${JP_JOIN} WHERE gp.id = ? LIMIT 1`).get(photoId) as JourneyPhoto | null;
 }

 // deletePhoto: hard-delete (backwards compat name used by old route).
-export function deletePhoto(photoId: number, userId: number): { id: number; photo_id: number; file_path?: string | null; journey_id: number } | null {
+export function deletePhoto(photoId: number, userId: number): { photo_id: number; file_path?: string | null; journey_id: number } | null {
  const row = db.prepare('SELECT id, journey_id, photo_id FROM journey_photos WHERE id = ?').get(photoId) as { id: number; journey_id: number; photo_id: number } | undefined;
  if (!row) return null;
  if (!canEdit(row.journey_id, userId)) return null;
@@ -817,7 +806,7 @@ export function deletePhoto(photoId: number, userId: number): { id: number; phot
  db.prepare('DELETE FROM journey_photos WHERE id = ?').run(photoId);
  deleteTrekPhotoIfOrphan(row.photo_id);

-  return { id: row.id, photo_id: row.photo_id, file_path: trekRow?.file_path ?? null, journey_id: row.journey_id };
+  return { photo_id: row.photo_id, file_path: trekRow?.file_path ?? null, journey_id: row.journey_id };
 }

 // ── Contributors ─────────────────────────────────────────────────────────
@@ -27,17 +27,14 @@ export async function ensureLocalThumbnail(
      const meta = await sharp(thumbAbs).metadata()
      return { thumbnailRelPath: thumbRel, width: meta.width ?? 0, height: meta.height ?? 0 }
    }
+  } catch { /* regenerate */ }

-    await fs.mkdir(path.dirname(thumbAbs), { recursive: true })
-    await sharp(originalAbs)
-      .rotate()
-      .resize({ width: THUMB_MAX, height: THUMB_MAX, fit: 'inside', withoutEnlargement: true })
-      .webp({ quality: THUMB_QUALITY })
-      .toFile(thumbAbs)
-    const meta = await sharp(thumbAbs).metadata()
-    return { thumbnailRelPath: thumbRel, width: meta.width ?? 0, height: meta.height ?? 0 }
-  } catch {
-    // Unsupported format, corrupt file, etc. — fall back to original in caller.
-    return null
-  }
+  await fs.mkdir(path.dirname(thumbAbs), { recursive: true })
+  await sharp(originalAbs)
+    .rotate()
+    .resize({ width: THUMB_MAX, height: THUMB_MAX, fit: 'inside', withoutEnlargement: true })
+    .webp({ quality: THUMB_QUALITY })
+    .toFile(thumbAbs)
+  const meta = await sharp(thumbAbs).metadata()
+  return { thumbnailRelPath: thumbRel, width: meta.width ?? 0, height: meta.height ?? 0 }
 }
@@ -140,21 +140,11 @@ export async function discover(issuer: string, discoveryUrl?: string | null): Pr
  const res = await fetch(url);
  if (!res.ok) throw new Error('Failed to fetch OIDC discovery document');
  const doc = (await res.json()) as OidcDiscoveryDoc;
-  // Validate that the discovery doc's issuer matches the operator-configured one.
-  // When no custom discoveryUrl is set, a mismatch signals a MITM or misconfiguration
-  // and we reject. When the operator explicitly overrides the discovery URL (e.g.
-  // Authentik realm paths), the discovery doc's issuer is the canonical value —
-  // trust it and warn rather than blocking login.
-  const docIssuer = doc.issuer?.replace(/\/+$/, '') ?? '';
-  if (docIssuer && docIssuer !== issuer) {
-    if (discoveryUrl) {
-      console.warn(
-        `[OIDC] Discovery doc issuer "${doc.issuer}" differs from configured OIDC_ISSUER "${issuer}". ` +
-        `Using discovery doc issuer for id_token verification (custom OIDC_DISCOVERY_URL is set).`,
-      );
-    } else {
-      throw new Error(`OIDC discovery issuer mismatch: expected "${issuer}", got "${doc.issuer}"`);
-    }
+  // Validate that the discovery doc's issuer matches the operator-configured
+  // one. A MITM or compromised doc could otherwise supply a crafted issuer
+  // that passes jwt.verify() because we used doc.issuer as the expected value.
+  if (doc.issuer && doc.issuer !== issuer) {
+    throw new Error(`OIDC discovery issuer mismatch: expected "${issuer}", got "${doc.issuer}"`);
  }
  doc._issuer = url;
  discoveryCache = doc;
@@ -323,6 +313,7 @@ export async function verifyIdToken(
  try {
    const verified = jwt.verify(idToken, publicKey, {
      algorithms: [alg as jwt.Algorithm],
+      issuer: expectedIssuer,
      audience: clientId,
    });
    claims = typeof verified === 'string' ? {} : (verified as Record<string, unknown>);
@@ -331,13 +322,6 @@ export async function verifyIdToken(
    return { ok: false, error: `signature_or_claim_mismatch: ${msg}` };
  }

-  // Normalize trailing slash before issuer comparison — some IdPs (e.g. Authentik)
-  // include a trailing slash in the id_token iss claim.
-  const tokenIssuer = typeof claims['iss'] === 'string' ? claims['iss'].replace(/\/+$/, '') : '';
-  if (tokenIssuer !== expectedIssuer) {
-    return { ok: false, error: `signature_or_claim_mismatch: jwt issuer invalid. expected: ${expectedIssuer}` };
-  }
-
  return { ok: true, claims };
 }

@@ -43,24 +43,6 @@ function loadEndpoints(reservationId: number): ReservationEndpoint[] {
  ).all(reservationId) as ReservationEndpoint[];
 }

-// Resolve the day row whose date matches the date portion of an ISO-ish
-// timestamp. Used to keep `day_id` / `end_day_id` in sync with
-// `reservation_time` / `reservation_end_time` so non-transport bookings
-// (tours, restaurants, events, ...) end up on the right day in the UI,
-// which now filters by day_id instead of reservation_time.
-function resolveDayIdFromTime(
-  tripId: string | number,
-  time: string | null | undefined,
-): number | null {
-  if (!time) return null;
-  const datePart = time.slice(0, 10);
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(datePart)) return null;
-  const row = db
-    .prepare('SELECT id FROM days WHERE trip_id = ? AND date = ? LIMIT 1')
-    .get(tripId, datePart) as { id: number } | undefined;
-  return row?.id ?? null;
-}
-
 const saveEndpoints = db.transaction((reservationId: number, endpoints: EndpointInput[]) => {
  db.prepare('DELETE FROM reservation_endpoints WHERE reservation_id = ?').run(reservationId);
  const insert = db.prepare(`
@@ -178,26 +160,13 @@ export function createReservation(tripId: string | number, data: CreateReservati
    }
  }

-  // Derive day_id / end_day_id from reservation_time when the client
-  // didn't explicitly set them (non-hotel bookings only — hotels store
-  // their date range on the linked day_accommodation).
-  const resolvedType = type || 'other';
-  let resolvedDayId: number | null = day_id ?? null;
-  if (resolvedDayId == null && resolvedType !== 'hotel' && reservation_time) {
-    resolvedDayId = resolveDayIdFromTime(tripId, reservation_time);
-  }
-  let resolvedEndDayId: number | null = end_day_id ?? null;
-  if (resolvedEndDayId == null && resolvedType !== 'hotel' && reservation_end_time) {
-    resolvedEndDayId = resolveDayIdFromTime(tripId, reservation_end_time);
-  }
-
  const result = db.prepare(`
    INSERT INTO reservations (trip_id, day_id, end_day_id, place_id, assignment_id, title, reservation_time, reservation_end_time, location, confirmation_number, notes, status, type, accommodation_id, metadata, needs_review)
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
  `).run(
    tripId,
-    resolvedDayId,
-    resolvedEndDayId,
+    day_id || null,
+    end_day_id ?? null,
    place_id || null,
    assignment_id || null,
    title,
@@ -207,7 +176,7 @@ export function createReservation(tripId: string | number, data: CreateReservati
    confirmation_number || null,
    notes || null,
    status || 'pending',
-    resolvedType,
+    type || 'other',
    resolvedAccommodationId,
    metadata ? JSON.stringify(metadata) : null,
    needs_review ? 1 : 0
@@ -321,35 +290,6 @@ export function updateReservation(id: string | number, tripId: string | number,
    }
  }

-  const resolvedType = (type ?? current.type) || 'other';
-  const nextReservationTime = resolvedType === 'hotel'
-    ? null
-    : (reservation_time !== undefined ? (reservation_time || null) : current.reservation_time);
-  const nextReservationEndTime = resolvedType === 'hotel'
-    ? null
-    : (reservation_end_time !== undefined ? (reservation_end_time || null) : current.reservation_end_time);
-
-  // day_id / end_day_id: honour an explicit value from the client,
-  // otherwise derive from the (possibly updated) reservation_time so the
-  // planner renders the booking on the correct day.
-  let nextDayId: number | null;
-  if (day_id !== undefined) {
-    nextDayId = day_id || null;
-  } else if (reservation_time !== undefined && resolvedType !== 'hotel') {
-    nextDayId = resolveDayIdFromTime(tripId, nextReservationTime);
-  } else {
-    nextDayId = current.day_id ?? null;
-  }
-
-  let nextEndDayId: number | null;
-  if (end_day_id !== undefined) {
-    nextEndDayId = end_day_id ?? null;
-  } else if (reservation_end_time !== undefined && resolvedType !== 'hotel') {
-    nextEndDayId = resolveDayIdFromTime(tripId, nextReservationEndTime);
-  } else {
-    nextEndDayId = (current as any).end_day_id ?? null;
-  }
-
  db.prepare(`
    UPDATE reservations SET
      title = COALESCE(?, title),
@@ -370,13 +310,13 @@ export function updateReservation(id: string | number, tripId: string | number,
    WHERE id = ?
  `).run(
    title || null,
-    nextReservationTime,
-    nextReservationEndTime,
+    (type ?? current.type) === 'hotel' ? null : (reservation_time !== undefined ? (reservation_time || null) : current.reservation_time),
+    (type ?? current.type) === 'hotel' ? null : (reservation_end_time !== undefined ? (reservation_end_time || null) : current.reservation_end_time),
    location !== undefined ? (location || null) : current.location,
    confirmation_number !== undefined ? (confirmation_number || null) : current.confirmation_number,
    notes !== undefined ? (notes || null) : current.notes,
-    nextDayId,
-    nextEndDayId,
+    day_id !== undefined ? (day_id || null) : current.day_id,
+    end_day_id !== undefined ? (end_day_id ?? null) : (current as any).end_day_id ?? null,
    place_id !== undefined ? (place_id || null) : current.place_id,
    assignment_id !== undefined ? (assignment_id || null) : current.assignment_id,
    status || null,
@@ -649,7 +649,7 @@ describe('Link photo to entry', () => {
      .send({});

    expect(res.status).toBe(400);
-    expect(res.body.error).toBe('journey_photo_id required');
+    expect(res.body.error).toBe('photo_id required');
  });
 });

@@ -84,9 +84,8 @@ describe('GET /api/system-notices/active', () => {

  it('returns empty array for non-first-login user with no applicable notices', async () => {
    const { user } = createUser(testDb);
-    // login_count > 1 means firstLogin condition does not match for any notice;
-    // first_seen_version >= 3.0.0 means existingUserBeforeVersion('3.0.0') also does not match
-    testDb.prepare('UPDATE users SET login_count = 5, first_seen_version = ? WHERE id = ?').run('3.0.0', user.id);
+    // login_count > 1 means firstLogin condition does not match for any notice
+    testDb.prepare('UPDATE users SET login_count = 5 WHERE id = ?').run(user.id);
    const res = await request(app)
      .get('/api/system-notices/active')
      .set('Cookie', authCookie(user.id));
@@ -123,7 +122,7 @@ describe('GET /api/system-notices/active', () => {
    SYSTEM_NOTICES.push(TEST_NOTICE);
    try {
      const { user } = createUser(testDb);
-      testDb.prepare('UPDATE users SET login_count = 5, first_seen_version = ? WHERE id = ?').run('3.0.0', user.id);
+      testDb.prepare('UPDATE users SET login_count = 5 WHERE id = ?').run(user.id);

      const res = await request(app)
        .get('/api/system-notices/active')
@@ -68,7 +68,6 @@ import {
  removeContributor,
  getSuggestions,
  syncTripPlaces,
-  reorderEntries,
  onPlaceCreated,
  onPlaceUpdated,
  onPlaceDeleted,
@@ -1326,10 +1325,9 @@ describe('Edge cases', () => {
    const result = deleteEntry(entry.id, user.id);
    expect(result).toBe(true);

-    // Junction row must be gone (ON DELETE CASCADE from journey_entries).
-    // Gallery row (journey_photos) is preserved — photo may belong to other entries.
-    const junctionRow = testDb.prepare('SELECT * FROM journey_entry_photos WHERE entry_id = ?').get(entry.id) as any;
-    expect(junctionRow).toBeUndefined();
+    // Photo should be deleted with the entry
+    const deletedPhoto = testDb.prepare('SELECT * FROM journey_photos WHERE id = ?').get(photo!.id) as any;
+    expect(deletedPhoto).toBeUndefined();
  });

  it('JOURNEY-SVC-082: updateJourney can set cover_gradient', () => {
@@ -1397,12 +1395,17 @@ describe('Edge cases', () => {

    addTripToJourney(journey.id, trip.id, user.id);

-    // Trip photos now go straight into the journey gallery (no wrapper entry).
+    // Should have a [Trip Photos] entry with the imported photo
+    const photoEntry = testDb.prepare(
+      "SELECT * FROM journey_entries WHERE journey_id = ? AND title = '[Trip Photos]'"
+    ).get(journey.id) as any;
+    expect(photoEntry).toBeDefined();
+
    const photos = testDb.prepare(`
      SELECT jp.*, tkp.asset_id FROM journey_photos jp
      JOIN trek_photos tkp ON tkp.id = jp.photo_id
-      WHERE jp.journey_id = ?
-    `).all(journey.id);
+      WHERE jp.entry_id = ?
+    `).all(photoEntry.id);
    expect(photos.length).toBe(1);
    expect((photos[0] as any).asset_id).toBe('immich-photo-1');
  });
@@ -1466,108 +1469,3 @@ describe('addProviderPhoto — passphrase', () => {
    expect(row?.passphrase).not.toBe('secret-pp');
  });
 });
-
-// -- reorderEntries (#846) ----------------------------------------------------
-
-function insertEntry(journeyId: number, authorId: number, opts: { entry_date: string; entry_time?: string | null; sort_order?: number }): { id: number } {
-  const now = Date.now();
-  const res = testDb.prepare(`
-    INSERT INTO journey_entries (journey_id, author_id, type, entry_date, entry_time, sort_order, visibility, created_at, updated_at)
-    VALUES (?, ?, 'entry', ?, ?, ?, 'private', ?, ?)
-  `).run(journeyId, authorId, opts.entry_date, opts.entry_time ?? null, opts.sort_order ?? 0, now, now);
-  return { id: Number(res.lastInsertRowid) };
-}
-
-describe('reorderEntries', () => {
-  it('JOURNEY-SVC-089: reorder persists and listEntries returns requested order regardless of entry_time', () => {
-    const { user } = createUser(testDb);
-    const journey = createJourney(testDb, user.id);
-    const e1 = insertEntry(journey.id, user.id, { entry_date: '2026-08-01', entry_time: '09:00', sort_order: 0 });
-    const e2 = insertEntry(journey.id, user.id, { entry_date: '2026-08-01', entry_time: '14:00', sort_order: 1 });
-
-    const ok = reorderEntries(journey.id, user.id, [e2.id, e1.id]);
-    expect(ok).toBe(true);
-
-    const entries = listEntries(journey.id, user.id)!;
-    const dayEntries = entries.filter(e => e.entry_date === '2026-08-01');
-    expect(dayEntries.map(e => e.id)).toEqual([e2.id, e1.id]);
-  });
-
-  it('JOURNEY-SVC-090: reorderEntries rejects ids from another journey', () => {
-    const { user } = createUser(testDb);
-    const j1 = createJourney(testDb, user.id);
-    const j2 = createJourney(testDb, user.id);
-    const entry = createJourneyEntry(testDb, j2.id, user.id, { entry_date: '2026-08-02' });
-
-    const ok = reorderEntries(j1.id, user.id, [entry.id]);
-    expect(ok).toBe(false);
-  });
-
-  it('JOURNEY-SVC-091: reorderEntries does not affect entries on other days', () => {
-    const { user } = createUser(testDb);
-    const journey = createJourney(testDb, user.id);
-    const day1a = insertEntry(journey.id, user.id, { entry_date: '2026-08-01', sort_order: 0 });
-    const day1b = insertEntry(journey.id, user.id, { entry_date: '2026-08-01', sort_order: 1 });
-    const day2 = insertEntry(journey.id, user.id, { entry_date: '2026-08-02', sort_order: 0 });
-
-    reorderEntries(journey.id, user.id, [day1b.id, day1a.id]);
-
-    const entries = listEntries(journey.id, user.id)!;
-    const day2Entry = entries.find(e => e.id === day2.id)!;
-    expect(day2Entry.sort_order).toBe(0);
-  });
-});
-
-describe('syncTripPlaces sort_order', () => {
-  it('JOURNEY-SVC-092: assigns unique sequential sort_order per date for same-day places', () => {
-    const { user } = createUser(testDb);
-    const journey = createJourney(testDb, user.id);
-    const trip = createTrip(testDb, user.id, {
-      title: 'Order Trip',
-      start_date: '2026-09-01',
-      end_date: '2026-09-02',
-    });
-    const day = testDb.prepare('SELECT id FROM days WHERE trip_id = ? ORDER BY date ASC LIMIT 1').get(trip.id) as { id: number };
-    const p1 = createPlace(testDb, trip.id, { name: 'Place A' });
-    const p2 = createPlace(testDb, trip.id, { name: 'Place B' });
-    const p3 = createPlace(testDb, trip.id, { name: 'Place C' });
-    createDayAssignment(testDb, day.id, p1.id);
-    createDayAssignment(testDb, day.id, p2.id);
-    createDayAssignment(testDb, day.id, p3.id);
-
-    syncTripPlaces(journey.id, trip.id, user.id);
-
-    const rows = testDb.prepare(
-      'SELECT sort_order FROM journey_entries WHERE journey_id = ? ORDER BY sort_order ASC'
-    ).all(journey.id) as { sort_order: number }[];
-    const orders = rows.map(r => r.sort_order);
-    expect(new Set(orders).size).toBe(orders.length);
-    expect(orders).toEqual([0, 1, 2]);
-  });
-});
-
-describe('onPlaceCreated sort_order', () => {
-  it('JOURNEY-SVC-093: assigns MAX+1 sort_order when entries already exist on the target date', () => {
-    const { user } = createUser(testDb);
-    const journey = createJourney(testDb, user.id);
-    const trip = createTrip(testDb, user.id, {
-      title: 'Append Trip',
-      start_date: '2026-10-01',
-      end_date: '2026-10-02',
-    });
-    addTripToJourney(journey.id, trip.id, user.id);
-
-    const day = testDb.prepare('SELECT id, date FROM days WHERE trip_id = ? ORDER BY date ASC LIMIT 1').get(trip.id) as { id: number; date: string };
-    insertEntry(journey.id, user.id, { entry_date: day.date, sort_order: 5 });
-
-    const place = createPlace(testDb, trip.id, { name: 'Late Addition' });
-    createDayAssignment(testDb, day.id, place.id);
-    onPlaceCreated(trip.id, place.id);
-
-    const newEntry = testDb.prepare(
-      'SELECT sort_order FROM journey_entries WHERE journey_id = ? AND source_place_id = ?'
-    ).get(journey.id, place.id) as { sort_order: number } | undefined;
-    expect(newEntry).toBeDefined();
-    expect(newEntry!.sort_order).toBe(6);
-  });
-});
@@ -58,7 +58,7 @@ afterAll(() => {

 // -- Helpers ------------------------------------------------------------------

-/** Insert a trek_photos + journey_photos (gallery) + journey_entry_photos row and return the trek_photos id (used as photoId in public URLs). */
+/** Insert a trek_photos + journey_photos row and return the trek_photos id (used as photoId in public URLs). */
 function insertJourneyPhoto(
  entryId: number,
  opts: { filePath?: string; assetId?: string; ownerId?: number } = {}
@@ -70,24 +70,10 @@ function insertJourneyPhoto(
    VALUES (?, ?, ?, ?, ?)
  `).run(provider, opts.assetId ?? null, filePath, opts.ownerId ?? null, Date.now());
  const trekId = trekResult.lastInsertRowid as number;
-
-  // Look up journey_id from entry so gallery row is keyed to the journey (not entry).
-  const entryRow = testDb.prepare('SELECT journey_id FROM journey_entries WHERE id = ?').get(entryId) as { journey_id: number };
-  const journeyId = entryRow.journey_id;
-  const now = Date.now();
-
  testDb.prepare(`
-    INSERT OR IGNORE INTO journey_photos (journey_id, photo_id, caption, sort_order, created_at)
+    INSERT INTO journey_photos (entry_id, photo_id, caption, sort_order, created_at)
    VALUES (?, ?, NULL, 0, ?)
-  `).run(journeyId, trekId, now);
-
-  const galleryRow = testDb.prepare('SELECT id FROM journey_photos WHERE journey_id = ? AND photo_id = ?').get(journeyId, trekId) as { id: number };
-
-  testDb.prepare(`
-    INSERT OR IGNORE INTO journey_entry_photos (entry_id, journey_photo_id, sort_order, created_at)
-    VALUES (?, ?, 0, ?)
-  `).run(entryId, galleryRow.id, now);
-
+  `).run(entryId, trekId, Date.now());
  // Return trek_photos.id — this is p.photo_id in the public API response
  // and the value the client sends to /api/public/journey/:token/photos/:photoId/:kind
  return trekId;
@@ -4,8 +4,6 @@
 * discover caching, and the ReDoS-sensitive issuer trailing-slash regex.
 */
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
-import { generateKeyPairSync } from 'crypto';
-import jwtLib from 'jsonwebtoken';

 // ── DB setup ──────────────────────────────────────────────────────────────────

@@ -52,7 +50,6 @@ import {
  frontendUrl,
  findOrCreateUser,
  discover,
-  verifyIdToken,
 } from '../../../src/services/oidcService';

 const MOCK_CONFIG = {
@@ -219,59 +216,6 @@ describe('discover', () => {
    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false }));
    await expect(discover('https://bad-issuer.example.com')).rejects.toThrow();
  });
-
-  it('OIDC-SVC-037: accepts mismatched doc issuer when discoveryUrl is explicit', async () => {
-    const doc = {
-      issuer: 'https://auth.example.com/application/o/myapp/',
-      authorization_endpoint: 'https://auth.example.com/application/o/myapp/authorize/',
-      token_endpoint: 'https://auth.example.com/application/o/token/',
-      userinfo_endpoint: 'https://auth.example.com/application/o/userinfo/',
-    };
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, json: async () => doc }));
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-    const result = await discover(
-      'https://auth.example.com',
-      'https://auth.example.com/application/o/myapp/.well-known/openid-configuration',
-    );
-
-    expect(result.issuer).toBe(doc.issuer);
-    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('differs from configured OIDC_ISSUER'));
-    warnSpy.mockRestore();
-  });
-
-  it('OIDC-SVC-038: throws on mismatched doc issuer when discoveryUrl is omitted', async () => {
-    const doc = {
-      issuer: 'https://evil.example.com',
-      authorization_endpoint: 'https://unique-2.example.com/auth',
-      token_endpoint: 'https://unique-2.example.com/token',
-      userinfo_endpoint: 'https://unique-2.example.com/userinfo',
-    };
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, json: async () => doc }));
-
-    await expect(discover('https://unique-2.example.com')).rejects.toThrow(
-      'OIDC discovery issuer mismatch',
-    );
-  });
-
-  it('OIDC-SVC-039: trailing-slash-only mismatch with explicit discoveryUrl does not warn', async () => {
-    const doc = {
-      issuer: 'https://auth.example.com/',
-      authorization_endpoint: 'https://auth.example.com/auth',
-      token_endpoint: 'https://auth.example.com/token',
-      userinfo_endpoint: 'https://auth.example.com/userinfo',
-    };
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, json: async () => doc }));
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-    await discover(
-      'https://auth.example.com',
-      'https://auth.example.com/.well-known/openid-configuration',
-    );
-
-    expect(warnSpy).not.toHaveBeenCalled();
-    warnSpy.mockRestore();
-  });
 });

 // ── issuer trailing-slash regex (ReDoS guard) ─────────────────────────────────
@@ -516,66 +460,3 @@ describe('getUserInfo', () => {
    expect(fetchCall[1].headers.Authorization).toBe('Bearer access-token-123');
  });
 });
-
-// ── verifyIdToken ─────────────────────────────────────────────────────────────
-
-describe('verifyIdToken', () => {
-  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
-  const jwk = publicKey.export({ format: 'jwk' }) as Record<string, unknown>;
-  const ISSUER = 'https://auth.example.com/application/o/trek';
-  const CLIENT_ID = 'trek-client';
-  const JWKS_URI = 'https://auth.example.com/.well-known/jwks.json';
-
-  function mockJwks() {
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => ({ keys: [jwk] }),
-    }));
-  }
-
-  function makeToken(iss: string, overrides: object = {}) {
-    return jwtLib.sign(
-      { sub: 'user-sub', email: 'user@example.com', ...overrides },
-      privateKey,
-      { algorithm: 'RS256', audience: CLIENT_ID, issuer: iss, expiresIn: '1h' }
-    );
-  }
-
-  const doc = { jwks_uri: JWKS_URI } as any;
-
-  afterEach(() => { vi.unstubAllGlobals(); });
-
-  it('OIDC-SVC-033: accepts token whose iss matches expectedIssuer exactly', async () => {
-    mockJwks();
-    const token = makeToken(ISSUER);
-    const result = await verifyIdToken(token, doc, CLIENT_ID, ISSUER);
-    expect(result.ok).toBe(true);
-  });
-
-  it('OIDC-SVC-034: accepts token whose iss has a trailing slash (Authentik)', async () => {
-    mockJwks();
-    const token = makeToken(ISSUER + '/');
-    const result = await verifyIdToken(token, doc, CLIENT_ID, ISSUER);
-    expect(result.ok).toBe(true);
-  });
-
-  it('OIDC-SVC-035: rejects token with wrong issuer', async () => {
-    mockJwks();
-    const token = makeToken('https://evil.example.com');
-    const result = await verifyIdToken(token, doc, CLIENT_ID, ISSUER);
-    expect(result.ok).toBe(false);
-    expect((result as any).error).toMatch('jwt issuer invalid');
-  });
-
-  it('OIDC-SVC-036: rejects token with wrong audience', async () => {
-    mockJwks();
-    const token = makeToken(ISSUER, {});
-    const wrongAudToken = jwtLib.sign(
-      { sub: 'user-sub', iss: ISSUER },
-      privateKey,
-      { algorithm: 'RS256', audience: 'wrong-client', expiresIn: '1h' }
-    );
-    const result = await verifyIdToken(wrongAudToken, doc, CLIENT_ID, ISSUER);
-    expect(result.ok).toBe(false);
-  });
-});
@@ -59,7 +59,7 @@ If a toggle fails (e.g., network error), it rolls back to its previous state.

 Some addons require credentials or environment variables before they are functional:

- **Journey** — works without any external integration. To embed photos from Immich or Synology Photos, enable the corresponding photo-provider toggle listed under Journey, then configure credentials per-user in **Settings → Integrations**. See [Photo-Providers](Photo-Providers).
+- **Journey** — requires photo provider credentials (Immich or Synology Photos) configured per-user in their personal Settings. See [Photo-Providers](Photo-Providers).
 - **MCP** — requires `APP_URL` to be set so OAuth redirect URIs resolve correctly.

 ## Related pages
@@ -48,7 +48,7 @@ Verified in `server/src/config.ts` (line 107):

 ## HTTPS / Proxy

-These three variables work together behind a TLS-terminating reverse proxy. See [Reverse-Proxy](Reverse-Proxy) for the full explanation.
+These three variables work together behind a TLS-terminating reverse proxy. See [Reverse-Proxy] for the full explanation.

 | Variable | Description | Default |
 |---|---|---|
@@ -62,7 +62,7 @@ These three variables work together behind a TLS-terminating reverse proxy. See

 ## OIDC / SSO

-For setup instructions, see [OIDC-SSO](OIDC-SSO).
+For setup instructions, see [OIDC-SSO].

 | Variable | Description | Default |
 |---|---|---|
@@ -110,7 +110,7 @@ Both variables must be set together. If either is omitted, the account is create

 ## MCP

-For setup instructions, see [MCP-Overview](MCP-Overview).
+For setup instructions, see [MCP-Overview].

 | Variable | Description | Default |
 |---|---|---|
@@ -129,7 +129,7 @@ For setup instructions, see [MCP-Overview](MCP-Overview).

 ## Related Pages

- [Reverse-Proxy](Reverse-Proxy) — HTTPS proxy setup and the `FORCE_HTTPS` / `TRUST_PROXY` / `COOKIE_SECURE` trio
- [OIDC-SSO](OIDC-SSO) — complete OIDC configuration guide
- [MCP-Overview](MCP-Overview) — MCP server setup and rate limiting
- [Encryption-Key-Rotation](Encryption-Key-Rotation) — rotating the `ENCRYPTION_KEY` without losing data
+- [Reverse-Proxy] — HTTPS proxy setup and the `FORCE_HTTPS` / `TRUST_PROXY` / `COOKIE_SECURE` trio
+- [OIDC-SSO] — complete OIDC configuration guide
+- [MCP-Overview] — MCP server setup and rate limiting
+- [Encryption-Key-Rotation] — rotating the `ENCRYPTION_KEY` without losing data
@@ -30,23 +30,17 @@ TREK is a self-hosted, real-time collaborative travel planner licensed under AGP
 - **Public Share Links** — share a read-only view of any trip

 ### Addons _(admin-toggleable)_
- **Lists** — packing lists and to-dos with templates, member assignments, optional bag tracking
- **Budget Planner** — expense tracker with category breakdown, splits, multi-currency
- **Documents** — file manager for trips, places, and reservations
- **Collab** — group chat, shared notes, polls, day-by-day attendance
 - **Vacay** — personal vacation day planner with calendar view, public holidays, and carry-over tracking
 - **Atlas** — interactive world map, bucket list, travel stats, continent breakdown
- **Journey** — magazine-style travel journal with entries, photos (via Immich/Synology Photos), maps, and moods
- **Naver List Import** — import places from shared Naver Maps lists
- **MCP** — expose TREK to AI assistants via the Model Context Protocol (OAuth 2.1)
-
-> Dashboard widgets (currency converter and timezone clock) are per-user preferences, not an admin-toggleable addon — see [Dashboard-Widgets](Dashboard-Widgets).
+- **Journey** — travel journal linking entries to trips, with contributor roles
+- **Memories** — photo-focused trip memories
+- **Collab** — group chat, shared notes, polls, and activity sign-ups
+- **Dashboard Widgets** — currency converter and timezone clock, toggled per user

 ### AI / MCP Integration
 - **MCP Server** — built-in Model Context Protocol server with OAuth 2.1 authentication
- **150+ Tools** — create trips, plan itineraries, manage budgets, send messages, and more
- **30 Resources** — read-only `trek://` URIs for trips, days, places, budget, packing, journeys, and more
- **27 OAuth Scopes** — granular permissions across 13 permission groups
+- **80+ Tools** — create trips, plan itineraries, manage budgets, send messages, and more
+- **24 OAuth Scopes** — granular permissions across 13 permission groups
 - **Pre-built Prompts** — `trip-summary`, `packing-list`, and `budget-overview` context loaders

 ### Admin
@@ -54,7 +48,7 @@ TREK is a self-hosted, real-time collaborative travel planner licensed under AGP
 - Addon management, API key storage, scheduled auto-backups
 - System notices for onboarding and announcements

-> **Admin:** Most configuration lives in the Admin Panel. On first boot TREK seeds an admin account automatically — credentials come from `ADMIN_EMAIL` / `ADMIN_PASSWORD` if set, otherwise a random password is printed to the container log.
+> **Admin:** Most configuration lives in the Admin Panel. The first user to register becomes the admin automatically.

 ## Get Started

@@ -93,7 +93,7 @@ ALLOWED_ORIGINS=https://trek.example.com
 APP_URL=https://trek.example.com
 ```

-Uncomment and fill in the OIDC, initial setup, or MCP variables as needed. For a full description of every variable, see [Environment-Variables](Environment-Variables).
+Uncomment and fill in the OIDC, initial setup, or MCP variables as needed. For a full description of every variable, see [Environment-Variables].

 ## Start TREK

@@ -111,10 +111,10 @@ docker compose logs -f

 This compose file is designed for deployments where a reverse proxy (nginx, Caddy, Traefik) terminates TLS in front of TREK. To enable HTTPS redirects and secure cookies, uncomment `FORCE_HTTPS=true` and `TRUST_PROXY=1`.

-See [Reverse-Proxy](Reverse-Proxy) for complete proxy configuration examples.
+See [Reverse-Proxy] for complete proxy configuration examples.

 ## Next Steps

- [Environment-Variables](Environment-Variables) — full variable reference
- [Reverse-Proxy](Reverse-Proxy) — HTTPS configuration
- [Updating](Updating) — how to pull a new image
+- [Environment-Variables] — full variable reference
+- [Reverse-Proxy] — HTTPS configuration
+- [Updating] — how to pull a new image
@@ -32,7 +32,7 @@ Pass additional `-e` flags for timezone and CORS/email link support:
  -e ALLOWED_ORIGINS=https://trek.example.com \
 ```

-See [Environment-Variables](Environment-Variables) for the full list.
+See [Environment-Variables] for the full list.

 ## Volume Reference

@@ -66,11 +66,11 @@ docker logs trek

 ## Limitations of `docker run`

-A bare `docker run` command has no built-in secret management and is harder to reproduce after a system reboot. For production, see [Install-Docker-Compose](Install-Docker-Compose), which adds security hardening (`read_only`, `cap_drop`, `cap_add`, `no-new-privileges`, `tmpfs`) and makes it easy to manage environment variables through a `.env` file.
+A bare `docker run` command has no built-in secret management and is harder to reproduce after a system reboot. For production, see [Install-Docker-Compose], which adds security hardening (`read_only`, `cap_drop`, `cap_add`, `no-new-privileges`, `tmpfs`) and makes it easy to manage environment variables through a `.env` file.

 ## Next Steps

- [Reverse-Proxy](Reverse-Proxy) — HTTPS is required for PWA install and the `trek_session` cookie `secure` flag
- [Install-Docker-Compose](Install-Docker-Compose) — recommended for production
- [Environment-Variables](Environment-Variables) — full list of configurable variables
- [Updating](Updating) — how to pull a new image without losing data
+- [Reverse-Proxy] — HTTPS is required for PWA install and the `trek_session` cookie `secure` flag
+- [Install-Docker-Compose] — recommended for production
+- [Environment-Variables] — full list of configurable variables
+- [Updating] — how to pull a new image without losing data
@@ -191,5 +191,5 @@ See the [`charts/README.md`](https://github.com/mauriceboe/TREK/blob/main/charts

 ## Next Steps

- [Environment-Variables](Environment-Variables) — full variable reference
- [Reverse-Proxy](Reverse-Proxy) — proxy configuration for non-Kubernetes deployments
+- [Environment-Variables] — full variable reference
+- [Reverse-Proxy] — proxy configuration for non-Kubernetes deployments
@@ -69,5 +69,5 @@ On first boot, TREK automatically creates an admin account. The credentials are

 ## Next Steps

- [Environment-Variables](Environment-Variables) — complete variable reference
- [Updating](Updating) — how to pull a new image on Unraid
+- [Environment-Variables] — complete variable reference
+- [Updating] — how to pull a new image on Unraid
@@ -2,7 +2,7 @@

 TREK can browse your personal photo library on Immich or Synology Photos and attach selected photos to trips. TREK never copies the original files — it stores only a reference (provider name + asset ID) and proxies all image streams through its own server, so your provider credentials are never sent to the browser.

-> **Admin:** Enable at least one photo provider (Immich or Synology Photos) in **Admin → Addons** — photo provider toggles appear as sub-items under the **Journey** addon. Once a provider is on, a Photo Providers section appears in each user's **Settings → Integrations**. If your provider runs on a local or private network, the server must be configured to allow internal network access. See [Admin-Addons](Admin-Addons) and [Internal-Network-Access](Internal-Network-Access).
+> **Admin:** Two things must be enabled for photo providers to appear in Settings: the **Memories addon** and the **individual photo provider** (Immich or Synology Photos). Both are toggled separately in **Admin → Addons**. See [Admin-Addons](Admin-Addons). If your provider is on a local or private network, the server must be configured to allow internal network access. See [Internal-Network-Access](Internal-Network-Access).

 ---

@@ -60,7 +60,7 @@ You will be prompted to change the password on first login.

 ## Next Steps

- [Install-Docker-Compose](Install-Docker-Compose) — production setup with security hardening
- [Reverse-Proxy](Reverse-Proxy) — put TREK behind HTTPS (required for PWA install and secure cookies)
- [Environment-Variables](Environment-Variables) — full configuration reference
- [Admin-Panel-Overview](Admin-Panel-Overview) — explore what the admin panel can do
+- [Install-Docker-Compose] — production setup with security hardening
+- [Reverse-Proxy] — put TREK behind HTTPS (required for PWA install and secure cookies)
+- [Environment-Variables] — full configuration reference
+- [Admin-Panel-Overview] — explore what the admin panel can do
@@ -98,9 +98,9 @@ Four variables control how TREK behaves behind a proxy. They work as a group:

 If you access TREK directly on `http://<host>:3000` without a proxy, leave `FORCE_HTTPS` unset and do not set `TRUST_PROXY`.

-See [Environment-Variables](Environment-Variables) for full documentation of these and all other variables.
+See [Environment-Variables] for full documentation of these and all other variables.

 ## Next Steps

- [Environment-Variables](Environment-Variables) — full variable reference including OIDC
- [Install-Docker-Compose](Install-Docker-Compose) — production compose file with proxy-ready env vars
+- [Environment-Variables] — full variable reference including OIDC
+- [Install-Docker-Compose] — production compose file with proxy-ready env vars
@@ -1,9 +1,7 @@
 # Tags and Categories

-TREK has two independent labelling systems for places:
+TREK has a labeling system: **Global Place Categories** (admin-managed, shared across all users).

- **Global Place Categories** — admin-managed, shared across every user on the instance (e.g. `Restaurant`, `Museum`).
- **Personal Tags** — user-scoped, private labels (e.g. `hidden gem`, `kid-friendly`).

 <!-- TODO: screenshot: tag list on place detail -->

@@ -26,23 +24,6 @@ Categories appear in:

 > **Admin:** Create and manage categories in [Admin-Categories](Admin-Categories). Only admins can create, edit, or delete categories. All users can read them.

-## Personal Tags
-
-Tags are private labels owned by each user. They attach to individual places via a many-to-many relationship (`place_tags` table), so the same tag can be applied to as many places as you like, and a single place can carry multiple tags.
-
-**Fields per tag:**
-
- **Name** — free-form text.
- **Color** — hex value displayed alongside the tag name. Default: `#10b981` (emerald).
-
-Tags are scoped to their creator — other trip members do not see your tags, and different users can create tags with identical names without conflict. Deleting a tag automatically removes it from every place it was attached to.
-
-### Where to manage them
-
-At the moment tags are exposed primarily through the MCP API — AI assistants connected to your instance can list, create, update, and delete tags (`list_tags`, `create_tag`, `update_tag`, `delete_tag`) and attach them to places through the place endpoints. A dedicated web UI for tag management is not yet available; the filter `tag` parameter on the places API / MCP resource does support filtering places by a tag ID once one exists.
-
-> **AI / MCP:** See [MCP-Tools-and-Resources](MCP-Tools-and-Resources) for the full tag tool list.
-
 ## When to use which

 | Use case | Use |
@@ -4,7 +4,7 @@ How to update TREK to a newer version without losing data.

 ## Before You Update

-Back up your data first. Go to Admin Panel → Backups and create a manual backup, or copy your `./data` and `./uploads` directories to a safe location. See [Backups](Backups) for details.
+Back up your data first. Go to Admin Panel → Backups and create a manual backup, or copy your `./data` and `./uploads` directories to a safe location. See [Backups] for details.

 ## Docker Compose (Recommended)

@@ -42,7 +42,7 @@ TREK runs any pending database migrations automatically at startup. No manual mi

 If you are upgrading from a version that predates the dedicated `ENCRYPTION_KEY` (i.e. you have no `ENCRYPTION_KEY` environment variable set), TREK automatically falls back to `./data/.jwt_secret` on startup and immediately promotes it to `./data/.encryption_key`. No manual steps are required — the transition is handled at first boot after the upgrade.

-If you want to rotate to a new key at any point (not required for a normal update), see [Encryption-Key-Rotation](Encryption-Key-Rotation) for the full procedure.
+If you want to rotate to a new key at any point (not required for a normal update), see [Encryption-Key-Rotation] for the full procedure.

 ## Unraid

@@ -50,6 +50,6 @@ In the Unraid Docker tab, click the TREK container and select **Update**. Unraid

 ## Next Steps

- [Backups](Backups) — schedule automatic backups so you always have a restore point before updates
- [Encryption-Key-Rotation](Encryption-Key-Rotation) — if you need to rotate or migrate the encryption key
- [Install-Docker-Compose](Install-Docker-Compose) — switch to Compose for easier future updates
+- [Backups] — schedule automatic backups so you always have a restore point before updates
+- [Encryption-Key-Rotation] — if you need to rotate or migrate the encryption key
+- [Install-Docker-Compose] — switch to Compose for easier future updates
Author	SHA1	Message	Date
sss3978	00a7ac0341	Merge `d30132197e` into `71aa8f8051`	2026-04-22 14:00:59 +00:00
sss3978	d30132197e	Update client/src/i18n/translations/ja.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-22 23:00:56 +09:00
sss3978	9bf4220054	Update ja.ts	2026-04-22 21:59:16 +09:00
sss3978	0d0ab5080c	Update supportedLanguages.ts	2026-04-22 21:56:52 +09:00
sss3978	1084d40685	Update TranslationContext.tsx	2026-04-22 21:55:47 +09:00
sss3978	75ef928264	Create ja.ts	2026-04-22 21:54:10 +09:00