From 7c3290c4e6e39f8f34d4afccc4a03ff47ba6586a Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Wed, 23 Jul 2025 21:57:00 +0300
Subject: [PATCH 01/15] Add photos API endpoints

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/API_DOCS.md      | 55 +++++++++++++++++++++++++++++-
 backend/main/app.py           |  3 +-
 backend/main/models.py        | 15 ++++++--
 backend/main/routes/photos.py | 64 +++++++++++++++++++++++++++++++++++
 4 files changed, 133 insertions(+), 4 deletions(-)
 create mode 100644 backend/main/routes/photos.py

diff --git a/backend/main/API_DOCS.md b/backend/main/API_DOCS.md
index 144e9bce..2d29460d 100644
--- a/backend/main/API_DOCS.md
+++ b/backend/main/API_DOCS.md
@@ -293,4 +293,57 @@ The Toolbox.io Telegram bot provides the same support functionality as the web i
 ## Authentication
 
 - All protected endpoints require the `Authorization: Bearer <access_token>` header.
-- JWT tokens are returned by `/api/auth/login` and must be stored securely on the client.
\ No newline at end of file
+- JWT tokens are returned by `/api/auth/login` and must be stored securely on the client.
+
+---
+
+## Photo Storage Endpoints
+
+All `/photos/*` endpoints are under the `/photos` prefix and require authentication (`Authorization: Bearer <access_token>`).
+
+### GET `/photos/sync`
+- **Description:** List all photo UUIDs and metadata for the authenticated user (for sync).
+- **Headers:**
+  - `Authorization: Bearer <access_token>`
+- **Response:**
+  ```json
+  {
+    "photos": [
+      {"uuid": "<uuid>", "uploaded_at": "<date>T<time>Z", "filename": "<string>"}
+      // ...
+    ]
+  }
+  ```
+- **Errors:**
+  - `401`: Unauthorized (invalid or missing token)
+
+---
+
+### POST `/photos/upload`
+- **Description:** Upload an encrypted photo file with a client-generated UUID.
+- **Headers:**
+  - `Authorization: Bearer <access_token>`
+- **Request (multipart/form-data):**
+  - `photo_uuid`: string (UUID, required)
+  - `file`: binary (encrypted photo, required)
+- **Response:**
+  `201 Created`
+  ```json
+  { "status": "success" }
+  ```
+- **Errors:**
+  - `400`: Photo UUID already exists for this user
+  - `401`: Unauthorized (invalid or missing token)
+
+---
+
+### GET `/photos/download/{photo_uuid}`
+- **Description:** Download the encrypted photo file for the given UUID (if it belongs to the user).
+- **Headers:**
+  - `Authorization: Bearer <access_token>`
+- **Response:**
+  - Content-Type: `application/octet-stream`
+  - File download (binary)
+- **Errors:**
+  - `404`: Photo not found or file missing
+  - `401`: Unauthorized (invalid or missing token)
\ No newline at end of file
diff --git a/backend/main/app.py b/backend/main/app.py
index 95827a8c..4f9a46db 100644
--- a/backend/main/app.py
+++ b/backend/main/app.py
@@ -7,7 +7,7 @@
 
 import utils
 from limiter import limiter
-from routes import auth, guides, core, issues, support
+from routes import auth, guides, core, issues, support, photos
 from live_reload import HTMLInjectorMiddleware
 import live_reload
 
@@ -55,3 +55,4 @@ async def rate_limit_handler(request: Request, exc: RateLimitExceeded) -> Respon
 app.include_router(issues.router, prefix="/api/issues")
 app.include_router(live_reload.router)
 app.include_router(support.router, prefix="/api/support")
+app.include_router(photos.router, prefix="/api/photos")
diff --git a/backend/main/models.py b/backend/main/models.py
index f8d7a207..5ecf7ee8 100644
--- a/backend/main/models.py
+++ b/backend/main/models.py
@@ -1,6 +1,6 @@
 import re
 from datetime import datetime
-from sqlalchemy import Boolean, String, DateTime, Column, Integer
+from sqlalchemy import Boolean, String, DateTime, Column, Integer, ForeignKey
 from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.sql import func
 
@@ -110,4 +110,15 @@ class BlacklistedToken(Base):
     __tablename__ = "blacklisted_tokens"
     id = Column(Integer, primary_key=True, index=True)
     token = Column(String(512), unique=True, nullable=False)
-    blacklisted_at = Column(DateTime(timezone=True), server_default=func.now())
\ No newline at end of file
+    blacklisted_at = Column(DateTime(timezone=True), server_default=func.now())
+
+class Photo(Base):
+    __tablename__ = "photos"
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("users.id"), nullable=False)
+    uuid = Column(String(36), unique=True, index=True, nullable=False)  # Client-generated UUID
+    filename = Column(String(255), nullable=False)
+    encrypted = Column(Boolean, default=False)  # True if photo is encrypted
+    salt = Column(String(64), nullable=True)    # Store as hex/base64 if encrypted
+    iv = Column(String(32), nullable=True)      # Store as hex/base64 if encrypted
+    uploaded_at = Column(DateTime(timezone=True), server_default=func.now())
\ No newline at end of file
diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
new file mode 100644
index 00000000..54307178
--- /dev/null
+++ b/backend/main/routes/photos.py
@@ -0,0 +1,64 @@
+from fastapi import APIRouter, UploadFile, File, Form, Depends, HTTPException, status
+from fastapi.responses import FileResponse
+from sqlalchemy.orm import Session
+import os
+from uuid import uuid4
+from models import Photo, User
+from db.core import get_db  # Adjust if your session dependency is elsewhere
+from routes.auth.utils import get_current_user
+
+router = APIRouter()
+PHOTO_DIR = "photos"
+os.makedirs(PHOTO_DIR, exist_ok=True)
+
+# TODO photo endpoints
+
+@router.get("/sync")
+def sync_photos(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user)
+):
+    photos = db.query(Photo).filter_by(user_id=current_user.id).all()
+    return {
+        "photos": [
+            {"uuid": p.uuid, "uploaded_at": p.uploaded_at, "filename": p.filename} for p in photos
+        ]
+    }
+
+@router.post("/upload", status_code=status.HTTP_201_CREATED)
+async def upload_photo(
+    photo_uuid: str = Form(...),
+    file: UploadFile = File(...),
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user)
+):
+    # Check if UUID already exists for this user
+    existing = db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first()
+    if existing:
+        raise HTTPException(status_code=400, detail="Photo UUID already exists.")
+
+    # Save encrypted file
+    filename = f"{current_user.id}_{photo_uuid}.bin"
+    file_path = os.path.join(PHOTO_DIR, filename)
+    with open(file_path, "wb") as f:
+        f.write(await file.read())
+
+    # Save metadata, including user_id and uuid (attached server-side)
+    photo = Photo(uuid=photo_uuid, user_id=current_user.id, filename=filename, encrypted=True)
+    db.add(photo)
+    db.commit()
+    return {"status": "success"}
+
+@router.get("/download/{photo_uuid}")
+def download_photo(
+    photo_uuid: str,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user)
+):
+    photo = db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first()
+    if not photo:
+        raise HTTPException(status_code=404, detail="Photo not found.")
+    file_path = os.path.join(PHOTO_DIR, photo.filename)
+    if not os.path.exists(file_path):
+        raise HTTPException(status_code=404, detail="File not found on server.")
+    return FileResponse(file_path, media_type="application/octet-stream", filename=photo.filename)
\ No newline at end of file

From 9d34e412bf1d619d7de42aed7109c62aaed1cae5 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Wed, 23 Jul 2025 21:56:41 +0300
Subject: [PATCH 02/15] Add Cursor rules

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 .cursor/rules/docs.mdc | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .cursor/rules/docs.mdc

diff --git a/.cursor/rules/docs.mdc b/.cursor/rules/docs.mdc
new file mode 100644
index 00000000..a3755c0d
--- /dev/null
+++ b/.cursor/rules/docs.mdc
@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+when working with this project and adding API endpoints always document them in @API_DOCS.md
\ No newline at end of file

From d0d815e057d6f10da01a6b842c53283944dc6d70 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Thu, 24 Jul 2025 10:54:53 +0300
Subject: [PATCH 03/15] Add basic photos UI

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 frontend/css/photos.scss   | 119 +++++++++++++++++++++++++++++++++++++
 frontend/photos/index.html |  40 +++++++++++++
 frontend/photos/index.ts   |  83 ++++++++++++++++++++++++++
 3 files changed, 242 insertions(+)
 create mode 100644 frontend/css/photos.scss
 create mode 100644 frontend/photos/index.html
 create mode 100644 frontend/photos/index.ts

diff --git a/frontend/css/photos.scss b/frontend/css/photos.scss
new file mode 100644
index 00000000..fdbb51f9
--- /dev/null
+++ b/frontend/css/photos.scss
@@ -0,0 +1,119 @@
+#photo-gallery {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
+  gap: 16px;
+  padding: 24px 0;
+  min-height: 200px;
+  position: relative;
+  background: #f8f9fa;
+  border-radius: 12px;
+  transition: box-shadow 0.2s;
+}
+
+#photo-gallery.dragover {
+  box-shadow: 0 0 0 4px #007bff33;
+  background: #e3f0ff;
+}
+
+#gallery-placeholder {
+  grid-column: 1 / -1;
+  text-align: center;
+  color: #888;
+  font-size: 1.1em;
+  padding: 40px 0;
+}
+
+.gallery-thumb {
+  width: 100%;
+  height: 120px;
+  object-fit: cover;
+  border-radius: 8px;
+  cursor: pointer;
+  box-shadow: 0 2px 8px #0001;
+  transition: transform 0.2s, box-shadow 0.2s;
+}
+
+.gallery-thumb:hover {
+  transform: scale(1.04);
+  box-shadow: 0 4px 16px #0002;
+}
+
+#photo-modal {
+  position: fixed;
+  inset: 0;
+  z-index: 1000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: rgba(0,0,0,0.7);
+  opacity: 1;
+  pointer-events: auto;
+  transition: opacity 0.3s;
+}
+
+#photo-modal.hidden {
+  opacity: 0;
+  pointer-events: none;
+}
+
+.modal-overlay {
+  position: absolute;
+  inset: 0;
+  background: transparent;
+}
+
+.modal-content {
+  position: relative;
+  background: #fff;
+  border-radius: 12px;
+  box-shadow: 0 8px 32px #0003;
+  padding: 32px 24px 24px 24px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  min-width: 320px;
+  min-height: 320px;
+  animation: modalExpand 0.3s cubic-bezier(.4,2,.6,1) both;
+}
+
+@keyframes modalExpand {
+  from { 
+    transform: scale(0.8); 
+    opacity: 0; 
+    }
+  to { 
+    transform: scale(1); 
+    opacity: 1; 
+}
+}
+
+#modal-photo {
+  max-width: 80vw;
+  max-height: 60vh;
+  border-radius: 8px;
+  margin-bottom: 24px;
+  box-shadow: 0 2px 16px #0002;
+}
+.modal-actions {
+  position: absolute;
+  top: 12px;
+  left: 0;
+  width: 100%;
+  display: flex;
+  justify-content: space-between;
+  padding: 0 24px;
+}
+.modal-actions button {
+  background: #007bff;
+  color: #fff;
+  border: none;
+  border-radius: 6px;
+  padding: 8px 18px;
+  font-size: 1em;
+  cursor: pointer;
+  box-shadow: 0 2px 8px #007bff22;
+  transition: background 0.2s;
+}
+.modal-actions button:hover {
+  background: #0056b3;
+}
diff --git a/frontend/photos/index.html b/frontend/photos/index.html
new file mode 100644
index 00000000..37b60a37
--- /dev/null
+++ b/frontend/photos/index.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8"/>
+        <meta lang="en" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Toolbox.io</title>
+        <link rel="icon" href="/res/favicon.svg" />
+
+        <link rel="stylesheet" href="/css/common.css" />
+        <link rel="stylesheet" href="/css/photos.css" />
+
+        <script src="/lib/jquery.js"></script>
+        <script type="module" src="/common.js"></script>
+    </head>
+    <body>
+        <tio-header class="top" tab="0"></tio-header>
+        <div class="wrapper">
+            <div id="main" class="automargin">
+                <h1>Фото</h1>
+                <div id="photo-gallery" class="gallery-drop-area">
+                    <!-- Thumbnails will be rendered here by JS -->
+                    <div id="gallery-placeholder">Перетащите фото сюда для загрузки</div>
+                </div>
+                <div id="photo-modal" class="hidden">
+                    <div class="modal-overlay"></div>
+                    <div class="modal-content">
+                        <img id="modal-photo" src="" alt="Фото" />
+                        <div class="modal-actions">
+                            <button id="download-photo">Скачать</button>
+                            <button id="delete-photo">Удалить</button>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <tio-footer></tio-footer>
+        <script type="module" src="index.js"></script>
+    </body>
+</html>
\ No newline at end of file
diff --git a/frontend/photos/index.ts b/frontend/photos/index.ts
new file mode 100644
index 00000000..16bc1a5b
--- /dev/null
+++ b/frontend/photos/index.ts
@@ -0,0 +1,83 @@
+(() => {
+    interface Photo {
+        uuid: string;
+        url: string; // data URL or blob URL
+    }
+    
+    const gallery = document.getElementById('photo-gallery')!;
+    const modal = document.getElementById('photo-modal')!;
+    const modalPhoto = document.getElementById('modal-photo') as HTMLImageElement;
+    const downloadBtn = document.getElementById('download-photo')!;
+    const deleteBtn = document.getElementById('delete-photo')!;
+    const galleryPlaceholder = document.getElementById('gallery-placeholder')!;
+    
+    let photos: Photo[] = [];
+    let currentPhoto: Photo | null = null;
+    
+    function renderGallery() {
+        gallery.innerHTML = '';
+        if (photos.length === 0) {
+            gallery.appendChild(galleryPlaceholder);
+        } else {
+            photos.forEach(photo => {
+                const img = document.createElement('img');
+                img.src = photo.url;
+                img.className = 'gallery-thumb';
+                img.onclick = () => openModal(photo);
+                gallery.appendChild(img);
+            });
+        }
+    }
+    
+    function openModal(photo: Photo) {
+        currentPhoto = photo;
+        modalPhoto.src = photo.url;
+        modal.classList.remove('hidden');
+    }
+    
+    function closeModal() {
+        modal.classList.add('hidden');
+        currentPhoto = null;
+    }
+    
+    // Modal overlay click closes modal
+    modal.querySelector('.modal-overlay')!.addEventListener('click', closeModal);
+    
+    // Download and delete button events (placeholders)
+    downloadBtn.addEventListener('click', () => {
+        if (currentPhoto) {
+            // TODO: implement download logic
+            alert('Download: ' + currentPhoto.uuid);
+        }
+    });
+    deleteBtn.addEventListener('click', () => {
+        if (currentPhoto) {
+            // TODO: implement delete logic
+            alert('Delete: ' + currentPhoto.uuid);
+        }
+    });
+    
+    // Drag-and-drop upload
+    function handleDrop(e: DragEvent) {
+        e.preventDefault();
+        if (e.dataTransfer && e.dataTransfer.files.length > 0) {
+            for (const file of Array.from(e.dataTransfer.files)) {
+                // TODO: encrypt and upload file
+                alert('Upload: ' + file.name);
+            }
+        }
+        gallery.classList.remove('dragover');
+    }
+    
+    gallery.addEventListener('dragover', e => {
+        e.preventDefault();
+        gallery.classList.add('dragover');
+    });
+    gallery.addEventListener('dragleave', e => {
+        e.preventDefault();
+        gallery.classList.remove('dragover');
+    });
+    gallery.addEventListener('drop', handleDrop);
+    
+    document.addEventListener('DOMContentLoaded', renderGallery);
+})();
\ No newline at end of file

From fd165e1dc9c6466b772d0b70b2b46e6ca82ecfc0 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Thu, 24 Jul 2025 12:04:25 +0300
Subject: [PATCH 04/15] Basic photo storage

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/routes/photos.py |   2 -
 frontend/js/account/index.ts  |  16 +++-
 frontend/photos/index.ts      | 144 +++++++++++++++++++++++++++++++++-
 3 files changed, 152 insertions(+), 10 deletions(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 54307178..8bb80d15 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -11,8 +11,6 @@
 PHOTO_DIR = "photos"
 os.makedirs(PHOTO_DIR, exist_ok=True)
 
-# TODO photo endpoints
-
 @router.get("/sync")
 def sync_photos(
     db: Session = Depends(get_db),
diff --git a/frontend/js/account/index.ts b/frontend/js/account/index.ts
index 1b3db4b2..10341f46 100644
--- a/frontend/js/account/index.ts
+++ b/frontend/js/account/index.ts
@@ -35,7 +35,7 @@ interface PasswordChangeData {
 
 interface ApiResponse<T = any> {
     data?: T;
-    error?: string;
+    detail?: string;
     message?: string;
     access_token?: string
 }
@@ -96,14 +96,22 @@ type PageType = 'login' | 'register' | 'account';
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify(credentials),
                 });
+
                 const data: ApiResponse = await response.json();
                 if (response.ok) {
                     localStorage.setItem('authToken', data.access_token || '');
+                    // Save password hash to localStorage
+                    const enc = new TextEncoder();
+                    const hashBuffer = await crypto.subtle.digest('SHA-256', enc.encode(password));
+                    const hashArray = Array.from(new Uint8Array(hashBuffer));
+                    const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+                    localStorage.setItem('passwordHash', hashHex);
                     location.href = '/account';
                 } else {
-                    showError(errorMessage, data.error || 'Не удалось войти');
+                    showError(errorMessage, data.detail || 'Не удалось войти');
                 }
             } catch (error) {
+                console.error(error);
                 showError(errorMessage, 'Неизвестная ошибка');
             }
         });
@@ -154,7 +162,7 @@ type PageType = 'login' | 'register' | 'account';
                 if (response.ok) {
                     location.href = `/account/register-code.html?email=${encodeURIComponent(email)}`;
                 } else {
-                    showError(errorMessage, data.error || 'Не удалось зарегистрироваться');
+                    showError(errorMessage, data.detail || 'Не удалось зарегистрироваться');
                 }
             } catch (error) {
                 showError(errorMessage, 'Неизвестная ошибка');
@@ -397,7 +405,7 @@ type PageType = 'login' | 'register' | 'account';
                     closePasswordDialog();
                 }, 2000);
             } else {
-                await showDialogError(dialogError, data.error || 'Не удалось сменить пароль');
+                await showDialogError(dialogError, data.detail || 'Не удалось сменить пароль');
             }
         } catch (error) {
             await showDialogError(dialogError, 'Неизвестная ошибка');
diff --git a/frontend/photos/index.ts b/frontend/photos/index.ts
index 16bc1a5b..5c22977f 100644
--- a/frontend/photos/index.ts
+++ b/frontend/photos/index.ts
@@ -57,13 +57,121 @@
         }
     });
     
-    // Drag-and-drop upload
+    // --- Encryption Utilities ---
+    async function deriveKeyFromPasswordHash(passwordHash: string): Promise<CryptoKey> {
+        // Use SHA-256 of the password hash as the key material
+        const enc = new TextEncoder();
+        const hashBuffer = await crypto.subtle.digest('SHA-256', enc.encode(passwordHash));
+        return crypto.subtle.importKey(
+            'raw',
+            hashBuffer,
+            { name: 'AES-GCM' },
+            false,
+            ['encrypt', 'decrypt']
+        );
+    }
+
+    async function encryptData(data: ArrayBuffer, key: CryptoKey): Promise<{cipher: ArrayBuffer, iv: Uint8Array}> {
+        const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV for AES-GCM
+        const cipher = await crypto.subtle.encrypt(
+            { name: 'AES-GCM', iv },
+            key,
+            data
+        );
+        return { cipher, iv };
+    }
+
+    async function decryptData(cipher: ArrayBuffer, key: CryptoKey, iv: Uint8Array): Promise<ArrayBuffer> {
+        return crypto.subtle.decrypt(
+            { name: 'AES-GCM', iv },
+            key,
+            cipher
+        );
+    }
+
+    function generateUUID() {
+        // RFC4122 v4 compliant UUID
+        return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
+            const r = crypto.getRandomValues(new Uint8Array(1))[0] % 16;
+            const v = c === 'x' ? r : (r & 0x3 | 0x8);
+            return v.toString(16);
+        });
+    }
+
+    function getPasswordHash(): string | null {
+        return localStorage.getItem('passwordHash');
+    }
+
+    // --- Upload Logic ---
+    async function handleFileUpload(file: File) {
+        const passwordHash = getPasswordHash();
+        if (!passwordHash) {
+            alert('No password hash found. Please log in again.');
+            return;
+        }
+        const key = await deriveKeyFromPasswordHash(passwordHash);
+        const arrayBuffer = await file.arrayBuffer();
+        const { cipher, iv } = await encryptData(arrayBuffer, key);
+        const uuid = generateUUID();
+
+        // Prepare form data
+        const formData = new FormData();
+        formData.append('photo_uuid', uuid);
+        // Combine IV and cipher for upload
+        const ivAndCipher = new Uint8Array(iv.length + cipher.byteLength);
+        ivAndCipher.set(iv, 0);
+        ivAndCipher.set(new Uint8Array(cipher), iv.length);
+        formData.append('file', new Blob([ivAndCipher]), file.name + '.enc');
+
+        // Upload to backend
+        const resp = await fetch('/api/photos/upload', {
+            method: 'POST',
+            body: formData,
+            headers: {
+                "Authorization": `Bearer ${localStorage.getItem("authToken")}`
+            }
+        });
+        if (!resp.ok) {
+            alert('Upload failed: ' + (await resp.text()));
+            return;
+        }
+        // Add to gallery
+        const url = URL.createObjectURL(file); // Show original for now (will reload from backend)
+        photos.push({ uuid, url });
+        renderGallery();
+    }
+
+    // --- Download & Decrypt Logic ---
+    async function downloadAndDecryptPhoto(uuid: string, filename: string): Promise<string> {
+        const passwordHash = getPasswordHash();
+        if (!passwordHash) throw new Error('No password hash found.');
+        const key = await deriveKeyFromPasswordHash(passwordHash);
+        const resp = await fetch(
+            `/api/photos/download/${uuid}`, 
+            {
+                headers: {
+                    "Authorization": `Bearer ${localStorage.getItem("authToken")}`
+                }
+            }
+        );
+        if (!resp.ok) throw new Error('Download failed');
+        const blob = await resp.blob();
+        const buffer = await blob.arrayBuffer();
+        // Extract IV and cipher
+        const iv = new Uint8Array(buffer.slice(0, 12));
+        const cipher = buffer.slice(12);
+        const plain = await decryptData(cipher, key, iv);
+        // Convert to data URL for display
+        const fileType = filename.split('.').pop()?.toLowerCase() === 'jpg' ? 'image/jpeg' : 'image/png';
+        return URL.createObjectURL(new Blob([plain], { type: fileType }));
+    }
+
+    // Drag-and-drop upload integration
     function handleDrop(e: DragEvent) {
         e.preventDefault();
         if (e.dataTransfer && e.dataTransfer.files.length > 0) {
             for (const file of Array.from(e.dataTransfer.files)) {
-                // TODO: encrypt and upload file
-                alert('Upload: ' + file.name);
+                handleFileUpload(file);
             }
         }
         gallery.classList.remove('dragover');
@@ -79,5 +187,33 @@
     });
     gallery.addEventListener('drop', handleDrop);
     
-    document.addEventListener('DOMContentLoaded', renderGallery);
+    // --- Load and decrypt photos from backend ---
+    async function loadAndDisplayPhotos() {
+        const resp = await fetch(
+            '/api/photos/sync', 
+            { 
+                "headers": {
+                    "Authorization": `Bearer ${localStorage.getItem("authToken")}`
+                }
+            }
+        );
+        if (!resp.ok) {
+            alert('Не удалось загрузить список фото');
+            return;
+        }
+        const data = await resp.json();
+        const photoList = data.photos as { uuid: string, filename: string }[];
+        photos = [];
+        for (const { uuid, filename } of photoList) {
+            try {
+                const url = await downloadAndDecryptPhoto(uuid, filename);
+                photos.push({ uuid, url });
+            } catch (e) {
+                console.error('Failed to load photo', uuid, e);
+            }
+        }
+        renderGallery();
+    }
+
+    document.addEventListener('DOMContentLoaded', loadAndDisplayPhotos);
 })();
\ No newline at end of file

From 3b46f5406ed83734510909615ca3238acb095a03 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Thu, 24 Jul 2025 12:38:36 +0300
Subject: [PATCH 05/15] Add a rate limit and a size limit

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/routes/photos.py | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 8bb80d15..4e5013e4 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -6,6 +6,8 @@
 from models import Photo, User
 from db.core import get_db  # Adjust if your session dependency is elsewhere
 from routes.auth.utils import get_current_user
+from limiter import limiter
+from fastapi import Request
 
 router = APIRouter()
 PHOTO_DIR = "photos"
@@ -24,23 +26,37 @@ def sync_photos(
     }
 
 @router.post("/upload", status_code=status.HTTP_201_CREATED)
+@limiter.limit("1/minute")
 async def upload_photo(
+    request: Request,
     photo_uuid: str = Form(...),
     file: UploadFile = File(...),
     db: Session = Depends(get_db),
     current_user: User = Depends(get_current_user)
 ):
+    # Limit file size to 50MB, read in chunks
+    MAX_SIZE = 50 * 1024 * 1024
+    chunk_size = 1024 * 1024  # 1MB
+    total_size = 0
+    filename = f"{current_user.id}_{photo_uuid}.bin"
+    file_path = os.path.join(PHOTO_DIR, filename)
+    with open(file_path, "wb") as out_file:
+        while True:
+            chunk = await file.read(chunk_size)
+            if not chunk:
+                break
+            total_size += len(chunk)
+            if total_size > MAX_SIZE:
+                out_file.close()
+                os.remove(file_path)
+                raise HTTPException(status_code=413, detail="File too large (max 50MB)")
+            out_file.write(chunk)
+    
     # Check if UUID already exists for this user
     existing = db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first()
     if existing:
+        os.remove(file_path)
         raise HTTPException(status_code=400, detail="Photo UUID already exists.")
-
-    # Save encrypted file
-    filename = f"{current_user.id}_{photo_uuid}.bin"
-    file_path = os.path.join(PHOTO_DIR, filename)
-    with open(file_path, "wb") as f:
-        f.write(await file.read())
-
     # Save metadata, including user_id and uuid (attached server-side)
     photo = Photo(uuid=photo_uuid, user_id=current_user.id, filename=filename, encrypted=True)
     db.add(photo)

From a9a20476cf1ee53cb959ae6aca845698dc812d81 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Thu, 24 Jul 2025 13:17:20 +0300
Subject: [PATCH 06/15] Add login fallback if not authorized

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 frontend/photos/index.ts | 56 ++++++++++++++++++++++------------------
 1 file changed, 31 insertions(+), 25 deletions(-)

diff --git a/frontend/photos/index.ts b/frontend/photos/index.ts
index 5c22977f..a30e3b7f 100644
--- a/frontend/photos/index.ts
+++ b/frontend/photos/index.ts
@@ -1,4 +1,4 @@
-(() => {
+(async () => {
     interface Photo {
         uuid: string;
         url: string; // data URL or blob URL
@@ -188,32 +188,38 @@
     gallery.addEventListener('drop', handleDrop);
     
     // --- Load and decrypt photos from backend ---
-    async function loadAndDisplayPhotos() {
-        const resp = await fetch(
-            '/api/photos/sync', 
-            { 
-                "headers": {
-                    "Authorization": `Bearer ${localStorage.getItem("authToken")}`
-                }
-            }
-        );
-        if (!resp.ok) {
-            alert('Не удалось загрузить список фото');
-            return;
+    const checkAuth = await fetch("/api/auth/check-auth", {
+        headers: {
+            "Authorization": `Bearer ${localStorage.getItem("authToken")}`
         }
-        const data = await resp.json();
-        const photoList = data.photos as { uuid: string, filename: string }[];
-        photos = [];
-        for (const { uuid, filename } of photoList) {
-            try {
-                const url = await downloadAndDecryptPhoto(uuid, filename);
-                photos.push({ uuid, url });
-            } catch (e) {
-                console.error('Failed to load photo', uuid, e);
+    })
+    if (!checkAuth.ok) {
+        location.href = "/account/login";
+        return;
+    }
+
+    const resp = await fetch(
+        '/api/photos/sync', 
+        { 
+            "headers": {
+                "Authorization": `Bearer ${localStorage.getItem("authToken")}`
             }
         }
-        renderGallery();
+    );
+    if (!resp.ok) {
+        alert('Не удалось загрузить список фото');
+        return;
     }
-
-    document.addEventListener('DOMContentLoaded', loadAndDisplayPhotos);
+    const data = await resp.json();
+    const photoList = data.photos as { uuid: string, filename: string }[];
+    photos = [];
+    for (const { uuid, filename } of photoList) {
+        try {
+            const url = await downloadAndDecryptPhoto(uuid, filename);
+            photos.push({ uuid, url });
+        } catch (e) {
+            console.error('Failed to load photo', uuid, e);
+        }
+    }
+    renderGallery();
 })();
\ No newline at end of file

From 8d75ef309665d473509c1a1e58979347cdbe3a37 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Thu, 24 Jul 2025 13:34:28 +0300
Subject: [PATCH 07/15] Don't include nonexistent photos in /sync endpoint

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/models.py        |  6 +-----
 backend/main/routes/photos.py | 26 ++++++++++++++++++++------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/backend/main/models.py b/backend/main/models.py
index 5ecf7ee8..56778434 100644
--- a/backend/main/models.py
+++ b/backend/main/models.py
@@ -114,11 +114,7 @@ class BlacklistedToken(Base):
 
 class Photo(Base):
     __tablename__ = "photos"
-    id = Column(Integer, primary_key=True, index=True)
     user_id = Column(Integer, ForeignKey("users.id"), nullable=False)
-    uuid = Column(String(36), unique=True, index=True, nullable=False)  # Client-generated UUID
+    uuid = Column(String(36), unique=True, index=True, nullable=False, primary_key=True)  # Client-generated UUID
     filename = Column(String(255), nullable=False)
-    encrypted = Column(Boolean, default=False)  # True if photo is encrypted
-    salt = Column(String(64), nullable=True)    # Store as hex/base64 if encrypted
-    iv = Column(String(32), nullable=True)      # Store as hex/base64 if encrypted
     uploaded_at = Column(DateTime(timezone=True), server_default=func.now())
\ No newline at end of file
diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 4e5013e4..6b5d3b96 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -8,22 +8,36 @@
 from routes.auth.utils import get_current_user
 from limiter import limiter
 from fastapi import Request
+import logging
 
 router = APIRouter()
 PHOTO_DIR = "photos"
 os.makedirs(PHOTO_DIR, exist_ok=True)
 
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
 @router.get("/sync")
 def sync_photos(
     db: Session = Depends(get_db),
     current_user: User = Depends(get_current_user)
 ):
     photos = db.query(Photo).filter_by(user_id=current_user.id).all()
-    return {
-        "photos": [
-            {"uuid": p.uuid, "uploaded_at": p.uploaded_at, "filename": p.filename} for p in photos
-        ]
-    }
+    photos_new = photos.copy()
+
+    for photo in photos:
+        logger.info(f"Checking {photo}")
+        if os.path.exists(photo.filename):
+            photos_new += {
+                "uuid": photo.uuid, 
+                "uploaded_at": photo.uploaded_at, 
+                "filename": photo.filename
+            }
+        else:
+            logger.warning(f"Photo {photo.uuid} doesn't exist")
+
+    return {"photos": photos_new}
 
 @router.post("/upload", status_code=status.HTTP_201_CREATED)
 @limiter.limit("1/minute")
@@ -58,7 +72,7 @@ async def upload_photo(
         os.remove(file_path)
         raise HTTPException(status_code=400, detail="Photo UUID already exists.")
     # Save metadata, including user_id and uuid (attached server-side)
-    photo = Photo(uuid=photo_uuid, user_id=current_user.id, filename=filename, encrypted=True)
+    photo = Photo(uuid=photo_uuid, user_id=current_user.id, filename=filename)
     db.add(photo)
     db.commit()
     return {"status": "success"}

From e4280fb86194ea4f7131dd23d6d705470f7e38cc Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Fri, 25 Jul 2025 09:55:46 +0300
Subject: [PATCH 08/15] Fix photo persistence

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/routes/photos.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 6b5d3b96..76b4dbb8 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -11,7 +11,7 @@
 import logging
 
 router = APIRouter()
-PHOTO_DIR = "photos"
+PHOTO_DIR = "data/photos"
 os.makedirs(PHOTO_DIR, exist_ok=True)
 
 # Configure logging

From 552fb45543486a645a01bc0cffdeab234964ae69 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Sat, 26 Jul 2025 12:15:05 +0300
Subject: [PATCH 09/15] 1GB storage limit

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/routes/photos.py | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 76b4dbb8..fe65cf75 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -50,10 +50,22 @@ async def upload_photo(
 ):
     # Limit file size to 50MB, read in chunks
     MAX_SIZE = 50 * 1024 * 1024
+    USER_MAX_STORAGE = 1024 * 1024 * 1024  # 1GB
     chunk_size = 1024 * 1024  # 1MB
     total_size = 0
     filename = f"{current_user.id}_{photo_uuid}.bin"
     file_path = os.path.join(PHOTO_DIR, filename)
+
+    # Calculate current user storage usage
+    user_photos = db.query(Photo).filter_by(user_id=current_user.id).order_by(Photo.uploaded_at).all()
+    user_storage = 0
+    for p in user_photos:
+        try:
+            if os.path.exists(p.filename):
+                user_storage += os.path.getsize(p.filename)
+        except Exception:
+            pass
+    # Read file in chunks, check size
     with open(file_path, "wb") as out_file:
         while True:
             chunk = await file.read(chunk_size)
@@ -65,7 +77,17 @@ async def upload_photo(
                 os.remove(file_path)
                 raise HTTPException(status_code=413, detail="File too large (max 50MB)")
             out_file.write(chunk)
-    
+    # Enforce 1GB per-user storage limit
+    while user_storage + total_size > USER_MAX_STORAGE and user_photos:
+        oldest = user_photos.pop(0)
+        try:
+            if os.path.exists(oldest.filename):
+                user_storage -= os.path.getsize(oldest.filename)
+                os.remove(oldest.filename)
+            db.delete(oldest)
+            db.commit()
+        except Exception as e:
+            logger.warning(f"Failed to delete old photo {oldest.uuid}: {e}")
     # Check if UUID already exists for this user
     existing = db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first()
     if existing:

From 78c41d377cc417d8bf20f79d5edd0b1aed203c45 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Sat, 26 Jul 2025 12:41:47 +0300
Subject: [PATCH 10/15] Modularize the code

Signed-off-by: denis0001-dev <denis0001.dev@ya.ru>
---
 backend/main/routes/photos.py | 73 ++++++++++++++++++-----------------
 backend/main/utils.py         | 23 ++++++++++-
 2 files changed, 59 insertions(+), 37 deletions(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index fe65cf75..6a01766b 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -3,6 +3,7 @@
 from sqlalchemy.orm import Session
 import os
 from uuid import uuid4
+from backend.main.utils import FileTooLargeError, save_file
 from models import Photo, User
 from db.core import get_db  # Adjust if your session dependency is elsewhere
 from routes.auth.utils import get_current_user
@@ -18,6 +19,33 @@
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger(__name__)
 
+MAX_SIZE = 50 * 1024 * 1024 # 50MB
+USER_MAX_STORAGE = 1024 * 1024 * 1024  # 1GB
+
+def get_used_storage(photos: list[Photo]):
+    user_storage = 0
+    for p in photos:
+        try:
+            if os.path.exists(p.filename):
+                user_storage += os.path.getsize(p.filename)
+        except Exception as e:
+            logger.error(e);
+            pass
+    return user_storage
+    
+
+def delete_old_photos(usedStorage: int, photos: list[Photo], db: Session):
+    while usedStorage > USER_MAX_STORAGE and photos:
+        oldest = photos.pop(0)
+        try:
+            if os.path.exists(oldest.filename):
+                user_storage -= os.path.getsize(oldest.filename)
+                os.remove(oldest.filename)
+            db.delete(oldest)
+            db.commit()
+        except Exception as e:
+            logger.warning(f"Failed to delete old photo {oldest.uuid}: {e}")
+
 @router.get("/sync")
 def sync_photos(
     db: Session = Depends(get_db),
@@ -48,49 +76,24 @@ async def upload_photo(
     db: Session = Depends(get_db),
     current_user: User = Depends(get_current_user)
 ):
-    # Limit file size to 50MB, read in chunks
-    MAX_SIZE = 50 * 1024 * 1024
-    USER_MAX_STORAGE = 1024 * 1024 * 1024  # 1GB
-    chunk_size = 1024 * 1024  # 1MB
-    total_size = 0
     filename = f"{current_user.id}_{photo_uuid}.bin"
     file_path = os.path.join(PHOTO_DIR, filename)
 
     # Calculate current user storage usage
     user_photos = db.query(Photo).filter_by(user_id=current_user.id).order_by(Photo.uploaded_at).all()
-    user_storage = 0
-    for p in user_photos:
-        try:
-            if os.path.exists(p.filename):
-                user_storage += os.path.getsize(p.filename)
-        except Exception:
-            pass
+    user_storage = get_used_storage()
+    
     # Read file in chunks, check size
-    with open(file_path, "wb") as out_file:
-        while True:
-            chunk = await file.read(chunk_size)
-            if not chunk:
-                break
-            total_size += len(chunk)
-            if total_size > MAX_SIZE:
-                out_file.close()
-                os.remove(file_path)
-                raise HTTPException(status_code=413, detail="File too large (max 50MB)")
-            out_file.write(chunk)
+    try:
+        total_size = save_file(input=file, output=file_path, max_size=MAX_SIZE)
+    except FileTooLargeError:
+        raise HTTPException(status_code=413, detail="File too large (max 50MB)")
+    
     # Enforce 1GB per-user storage limit
-    while user_storage + total_size > USER_MAX_STORAGE and user_photos:
-        oldest = user_photos.pop(0)
-        try:
-            if os.path.exists(oldest.filename):
-                user_storage -= os.path.getsize(oldest.filename)
-                os.remove(oldest.filename)
-            db.delete(oldest)
-            db.commit()
-        except Exception as e:
-            logger.warning(f"Failed to delete old photo {oldest.uuid}: {e}")
+    delete_old_photos(usedStorage=user_storage + total_size, photos=user_photos, db=db)
+
     # Check if UUID already exists for this user
-    existing = db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first()
-    if existing:
+    if db.query(Photo).filter_by(uuid=photo_uuid, user_id=current_user.id).first():
         os.remove(file_path)
         raise HTTPException(status_code=400, detail="Photo UUID already exists.")
     # Save metadata, including user_id and uuid (attached server-side)
diff --git a/backend/main/utils.py b/backend/main/utils.py
index fcf600b2..99521a18 100644
--- a/backend/main/utils.py
+++ b/backend/main/utils.py
@@ -1,9 +1,10 @@
+from _typeshed import FileDescriptorOrPath
 import os
 from functools import wraps
 from pathlib import Path
 from typing import Tuple, Optional
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, UploadFile
 from starlette.staticfiles import StaticFiles
 
 from constants import CONTENT_PATH
@@ -87,4 +88,22 @@ def trim_margin(text: str, margin: str = '|') -> str:
             trimmed_lines.append(line[idx + len(margin):])
         else:
             trimmed_lines.append(line)
-    return '\n'.join(trimmed_lines)
\ No newline at end of file
+    return '\n'.join(trimmed_lines)
+
+class FileTooLargeError(Exception): pass
+
+async def save_file(input: UploadFile, output: FileDescriptorOrPath, max_size: int = 0, chunk_size: int = 1024 * 1024):
+    total_size = 0
+    with open(output, "wb") as out_file:
+        while True:
+            chunk = await input.read(chunk_size)
+            if not chunk:
+                break
+            total_size += len(chunk)
+            if max_size != 0 and total_size > max_size:
+                out_file.close()
+                os.remove(output)
+                raise FileTooLargeError()
+            out_file.write(chunk)
+    
+    return total_size
\ No newline at end of file

From bd1de51953846e8eb499e1bfc5ee13835d03e86a Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Mon, 11 Aug 2025 19:10:06 +0300
Subject: [PATCH 11/15] Fix #13

---
 backend/main/routes/photos.py | 4 ++--
 backend/main/utils.py         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 6a01766b..239b0989 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -3,9 +3,9 @@
 from sqlalchemy.orm import Session
 import os
 from uuid import uuid4
-from backend.main.utils import FileTooLargeError, save_file
+from utils import FileTooLargeError, save_file
 from models import Photo, User
-from db.core import get_db  # Adjust if your session dependency is elsewhere
+from db.core import get_db
 from routes.auth.utils import get_current_user
 from limiter import limiter
 from fastapi import Request
diff --git a/backend/main/utils.py b/backend/main/utils.py
index 99521a18..24f9fbb3 100644
--- a/backend/main/utils.py
+++ b/backend/main/utils.py
@@ -1,5 +1,5 @@
-from _typeshed import FileDescriptorOrPath
 import os
+from os import PathLike
 from functools import wraps
 from pathlib import Path
 from typing import Tuple, Optional
@@ -92,7 +92,7 @@ def trim_margin(text: str, margin: str = '|') -> str:
 
 class FileTooLargeError(Exception): pass
 
-async def save_file(input: UploadFile, output: FileDescriptorOrPath, max_size: int = 0, chunk_size: int = 1024 * 1024):
+async def save_file(input: UploadFile, output: str | PathLike[str], max_size: int = 0, chunk_size: int = 1024 * 1024):
     total_size = 0
     with open(output, "wb") as out_file:
         while True:

From 1b7e940bb21ac91f915c16b85b14d5ae4b4036cd Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Mon, 11 Aug 2025 21:00:23 +0300
Subject: [PATCH 12/15] Fix photos page to adapt to new structure

---
 frontend/{photos/index.ts => js/photos.ts}  | 0
 frontend/{photos/index.html => photos.html} | 4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename frontend/{photos/index.ts => js/photos.ts} (100%)
 rename frontend/{photos/index.html => photos.html} (92%)

diff --git a/frontend/photos/index.ts b/frontend/js/photos.ts
similarity index 100%
rename from frontend/photos/index.ts
rename to frontend/js/photos.ts
diff --git a/frontend/photos/index.html b/frontend/photos.html
similarity index 92%
rename from frontend/photos/index.html
rename to frontend/photos.html
index 37b60a37..b2670e63 100644
--- a/frontend/photos/index.html
+++ b/frontend/photos.html
@@ -11,7 +11,7 @@
         <link rel="stylesheet" href="/css/photos.css" />
 
         <script src="/lib/jquery.js"></script>
-        <script type="module" src="/common.js"></script>
+        <script type="module" src="/js/common.js"></script>
     </head>
     <body>
         <tio-header class="top" tab="0"></tio-header>
@@ -35,6 +35,6 @@ <h1>Фото</h1>
             </div>
         </div>
         <tio-footer></tio-footer>
-        <script type="module" src="index.js"></script>
+        <script type="module" src="/js/photos.js"></script>
     </body>
 </html>
\ No newline at end of file

From 8c1caa0403751719a11c3a1bcb6b5e94921925f7 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Mon, 11 Aug 2025 21:08:18 +0300
Subject: [PATCH 13/15] Fix used storage function issue

---
 backend/main/routes/photos.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/main/routes/photos.py b/backend/main/routes/photos.py
index 239b0989..fc19fa7d 100644
--- a/backend/main/routes/photos.py
+++ b/backend/main/routes/photos.py
@@ -81,11 +81,11 @@ async def upload_photo(
 
     # Calculate current user storage usage
     user_photos = db.query(Photo).filter_by(user_id=current_user.id).order_by(Photo.uploaded_at).all()
-    user_storage = get_used_storage()
+    user_storage = get_used_storage(user_photos)
     
     # Read file in chunks, check size
     try:
-        total_size = save_file(input=file, output=file_path, max_size=MAX_SIZE)
+        total_size = await save_file(input=file, output=file_path, max_size=MAX_SIZE)
     except FileTooLargeError:
         raise HTTPException(status_code=413, detail="File too large (max 50MB)")
     

From d7a4abe0d3b949aab68c89cbf55f8e17723f67c5 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Mon, 11 Aug 2025 21:20:32 +0300
Subject: [PATCH 14/15] Fix permission issue

---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index fdc53d7d..8ae57ee7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,7 +35,9 @@ FROM python:3.12-slim AS runtime
 RUN useradd -m -u 1000 toolbox && \
     chown -R toolbox:toolbox /home/toolbox && \
     mkdir -p /home/toolbox/.cache/huggingface && \
-    chown -R toolbox:toolbox /home/toolbox/.cache/huggingface
+    chown -R toolbox:toolbox /home/toolbox/.cache/huggingface && \
+    mkdir -p /home/toolbox/site/backend/main/data/photos && \
+    chown -R toolbox:toolbox /home/toolbox/site/backend/main/data/photos
 USER toolbox
 
 # 3.2. Copy content

From b1fc11ee9b6720ef8579e77307e7705930486088 Mon Sep 17 00:00:00 2001
From: denis0001-dev <denis0001.dev@ya.ru>
Date: Tue, 12 Aug 2025 14:45:00 +0300
Subject: [PATCH 15/15] Clean up styles

---
 frontend/css/common/_animations.scss |  11 ++
 frontend/css/photos.scss             | 203 +++++++++++++--------------
 2 files changed, 109 insertions(+), 105 deletions(-)

diff --git a/frontend/css/common/_animations.scss b/frontend/css/common/_animations.scss
index d5ea1875..c5e2e399 100755
--- a/frontend/css/common/_animations.scss
+++ b/frontend/css/common/_animations.scss
@@ -48,4 +48,15 @@
         opacity: 1;
         transform: translateY(0);
     }
+}
+
+@keyframes modalExpand {
+    from { 
+        transform: scale(0.8); 
+        opacity: 0; 
+    }
+    to { 
+        transform: scale(1); 
+        opacity: 1; 
+    }
 }
\ No newline at end of file
diff --git a/frontend/css/photos.scss b/frontend/css/photos.scss
index fdbb51f9..7c022bcc 100644
--- a/frontend/css/photos.scss
+++ b/frontend/css/photos.scss
@@ -1,119 +1,112 @@
 #photo-gallery {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
-  gap: 16px;
-  padding: 24px 0;
-  min-height: 200px;
-  position: relative;
-  background: #f8f9fa;
-  border-radius: 12px;
-  transition: box-shadow 0.2s;
-}
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
+    gap: 16px;
+    padding: 24px 0;
+    min-height: 200px;
+    position: relative;
+    background: #f8f9fa;
+    border-radius: 12px;
+    transition: box-shadow 0.2s;
 
-#photo-gallery.dragover {
-  box-shadow: 0 0 0 4px #007bff33;
-  background: #e3f0ff;
-}
+    &.dragover {
+        box-shadow: 0 0 0 4px #007bff33;
+        background: #e3f0ff;
+    }
 
-#gallery-placeholder {
-  grid-column: 1 / -1;
-  text-align: center;
-  color: #888;
-  font-size: 1.1em;
-  padding: 40px 0;
-}
+    #gallery-placeholder {
+        grid-column: 1 / -1;
+        text-align: center;
+        color: #888;
+        font-size: 1.1em;
+        padding: 40px 0;
+    }
+      
+    .gallery-thumb {
+        width: 100%;
+        height: 120px;
+        object-fit: cover;
+        border-radius: 8px;
+        cursor: pointer;
+        box-shadow: 0 2px 8px #0001;
+        transition: transform 0.2s, box-shadow 0.2s;
 
-.gallery-thumb {
-  width: 100%;
-  height: 120px;
-  object-fit: cover;
-  border-radius: 8px;
-  cursor: pointer;
-  box-shadow: 0 2px 8px #0001;
-  transition: transform 0.2s, box-shadow 0.2s;
+        &:hover {
+            transform: scale(1.04);
+            box-shadow: 0 4px 16px #0002;
+        }
+    }
 }
 
-.gallery-thumb:hover {
-  transform: scale(1.04);
-  box-shadow: 0 4px 16px #0002;
-}
 
 #photo-modal {
-  position: fixed;
-  inset: 0;
-  z-index: 1000;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  background: rgba(0,0,0,0.7);
-  opacity: 1;
-  pointer-events: auto;
-  transition: opacity 0.3s;
-}
+    position: fixed;
+    inset: 0;
+    z-index: 1000;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: rgba(0,0,0,0.7);
+    opacity: 1;
+    pointer-events: auto;
+    transition: opacity 0.3s;
 
-#photo-modal.hidden {
-  opacity: 0;
-  pointer-events: none;
-}
+    &.hidden {
+        opacity: 0;
+        pointer-events: none;
+    }
 
-.modal-overlay {
-  position: absolute;
-  inset: 0;
-  background: transparent;
-}
+    .modal-overlay {
+        position: absolute;
+        inset: 0;
+        background: transparent;
+    }
 
-.modal-content {
-  position: relative;
-  background: #fff;
-  border-radius: 12px;
-  box-shadow: 0 8px 32px #0003;
-  padding: 32px 24px 24px 24px;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  min-width: 320px;
-  min-height: 320px;
-  animation: modalExpand 0.3s cubic-bezier(.4,2,.6,1) both;
-}
+    .modal-content {
+        position: relative;
+        background: #fff;
+        border-radius: 12px;
+        box-shadow: 0 8px 32px #0003;
+        padding: 32px 24px 24px 24px;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        min-width: 320px;
+        min-height: 320px;
+        animation: modalExpand 0.3s cubic-bezier(.4,2,.6,1) both;
 
-@keyframes modalExpand {
-  from { 
-    transform: scale(0.8); 
-    opacity: 0; 
-    }
-  to { 
-    transform: scale(1); 
-    opacity: 1; 
-}
-}
+        #modal-photo {
+            max-width: 80vw;
+            max-height: 60vh;
+            border-radius: 8px;
+            margin-bottom: 24px;
+            box-shadow: 0 2px 16px #0002;
+        }
 
-#modal-photo {
-  max-width: 80vw;
-  max-height: 60vh;
-  border-radius: 8px;
-  margin-bottom: 24px;
-  box-shadow: 0 2px 16px #0002;
-}
-.modal-actions {
-  position: absolute;
-  top: 12px;
-  left: 0;
-  width: 100%;
-  display: flex;
-  justify-content: space-between;
-  padding: 0 24px;
-}
-.modal-actions button {
-  background: #007bff;
-  color: #fff;
-  border: none;
-  border-radius: 6px;
-  padding: 8px 18px;
-  font-size: 1em;
-  cursor: pointer;
-  box-shadow: 0 2px 8px #007bff22;
-  transition: background 0.2s;
-}
-.modal-actions button:hover {
-  background: #0056b3;
+        .modal-actions {
+            position: absolute;
+            top: 12px;
+            left: 0;
+            width: 100%;
+            display: flex;
+            justify-content: space-between;
+            padding: 0 24px;
+
+            button {
+                background: #007bff;
+                color: #fff;
+                border: none;
+                border-radius: 6px;
+                padding: 8px 18px;
+                font-size: 1em;
+                cursor: pointer;
+                box-shadow: 0 2px 8px #007bff22;
+                transition: background 0.2s;
+
+                &:hover {
+                    background: #0056b3;
+                }
+            }
+        }
+    }
 }