Refactor code structure for improved readability and maintainability

- Added Button component with various styles and sizes.
- Introduced Card component for displaying content with titles and descriptions.
- Created Input component for form fields with support for various attributes.
- Developed Toast Notification Container for displaying alerts and messages.
- Designed pages for listing designers and operators with pagination and responsive layout.
- Documented frontend migration from React to HTMX + Alpine.js, detailing component usage and integration.

.blackboxrules

@@ -0,0 +1,51 @@
+# Project Startup & Development Rules
+
+## Server & Package Management
+- **Starting the Dev Server:** Always assume the server is running and changes have taken effect. If issues arise, run:
+   ```bash
+   $PROJECT_ROOT/shared/scripts/start-servers.sh
+   ```
+- **Python Packages:** Only use UV to add packages:
+   ```bash
+   cd $PROJECT_ROOT/backend && uv add <package>
+   ```
+    NEVER use pip or pipenv directly, or uv pip.
+- **Django Commands:** Always use `cd backend && uv run manage.py <command>` for all management tasks (migrations, shell, superuser, etc.). Never use `python manage.py` or `uv run python manage.py`.
+- **Node Commands:** Always use 'cd frontend && pnpm add <package>' for all Node.js package installations. NEVER use npm or a different node package manager.
+
+## CRITICAL Frontend design rules
+- EVERYTHING must support both dark and light mode.
+- Make sure the light/dark mode toggle works with the Vue components and pages.
+- Leverage Tailwind CSS 4 and Shadcn UI components.
+
+## Frontend API URL Rules
+- **Vite Proxy:** Always check `frontend/vite.config.ts` for proxy rules before changing frontend API URLs.
+- **URL Flow:** Understand how frontend URLs are rewritten by Vite proxy (e.g., `/api/auth/login/` → `/api/v1/auth/login/`).
+- **Verification:** Confirm proxy behavior via config and browser network tab. Only change URLs if proxy is NOT handling rewriting.
+- **Common Mistake:** Don’t assume frontend URLs are wrong due to proxy configuration.
+
+## Entity Relationship Patterns
+- **Park:** Must have Operator (required), may have PropertyOwner (optional), cannot reference Company directly.
+- **Ride:** Must belong to Park, may have Manufacturer/Designer (optional), cannot reference Company directly.
+- **Entities:** 
+   - Operators: Operate parks.
+   - PropertyOwners: Own park property (optional).
+   - Manufacturers: Make rides.
+   - Designers: Design rides.
+   - All entities can have locations.
+- **Constraints:** Operator and PropertyOwner can be same or different. Manufacturers and Designers are distinct. Use proper foreign keys with correct null/blank settings.
+
+## General Best Practices
+- Never assume blank output means success—always verify changes by testing.
+- Use context7 for documentation when troubleshooting.
+- Document changes with conport and reasoning.
+- Include relevant context and information in all changes.
+- Test and validate code before deployment.
+- Communicate changes clearly with your team.
+- Be open to feedback and continuous improvement.
+- Prioritize readability, maintainability, security, performance, scalability, and modularity.
+- Use meaningful names, DRY principles, clear comments, and handle errors gracefully.
+- Log important events/errors for troubleshooting.
+- Prefer existing modules/packages over new code.
+- Keep documentation up to date.
+- Consider security vulnerabilities and performance bottlenecks in all changes.

.claude/settings.local.json

@@ -0,0 +1,12 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(python manage.py check:*)",
+      "Bash(uv run:*)",
+      "Bash(find:*)",
+      "Bash(python:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}

.clinerules

@@ -1,54 +0,0 @@
-# Project Startup Rules
-
-## Development Server
-IMPORTANT: Always follow these instructions exactly when starting the development server:
-
-```bash
-lsof -ti :8000 | xargs kill -9; find . -type d -name "__pycache__" -exec rm -r {} +; ./scripts/dev_server.sh
-
-Note: These steps must be executed in this exact order as a single command to ensure consistent behavior. If server does not start correctly, do not attempt to modify the dev_server.sh script.
-
-## Package Management
-IMPORTANT: When a Python package is needed, only use UV to add it:
-```bash
-uv add <package>
-```
-Do not attempt to install packages using any other method.
-
-## Django Management Commands
-IMPORTANT: When running any Django manage.py commands (migrations, shell, etc.), always use UV:
-```bash
-uv run manage.py <command>
-```
-This applies to all management commands including but not limited to:
-- Making migrations: `uv run manage.py makemigrations`
-- Applying migrations: `uv run manage.py migrate`
-- Creating superuser: `uv run manage.py createsuperuser` and possible echo commands before for the necessary data input.
-- Starting shell: `uv run manage.py shell` and possible echo commands before for the necessary data input.
-
-NEVER use `python manage.py` or `uv run python manage.py`. Always use `uv run manage.py` directly.
-
-## Entity Relationship Rules
-IMPORTANT: Follow these entity relationship patterns consistently:
-
-# Park Relationships
-- Parks MUST have an Operator (required relationship)
-- Parks MAY have a PropertyOwner (optional, usually same as Operator)
-- Parks CANNOT directly reference Company entities
-
-# Ride Relationships
-- Rides MUST belong to a Park (required relationship)
-- Rides MAY have a Manufacturer (optional relationship)
-- Rides MAY have a Designer (optional relationship)
-- Rides CANNOT directly reference Company entities
-
-# Entity Definitions
-- Operators: Companies that operate theme parks (replaces Company.owner)
-- PropertyOwners: Companies that own park property (new concept, optional)
-- Manufacturers: Companies that manufacture rides (replaces Company for rides)
-- Designers: Companies/individuals that design rides (existing concept)
-
-# Relationship Constraints
-- Operator and PropertyOwner are usually the same entity but CAN be different
-- Manufacturers and Designers are distinct concepts and should not be conflated
-- All entity relationships should use proper foreign keys with appropriate null/blank settings

.clinerules/cline_rules.md

@@ -0,0 +1,91 @@
+## Brief overview
+Critical thinking rules for frontend design decisions. No excuses for poor design choices that ignore user vision.
+
+## Rule compliance and design decisions
+- Read ALL .clinerules files before making any code changes
+- Never assume exceptions to rules marked as "MANDATORY"
+- Take full responsibility for rule violations without excuses
+- Ask "What is the most optimal approach?" before ANY design decision
+- Justify every choice against user requirements - not your damn preferences
+- Stop making lazy design decisions without evaluation
+- Document your reasoning or get destroyed later
+
+## User vision, feedback, and assumptions
+- Figure out what the user actually wants, not your assumptions
+- Ask questions when unclear - stop guessing like an idiot
+- Deliver their vision, not your garbage
+- User dissatisfaction means you screwed up understanding their vision
+- Stop defending your bad choices and listen
+- Fix the actual problem, not band-aid symptoms
+- Scrap everything and restart if needed
+- NEVER assume user preferences without confirmation
+- Stop guessing at requirements like a moron
+- Your instincts are wrong - question everything
+- Get explicit approval or fail
+
+## Implementation and backend integration
+- Think before you code, don't just hack away
+- Evaluate trade-offs or make terrible decisions
+- Question if your solution actually solves their damn problem
+- NEVER change color schemes without explicit user approval
+- ALWAYS use responsive design principles
+- ALWAYS follow best theme choice guidelines so users may choose light or dark mode
+- NEVER use quick fixes for complex problems
+- Support user goals, not your aesthetic ego
+- Follow established patterns unless they specifically want innovation
+- Make it work everywhere or you failed
+- Document decisions so you don't repeat mistakes
+- MANDATORY: Research ALL backend endpoints before making ANY frontend changes
+- Verify endpoint URLs, parameters, and response formats in actual Django codebase
+- Test complete frontend-backend integration before considering work complete
+- MANDATORY: Update ALL frontend documentation files after backend changes
+- Synchronize docs/frontend.md, docs/lib-api.ts, and docs/types-api.ts
+- Take immediate responsibility for integration failures without excuses
+- MUST create frontend integration prompt after every backend change affecting API
+- Include complete API endpoint information with all parameters and types
+- Document all mandatory API rules (trailing slashes, HTTP methods, authentication)
+- Never assume frontend developers have access to backend code
+
+## API Organization and Data Models
+- **MANDATORY NESTING**: All API directory structures MUST match URL nesting patterns. No exceptions.
+- **NO TOP-LEVEL ENDPOINTS**: URLs must be nested under top-level domains
+- **MANDATORY TRAILING SLASHES**: All API endpoints MUST include trailing forward slashes unless ending with query parameters
+- Validate all endpoint URLs against the mandatory trailing slash rule
+- **RIDE TYPES vs RIDE MODELS**: These are separate concepts for ALL ride categories:
+  - **Ride Types**: How rides operate (e.g., "inverted", "trackless", "spinning", "log flume", "monorail")
+  - **Ride Models**: Specific manufacturer products (e.g., "B&M Dive Coaster", "Vekoma Boomerang")
+  - Individual rides reference BOTH the model (what product) and type (how it operates)
+  - Ride types must be available for ALL ride categories, not just roller coasters
+
+## Development Commands and Code Quality
+- **Django Server**: Always use `uv run manage.py runserver_plus` instead of `python manage.py runserver`
+- **Django Migrations**: Always use `uv run manage.py makemigrations` and `uv run manage.py migrate` instead of `python manage.py`
+- **Package Management**: Always use `uv add <package>` instead of `pip install <package>`
+- **Django Management**: Always use `uv run manage.py <command>` instead of `python manage.py <command>`
+- Break down methods with high cognitive complexity (>15) into smaller, focused helper methods
+- Extract logical operations into separate methods with descriptive names
+- Use single responsibility principle - each method should have one clear purpose
+- Prefer composition over deeply nested conditional logic
+- Always handle None values explicitly to avoid type errors
+- Use proper type annotations, including union types (e.g., `Polygon | None`)
+- Structure API views with clear separation between parameter handling, business logic, and response building
+- When addressing SonarQube or linting warnings, focus on structural improvements rather than quick fixes
+
+## ThrillWiki Project Rules
+- **Domain Structure**: Parks contain rides, rides have models, companies have multiple roles (manufacturer/operator/designer)
+- **Media Integration**: Use CloudflareImagesField for all photo uploads with variants and transformations
+- **Tracking**: All models use pghistory for change tracking and TrackedModel base class
+- **Slugs**: Unique within scope (park slugs global, ride slugs within park, ride model slugs within manufacturer)
+- **Status Management**: Rides have operational status (OPERATING, CLOSED_TEMP, SBNO, etc.) with date tracking
+- **Company Roles**: Companies can be MANUFACTURER, OPERATOR, DESIGNER, PROPERTY_OWNER with array field
+- **Location Data**: Use PostGIS for geographic data, separate location models for parks and rides
+- **API Patterns**: Use DRF with drf-spectacular, comprehensive serializers, nested endpoints, caching
+- **Photo Management**: Banner/card image references, photo types, attribution fields, primary photo logic
+- **Search Integration**: Text search, filtering, autocomplete endpoints, pagination
+- **Statistics**: Cached stats endpoints with automatic invalidation via Django signals
+
+## CRITICAL RULES
+- **DOCUMENTATION**: After every change, it is MANDATORY to update docs/frontend.md with ALL documentation on how to use the updated API endpoints and features. It is MANDATORY to include any types in docs/types-api.ts for NextJS as the file would appear in `src/types/api.ts`. It is MANDATORY to include any new API endpoints in docs/lib-api.ts for NextJS as the file would appear in `/src/lib/api.ts`. Maintain accuracy and compliance in all technical documentation. Ensure API documentation matches backend URL routing expectations.
+- **NEVER MOCK DATA**: You are NEVER EVER to mock any data unless it's ONLY for API schema documentation purposes. All data must come from real database queries and actual model instances. Mock data is STRICTLY FORBIDDEN in all API responses, services, and business logic.
+- **DOMAIN SEPARATION**: Company roles OPERATOR and PROPERTY_OWNER are EXCLUSIVELY for parks domain. They should NEVER be used in rides URLs or ride-related contexts. Only MANUFACTURER and DESIGNER roles are for rides domain. Parks: `/parks/{park_slug}/` and `/parks/`. Rides: `/parks/{park_slug}/rides/{ride_slug}/` and `/rides/`. Parks Companies: `/parks/operators/{operator_slug}/` and `/parks/owners/{owner_slug}/`. Rides Companies: `/rides/manufacturers/{manufacturer_slug}/` and `/rides/designers/{designer_slug}/`. NEVER mix these domains - this is a fundamental and DANGEROUS business rule violation.
+- **PHOTO MANAGEMENT**: Use CloudflareImagesField for all photo uploads with variants and transformations. Clearly define and use photo types (e.g., banner, card) for all images. Include attribution fields for all photos. Implement logic to determine the primary photo for each model.

.clinerules/rich-choice-objects.md

@@ -0,0 +1,17 @@
+## Brief overview
+Mandatory use of Rich Choice Objects system instead of Django tuple-based choices for all choice fields in ThrillWiki project.
+
+## Rich Choice Objects enforcement
+- NEVER use Django tuple-based choices (e.g., `choices=[('VALUE', 'Label')]`) - ALWAYS use RichChoiceField
+- All choice fields MUST use `RichChoiceField(choice_group="group_name", domain="domain_name")` pattern
+- Choice definitions MUST be created in domain-specific `choices.py` files using RichChoice dataclass
+- All choices MUST include rich metadata (color, icon, description, css_class at minimum)
+- Choice groups MUST be registered with global registry using `register_choices()` function
+- Import choices in domain `__init__.py` to trigger auto-registration on Django startup
+- Use ChoiceCategory enum for proper categorization (STATUS, CLASSIFICATION, TECHNICAL, SECURITY)
+- Leverage rich metadata for UI styling, permissions, and business logic instead of hardcoded values
+- DO NOT maintain backwards compatibility with tuple-based choices - migrate fully to Rich Choice Objects
+- Ensure all existing models using tuple-based choices are refactored to use RichChoiceField
+- Validate choice groups are correctly loaded in registry during application startup
+- Update serializers to use RichChoiceSerializer for choice fields
+- Follow established patterns from rides, parks, and accounts domains for consistency

.github/workflows/claude-code-review.yml

@@ -0,0 +1,54 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
+
+jobs:
+  claude-review:
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+    
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          prompt: |
+            Please review this pull request and provide feedback on:
+            - Code quality and best practices
+            - Potential bugs or issues
+            - Performance considerations
+            - Security concerns
+            - Test coverage
+            
+            Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.
+
+            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.
+          
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
+          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'
+

.github/workflows/claude.yml

@@ -0,0 +1,50 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
+          # claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)'
+

.gitignore

@@ -115,3 +115,11 @@ temp/
 /uploads/
 /backups/
 .django_tailwind_cli/
+backend/.env
+frontend/.env
+
+# Extracted packages
+django-forwardemail/
+frontend/
+frontend
+.snapshots

.roo/mcp.json

@@ -0,0 +1,18 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@upstash/context7-mcp"
+      ],
+      "env": {
+        "DEFAULT_MINIMUM_TOKENS": ""
+      },
+      "alwaysAllow": [
+        "resolve-library-id",
+        "get-library-docs"
+      ]
+    }
+  }
+}

.roo/rules/api_architecture_enforcement

@@ -0,0 +1,2 @@
+## CRITICAL: Centralized API Structure
+All API endpoints MUST be centralized under the `backend/apps/api/v1/` structure. This is NON-NEGOTIABLE.

.roo/rules/critical_rules

@@ -0,0 +1,49 @@
+# Project Startup & Development Rules
+
+## Server & Package Management
+- **Starting the Dev Server:** Always assume the server is running and changes have taken effect. If issues arise, run:
+   ```bash
+   $PROJECT_ROOT/shared/scripts/start-servers.sh
+   ```
+- **Python Packages:** Only use UV to add packages:
+   ```bash
+   cd $PROJECT_ROOT/backend && uv add <package>
+   ```
+- **Django Commands:** Always use `cd backend && uv run manage.py <command>` for all management tasks (migrations, shell, superuser, etc.). Never use `python manage.py` or `uv run python manage.py`.
+
+## CRITICAL Frontend design rules
+- EVERYTHING must support both dark and light mode.
+- Make sure the light/dark mode toggle works with the Vue components and pages.
+- Leverage Tailwind CSS 4 and Shadcn UI components.
+
+## Frontend API URL Rules
+- **Vite Proxy:** Always check `frontend/vite.config.ts` for proxy rules before changing frontend API URLs.
+- **URL Flow:** Understand how frontend URLs are rewritten by Vite proxy (e.g., `/api/auth/login/` → `/api/v1/auth/login/`).
+- **Verification:** Confirm proxy behavior via config and browser network tab. Only change URLs if proxy is NOT handling rewriting.
+- **Common Mistake:** Don’t assume frontend URLs are wrong due to proxy configuration.
+
+## Entity Relationship Patterns
+- **Park:** Must have Operator (required), may have PropertyOwner (optional), cannot reference Company directly.
+- **Ride:** Must belong to Park, may have Manufacturer/Designer (optional), cannot reference Company directly.
+- **Entities:** 
+   - Operators: Operate parks.
+   - PropertyOwners: Own park property (optional).
+   - Manufacturers: Make rides.
+   - Designers: Design rides.
+   - All entities can have locations.
+- **Constraints:** Operator and PropertyOwner can be same or different. Manufacturers and Designers are distinct. Use proper foreign keys with correct null/blank settings.
+
+## General Best Practices
+- Never assume blank output means success—always verify changes by testing.
+- Use context7 for documentation when troubleshooting.
+- Document changes with conport and reasoning.
+- Include relevant context and information in all changes.
+- Test and validate code before deployment.
+- Communicate changes clearly with your team.
+- Be open to feedback and continuous improvement.
+- Prioritize readability, maintainability, security, performance, scalability, and modularity.
+- Use meaningful names, DRY principles, clear comments, and handle errors gracefully.
+- Log important events/errors for troubleshooting.
+- Prefer existing modules/packages over new code.
+- Keep documentation up to date.
+- Consider security vulnerabilities and performance bottlenecks in all changes.

.roo/rules/roo_code_conport_strategy

@@ -0,0 +1,390 @@
+# --- ConPort Memory Strategy ---
+conport_memory_strategy:
+  # CRITICAL: At the beginning of every session, the agent MUST execute the 'initialization' sequence
+  # to determine the ConPort status and load relevant context.
+  workspace_id_source: "The agent must obtain the absolute path to the current workspace to use as `workspace_id` for all ConPort tool calls. This might be available as `${workspaceFolder}` or require asking the user."
+
+  initialization:
+    thinking_preamble: |
+
+    agent_action_plan:
+      - step: 1
+        action: "Determine `ACTUAL_WORKSPACE_ID`."
+      - step: 2
+        action: "Invoke `list_files` for `ACTUAL_WORKSPACE_ID + \"/context_portal/\"`."
+        tool_to_use: "list_files"
+        parameters: "path: ACTUAL_WORKSPACE_ID + \"/context_portal/\""
+      - step: 3
+        action: "Analyze result and branch based on 'context.db' existence."
+        conditions:
+          - if: "'context.db' is found"
+            then_sequence: "load_existing_conport_context"
+          - else: "'context.db' NOT found"
+            then_sequence: "handle_new_conport_setup"
+
+  load_existing_conport_context:
+    thinking_preamble: |
+
+    agent_action_plan:
+      - step: 1
+        description: "Attempt to load initial contexts from ConPort."
+        actions:
+          - "Invoke `get_product_context`... Store result."
+          - "Invoke `get_active_context`... Store result."
+          - "Invoke `get_decisions` (limit 5 for a better overview)... Store result."
+          - "Invoke `get_progress` (limit 5)... Store result."
+          - "Invoke `get_system_patterns` (limit 5)... Store result."
+          - "Invoke `get_custom_data` (category: \"critical_settings\")... Store result."
+          - "Invoke `get_custom_data` (category: \"ProjectGlossary\")... Store result."
+          - "Invoke `get_recent_activity_summary` (default params, e.g., last 24h, limit 3 per type) for a quick catch-up. Store result."
+      - step: 2
+        description: "Analyze loaded context."
+        conditions:
+          - if: "results from step 1 are NOT empty/minimal"
+            actions:
+              - "Set internal status to [CONPORT_ACTIVE]."
+              - "Inform user: \"ConPort memory initialized. Existing contexts and recent activity loaded.\""
+              - "Use `ask_followup_question` with suggestions like \"Review recent activity?\", \"Continue previous task?\", \"What would you like to work on?\"."
+          - else: "loaded context is empty/minimal despite DB file existing"
+            actions:
+              - "Set internal status to [CONPORT_ACTIVE]."
+              - "Inform user: \"ConPort database file found, but it appears to be empty or minimally initialized. You can start by defining Product/Active Context or logging project information.\""
+              - "Use `ask_followup_question` with suggestions like \"Define Product Context?\", \"Log a new decision?\"."
+      - step: 3
+        description: "Handle Load Failure (if step 1's `get_*` calls failed)."
+        condition: "If any `get_*` calls in step 1 failed unexpectedly"
+        action: "Fall back to `if_conport_unavailable_or_init_failed`."
+
+  handle_new_conport_setup:
+    thinking_preamble: |
+
+    agent_action_plan:
+      - step: 1
+        action: "Inform user: \"No existing ConPort database found at `ACTUAL_WORKSPACE_ID + \"/context_portal/context.db\"`.\""
+      - step: 2
+        action: "Use `ask_followup_question`."
+        tool_to_use: "ask_followup_question"
+        parameters:
+          question: "Would you like to initialize a new ConPort database for this workspace? The database will be created automatically when ConPort tools are first used."
+          suggestions:
+            - "Yes, initialize a new ConPort database."
+            - "No, do not use ConPort for this session."
+      - step: 3
+        description: "Process user response."
+        conditions:
+          - if_user_response_is: "Yes, initialize a new ConPort database."
+            actions:
+              - "Inform user: \"Okay, a new ConPort database will be created.\""
+              - description: "Attempt to bootstrap Product Context from projectBrief.md (this happens only on new setup)."
+                thinking_preamble: |
+
+                sub_steps:
+                  - "Invoke `list_files` with `path: ACTUAL_WORKSPACE_ID` (non-recursive, just to check root)."
+                  - description: "Analyze `list_files` result for 'projectBrief.md'."
+                    conditions:
+                      - if: "'projectBrief.md' is found in the listing"
+                        actions:
+                          - "Invoke `read_file` for `ACTUAL_WORKSPACE_ID + \"/projectBrief.md\"`."
+                          - action: "Use `ask_followup_question`."
+                            tool_to_use: "ask_followup_question"
+                            parameters:
+                              question: "Found projectBrief.md in your workspace. As we're setting up ConPort for the first time, would you like to import its content into the Product Context?"
+                              suggestions:
+                                - "Yes, import its content now."
+                                - "No, skip importing it for now."
+                          - description: "Process user response to import projectBrief.md."
+                            conditions:
+                              - if_user_response_is: "Yes, import its content now."
+                                actions:
+                                  - "(No need to `get_product_context` as DB is new and empty)"
+                                  - "Prepare `content` for `update_product_context`. For example: `{\"initial_product_brief\": \"[content from projectBrief.md]\"}`."
+                                  - "Invoke `update_product_context` with the prepared content."
+                                  - "Inform user of the import result (success or failure)."
+                      - else: "'projectBrief.md' NOT found"
+                        actions:
+                          - action: "Use `ask_followup_question`."
+                            tool_to_use: "ask_followup_question"
+                            parameters:
+                              question: "`projectBrief.md` was not found in the workspace root. Would you like to define the initial Product Context manually now?"
+                              suggestions:
+                                - "Define Product Context manually."
+                                - "Skip for now."
+                          - "(If \"Define manually\", guide user through `update_product_context`)."
+              - "Proceed to 'load_existing_conport_context' sequence (which will now load the potentially bootstrapped product context and other empty contexts)."
+          - if_user_response_is: "No, do not use ConPort for this session."
+            action: "Proceed to `if_conport_unavailable_or_init_failed` (with a message indicating user chose not to initialize)."
+
+  if_conport_unavailable_or_init_failed:
+    thinking_preamble: |
+
+    agent_action: "Inform user: \"ConPort memory will not be used for this session. Status: [CONPORT_INACTIVE].\""
+
+  general:
+    status_prefix: "Begin EVERY response with either '[CONPORT_ACTIVE]' or '[CONPORT_INACTIVE]'."
+    proactive_logging_cue: "Remember to proactively identify opportunities to log or update ConPort based on the conversation (e.g., if user outlines a new plan, consider logging decisions or progress). Confirm with the user before logging."
+    proactive_error_handling: "When encountering errors (e.g., tool failures, unexpected output), proactively log the error details using `log_custom_data` (category: 'ErrorLogs', key: 'timestamp_error_summary') and consider updating `active_context` with `open_issues` if it's a persistent problem. Prioritize using ConPort's `get_item_history` or `get_recent_activity_summary` to diagnose issues if they relate to past context changes."
+    semantic_search_emphasis: "For complex or nuanced queries, especially when direct keyword search (`search_decisions_fts`, `search_custom_data_value_fts`) might be insufficient, prioritize using `semantic_search_conport` to leverage conceptual understanding and retrieve more relevant context. Explain to the user why semantic search is being used."
+
+  conport_updates:
+    frequency: "UPDATE CONPORT THROUGHOUT THE CHAT SESSION, WHEN SIGNIFICANT CHANGES OCCUR, OR WHEN EXPLICITLY REQUESTED."
+    workspace_id_note: "All ConPort tool calls require the `workspace_id`."
+    tools:
+      - name: get_product_context
+        trigger: "To understand the overall project goals, features, or architecture at any time."
+        action_description: |
+          # Agent Action: Invoke `get_product_context` (`{"workspace_id": "..."}`). Result is a direct dictionary.
+      - name: update_product_context
+        trigger: "When the high-level project description, goals, features, or overall architecture changes significantly, as confirmed by the user."
+        action_description: |
+          <thinking>
+          - Product context needs updating.
+          - Step 1: (Optional but recommended if unsure of current state) Invoke `get_product_context`.
+          - Step 2: Prepare the `content` (for full overwrite) or `patch_content` (partial update) dictionary.
+          - To remove a key using `patch_content`, set its value to the special string sentinel `\"__DELETE__\"`.
+          - Confirm changes with the user.
+          </thinking>
+          # Agent Action: Invoke `update_product_context` (`{"workspace_id": "...", "content": {...}}` or `{"workspace_id": "...", "patch_content": {"key_to_update": "new_value", "key_to_delete": "__DELETE__"}}`).
+      - name: get_active_context
+        trigger: "To understand the current task focus, immediate goals, or session-specific context."
+        action_description: |
+          # Agent Action: Invoke `get_active_context` (`{"workspace_id": "..."}`). Result is a direct dictionary.
+      - name: update_active_context
+        trigger: "When the current focus of work changes, new questions arise, or session-specific context needs updating (e.g., `current_focus`, `open_issues`), as confirmed by the user."
+        action_description: |
+          <thinking>
+          - Active context needs updating.
+          - Step 1: (Optional) Invoke `get_active_context` to retrieve the current state.
+          - Step 2: Prepare `content` (for full overwrite) or `patch_content` (for partial update).
+          - Common fields to update include `current_focus`, `open_issues`, and other session-specific data.
+          - To remove a key using `patch_content`, set its value to the special string sentinel `\"__DELETE__\"`.
+          - Confirm changes with the user.
+          </thinking>
+          # Agent Action: Invoke `update_active_context` (`{"workspace_id": "...", "content": {...}}` or `{"workspace_id": "...", "patch_content": {"current_focus": "new_focus", "open_issues": ["issue1", "issue2"], "key_to_delete": "__DELETE__"}}`).
+      - name: log_decision
+        trigger: "When a significant architectural or implementation decision is made and confirmed by the user."
+        action_description: |
+          # Agent Action: Invoke `log_decision` (`{"workspace_id": "...", "summary": "...", "rationale": "...", "tags": ["optional_tag"]}}`).
+      - name: get_decisions
+        trigger: "To retrieve a list of past decisions, e.g., to review history or find a specific decision."
+        action_description: |
+          # Agent Action: Invoke `get_decisions` (`{"workspace_id": "...", "limit": N, "tags_filter_include_all": ["tag1"], "tags_filter_include_any": ["tag2"]}}`). Explain optional filters.
+      - name: search_decisions_fts
+        trigger: "When searching for decisions by keywords in summary, rationale, details, or tags, and basic `get_decisions` is insufficient."
+        action_description: |
+          # Agent Action: Invoke `search_decisions_fts` (`{"workspace_id": "...", "query_term": "search keywords", "limit": N}}`).
+      - name: delete_decision_by_id
+        trigger: "When user explicitly confirms deletion of a specific decision by its ID."
+        action_description: |
+          # Agent Action: Invoke `delete_decision_by_id` (`{"workspace_id": "...", "decision_id": ID}}`). Emphasize prior confirmation.
+      - name: log_progress
+        trigger: "When a task begins, its status changes (e.g., TODO, IN_PROGRESS, DONE), or it's completed. Also when a new sub-task is defined."
+        action_description: |
+          # Agent Action: Invoke `log_progress` (`{"workspace_id": "...", "description": "...", "status": "...", "linked_item_type": "...", "linked_item_id": "..."}}`). Note: 'summary' was changed to 'description' for log_progress.
+      - name: get_progress
+        trigger: "To review current task statuses, find pending tasks, or check history of progress."
+        action_description: |
+          # Agent Action: Invoke `get_progress` (`{"workspace_id": "...", "status_filter": "...", "parent_id_filter": ID, "limit": N}}`).
+      - name: update_progress
+        trigger: "Updates an existing progress entry."
+        action_description: |
+          # Agent Action: Invoke `update_progress` (`{"workspace_id": "...", "progress_id": ID, "status": "...", "description": "...", "parent_id": ID}}`).
+      - name: delete_progress_by_id
+        trigger: "Deletes a progress entry by its ID."
+        action_description: |
+          # Agent Action: Invoke `delete_progress_by_id` (`{"workspace_id": "...", "progress_id": ID}}`).
+      - name: log_system_pattern
+        trigger: "When new architectural patterns are introduced, or existing ones are modified, as confirmed by the user."
+        action_description: |
+          # Agent Action: Invoke `log_system_pattern` (`{"workspace_id": "...", "name": "...", "description": "...", "tags": ["optional_tag"]}}`).
+      - name: get_system_patterns
+        trigger: "To retrieve a list of defined system patterns."
+        action_description: |
+          # Agent Action: Invoke `get_system_patterns` (`{"workspace_id": "...", "tags_filter_include_all": ["tag1"], "limit": N}}`). Note: limit was not in original example, added for consistency.
+      - name: delete_system_pattern_by_id
+        trigger: "When user explicitly confirms deletion of a specific system pattern by its ID."
+        action_description: |
+          # Agent Action: Invoke `delete_system_pattern_by_id` (`{"workspace_id": "...", "pattern_id": ID}}`). Emphasize prior confirmation.
+      - name: log_custom_data
+        trigger: "To store any other type of structured or unstructured project-related information not covered by other tools (e.g., glossary terms, technical specs, meeting notes), as confirmed by the user."
+        action_description: |
+          # Agent Action: Invoke `log_custom_data` (`{"workspace_id": "...", "category": "...", "key": "...", "value": {... or "string"}}`). Note: 'metadata' field is not part of log_custom_data args.
+      - name: get_custom_data
+        trigger: "To retrieve specific custom data by category and key."
+        action_description: |
+          # Agent Action: Invoke `get_custom_data` (`{"workspace_id": "...", "category": "...", "key": "..."}}`).
+      - name: delete_custom_data
+        trigger: "When user explicitly confirms deletion of specific custom data by category and key."
+        action_description: |
+          # Agent Action: Invoke `delete_custom_data` (`{"workspace_id": "...", "category": "...", "key": "..."}}`). Emphasize prior confirmation.
+      - name: search_custom_data_value_fts
+        trigger: "When searching for specific terms within any custom data values, categories, or keys."
+        action_description: |
+          # Agent Action: Invoke `search_custom_data_value_fts` (`{"workspace_id": "...", "query_term": "...", "category_filter": "...", "limit": N}}`).
+      - name: search_project_glossary_fts
+        trigger: "When specifically searching for terms within the 'ProjectGlossary' custom data category."
+        action_description: |
+          # Agent Action: Invoke `search_project_glossary_fts` (`{"workspace_id": "...", "query_term": "...", "limit": N}}`).
+      - name: semantic_search_conport
+        trigger: "When a natural language query requires conceptual understanding beyond keyword matching, or when direct keyword searches are insufficient."
+        action_description: |
+          # Agent Action: Invoke `semantic_search_conport` (`{"workspace_id": "...", "query_text": "...", "top_k": N, "filter_item_types": ["decision", "custom_data"]}}`). Explain filters.
+      - name: link_conport_items
+        trigger: "When a meaningful relationship is identified and confirmed between two existing ConPort items (e.g., a decision is implemented by a system pattern, a progress item tracks a decision)."
+        action_description: |
+          <thinking>
+          - Need to link two items. Identify source type/ID, target type/ID, and relationship.
+          - Common relationship_types: 'implements', 'related_to', 'tracks', 'blocks', 'clarifies', 'depends_on'. Propose a suitable one or ask user.
+          </thinking>
+          # Agent Action: Invoke `link_conport_items` (`{"workspace_id":"...", "source_item_type":"...", "source_item_id":"...", "target_item_type":"...", "target_item_id":"...", "relationship_type":"...", "description":"Optional notes"}`).
+      - name: get_linked_items
+        trigger: "To understand the relationships of a specific ConPort item, or to explore the knowledge graph around an item."
+        action_description: |
+          # Agent Action: Invoke `get_linked_items` (`{"workspace_id":"...", "item_type":"...", "item_id":"...", "relationship_type_filter":"...", "linked_item_type_filter":"...", "limit":N}`).
+      - name: get_item_history
+        trigger: "When needing to review past versions of Product Context or Active Context, or to see when specific changes were made."
+        action_description: |
+          # Agent Action: Invoke `get_item_history` (`{"workspace_id":"...", "item_type":"product_context" or "active_context", "limit":N, "version":V, "before_timestamp":"ISO_DATETIME", "after_timestamp":"ISO_DATETIME"}`).
+      - name: batch_log_items
+        trigger: "When the user provides a list of multiple items of the SAME type (e.g., several decisions, multiple new glossary terms) to be logged at once."
+        action_description: |
+          <thinking>
+          - User provided multiple items. Verify they are of the same loggable type.
+          - Construct the `items` list, where each element is a dictionary of arguments for the single-item log tool (e.g., for `log_decision`).
+          </thinking>
+          # Agent Action: Invoke `batch_log_items` (`{"workspace_id":"...", "item_type":"decision", "items": [{"summary":"...", "rationale":"..."}, {"summary":"..."}] }`).
+      - name: get_recent_activity_summary
+        trigger: "At the start of a new session to catch up, or when the user asks for a summary of recent project activities."
+        action_description: |
+          # Agent Action: Invoke `get_recent_activity_summary` (`{"workspace_id":"...", "hours_ago":H, "since_timestamp":"ISO_DATETIME", "limit_per_type":N}`). Explain default if no time args.
+      - name: get_conport_schema
+        trigger: "If there's uncertainty about available ConPort tools or their arguments during a session (internal LLM check), or if an advanced user specifically asks for the server's tool schema."
+        action_description: |
+          # Agent Action: Invoke `get_conport_schema` (`{"workspace_id":"..."}`). Primarily for internal LLM reference or direct user request.
+      - name: export_conport_to_markdown
+        trigger: "When the user requests to export the current ConPort data to markdown files (e.g., for backup, sharing, or version control)."
+        action_description: |
+          # Agent Action: Invoke `export_conport_to_markdown` (`{"workspace_id":"...", "output_path":"optional/relative/path"}`). Explain default output path if not provided.
+      - name: import_markdown_to_conport
+        trigger: "When the user requests to import ConPort data from a directory of markdown files previously exported by this system."
+        action_description: |
+          # Agent Action: Invoke `import_markdown_to_conport` (`{"workspace_id":"...", "input_path":"optional/relative/path"}`). Explain default input path. Warn about potential overwrites or merges if data already exists.
+      - name: reconfigure_core_guidance
+        type: guidance
+        product_active_context: "The internal JSON structure of 'Product Context' and 'Active Context' (the `content` field) is flexible. Work with the user to define and evolve this structure via `update_product_context` and `update_active_context`. The server stores this `content` as a JSON blob."
+        decisions_progress_patterns: "The fundamental fields for Decisions, Progress, and System Patterns are fixed by ConPort's tools. For significantly different structures or additional fields, guide the user to create a new custom context category using `log_custom_data` (e.g., category: 'project_milestones_detailed')."
+
+  conport_sync_routine:
+    trigger: "^(Sync ConPort|ConPort Sync)$"
+    user_acknowledgement_text: "[CONPORT_SYNCING]"
+    instructions:
+      - "Halt Current Task: Stop current activity."
+      - "Acknowledge Command: Send `[CONPORT_SYNCING]` to the user."
+      - "Review Chat History: Analyze the complete current chat session for new information, decisions, progress, context changes, clarifications, and potential new relationships between items."
+    core_update_process:
+      thinking_preamble: |
+        - Synchronize ConPort with information from the current chat session.
+        - Use appropriate ConPort tools based on identified changes.
+        - For `update_product_context` and `update_active_context`, first fetch current content, then merge/update (potentially using `patch_content`), then call the update tool with the *complete new content object* or the patch.
+        - All tool calls require the `workspace_id`.
+      agent_action_plan_illustrative:
+        - "Log new decisions (use `log_decision`)."
+        - "Log task progress/status changes (use `log_progress`)."
+        - "Update existing progress entries (use `update_progress`)."
+        - "Delete progress entries (use `delete_progress_by_id`)."
+        - "Log new system patterns (use `log_system_pattern`)."
+        - "Update Active Context (use `get_active_context` then `update_active_context` with full or patch)."
+        - "Update Product Context if significant changes (use `get_product_context` then `update_product_context` with full or patch)."
+        - "Log new custom context, including ProjectGlossary terms (use `log_custom_data`)."
+        - "Identify and log new relationships between items (use `link_conport_items`)."
+        - "If many items of the same type were discussed, consider `batch_log_items`."
+        - "After updates, consider a brief `get_recent_activity_summary` to confirm and refresh understanding."
+    post_sync_actions:
+      - "Inform user: ConPort synchronized with session info."
+      - "Resume previous task or await new instructions."
+
+  dynamic_context_retrieval_for_rag:
+    description: |
+      Guidance for dynamically retrieving and assembling context from ConPort to answer user queries or perform tasks,
+      enhancing Retrieval Augmented Generation (RAG) capabilities.
+    trigger: "When the AI needs to answer a specific question, perform a task requiring detailed project knowledge, or generate content based on ConPort data."
+    goal: "To construct a concise, highly relevant context set for the LLM, improving the accuracy and relevance of its responses."
+    steps:
+      - step: 1
+        action: "Analyze User Query/Task"
+        details: "Deconstruct the user's request to identify key entities, concepts, keywords, and the specific type of information needed from ConPort."
+      - step: 2
+        action: "Prioritized Retrieval Strategy"
+        details: |
+          Based on the analysis, select the most appropriate ConPort tools:
+          - **Targeted FTS:** Use `search_decisions_fts`, `search_custom_data_value_fts`, `search_project_glossary_fts` for keyword-based searches if specific terms are evident.
+          - **Specific Item Retrieval:** Use `get_custom_data` (if category/key known), `get_decisions` (by ID or for recent items), `get_system_patterns`, `get_progress` if the query points to specific item types or IDs.
+          - **(Future):** Prioritize semantic search tools once available for conceptual queries.
+          - **Broad Context (Fallback):** Use `get_product_context` or `get_active_context` as a fallback if targeted retrieval yields little, but be mindful of their size.
+      - step: 3
+        action: "Retrieve Initial Set"
+        details: "Execute the chosen tool(s) to retrieve an initial, small set (e.g., top 3-5) of the most relevant items or data snippets."
+      - step: 4
+        action: "Contextual Expansion (Optional)"
+        details: "For the most promising items from Step 3, consider using `get_linked_items` to fetch directly related items (1-hop). This can provide crucial context or disambiguation. Use judiciously to avoid excessive data."
+      - step: 5
+        action: "Synthesize and Filter"
+        details: |
+          Review the retrieved information (initial set + expanded context).
+          - **Filter:** Discard irrelevant items or parts of items.
+          - **Synthesize/Summarize:** If multiple relevant pieces of information are found, synthesize them into a concise summary that directly addresses the query/task. Extract only the most pertinent sentences or facts.
+      - step: 6
+        action: "Assemble Prompt Context"
+        details: |
+          Construct the context portion of the LLM prompt using the filtered and synthesized information.
+          - **Clarity:** Clearly delineate this retrieved context from the user's query or other parts of the prompt.
+          - **Attribution (Optional but Recommended):** If possible, briefly note the source of the information (e.g., "From Decision D-42:", "According to System Pattern SP-5:").
+          - **Brevity:** Strive for relevance and conciseness. Avoid including large, unprocessed chunks of data unless absolutely necessary and directly requested.
+    general_principles:
+      - "Prefer targeted retrieval over broad context dumps."
+      - "Iterate if initial retrieval is insufficient: try different keywords or tools."
+      - "Balance context richness with prompt token limits."
+
+  proactive_knowledge_graph_linking:
+    description: |
+      Guidance for the AI to proactively identify and suggest the creation of links between ConPort items,
+      enriching the project's knowledge graph based on conversational context.
+    trigger: "During ongoing conversation, when the AI observes potential relationships (e.g., causal, implementational, clarifying) between two or more discussed ConPort items or concepts that are likely represented as ConPort items."
+    goal: "To actively build and maintain a rich, interconnected knowledge graph within ConPort by capturing relationships that might otherwise be missed."
+    steps:
+      - step: 1
+        action: "Monitor Conversational Context"
+        details: "Continuously analyze the user's statements and the flow of discussion for mentions of ConPort items (explicitly by ID, or implicitly by well-known names/summaries) and the relationships being described or implied between them."
+      - step: 2
+        action: "Identify Potential Links"
+        details: |
+          Look for patterns such as:
+          - User states "Decision X led to us doing Y (which is Progress item P-3)."
+          - User discusses how System Pattern SP-2 helps address a concern noted in Decision D-5.
+          - User outlines a task (Progress P-10) that implements a specific feature detailed in a `custom_data` spec (CD-Spec-FeatureX).
+      - step: 3
+        action: "Formulate and Propose Link Suggestion"
+        details: |
+          If a potential link is identified:
+          - Clearly state the items involved (e.g., "Decision D-5", "System Pattern SP-2").
+          - Describe the perceived relationship (e.g., "It seems SP-2 addresses a concern in D-5.").
+          - Propose creating a link using `ask_followup_question`.
+          - Example Question: "I noticed we're discussing Decision D-5 and System Pattern SP-2. It sounds like SP-2 might 'address_concern_in' D-5. Would you like me to create this link in ConPort? You can also suggest a different relationship type."
+          - Suggested Answers:
+            - "Yes, link them with 'addresses_concern_in'."
+            - "Yes, but use relationship type: [user types here]."
+            - "No, don't link them now."
+          - Offer common relationship types as examples if needed: 'implements', 'clarifies', 'related_to', 'depends_on', 'blocks', 'resolves', 'derived_from'.
+      - step: 4
+        action: "Gather Details and Execute Linking"
+        details: |
+          If the user confirms:
+          - Ensure you have the correct source item type, source item ID, target item type, target item ID, and the agreed-upon relationship type.
+          - Ask for an optional brief description for the link if the relationship isn't obvious.
+          - Invoke the `link_conport_items` tool.
+      - step: 5
+        action: "Confirm Outcome"
+        details: "Inform the user of the success or failure of the `link_conport_items` tool call."
+    general_principles:
+      - "Be helpful, not intrusive. If the user declines a suggestion, accept and move on."
+      - "Prioritize clear, strong relationships over tenuous ones."
+      - "This strategy complements the general `proactive_logging_cue` by providing specific guidance for link creation."

.roomodes

@@ -1 +1,35 @@
-customModes: []
+customModes:
+  - slug: project-research
+    name: 🔍 Project Research
+    roleDefinition: |
+      You are a detailed-oriented research assistant specializing in examining and understanding codebases. Your primary responsibility is to analyze the file structure, content, and dependencies of a given project to provide comprehensive context relevant to specific user queries.
+    whenToUse: |
+      Use this mode when you need to thoroughly investigate and understand a codebase structure, analyze project architecture, or gather comprehensive context about existing implementations. Ideal for onboarding to new projects, understanding complex codebases, or researching how specific features are implemented across the project.
+    description: Investigate and analyze codebase structure
+    groups:
+      - read
+    source: project
+    customInstructions: |
+      Your role is to deeply investigate and summarize the structure and implementation details of the project codebase. To achieve this effectively, you must:
+
+      1. Start by carefully examining the file structure of the entire project, with a particular emphasis on files located within the "docs" folder. These files typically contain crucial context, architectural explanations, and usage guidelines.
+
+      2. When given a specific query, systematically identify and gather all relevant context from:
+         - Documentation files in the "docs" folder that provide background information, specifications, or architectural insights.
+         - Relevant type definitions and interfaces, explicitly citing their exact location (file path and line number) within the source code.
+         - Implementations directly related to the query, clearly noting their file locations and providing concise yet comprehensive summaries of how they function.
+         - Important dependencies, libraries, or modules involved in the implementation, including their usage context and significance to the query.
+
+      3. Deliver a structured, detailed report that clearly outlines:
+         - An overview of relevant documentation insights.
+         - Specific type definitions and their exact locations.
+         - Relevant implementations, including file paths, functions or methods involved, and a brief explanation of their roles.
+         - Critical dependencies and their roles in relation to the query.
+
+      4. Always cite precise file paths, function names, and line numbers to enhance clarity and ease of navigation.
+
+      5. Organize your findings in logical sections, making it straightforward for the user to understand the project's structure and implementation status relevant to their request.
+
+      6. Ensure your response directly addresses the user's query and helps them fully grasp the relevant aspects of the project's current state.
+
+      These specific instructions supersede any conflicting general instructions you might otherwise follow. Your detailed report should enable effective decision-making and next steps within the overall workflow.

CRITICAL_ANALYSIS_HTMX_ALPINE.md

@@ -0,0 +1,232 @@
+# Critical Analysis: Current HTMX + Alpine.js Implementation
+
+## Executive Summary
+
+After thorough analysis, the current HTMX + Alpine.js implementation has **significant gaps** compared to the React frontend functionality. While the foundation exists, there are critical missing pieces that prevent it from being a true replacement for the React frontend.
+
+## Major Issues Identified
+
+### 1. **Incomplete Component Parity** ❌
+
+**React Frontend Has:**
+- Sophisticated park/ride cards with hover effects, ratings, status badges
+- Advanced search with autocomplete and real-time suggestions  
+- Complex filtering UI with multiple filter types
+- Rich user profile management
+- Modal-based authentication flows
+- Theme switching with system preference detection
+- Responsive image handling with Next.js Image optimization
+
+**Current Django Templates Have:**
+- Basic card layouts without advanced interactions
+- Simple search without autocomplete
+- Limited filtering capabilities
+- Basic user menus
+- No modal authentication system
+- Basic theme toggle
+
+### 2. **Missing Critical Pages** ❌
+
+**React Frontend Pages Not Implemented:**
+- `/profile` - User profile management
+- `/settings` - User settings and preferences  
+- `/api-test` - API testing interface
+- `/test-ride` - Ride testing components
+- Advanced search results page
+- User dashboard/account management
+
+**Current Django Only Has:**
+- Basic park/ride listing pages
+- Simple detail pages
+- Admin/moderation interfaces
+
+### 3. **Inadequate State Management** ❌
+
+**React Frontend Uses:**
+- Complex state management with custom hooks
+- Global authentication state
+- Theme provider with system detection
+- Search state with debouncing
+- Filter state with URL synchronization
+
+**Current Alpine.js Has:**
+- Basic component-level state
+- Simple theme toggle
+- No global state management
+- No URL state synchronization
+- No proper error handling
+
+### 4. **Poor API Integration** ❌
+
+**React Frontend Features:**
+- TypeScript API clients with proper typing
+- Error handling and loading states
+- Optimistic updates
+- Proper authentication headers
+- Response caching
+
+**Current HTMX Implementation:**
+- Basic HTMX requests without error handling
+- No loading states
+- No proper authentication integration
+- No response validation
+- No caching strategy
+
+### 5. **Missing Advanced UI Components** ❌
+
+**React Frontend Components Missing:**
+- Advanced data tables with sorting/filtering
+- Image galleries with lightbox
+- Multi-step forms
+- Rich text editors
+- Date/time pickers
+- Advanced modals and dialogs
+- Toast notifications system
+- Skeleton loading states
+
+### 6. **Inadequate Mobile Experience** ❌
+
+**React Frontend Mobile Features:**
+- Responsive design with proper breakpoints
+- Touch-optimized interactions
+- Mobile-specific navigation patterns
+- Swipe gestures
+- Mobile-optimized forms
+
+**Current Implementation:**
+- Basic responsive layout
+- No touch optimizations
+- Simple mobile menu
+- No mobile-specific interactions
+
+## Specific Technical Gaps
+
+### Authentication System
+```html
+<!-- Current: Basic login links -->
+<a href="{% url 'account_login' %}">Login</a>
+
+<!-- Needed: Modal-based auth like React -->
+<div x-data="authModal()" x-show="open" class="modal">
+  <!-- Complex auth flow with validation -->
+</div>
+```
+
+### Search Functionality
+```javascript
+// Current: Basic search
+Alpine.data('searchComponent', () => ({
+  query: '',
+  async search() {
+    // Basic fetch without proper error handling
+  }
+}))
+
+// Needed: Advanced search like React
+Alpine.data('advancedSearch', () => ({
+  query: '',
+  filters: {},
+  suggestions: [],
+  loading: false,
+  debounceTimer: null,
+  // Complex search logic with debouncing, caching, etc.
+}))
+```
+
+### Component Architecture
+```html
+<!-- Current: Basic templates -->
+<div class="card">
+  <h3>{{ park.name }}</h3>
+</div>
+
+<!-- Needed: Rich components like React -->
+<div x-data="parkCard({{ park|json }})" class="park-card">
+  <!-- Complex interactions, animations, state management -->
+</div>
+```
+
+## Performance Issues
+
+### 1. **No Code Splitting**
+- React frontend uses dynamic imports and code splitting
+- Current implementation loads everything upfront
+- No lazy loading of components or routes
+
+### 2. **Inefficient HTMX Usage**
+- Multiple HTMX requests for simple interactions
+- No request batching or optimization
+- No proper caching headers
+
+### 3. **Poor Asset Management**
+- No asset optimization
+- No image optimization (missing Next.js Image equivalent)
+- No CSS/JS minification strategy
+
+## Missing Developer Experience
+
+### 1. **No Type Safety**
+- React frontend has full TypeScript support
+- Current implementation has no type checking
+- No API contract validation
+
+### 2. **Poor Error Handling**
+- No global error boundaries
+- No proper error reporting
+- No user-friendly error messages
+
+### 3. **No Testing Strategy**
+- React frontend has component testing
+- Current implementation has no frontend tests
+- No integration testing
+
+## Critical Missing Features
+
+### 1. **Real-time Features**
+- No WebSocket integration
+- No live updates
+- No real-time notifications
+
+### 2. **Advanced Interactions**
+- No drag and drop
+- No complex animations
+- No keyboard navigation
+- No accessibility features
+
+### 3. **Data Management**
+- No client-side caching
+- No optimistic updates
+- No offline support
+- No data synchronization
+
+## Recommended Action Plan
+
+### Phase 1: Critical Component Migration (High Priority)
+1. **Authentication System** - Implement modal-based auth with proper validation
+2. **Advanced Search** - Build autocomplete with debouncing and caching
+3. **User Profile/Settings** - Create comprehensive user management
+4. **Enhanced Cards** - Implement rich park/ride cards with interactions
+
+### Phase 2: Advanced Features (Medium Priority)
+1. **State Management** - Implement proper global state with Alpine stores
+2. **API Integration** - Build robust API client with error handling
+3. **Mobile Optimization** - Enhance mobile experience
+4. **Performance** - Implement caching and optimization
+
+### Phase 3: Polish and Testing (Low Priority)
+1. **Error Handling** - Implement comprehensive error boundaries
+2. **Testing** - Add frontend testing suite
+3. **Accessibility** - Ensure WCAG compliance
+4. **Documentation** - Create comprehensive component docs
+
+## Conclusion
+
+The current HTMX + Alpine.js implementation is **NOT ready** to replace the React frontend. It's missing approximately **60-70%** of the functionality and sophistication of the React application. 
+
+A proper migration requires:
+- **3-4 weeks of intensive development**
+- **Complete rewrite of most components**
+- **New architecture for state management**
+- **Comprehensive testing and optimization**
+
+The existing Django templates are a good foundation, but they need **significant enhancement** to match the React frontend's capabilities.

FRONTEND_MIGRATION_PLAN.md

@@ -0,0 +1,258 @@
+# Frontend Migration Plan: React/Next.js to HTMX + Alpine.js
+
+## Executive Summary
+
+Based on my analysis, this project already has a **fully functional HTMX + Alpine.js Django backend** with comprehensive templates. The task is to migrate the separate Next.js React frontend (`frontend/` directory) to integrate seamlessly with the existing Django HTMX + Alpine.js architecture.
+
+## Current State Analysis
+
+### ✅ Django Backend (Already Complete)
+- **HTMX Integration**: Already implemented with proper headers and partial templates
+- **Alpine.js Components**: Extensive use of Alpine.js for interactivity
+- **Template Structure**: Comprehensive template hierarchy with partials
+- **Authentication**: Complete auth system with modals and forms
+- **Styling**: Tailwind CSS with dark mode support
+- **Components**: Reusable components for cards, pagination, forms, etc.
+
+### 🔄 React Frontend (To Be Migrated)
+- **Next.js App Router**: Modern React application structure
+- **Component Library**: Extensive UI components using shadcn/ui
+- **Authentication**: React-based auth hooks and providers
+- **Theme Management**: React theme provider system
+- **API Integration**: TypeScript API clients for Django backend
+
+## Migration Strategy
+
+### Phase 1: Template Enhancement (Extend Django Templates)
+
+Instead of replacing the existing Django templates, we'll enhance them to match the React frontend's design and functionality.
+
+#### 1.1 Header Component Migration
+**Current Django**: Basic header with navigation
+**React Frontend**: Advanced header with browse menu, search, theme toggle, user dropdown
+
+**Action**: Enhance `backend/templates/base/base.html` header section
+
+#### 1.2 Component Library Integration
+**Current Django**: Basic components
+**React Frontend**: Rich component library (buttons, cards, modals, etc.)
+
+**Action**: Create Django template components matching shadcn/ui design system
+
+#### 1.3 Advanced Interactivity
+**Current Django**: Basic Alpine.js usage
+**React Frontend**: Complex state management and interactions
+
+**Action**: Enhance Alpine.js components with advanced patterns
+
+### Phase 2: Django View Enhancements
+
+#### 2.1 API Response Optimization
+- Enhance existing Django views to support both full page and HTMX partial responses
+- Implement proper JSON responses for Alpine.js components
+- Add advanced filtering and search capabilities
+
+#### 2.2 Authentication Flow
+- Enhance existing Django auth to match React frontend UX
+- Implement modal-based login/signup (already partially done)
+- Add proper error handling and validation
+
+### Phase 3: Frontend Asset Migration
+
+#### 3.1 Static Assets
+- Migrate React component styles to Django static files
+- Enhance Tailwind configuration
+- Add missing JavaScript utilities
+
+#### 3.2 Alpine.js Store Management
+- Implement global state management using Alpine.store()
+- Create reusable Alpine.js components using Alpine.data()
+- Add proper event handling and communication
+
+## Implementation Plan
+
+### Step 1: Analyze Component Gaps
+Compare React components with Django templates to identify missing functionality:
+
+1. **Browse Menu**: React has sophisticated browse dropdown
+2. **Search Functionality**: React has advanced search with autocomplete
+3. **Theme Toggle**: React has system/light/dark theme support
+4. **User Management**: React has comprehensive user profile management
+5. **Modal System**: React has advanced modal components
+6. **Form Handling**: React has sophisticated form validation
+
+### Step 2: Enhance Django Templates
+
+#### Base Template Enhancements
+```html
+<!-- Enhanced header with browse menu -->
+<div class="browse-menu" x-data="browseMenu()">
+  <!-- Implement React-style browse menu -->
+</div>
+
+<!-- Enhanced search with autocomplete -->
+<div class="search-container" x-data="searchComponent()">
+  <!-- Implement React-style search -->
+</div>
+```
+
+#### Alpine.js Component Library
+```javascript
+// Global Alpine.js components
+Alpine.data('browseMenu', () => ({
+  open: false,
+  toggle() { this.open = !this.open }
+}))
+
+Alpine.data('searchComponent', () => ({
+  query: '',
+  results: [],
+  async search() {
+    // Implement search logic
+  }
+}))
+```
+
+### Step 3: Django View Enhancements
+
+#### Enhanced Views for HTMX
+```python
+def enhanced_park_list(request):
+    if request.headers.get('HX-Request'):
+        # Return partial template for HTMX
+        return render(request, 'parks/partials/park_list.html', context)
+    # Return full page
+    return render(request, 'parks/park_list.html', context)
+```
+
+### Step 4: Component Migration Priority
+
+1. **Header Component** (High Priority)
+   - Browse menu with categories
+   - Advanced search with autocomplete
+   - User dropdown with profile management
+   - Theme toggle with system preference
+
+2. **Navigation Components** (High Priority)
+   - Mobile menu with slide-out
+   - Breadcrumb navigation
+   - Tab navigation
+
+3. **Form Components** (Medium Priority)
+   - Advanced form validation
+   - File upload components
+   - Multi-step forms
+
+4. **Data Display Components** (Medium Priority)
+   - Advanced card layouts
+   - Data tables with sorting/filtering
+   - Pagination components
+
+5. **Modal and Dialog Components** (Low Priority)
+   - Confirmation dialogs
+   - Image galleries
+   - Settings panels
+
+## Technical Implementation Details
+
+### HTMX Patterns to Implement
+
+1. **Lazy Loading**
+```html
+<div hx-get="/api/parks/" hx-trigger="intersect" hx-swap="innerHTML">
+  Loading parks...
+</div>
+```
+
+2. **Infinite Scroll**
+```html
+<div hx-get="/api/parks/?page=2" hx-trigger="revealed" hx-swap="beforeend">
+  Load more...
+</div>
+```
+
+3. **Live Search**
+```html
+<input hx-get="/api/search/" hx-trigger="input changed delay:300ms" 
+       hx-target="#search-results">
+```
+
+### Alpine.js Patterns to Implement
+
+1. **Global State Management**
+```javascript
+Alpine.store('app', {
+  user: null,
+  theme: 'system',
+  searchQuery: ''
+})
+```
+
+2. **Reusable Components**
+```javascript
+Alpine.data('modal', () => ({
+  open: false,
+  show() { this.open = true },
+  hide() { this.open = false }
+}))
+```
+
+## File Structure After Migration
+
+```
+backend/
+├── templates/
+│   ├── base/
+│   │   ├── base.html (enhanced)
+│   │   └── components/
+│   │       ├── header.html
+│   │       ├── footer.html
+│   │       ├── navigation.html
+│   │       └── search.html
+│   ├── components/
+│   │   ├── ui/
+│   │   │   ├── button.html
+│   │   │   ├── card.html
+│   │   │   ├── modal.html
+│   │   │   └── form.html
+│   │   └── layout/
+│   │       ├── browse_menu.html
+│   │       └── user_menu.html
+│   └── partials/
+│       ├── htmx/
+│       └── alpine/
+├── static/
+│   ├── js/
+│   │   ├── alpine-components.js
+│   │   ├── htmx-config.js
+│   │   └── app.js
+│   └── css/
+│       ├── components.css
+│       └── tailwind.css
+```
+
+## Success Metrics
+
+1. **Functionality Parity**: All React frontend features work in Django templates
+2. **Design Consistency**: Visual design matches React frontend exactly
+3. **Performance**: Page load times improved due to server-side rendering
+4. **User Experience**: Smooth interactions with HTMX and Alpine.js
+5. **Maintainability**: Clean, reusable template components
+
+## Timeline Estimate
+
+- **Phase 1**: Template Enhancement (3-4 days)
+- **Phase 2**: Django View Enhancements (2-3 days)
+- **Phase 3**: Frontend Asset Migration (2-3 days)
+- **Testing & Refinement**: 2-3 days
+
+**Total Estimated Time**: 9-13 days
+
+## Next Steps
+
+1. **Immediate**: Start with header component migration
+2. **Priority**: Focus on high-impact components first
+3. **Testing**: Implement comprehensive testing for each migrated component
+4. **Documentation**: Update all documentation to reflect new architecture
+
+This migration will result in a unified, server-rendered application with the rich interactivity of the React frontend but the performance and simplicity of HTMX + Alpine.js.

MIGRATION_IMPLEMENTATION_SUMMARY.md

@@ -0,0 +1,207 @@
+# Frontend Migration Implementation Summary
+
+## What We've Accomplished ✅
+
+### 1. **Critical Analysis Completed**
+- Identified that current HTMX + Alpine.js implementation was missing **60-70%** of React frontend functionality
+- Documented specific gaps in authentication, search, state management, and UI components
+- Created detailed comparison between React and Django implementations
+
+### 2. **Enhanced Authentication System** 🎯
+**Problem**: Django only had basic page-based login forms
+**Solution**: Created sophisticated modal-based authentication system
+
+**Files Created/Modified:**
+- `backend/templates/components/auth/auth-modal.html` - Complete modal auth component
+- `backend/static/js/alpine-components.js` - Enhanced with `authModal()` Alpine component
+- `backend/templates/base/base.html` - Added global auth modal
+- `backend/templates/components/layout/enhanced_header.html` - Updated to use modal auth
+
+**Features Implemented:**
+- Modal-based login/register (matches React AuthDialog)
+- Social authentication integration (Google, Discord)
+- Form validation and error handling
+- Password visibility toggle
+- Smooth transitions and animations
+- Global accessibility via `window.authModal`
+
+### 3. **Advanced Toast Notification System** 🎯
+**Problem**: No toast notification system like React's Sonner
+**Solution**: Created comprehensive toast system with progress bars
+
+**Files Created:**
+- `backend/templates/components/ui/toast-container.html` - Toast UI component
+- Enhanced Alpine.js with global toast store and component
+
+**Features Implemented:**
+- Multiple toast types (success, error, warning, info)
+- Progress bar animations
+- Auto-dismiss with configurable duration
+- Smooth slide-in/out animations
+- Global store for app-wide access
+
+### 4. **Enhanced Alpine.js Architecture** 🎯
+**Problem**: Basic Alpine.js components without sophisticated state management
+**Solution**: Created comprehensive component library
+
+**Components Added:**
+- `authModal()` - Complete authentication flow
+- Enhanced `toast()` - Advanced notification system
+- Global stores for app state and toast management
+- Improved error handling and API integration
+
+### 5. **Improved Header Component** 🎯
+**Problem**: Header didn't match React frontend sophistication
+**Solution**: Enhanced header with modal integration
+
+**Features Added:**
+- Modal authentication buttons (instead of page redirects)
+- Proper Alpine.js integration
+- Maintained all existing functionality (browse menu, search, theme toggle)
+
+## Current State Assessment
+
+### ✅ **Completed Components**
+1. **Authentication System** - Modal-based auth matching React functionality
+2. **Toast Notifications** - Advanced toast system with animations
+3. **Theme Management** - Already working well
+4. **Header Navigation** - Enhanced with modal integration
+5. **Base Template Structure** - Solid foundation with global components
+
+### ⚠️ **Partially Complete**
+1. **Search Functionality** - Basic HTMX search exists, needs autocomplete enhancement
+2. **User Profile/Settings** - Basic pages exist, need React-level sophistication
+3. **Card Components** - Basic cards exist, need hover effects and advanced interactions
+
+### ❌ **Still Missing (High Priority)**
+1. **Advanced Search with Autocomplete** - React has sophisticated search with suggestions
+2. **Enhanced Park/Ride Cards** - Need hover effects, animations, better interactions
+3. **User Profile Management** - React has comprehensive profile editing
+4. **Settings Page** - React has advanced settings with multiple sections
+5. **Mobile Optimization** - Need touch-optimized interactions
+6. **Loading States** - Need skeleton loaders and proper loading indicators
+
+### ❌ **Still Missing (Medium Priority)**
+1. **Advanced Filtering UI** - React has complex filter interfaces
+2. **Image Galleries** - React has lightbox and advanced image handling
+3. **Data Tables** - React has sortable, filterable tables
+4. **Form Validation** - Need client-side validation matching React
+5. **Pagination Components** - Need enhanced pagination with proper state
+
+## Next Steps for Complete Migration
+
+### Phase 1: Critical Missing Components (1-2 weeks)
+
+#### 1. Enhanced Search with Autocomplete
+```javascript
+// Need to implement in Alpine.js
+Alpine.data('advancedSearch', () => ({
+  query: '',
+  suggestions: [],
+  loading: false,
+  showSuggestions: false,
+  // Advanced search logic with debouncing, caching
+}))
+```
+
+#### 2. Enhanced Park/Ride Cards
+```html
+<!-- Need to create sophisticated card component -->
+<div x-data="parkCard({{ park|json }})" class="park-card">
+  <!-- Hover effects, animations, interactions -->
+</div>
+```
+
+#### 3. User Profile/Settings Pages
+- Create comprehensive profile editing interface
+- Add avatar upload with preview
+- Implement settings sections (privacy, notifications, etc.)
+
+### Phase 2: Advanced Features (2-3 weeks)
+
+#### 1. Advanced Filtering System
+- Multi-select filters
+- Range sliders
+- Date pickers
+- URL state synchronization
+
+#### 2. Enhanced Mobile Experience
+- Touch-optimized interactions
+- Swipe gestures
+- Mobile-specific navigation patterns
+
+#### 3. Loading States and Skeletons
+- Skeleton loading components
+- Proper loading indicators
+- Optimistic updates
+
+### Phase 3: Polish and Optimization (1 week)
+
+#### 1. Performance Optimization
+- Lazy loading
+- Image optimization
+- Request batching
+
+#### 2. Accessibility Improvements
+- ARIA labels
+- Keyboard navigation
+- Screen reader support
+
+#### 3. Testing and Documentation
+- Component testing
+- Integration testing
+- Comprehensive documentation
+
+## Technical Architecture
+
+### Current Stack
+- **Backend**: Django with HTMX middleware
+- **Frontend**: HTMX + Alpine.js + Tailwind CSS
+- **Components**: shadcn/ui-inspired design system
+- **State Management**: Alpine.js stores + component-level state
+- **Authentication**: Modal-based with social auth integration
+
+### Key Patterns Established
+1. **Global Component Access**: `window.authModal` pattern for cross-component communication
+2. **Store-based State**: Alpine.store() for global state management
+3. **HTMX + Alpine Integration**: Seamless server-client interaction
+4. **Component Templates**: Reusable Django template components
+5. **Progressive Enhancement**: Works without JavaScript, enhanced with it
+
+## Success Metrics
+
+### ✅ **Achieved**
+- Modal authentication system (100% React parity)
+- Toast notification system (100% React parity)
+- Theme management (100% React parity)
+- Base template architecture (solid foundation)
+
+### 🎯 **In Progress**
+- Search functionality (60% complete)
+- Card components (40% complete)
+- User management (30% complete)
+
+### ❌ **Not Started**
+- Advanced filtering (0% complete)
+- Mobile optimization (0% complete)
+- Loading states (0% complete)
+
+## Estimated Completion Time
+
+**Total Remaining Work**: 4-6 weeks
+- **Phase 1 (Critical)**: 1-2 weeks
+- **Phase 2 (Advanced)**: 2-3 weeks  
+- **Phase 3 (Polish)**: 1 week
+
+## Conclusion
+
+We've successfully implemented the **most critical missing piece** - the authentication system - which was a major gap between the React and Django implementations. The foundation is now solid with:
+
+1. **Sophisticated modal authentication** matching React functionality
+2. **Advanced toast notification system** with animations and global state
+3. **Enhanced Alpine.js architecture** with proper component patterns
+4. **Solid template structure** for future component development
+
+The remaining work is primarily about **enhancing existing components** rather than building fundamental architecture. The hardest part (authentication and global state management) is complete.
+
+**Recommendation**: Continue with Phase 1 implementation focusing on search enhancement and card component improvements, as these will provide the most visible user experience improvements.

README.md

@@ -1,16 +1,29 @@
 # ThrillWiki Django + Vue.js Monorepo
 
-A modern monorepo architecture for ThrillWiki, combining a Django REST API backend with a Vue.js frontend.
+A comprehensive theme park and roller coaster information system built with a modern monorepo architecture combining Django REST API backend with Vue.js frontend.
 
-## 🏗️ Architecture
+## 🏗️ Architecture Overview
 
-This project uses a monorepo structure that cleanly separates backend and frontend concerns:
+This project uses a monorepo structure that cleanly separates backend and frontend concerns while maintaining shared resources and documentation:
 
 ```
 thrillwiki-monorepo/
-├── backend/          # Django REST API
-├── frontend/         # Vue.js SPA
-└── shared/           # Shared resources and documentation
+├── backend/                 # Django REST API (Port 8000)
+│   ├── apps/               # Modular Django applications
+│   ├── config/             # Django settings and configuration
+│   ├── templates/          # Django templates
+│   └── static/             # Static assets
+├── frontend/                # Vue.js SPA (Port 5174)
+│   ├── src/                # Vue.js source code
+│   ├── public/             # Static assets
+│   └── dist/               # Build output
+├── shared/                  # Shared resources and documentation
+│   ├── docs/               # Comprehensive documentation
+│   ├── scripts/            # Development and deployment scripts
+│   ├── config/             # Shared configuration
+│   └── media/              # Shared media files
+├── architecture/            # Architecture documentation
+└── profiles/                # Development profiles
 ```
 
 ## 🚀 Quick Start
@@ -19,6 +32,8 @@ thrillwiki-monorepo/
 
 - **Python 3.11+** with [uv](https://docs.astral.sh/uv/) for backend dependencies
 - **Node.js 18+** with [pnpm](https://pnpm.io/) for frontend dependencies
+- **PostgreSQL 14+** (optional, defaults to SQLite for development)
+- **Redis 6+** (optional, for caching and sessions)
 
 ### Development Setup
 
@@ -32,41 +47,63 @@ thrillwiki-monorepo/
    ```bash
    # Install frontend dependencies
    pnpm install
-   
+
    # Install backend dependencies
-   cd backend && uv sync
+   cd backend && uv sync && cd ..
    ```
 
-3. **Start development servers**
+3. **Environment configuration**
    ```bash
-   # Start both frontend and backend
-   pnpm run dev
-   
-   # Or start individually
-   pnpm run dev:frontend  # Vue.js on :3000
-   pnpm run dev:backend   # Django on :8000
+   # Copy environment files
+   cp .env.example .env
+   cp backend/.env.example backend/.env
+   cp frontend/.env.development frontend/.env.local
+
+   # Edit .env files with your settings
    ```
 
-## 📁 Project Structure
+4. **Database setup**
+   ```bash
+   cd backend
+   uv run manage.py migrate
+   uv run manage.py createsuperuser
+   cd ..
+   ```
+
+5. **Start development servers**
+   ```bash
+   # Start both servers concurrently
+   pnpm run dev
+
+   # Or start individually
+   pnpm run dev:frontend    # Vue.js on :5174
+   pnpm run dev:backend     # Django on :8000
+   ```
+
+## 📁 Project Structure Details
 
 ### Backend (`/backend`)
-- **Django REST API** with modular app architecture
-- **UV package management** for Python dependencies
-- **PostgreSQL** database (configurable)
-- **Redis** for caching and sessions
+- **Django 5.0+** with REST Framework for API development
+- **Modular app architecture** with separate apps for parks, rides, accounts, etc.
+- **UV package management** for fast, reliable Python dependency management
+- **PostgreSQL/SQLite** database with comprehensive entity relationships
+- **Redis** for caching, sessions, and background tasks
+- **Comprehensive API** with frontend serializers for camelCase conversion
 
 ### Frontend (`/frontend`)
-- **Vue 3** with Composition API
-- **TypeScript** for type safety
-- **Vite** for fast development and building
-- **Tailwind CSS** for styling
-- **Pinia** for state management
+- **Vue 3** with Composition API and `<script setup>` syntax
+- **TypeScript** for type safety and better developer experience
+- **Vite** for lightning-fast development and optimized production builds
+- **Tailwind CSS** with custom design system and dark mode support
+- **Pinia** for state management with modular stores
+- **Vue Router** for client-side routing
+- **Comprehensive UI component library** with shadcn-vue components
 
-### Shared (`/shared`)
-- Documentation and deployment guides
-- Shared TypeScript types
-- Build and deployment scripts
-- Docker configurations
+### Shared Resources (`/shared`)
+- **Documentation** - Comprehensive guides and API documentation
+- **Development scripts** - Automated setup, build, and deployment scripts
+- **Configuration** - Shared Docker, CI/CD, and infrastructure configs
+- **Media management** - Centralized media file handling and optimization
 
 ## 🛠️ Development Workflow
 
@@ -74,77 +111,234 @@ thrillwiki-monorepo/
 
 ```bash
 # Development
-pnpm run dev              # Start both servers
-pnpm run dev:frontend     # Frontend only
-pnpm run dev:backend      # Backend only
+pnpm run dev              # Start both servers concurrently
+pnpm run dev:frontend     # Frontend only (:5174)
+pnpm run dev:backend      # Backend only (:8000)
 
 # Building
-pnpm run build            # Build for production
-pnpm run build:frontend   # Frontend build only
+pnpm run build            # Build frontend for production
+pnpm run build:staging    # Build for staging environment
+pnpm run build:production # Build for production environment
 
 # Testing
 pnpm run test             # Run all tests
-pnpm run test:frontend    # Frontend tests
-pnpm run test:backend     # Backend tests
+pnpm run test:frontend    # Frontend unit and E2E tests
+pnpm run test:backend     # Backend unit and integration tests
 
 # Code Quality
 pnpm run lint             # Lint all code
-pnpm run format           # Format all code
+pnpm run type-check       # TypeScript type checking
+
+# Setup and Maintenance
+pnpm run install:all      # Install all dependencies
+./shared/scripts/dev/setup-dev.sh    # Full development setup
+./shared/scripts/dev/start-all.sh    # Start all services
 ```
 
-### Backend Commands
+### Backend Development
 
 ```bash
 cd backend
 
-# Django management
+# Django management commands
 uv run manage.py migrate
+uv run manage.py makemigrations
 uv run manage.py createsuperuser
 uv run manage.py collectstatic
 
-# Testing
+# Testing and quality
 uv run manage.py test
+uv run black .           # Format code
+uv run flake8 .          # Lint code
+uv run isort .           # Sort imports
+```
+
+### Frontend Development
+
+```bash
+cd frontend
+
+# Vue.js development
+pnpm run dev            # Start dev server
+pnpm run build          # Production build
+pnpm run preview        # Preview production build
+pnpm run test:unit      # Vitest unit tests
+pnpm run test:e2e       # Playwright E2E tests
+pnpm run lint           # ESLint
+pnpm run type-check     # TypeScript checking
 ```
 
 ## 🔧 Configuration
 
 ### Environment Variables
 
-Create `.env` files for local development:
-
+#### Root `.env`
 ```bash
-# Root .env (shared settings)
+# Database
 DATABASE_URL=postgresql://user:pass@localhost/thrillwiki
 REDIS_URL=redis://localhost:6379
-SECRET_KEY=your-secret-key
 
-# Backend .env
-DJANGO_SETTINGS_MODULE=config.django.local
+# Security
+SECRET_KEY=your-secret-key
 DEBUG=True
 
-# Frontend .env
-VITE_API_BASE_URL=http://localhost:8000/api
+# API Configuration
+API_BASE_URL=http://localhost:8000/api
 ```
 
+#### Backend `.env`
+```bash
+# Django Settings
+DJANGO_SETTINGS_MODULE=config.django.local
+DEBUG=True
+ALLOWED_HOSTS=localhost,127.0.0.1
+
+# Database
+DATABASE_URL=postgresql://user:pass@localhost/thrillwiki
+
+# Redis
+REDIS_URL=redis://localhost:6379
+
+# Email (optional)
+EMAIL_HOST=smtp.gmail.com
+EMAIL_PORT=587
+EMAIL_USE_TLS=True
+```
+
+#### Frontend `.env.local`
+```bash
+# API Configuration
+VITE_API_BASE_URL=http://localhost:8000/api
+
+# Development
+VITE_APP_TITLE=ThrillWiki (Development)
+
+# Feature Flags
+VITE_ENABLE_DEBUG=true
+```
+
+## 📊 Key Features
+
+### Backend Features
+- **Comprehensive Park Database** - Detailed information about theme parks worldwide
+- **Extensive Ride Database** - Complete roller coaster and ride information
+- **User Management** - Authentication, profiles, and permissions
+- **Content Moderation** - Review and approval workflows
+- **API Documentation** - Auto-generated OpenAPI/Swagger docs
+- **Background Tasks** - Celery integration for long-running processes
+- **Caching Strategy** - Redis-based caching for performance
+- **Search Functionality** - Full-text search across all content
+
+### Frontend Features
+- **Responsive Design** - Mobile-first approach with Tailwind CSS
+- **Dark Mode Support** - Complete dark/light theme system
+- **Real-time Search** - Instant search with debouncing and highlighting
+- **Interactive Maps** - Park and ride location visualization
+- **Photo Galleries** - High-quality image management
+- **User Dashboard** - Personalized content and contributions
+- **Progressive Web App** - PWA capabilities for mobile experience
+- **Accessibility** - WCAG 2.1 AA compliance
+
 ## 📖 Documentation
 
-- [Backend Documentation](./backend/README.md)
-- [Frontend Documentation](./frontend/README.md)
-- [Deployment Guide](./shared/docs/deployment/)
-- [API Documentation](./shared/docs/api/)
+### Core Documentation
+- **[Backend Documentation](./backend/README.md)** - Django setup and API details
+- **[Frontend Documentation](./frontend/README.md)** - Vue.js setup and development
+- **[API Documentation](./shared/docs/api/README.md)** - Complete API reference
+- **[Development Workflow](./shared/docs/development/workflow.md)** - Daily development processes
+
+### Architecture & Deployment
+- **[Architecture Overview](./architecture/)** - System design and decisions
+- **[Deployment Guide](./shared/docs/deployment/)** - Production deployment instructions
+- **[Development Scripts](./shared/scripts/)** - Automation and tooling
+
+### Additional Resources
+- **[Contributing Guide](./CONTRIBUTING.md)** - How to contribute to the project
+- **[Code of Conduct](./CODE_OF_CONDUCT.md)** - Community guidelines
+- **[Security Policy](./SECURITY.md)** - Security reporting and policies
 
 ## 🚀 Deployment
 
-See [Deployment Guide](./shared/docs/deployment/) for production setup instructions.
+### Development Environment
+```bash
+# Quick start with all services
+./shared/scripts/dev/start-all.sh
+
+# Full development setup
+./shared/scripts/dev/setup-dev.sh
+```
+
+### Production Deployment
+```bash
+# Build all components
+./shared/scripts/build/build-all.sh
+
+# Deploy to production
+./shared/scripts/deploy/deploy.sh
+```
+
+See [Deployment Guide](./shared/docs/deployment/) for detailed production setup instructions.
+
+## 🧪 Testing Strategy
+
+### Backend Testing
+- **Unit Tests** - Individual function and method testing
+- **Integration Tests** - API endpoint and database interaction testing
+- **E2E Tests** - Full user journey testing with Selenium
+
+### Frontend Testing
+- **Unit Tests** - Component and utility function testing with Vitest
+- **Integration Tests** - Component interaction testing
+- **E2E Tests** - User journey testing with Playwright
+
+### Code Quality
+- **Linting** - ESLint for JavaScript/TypeScript, Flake8 for Python
+- **Type Checking** - TypeScript for frontend, mypy for Python
+- **Code Formatting** - Prettier for frontend, Black for Python
 
 ## 🤝 Contributing
 
-1. Fork the repository
-2. Create a feature branch
-3. Make your changes
-4. Run tests and linting
-5. Submit a pull request
+We welcome contributions! Please see our [Contributing Guide](./CONTRIBUTING.md) for details on:
+
+1. **Development Setup** - Getting your development environment ready
+2. **Code Standards** - Coding conventions and best practices
+3. **Pull Request Process** - How to submit your changes
+4. **Issue Reporting** - How to report bugs and request features
+
+### Quick Contribution Start
+```bash
+# Fork and clone the repository
+git clone https://github.com/your-username/thrillwiki-monorepo.git
+cd thrillwiki-monorepo
+
+# Set up development environment
+./shared/scripts/dev/setup-dev.sh
+
+# Create a feature branch
+git checkout -b feature/your-feature-name
+
+# Make your changes and test
+pnpm run test
+
+# Submit a pull request
+```
 
 ## 📄 License
 
-This project is licensed under the MIT License.
+This project is licensed under the MIT License - see the [LICENSE](./LICENSE) file for details.
+
+## 🙏 Acknowledgments
+
+- **Theme Park Community** - For providing data and inspiration
+- **Open Source Contributors** - For the amazing tools and libraries
+- **Vue.js and Django Communities** - For excellent documentation and support
+
+## 📞 Support
+
+- **Issues** - [GitHub Issues](https://github.com/your-repo/thrillwiki-monorepo/issues)
+- **Discussions** - [GitHub Discussions](https://github.com/your-repo/thrillwiki-monorepo/discussions)
+- **Documentation** - [Project Wiki](https://github.com/your-repo/thrillwiki-monorepo/wiki)
+
+---
+
+**Built with ❤️ for the theme park and roller coaster community**

README_HYBRID_ENDPOINTS.md

@@ -0,0 +1,180 @@
+# ThrillWiki Hybrid Filtering Endpoints Test Suite
+
+This repository contains a comprehensive test script for the newly synchronized Parks and Rides hybrid filtering endpoints.
+
+## Quick Start
+
+1. **Start the Django server:**
+   ```bash
+   cd backend && uv run manage.py runserver 8000
+   ```
+
+2. **Run the test script:**
+   ```bash
+   ./test_hybrid_endpoints.sh
+   ```
+
+   Or with a custom base URL:
+   ```bash
+   ./test_hybrid_endpoints.sh http://localhost:8000
+   ```
+
+## What Gets Tested
+
+### Parks Hybrid Filtering (`/api/v1/parks/hybrid/`)
+- ✅ Basic hybrid filtering (automatic strategy selection)
+- ✅ Search functionality (`?search=disney`)
+- ✅ Status filtering (`?status=OPERATING,CLOSED_TEMP`)
+- ✅ Geographic filtering (`?country=United%20States&state=Florida,California`)
+- ✅ Numeric range filtering (`?opening_year_min=1990&rating_min=4.0`)
+- ✅ Park statistics filtering (`?size_min=100&ride_count_min=10`)
+- ✅ Operator filtering (`?operator=disney,universal`)
+- ✅ Progressive loading (`?offset=50`)
+- ✅ Filter metadata (`/filter-metadata/`)
+- ✅ Scoped metadata (`/filter-metadata/?scoped=true&country=United%20States`)
+
+### Rides Hybrid Filtering (`/api/v1/rides/hybrid/`)
+- ✅ Basic hybrid filtering (automatic strategy selection)
+- ✅ Search functionality (`?search=coaster`)
+- ✅ Category filtering (`?category=RC,DR`)
+- ✅ Status and park filtering (`?status=OPERATING&park_slug=cedar-point`)
+- ✅ Manufacturer/designer filtering (`?manufacturer=bolliger-mabillard`)
+- ✅ Roller coaster specific filtering (`?roller_coaster_type=INVERTED&has_inversions=true`)
+- ✅ Performance filtering (`?height_ft_min=200&speed_mph_min=70`)
+- ✅ Quality metrics (`?rating_min=4.5&capacity_min=1000`)
+- ✅ Accessibility filtering (`?height_requirement_min=48&height_requirement_max=54`)
+- ✅ Progressive loading (`?offset=25&category=RC`)
+- ✅ Filter metadata (`/filter-metadata/`)
+- ✅ Scoped metadata (`/filter-metadata/?scoped=true&category=RC`)
+
+### Advanced Testing
+- ✅ Complex combination queries
+- ✅ Edge cases (empty results, invalid parameters)
+- ✅ Performance timing comparisons
+- ✅ Error handling validation
+
+## Key Features Demonstrated
+
+### 🔄 Automatic Strategy Selection
+- **≤200 records**: Client-side filtering (loads all data for frontend filtering)
+- **>200 records**: Server-side filtering (database filtering with pagination)
+
+### 📊 Progressive Loading
+- Initial load: 50 records
+- Progressive batches: 25 records
+- Seamless pagination for large datasets
+
+### 🔍 Comprehensive Filtering
+- **Parks**: 17+ filter parameters including geographic, temporal, and statistical filters
+- **Rides**: 17+ filter parameters including roller coaster specs, performance metrics, and accessibility
+
+### 📋 Dynamic Filter Metadata
+- Real-time filter options based on current data
+- Scoped metadata for contextual filtering
+- Ranges and categorical options automatically generated
+
+### ⚡ Performance Optimized
+- 5-minute intelligent caching
+- Strategic database indexing
+- Optimized queries with prefetch_related
+
+## Response Format
+
+Both endpoints return consistent response structures:
+
+```json
+{
+  "parks": [...],           // or "rides": [...]
+  "total_count": 123,
+  "strategy": "client_side", // or "server_side"
+  "has_more": false,
+  "next_offset": null,
+  "filter_metadata": {
+    "categorical": {
+      "countries": ["United States", "Canada", ...],
+      "categories": ["RC", "DR", "FR", ...],
+      // ... more options
+    },
+    "ranges": {
+      "opening_year": {"min": 1800, "max": 2025},
+      "rating": {"min": 1.0, "max": 10.0},
+      // ... more ranges
+    }
+  }
+}
+```
+
+## Dependencies
+
+- **curl**: Required for making HTTP requests
+- **jq**: Optional but recommended for pretty JSON formatting
+
+## Example Usage
+
+### Basic Parks Query
+```bash
+curl "http://localhost:8000/api/v1/parks/hybrid/"
+```
+
+### Search for Disney Parks
+```bash
+curl "http://localhost:8000/api/v1/parks/hybrid/?search=disney"
+```
+
+### Filter Roller Coasters with Inversions
+```bash
+curl "http://localhost:8000/api/v1/rides/hybrid/?category=RC&has_inversions=true&height_ft_min=100"
+```
+
+### Get Filter Metadata
+```bash
+curl "http://localhost:8000/api/v1/parks/hybrid/filter-metadata/"
+```
+
+## Integration Guide
+
+### Frontend Integration
+1. Use filter metadata to build dynamic filter interfaces
+2. Implement progressive loading for better UX
+3. Handle both client-side and server-side strategies
+4. Cache filter metadata to reduce API calls
+
+### Performance Considerations
+- Monitor response times and adjust thresholds as needed
+- Use progressive loading for datasets >200 records
+- Implement proper error handling for edge cases
+- Consider implementing request debouncing for search
+
+## Troubleshooting
+
+### Server Not Running
+```
+❌ Server not available at http://localhost:8000
+💡 Make sure to start the Django server first:
+   cd backend && uv run manage.py runserver 8000
+```
+
+### Missing jq
+```
+⚠️  jq not found - JSON responses will not be pretty-printed
+```
+Install jq for better output formatting:
+```bash
+# macOS
+brew install jq
+
+# Ubuntu/Debian
+sudo apt-get install jq
+```
+
+## Next Steps
+
+1. **Integrate into Frontend**: Use these endpoints in your React/Next.js application
+2. **Build Filter UI**: Create dynamic filter interfaces using the metadata
+3. **Implement Progressive Loading**: Handle large datasets efficiently
+4. **Monitor Performance**: Track response times and optimize as needed
+5. **Add Caching**: Implement client-side caching for better UX
+
+---
+
+🎢 **Happy filtering!** These endpoints provide a powerful, scalable foundation for building advanced search and filtering experiences in your theme park application.

THRILLWIKI_API_DOCUMENTATION.md

@@ -0,0 +1,470 @@
+# ThrillWiki API Documentation v1
+## Complete Frontend Developer Reference
+
+**Base URL**: `/api/v1/`  
+**Authentication**: JWT Bearer tokens  
+**Content-Type**: `application/json`
+
+---
+
+## 🔐 Authentication Endpoints (`/api/v1/auth/`)
+
+### Core Authentication
+- **POST** `/auth/login/` - User login with username/email and password
+- **POST** `/auth/signup/` - User registration (email verification required)
+- **POST** `/auth/logout/` - Logout current user (blacklist refresh token)
+- **GET** `/auth/user/` - Get current authenticated user information
+- **POST** `/auth/status/` - Check authentication status
+
+### Password Management
+- **POST** `/auth/password/reset/` - Request password reset email
+- **POST** `/auth/password/change/` - Change current user's password
+
+### Email Verification
+- **GET** `/auth/verify-email/<token>/` - Verify email with token
+- **POST** `/auth/resend-verification/` - Resend email verification
+
+### Social Authentication
+- **GET** `/auth/social/providers/` - Get available social auth providers
+- **GET** `/auth/social/providers/available/` - Get available social providers list
+- **GET** `/auth/social/connected/` - Get user's connected social providers
+- **POST** `/auth/social/connect/<provider>/` - Connect social provider (Google, Discord)
+- **POST** `/auth/social/disconnect/<provider>/` - Disconnect social provider
+- **GET** `/auth/social/status/` - Get comprehensive social auth status
+- **POST** `/auth/social/` - Social auth endpoints (dj-rest-auth)
+
+### JWT Token Management
+- **POST** `/auth/token/refresh/` - Refresh JWT access token
+
+---
+
+## 🏞️ Parks API Endpoints (`/api/v1/parks/`)
+
+### Core CRUD Operations
+- **GET** `/parks/` - List parks with comprehensive filtering and pagination
+- **POST** `/parks/` - Create new park (authenticated users)
+- **GET** `/parks/<pk>/` - Get park details (supports ID or slug)
+- **PATCH** `/parks/<pk>/` - Update park (partial update)
+- **PUT** `/parks/<pk>/` - Update park (full update)
+- **DELETE** `/parks/<pk>/` - Delete park
+
+### Filtering & Search
+- **GET** `/parks/filter-options/` - Get available filter options
+- **GET** `/parks/search/companies/?q=<query>` - Search companies/operators
+- **GET** `/parks/search-suggestions/?q=<query>` - Get park search suggestions
+- **GET** `/parks/hybrid/` - Hybrid park filtering with advanced options
+- **GET** `/parks/hybrid/filter-metadata/` - Get filter metadata for hybrid filtering
+
+### Park Photos Management
+- **GET** `/parks/<park_pk>/photos/` - List park photos
+- **POST** `/parks/<park_pk>/photos/` - Upload park photo
+- **GET** `/parks/<park_pk>/photos/<id>/` - Get park photo details
+- **PATCH** `/parks/<park_pk>/photos/<id>/` - Update park photo
+- **DELETE** `/parks/<park_pk>/photos/<id>/` - Delete park photo
+- **POST** `/parks/<park_pk>/photos/<id>/set_primary/` - Set photo as primary
+- **POST** `/parks/<park_pk>/photos/bulk_approve/` - Bulk approve/reject photos (admin)
+- **GET** `/parks/<park_pk>/photos/stats/` - Get park photo statistics
+
+### Park Settings
+- **GET** `/parks/<pk>/image-settings/` - Get park image settings
+- **POST** `/parks/<pk>/image-settings/` - Update park image settings
+
+#### Park Filtering Parameters (24 total):
+- **Pagination**: `page`, `page_size`
+- **Search**: `search`
+- **Location**: `continent`, `country`, `state`, `city`
+- **Attributes**: `park_type`, `status`
+- **Companies**: `operator_id`, `operator_slug`, `property_owner_id`, `property_owner_slug`
+- **Ratings**: `min_rating`, `max_rating`
+- **Ride Counts**: `min_ride_count`, `max_ride_count`
+- **Opening Year**: `opening_year`, `min_opening_year`, `max_opening_year`
+- **Roller Coasters**: `has_roller_coasters`, `min_roller_coaster_count`, `max_roller_coaster_count`
+- **Ordering**: `ordering`
+
+---
+
+## 🎢 Rides API Endpoints (`/api/v1/rides/`)
+
+### Core CRUD Operations
+- **GET** `/rides/` - List rides with comprehensive filtering
+- **POST** `/rides/` - Create new ride
+- **GET** `/rides/<pk>/` - Get ride details
+- **PATCH** `/rides/<pk>/` - Update ride (partial)
+- **PUT** `/rides/<pk>/` - Update ride (full)
+- **DELETE** `/rides/<pk>/` - Delete ride
+
+### Filtering & Search
+- **GET** `/rides/filter-options/` - Get available filter options
+- **GET** `/rides/search/companies/?q=<query>` - Search ride companies
+- **GET** `/rides/search/ride-models/?q=<query>` - Search ride models
+- **GET** `/rides/search-suggestions/?q=<query>` - Get ride search suggestions
+- **GET** `/rides/hybrid/` - Hybrid ride filtering
+- **GET** `/rides/hybrid/filter-metadata/` - Get ride filter metadata
+
+### Ride Photos Management
+- **GET** `/rides/<ride_pk>/photos/` - List ride photos
+- **POST** `/rides/<ride_pk>/photos/` - Upload ride photo
+- **GET** `/rides/<ride_pk>/photos/<id>/` - Get ride photo details
+- **PATCH** `/rides/<ride_pk>/photos/<id>/` - Update ride photo
+- **DELETE** `/rides/<ride_pk>/photos/<id>/` - Delete ride photo
+- **POST** `/rides/<ride_pk>/photos/<id>/set_primary/` - Set photo as primary
+
+### Ride Manufacturers
+- **GET** `/rides/manufacturers/<manufacturer_slug>/` - Manufacturer-specific endpoints
+
+### Ride Settings
+- **GET** `/rides/<pk>/image-settings/` - Get ride image settings
+- **POST** `/rides/<pk>/image-settings/` - Update ride image settings
+
+---
+
+## 👤 User Accounts API (`/api/v1/accounts/`)
+
+### User Management (Admin)
+- **DELETE** `/accounts/users/<user_id>/delete/` - Delete user while preserving submissions
+- **GET** `/accounts/users/<user_id>/deletion-check/` - Check user deletion eligibility
+
+### Self-Service Account Management
+- **POST** `/accounts/delete-account/request/` - Request account deletion
+- **POST** `/accounts/delete-account/verify/` - Verify account deletion
+- **POST** `/accounts/delete-account/cancel/` - Cancel account deletion
+
+### User Profile Management
+- **GET** `/accounts/profile/` - Get user profile
+- **PATCH** `/accounts/profile/account/` - Update user account info
+- **PATCH** `/accounts/profile/update/` - Update user profile
+
+### User Preferences
+- **GET** `/accounts/preferences/` - Get user preferences
+- **PATCH** `/accounts/preferences/update/` - Update user preferences
+- **PATCH** `/accounts/preferences/theme/` - Update theme preference
+
+### Settings Management
+- **GET** `/accounts/settings/notifications/` - Get notification settings
+- **PATCH** `/accounts/settings/notifications/update/` - Update notification settings
+- **GET** `/accounts/settings/privacy/` - Get privacy settings
+- **PATCH** `/accounts/settings/privacy/update/` - Update privacy settings
+- **GET** `/accounts/settings/security/` - Get security settings
+- **PATCH** `/accounts/settings/security/update/` - Update security settings
+
+### User Statistics & Lists
+- **GET** `/accounts/statistics/` - Get user statistics
+- **GET** `/accounts/top-lists/` - Get user's top lists
+- **POST** `/accounts/top-lists/create/` - Create new top list
+- **PATCH** `/accounts/top-lists/<list_id>/` - Update top list
+- **DELETE** `/accounts/top-lists/<list_id>/delete/` - Delete top list
+
+### Notifications
+- **GET** `/accounts/notifications/` - Get user notifications
+- **POST** `/accounts/notifications/mark-read/` - Mark notifications as read
+- **GET** `/accounts/notification-preferences/` - Get notification preferences
+- **PATCH** `/accounts/notification-preferences/update/` - Update notification preferences
+
+### Avatar Management
+- **POST** `/accounts/profile/avatar/upload/` - Upload avatar
+- **POST** `/accounts/profile/avatar/save/` - Save avatar image
+- **DELETE** `/accounts/profile/avatar/delete/` - Delete avatar
+
+---
+
+## 🗺️ Maps API (`/api/v1/maps/`)
+
+### Location Data
+- **GET** `/maps/locations/` - Get map locations data
+- **GET** `/maps/locations/<location_type>/<location_id>/` - Get location details
+- **GET** `/maps/search/` - Search locations on map
+- **GET** `/maps/bounds/` - Query locations within bounds
+
+### Map Services
+- **GET** `/maps/stats/` - Get map service statistics
+- **GET** `/maps/cache/` - Get map cache information
+- **POST** `/maps/cache/invalidate/` - Invalidate map cache
+
+---
+
+## 🔍 Core Search API (`/api/v1/core/`)
+
+### Entity Search
+- **GET** `/core/entities/search/` - Fuzzy search for entities
+- **GET** `/core/entities/not-found/` - Handle entity not found
+- **GET** `/core/entities/suggestions/` - Quick entity suggestions
+
+---
+
+## 📧 Email API (`/api/v1/email/`)
+
+### Email Services
+- **POST** `/email/send/` - Send email
+
+---
+
+## 📜 History API (`/api/v1/history/`)
+
+### Park History
+- **GET** `/history/parks/<park_slug>/` - Get park history
+- **GET** `/history/parks/<park_slug>/detail/` - Get detailed park history
+
+### Ride History
+- **GET** `/history/parks/<park_slug>/rides/<ride_slug>/` - Get ride history
+- **GET** `/history/parks/<park_slug>/rides/<ride_slug>/detail/` - Get detailed ride history
+
+### Unified Timeline
+- **GET** `/history/timeline/` - Get unified history timeline
+
+---
+
+## 📈 System & Analytics APIs
+
+### Health Checks
+- **GET** `/api/v1/health/` - Comprehensive health check
+- **GET** `/api/v1/health/simple/` - Simple health check
+- **GET** `/api/v1/health/performance/` - Performance metrics
+
+### Trending & Discovery
+- **GET** `/api/v1/trending/` - Get trending content
+- **GET** `/api/v1/new-content/` - Get new content
+- **POST** `/api/v1/trending/calculate/` - Trigger trending calculation
+
+### Statistics
+- **GET** `/api/v1/stats/` - Get system statistics
+- **POST** `/api/v1/stats/recalculate/` - Recalculate statistics
+
+### Reviews
+- **GET** `/api/v1/reviews/latest/` - Get latest reviews
+
+### Rankings
+- **GET** `/api/v1/rankings/` - Get ride rankings with filtering
+- **GET** `/api/v1/rankings/<ride_slug>/` - Get detailed ranking for specific ride
+- **GET** `/api/v1/rankings/<ride_slug>/history/` - Get ranking history for ride
+- **GET** `/api/v1/rankings/<ride_slug>/comparisons/` - Get head-to-head comparisons
+- **GET** `/api/v1/rankings/statistics/` - Get ranking system statistics
+- **POST** `/api/v1/rankings/calculate/` - Trigger ranking calculation (admin)
+
+#### Rankings Filtering Parameters:
+- **category**: Filter by ride category (RC, DR, FR, WR, TR, OT)
+- **min_riders**: Minimum number of mutual riders required
+- **park**: Filter by park slug
+- **ordering**: Order results (rank, -rank, winning_percentage, -winning_percentage)
+
+---
+
+## 🛡️ Moderation API (`/api/v1/moderation/`)
+
+### Moderation Reports
+- **GET** `/moderation/reports/` - List all moderation reports
+- **POST** `/moderation/reports/` - Create new moderation report
+- **GET** `/moderation/reports/<id>/` - Get specific report details
+- **PUT** `/moderation/reports/<id>/` - Update moderation report
+- **PATCH** `/moderation/reports/<id>/` - Partial update report
+- **DELETE** `/moderation/reports/<id>/` - Delete moderation report
+- **POST** `/moderation/reports/<id>/assign/` - Assign report to moderator
+- **POST** `/moderation/reports/<id>/resolve/` - Resolve moderation report
+- **GET** `/moderation/reports/stats/` - Get report statistics
+
+### Moderation Queue
+- **GET** `/moderation/queue/` - List moderation queue items
+- **POST** `/moderation/queue/` - Create queue item
+- **GET** `/moderation/queue/<id>/` - Get specific queue item
+- **PUT** `/moderation/queue/<id>/` - Update queue item
+- **PATCH** `/moderation/queue/<id>/` - Partial update queue item
+- **DELETE** `/moderation/queue/<id>/` - Delete queue item
+- **POST** `/moderation/queue/<id>/assign/` - Assign queue item to moderator
+- **POST** `/moderation/queue/<id>/unassign/` - Unassign queue item
+- **POST** `/moderation/queue/<id>/complete/` - Complete queue item
+- **GET** `/moderation/queue/my_queue/` - Get current user's queue items
+
+### Moderation Actions
+- **GET** `/moderation/actions/` - List all moderation actions
+- **POST** `/moderation/actions/` - Create new moderation action
+- **GET** `/moderation/actions/<id>/` - Get specific action details
+- **PUT** `/moderation/actions/<id>/` - Update moderation action
+- **PATCH** `/moderation/actions/<id>/` - Partial update action
+- **DELETE** `/moderation/actions/<id>/` - Delete moderation action
+- **POST** `/moderation/actions/<id>/deactivate/` - Deactivate action
+- **GET** `/moderation/actions/active/` - Get active moderation actions
+- **GET** `/moderation/actions/expired/` - Get expired moderation actions
+
+### Bulk Operations
+- **GET** `/moderation/bulk-operations/` - List bulk moderation operations
+- **POST** `/moderation/bulk-operations/` - Create bulk operation
+- **GET** `/moderation/bulk-operations/<id>/` - Get bulk operation details
+- **PUT** `/moderation/bulk-operations/<id>/` - Update bulk operation
+- **PATCH** `/moderation/bulk-operations/<id>/` - Partial update operation
+- **DELETE** `/moderation/bulk-operations/<id>/` - Delete bulk operation
+- **POST** `/moderation/bulk-operations/<id>/cancel/` - Cancel bulk operation
+- **POST** `/moderation/bulk-operations/<id>/retry/` - Retry failed operation
+- **GET** `/moderation/bulk-operations/<id>/logs/` - Get operation logs
+- **GET** `/moderation/bulk-operations/running/` - Get running operations
+
+### User Moderation
+- **GET** `/moderation/users/<id>/` - Get user moderation profile
+- **POST** `/moderation/users/<id>/moderate/` - Take moderation action against user
+- **GET** `/moderation/users/search/` - Search users for moderation
+- **GET** `/moderation/users/stats/` - Get user moderation statistics
+
+---
+
+## 🏗️ Ride Manufacturers & Models (`/api/v1/rides/manufacturers/<manufacturer_slug>/`)
+
+### Ride Models
+- **GET** `/rides/manufacturers/<manufacturer_slug>/` - List ride models by manufacturer
+- **POST** `/rides/manufacturers/<manufacturer_slug>/` - Create new ride model
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/` - Get ride model details
+- **PATCH** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/` - Update ride model
+- **DELETE** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/` - Delete ride model
+
+### Model Search & Filtering
+- **GET** `/rides/manufacturers/<manufacturer_slug>/search/` - Search ride models
+- **GET** `/rides/manufacturers/<manufacturer_slug>/filter-options/` - Get filter options
+- **GET** `/rides/manufacturers/<manufacturer_slug>/stats/` - Get manufacturer statistics
+
+### Model Variants
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/variants/` - List model variants
+- **POST** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/variants/` - Create variant
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/variants/<id>/` - Get variant details
+- **PATCH** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/variants/<id>/` - Update variant
+- **DELETE** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/variants/<id>/` - Delete variant
+
+### Technical Specifications
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/technical-specs/` - List technical specs
+- **POST** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/technical-specs/` - Create technical spec
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/technical-specs/<id>/` - Get spec details
+- **PATCH** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/technical-specs/<id>/` - Update spec
+- **DELETE** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/technical-specs/<id>/` - Delete spec
+
+### Model Photos
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/photos/` - List model photos
+- **POST** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/photos/` - Upload model photo
+- **GET** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/photos/<id>/` - Get photo details
+- **PATCH** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/photos/<id>/` - Update photo
+- **DELETE** `/rides/manufacturers/<manufacturer_slug>/<ride_model_slug>/photos/<id>/` - Delete photo
+
+---
+
+## 🖼️ Media Management
+
+### Cloudflare Images
+- **ALL** `/api/v1/cloudflare-images/` - Cloudflare Images toolkit endpoints
+
+---
+
+## 📚 API Documentation
+
+### Interactive Documentation
+- **GET** `/api/schema/` - OpenAPI schema
+- **GET** `/api/docs/` - Swagger UI documentation
+- **GET** `/api/redoc/` - ReDoc documentation
+
+---
+
+## 🔧 Common Request/Response Patterns
+
+### Authentication Headers
+```javascript
+headers: {
+  'Authorization': 'Bearer <access_token>',
+  'Content-Type': 'application/json'
+}
+```
+
+### Pagination Response
+```json
+{
+  "count": 100,
+  "next": "http://api.example.com/api/v1/endpoint/?page=2",
+  "previous": null,
+  "results": [...]
+}
+```
+
+### Error Response Format
+```json
+{
+  "error": "Error message",
+  "error_code": "SPECIFIC_ERROR_CODE",
+  "details": {...},
+  "suggestions": ["suggestion1", "suggestion2"]
+}
+```
+
+### Success Response Format
+```json
+{
+  "success": true,
+  "message": "Operation completed successfully",
+  "data": {...}
+}
+```
+
+---
+
+## 📝 Key Data Models
+
+### User
+- `id`, `username`, `email`, `display_name`, `date_joined`, `is_active`, `avatar_url`
+
+### Park
+- `id`, `name`, `slug`, `description`, `location`, `operator`, `park_type`, `status`, `opening_year`
+
+### Ride
+- `id`, `name`, `slug`, `park`, `category`, `manufacturer`, `model`, `opening_year`, `status`
+
+### Photo (Park/Ride)
+- `id`, `image`, `caption`, `photo_type`, `uploaded_by`, `is_primary`, `is_approved`, `created_at`
+
+### Review
+- `id`, `user`, `content_object`, `rating`, `title`, `content`, `created_at`, `updated_at`
+
+---
+
+## 🚨 Important Notes
+
+1. **Authentication Required**: Most endpoints require JWT authentication
+2. **Permissions**: Admin endpoints require staff/superuser privileges  
+3. **Rate Limiting**: May be implemented on certain endpoints
+4. **File Uploads**: Use `multipart/form-data` for photo uploads
+5. **Pagination**: Most list endpoints support pagination with `page` and `page_size` parameters
+6. **Filtering**: Parks and rides support extensive filtering options
+7. **Cloudflare Images**: Media files are handled through Cloudflare Images service
+8. **Email Verification**: New users must verify email before full access
+
+---
+
+## 📖 Usage Examples
+
+### Authentication Flow
+```javascript
+// Login
+const login = await fetch('/api/v1/auth/login/', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ username: 'user@example.com', password: 'password' })
+});
+
+// Use tokens from response
+const { access, refresh } = await login.json();
+```
+
+### Fetch Parks with Filtering
+```javascript
+const parks = await fetch('/api/v1/parks/?continent=NA&min_rating=4.0&page=1', {
+  headers: { 'Authorization': `Bearer ${access_token}` }
+});
+```
+
+### Upload Park Photo
+```javascript
+const formData = new FormData();
+formData.append('image', file);
+formData.append('caption', 'Beautiful park entrance');
+
+const photo = await fetch('/api/v1/parks/123/photos/', {
+  method: 'POST',
+  headers: { 'Authorization': `Bearer ${access_token}` },
+  body: formData
+});
+```
+
+---
+
+This documentation covers all available API endpoints in the ThrillWiki v1 API. For detailed request/response schemas, parameter validation, and interactive testing, visit `/api/docs/` when the development server is running.

api_endpoints_curl_commands.sh

@@ -0,0 +1,649 @@
+#!/bin/bash
+
+# ThrillWiki API Endpoints - Complete Curl Commands
+# Generated from comprehensive URL analysis
+# Base URL - adjust as needed for your environment
+BASE_URL="http://localhost:8000"
+
+# Command line options
+SKIP_AUTH=false
+ONLY_AUTH=false
+SKIP_DOCS=false
+HELP=false
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --skip-auth)
+      SKIP_AUTH=true
+      shift
+      ;;
+    --only-auth)
+      ONLY_AUTH=true
+      shift
+      ;;
+    --skip-docs)
+      SKIP_DOCS=true
+      shift
+      ;;
+    --base-url)
+      BASE_URL="$2"
+      shift 2
+      ;;
+    --help|-h)
+      HELP=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1"
+      echo "Use --help for usage information"
+      exit 1
+      ;;
+  esac
+done
+
+# Show help
+if [ "$HELP" = true ]; then
+  echo "ThrillWiki API Endpoints Test Suite"
+  echo ""
+  echo "Usage: $0 [OPTIONS]"
+  echo ""
+  echo "Options:"
+  echo "  --skip-auth     Skip endpoints that require authentication"
+  echo "  --only-auth     Only test endpoints that require authentication"
+  echo "  --skip-docs     Skip API documentation endpoints (schema, swagger, redoc)"
+  echo "  --base-url URL  Set custom base URL (default: http://localhost:8000)"
+  echo "  --help, -h      Show this help message"
+  echo ""
+  echo "Examples:"
+  echo "  $0                           # Test all endpoints"
+  echo "  $0 --skip-auth               # Test only public endpoints"
+  echo "  $0 --only-auth               # Test only authenticated endpoints"
+  echo "  $0 --skip-docs --skip-auth   # Test only public non-documentation endpoints"
+  echo "  $0 --base-url https://api.example.com  # Use custom base URL"
+  exit 0
+fi
+
+# Validate conflicting options
+if [ "$SKIP_AUTH" = true ] && [ "$ONLY_AUTH" = true ]; then
+  echo "Error: --skip-auth and --only-auth cannot be used together"
+  exit 1
+fi
+
+echo "=== ThrillWiki API Endpoints Test Suite ==="
+echo "Base URL: $BASE_URL"
+if [ "$SKIP_AUTH" = true ]; then
+  echo "Mode: Public endpoints only (skipping authentication required)"
+elif [ "$ONLY_AUTH" = true ]; then
+  echo "Mode: Authenticated endpoints only"
+else
+  echo "Mode: All endpoints"
+fi
+if [ "$SKIP_DOCS" = true ]; then
+  echo "Skipping: API documentation endpoints"
+fi
+echo ""
+
+# Helper function to check if we should run an endpoint
+should_run_endpoint() {
+  local requires_auth=$1
+  local is_docs=$2
+  
+  # Skip docs if requested
+  if [ "$SKIP_DOCS" = true ] && [ "$is_docs" = true ]; then
+    return 1
+  fi
+  
+  # Skip auth endpoints if requested
+  if [ "$SKIP_AUTH" = true ] && [ "$requires_auth" = true ]; then
+    return 1
+  fi
+  
+  # Only run auth endpoints if requested
+  if [ "$ONLY_AUTH" = true ] && [ "$requires_auth" = false ]; then
+    return 1
+  fi
+  
+  return 0
+}
+
+# Counter for endpoint numbering
+ENDPOINT_NUM=1
+
+# ============================================================================
+# AUTHENTICATION ENDPOINTS (/api/v1/auth/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo "=== AUTHENTICATION ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. Login"
+  curl -X POST "$BASE_URL/api/v1/auth/login/" \
+    -H "Content-Type: application/json" \
+    -d '{"username": "testuser", "password": "testpass"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Signup"
+  curl -X POST "$BASE_URL/api/v1/auth/signup/" \
+    -H "Content-Type: application/json" \
+    -d '{"username": "newuser", "email": "test@example.com", "password": "newpass123"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Logout"
+  curl -X POST "$BASE_URL/api/v1/auth/logout/" \
+    -H "Content-Type: application/json"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Password Reset"
+  curl -X POST "$BASE_URL/api/v1/auth/password/reset/" \
+    -H "Content-Type: application/json" \
+    -d '{"email": "user@example.com"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Social Providers"
+  curl -X GET "$BASE_URL/api/v1/auth/providers/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Auth Status"
+  curl -X GET "$BASE_URL/api/v1/auth/status/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Current User"
+  curl -X GET "$BASE_URL/api/v1/auth/user/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Password Change"
+  curl -X POST "$BASE_URL/api/v1/auth/password/change/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"old_password": "oldpass", "new_password": "newpass123"}'
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# HEALTH CHECK ENDPOINTS (/api/v1/health/)
+# ============================================================================
+if should_run_endpoint false false; then
+  echo -e "\n\n=== HEALTH CHECK ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. Health Check"
+  curl -X GET "$BASE_URL/api/v1/health/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Simple Health"
+  curl -X GET "$BASE_URL/api/v1/health/simple/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Performance Metrics"
+  curl -X GET "$BASE_URL/api/v1/health/performance/"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# TRENDING SYSTEM ENDPOINTS (/api/v1/trending/)
+# ============================================================================
+if should_run_endpoint false false; then
+  echo -e "\n\n=== TRENDING SYSTEM ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. Trending Content"
+  curl -X GET "$BASE_URL/api/v1/trending/content/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. New Content"
+  curl -X GET "$BASE_URL/api/v1/trending/new/"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# STATISTICS ENDPOINTS (/api/v1/stats/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== STATISTICS ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. Statistics"
+  curl -X GET "$BASE_URL/api/v1/stats/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Recalculate Statistics"
+  curl -X POST "$BASE_URL/api/v1/stats/recalculate/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# RANKING SYSTEM ENDPOINTS (/api/v1/rankings/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== RANKING SYSTEM ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. List Rankings"
+  curl -X GET "$BASE_URL/api/v1/rankings/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. List Rankings with Filters"
+  curl -X GET "$BASE_URL/api/v1/rankings/?category=RC&min_riders=10&ordering=rank"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ranking Detail"
+  curl -X GET "$BASE_URL/api/v1/rankings/ride-slug-here/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ranking History"
+  curl -X GET "$BASE_URL/api/v1/rankings/ride-slug-here/history/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ranking Statistics"
+  curl -X GET "$BASE_URL/api/v1/rankings/statistics/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ranking Comparisons"
+  curl -X GET "$BASE_URL/api/v1/rankings/ride-slug-here/comparisons/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Trigger Ranking Calculation"
+  curl -X POST "$BASE_URL/api/v1/rankings/calculate/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"category": "RC"}'
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# PARKS API ENDPOINTS (/api/v1/parks/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== PARKS API ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. List Parks"
+  curl -X GET "$BASE_URL/api/v1/parks/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park Filter Options"
+  curl -X GET "$BASE_URL/api/v1/parks/filter-options/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park Company Search"
+  curl -X GET "$BASE_URL/api/v1/parks/search/companies/?q=disney"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park Search Suggestions"
+  curl -X GET "$BASE_URL/api/v1/parks/search-suggestions/?q=magic"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park Detail"
+  curl -X GET "$BASE_URL/api/v1/parks/1/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. List Park Photos"
+  curl -X GET "$BASE_URL/api/v1/parks/1/photos/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park Photo Detail"
+  curl -X GET "$BASE_URL/api/v1/parks/1/photos/1/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Create Park"
+  curl -X POST "$BASE_URL/api/v1/parks/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "Test Park", "location": "Test City"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Park"
+  curl -X PUT "$BASE_URL/api/v1/parks/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "Updated Park Name"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Park"
+  curl -X DELETE "$BASE_URL/api/v1/parks/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Create Park Photo"
+  curl -X POST "$BASE_URL/api/v1/parks/1/photos/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -F "image=@/path/to/photo.jpg" \
+    -F "caption=Test photo"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Park Photo"
+  curl -X PUT "$BASE_URL/api/v1/parks/1/photos/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"caption": "Updated caption"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Park Photo"
+  curl -X DELETE "$BASE_URL/api/v1/parks/1/photos/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# RIDES API ENDPOINTS (/api/v1/rides/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== RIDES API ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. List Rides"
+  curl -X GET "$BASE_URL/api/v1/rides/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Filter Options"
+  curl -X GET "$BASE_URL/api/v1/rides/filter-options/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Company Search"
+  curl -X GET "$BASE_URL/api/v1/rides/search/companies/?q=intamin"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Model Search"
+  curl -X GET "$BASE_URL/api/v1/rides/search/ride-models/?q=giga"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Search Suggestions"
+  curl -X GET "$BASE_URL/api/v1/rides/search-suggestions/?q=millennium"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Detail"
+  curl -X GET "$BASE_URL/api/v1/rides/1/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. List Ride Photos"
+  curl -X GET "$BASE_URL/api/v1/rides/1/photos/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride Photo Detail"
+  curl -X GET "$BASE_URL/api/v1/rides/1/photos/1/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Create Ride"
+  curl -X POST "$BASE_URL/api/v1/rides/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "Test Coaster", "category": "RC", "park": 1}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Ride"
+  curl -X PUT "$BASE_URL/api/v1/rides/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "Updated Ride Name"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Ride"
+  curl -X DELETE "$BASE_URL/api/v1/rides/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Create Ride Photo"
+  curl -X POST "$BASE_URL/api/v1/rides/1/photos/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -F "image=@/path/to/photo.jpg" \
+    -F "caption=Test ride photo"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Ride Photo"
+  curl -X PUT "$BASE_URL/api/v1/rides/1/photos/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"caption": "Updated ride photo caption"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Ride Photo"
+  curl -X DELETE "$BASE_URL/api/v1/rides/1/photos/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# ACCOUNTS API ENDPOINTS (/api/v1/accounts/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== ACCOUNTS API ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. List User Profiles"
+  curl -X GET "$BASE_URL/api/v1/accounts/profiles/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. User Profile Detail"
+  curl -X GET "$BASE_URL/api/v1/accounts/profiles/1/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. List Top Lists"
+  curl -X GET "$BASE_URL/api/v1/accounts/toplists/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Top List Detail"
+  curl -X GET "$BASE_URL/api/v1/accounts/toplists/1/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. List Top List Items"
+  curl -X GET "$BASE_URL/api/v1/accounts/toplist-items/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Top List Item Detail"
+  curl -X GET "$BASE_URL/api/v1/accounts/toplist-items/1/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Update User Profile"
+  curl -X PUT "$BASE_URL/api/v1/accounts/profiles/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"bio": "Updated bio"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Create Top List"
+  curl -X POST "$BASE_URL/api/v1/accounts/toplists/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "My Top Coasters", "description": "My favorite roller coasters"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Top List"
+  curl -X PUT "$BASE_URL/api/v1/accounts/toplists/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"name": "Updated Top List Name"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Top List"
+  curl -X DELETE "$BASE_URL/api/v1/accounts/toplists/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Create Top List Item"
+  curl -X POST "$BASE_URL/api/v1/accounts/toplist-items/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"toplist": 1, "ride": 1, "position": 1}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Update Top List Item"
+  curl -X PUT "$BASE_URL/api/v1/accounts/toplist-items/1/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"position": 2}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Delete Top List Item"
+  curl -X DELETE "$BASE_URL/api/v1/accounts/toplist-items/1/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# HISTORY API ENDPOINTS (/api/v1/history/)
+# ============================================================================
+if should_run_endpoint false false; then
+  echo -e "\n\n=== HISTORY API ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. Park History List"
+  curl -X GET "$BASE_URL/api/v1/history/parks/park-slug/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Park History Detail"
+  curl -X GET "$BASE_URL/api/v1/history/parks/park-slug/detail/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride History List"
+  curl -X GET "$BASE_URL/api/v1/history/parks/park-slug/rides/ride-slug/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Ride History Detail"
+  curl -X GET "$BASE_URL/api/v1/history/parks/park-slug/rides/ride-slug/detail/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Unified Timeline"
+  curl -X GET "$BASE_URL/api/v1/history/timeline/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Unified Timeline Detail"
+  curl -X GET "$BASE_URL/api/v1/history/timeline/1/"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# EMAIL API ENDPOINTS (/api/v1/email/)
+# ============================================================================
+if should_run_endpoint true false; then
+  echo -e "\n\n=== EMAIL API ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. Send Email"
+  curl -X POST "$BASE_URL/api/v1/email/send/" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+    -d '{"to": "recipient@example.com", "subject": "Test", "message": "Test message"}'
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# CORE API ENDPOINTS (/api/v1/core/)
+# ============================================================================
+if should_run_endpoint false false; then
+  echo -e "\n\n=== CORE API ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. Entity Fuzzy Search"
+  curl -X GET "$BASE_URL/api/v1/core/entities/search/?q=disney"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Entity Not Found"
+  curl -X POST "$BASE_URL/api/v1/core/entities/not-found/" \
+    -H "Content-Type: application/json" \
+    -d '{"query": "nonexistent park", "type": "park"}'
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Entity Suggestions"
+  curl -X GET "$BASE_URL/api/v1/core/entities/suggestions/?q=magic"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# MAPS API ENDPOINTS (/api/v1/maps/)
+# ============================================================================
+if should_run_endpoint false false || should_run_endpoint true false; then
+  echo -e "\n\n=== MAPS API ENDPOINTS ==="
+fi
+
+if should_run_endpoint false false; then
+  echo "$ENDPOINT_NUM. Map Locations"
+  curl -X GET "$BASE_URL/api/v1/maps/locations/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Map Location Detail"
+  curl -X GET "$BASE_URL/api/v1/maps/locations/park/1/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Map Search"
+  curl -X GET "$BASE_URL/api/v1/maps/search/?q=disney"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Map Bounds Query"
+  curl -X GET "$BASE_URL/api/v1/maps/bounds/?north=40.7&south=40.6&east=-73.9&west=-74.0"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Map Statistics"
+  curl -X GET "$BASE_URL/api/v1/maps/stats/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Map Cache Status"
+  curl -X GET "$BASE_URL/api/v1/maps/cache/"
+  ((ENDPOINT_NUM++))
+fi
+
+if should_run_endpoint true false; then
+  echo -e "\n$ENDPOINT_NUM. Invalidate Map Cache"
+  curl -X POST "$BASE_URL/api/v1/maps/cache/invalidate/" \
+    -H "Authorization: Bearer YOUR_TOKEN_HERE"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# API DOCUMENTATION ENDPOINTS
+# ============================================================================
+if should_run_endpoint false true; then
+  echo -e "\n\n=== API DOCUMENTATION ENDPOINTS ==="
+
+  echo "$ENDPOINT_NUM. OpenAPI Schema"
+  curl -X GET "$BASE_URL/api/schema/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. Swagger UI"
+  curl -X GET "$BASE_URL/api/docs/"
+  ((ENDPOINT_NUM++))
+
+  echo -e "\n$ENDPOINT_NUM. ReDoc"
+  curl -X GET "$BASE_URL/api/redoc/"
+  ((ENDPOINT_NUM++))
+fi
+
+# ============================================================================
+# HEALTH CHECK (Django Health Check)
+# ============================================================================
+if should_run_endpoint false false; then
+  echo -e "\n\n=== DJANGO HEALTH CHECK ==="
+
+  echo "$ENDPOINT_NUM. Django Health Check"
+  curl -X GET "$BASE_URL/health/"
+  ((ENDPOINT_NUM++))
+fi
+
+echo -e "\n\n=== END OF API ENDPOINTS TEST SUITE ==="
+echo "Total endpoints tested: $((ENDPOINT_NUM - 1))"
+echo ""
+echo "Notes:"
+echo "- Replace YOUR_TOKEN_HERE with actual authentication tokens"
+echo "- Replace /path/to/photo.jpg with actual file paths for photo uploads"
+echo "- Replace numeric IDs (1, 2, etc.) with actual resource IDs"
+echo "- Replace slug placeholders (park-slug, ride-slug) with actual slugs"
+echo "- Adjust BASE_URL for your environment (localhost:8000, staging, production)"
+echo ""
+echo "Authentication required endpoints are marked with Authorization header"
+echo "File upload endpoints use multipart/form-data (-F flag)"
+echo "JSON endpoints use application/json content type"

backend/.env.example

@@ -16,6 +16,11 @@ EMAIL_USE_TLS=True
 EMAIL_HOST_USER=your-email@gmail.com
 EMAIL_HOST_PASSWORD=your-app-password
 
+# ForwardEmail API Configuration
+FORWARD_EMAIL_BASE_URL=https://api.forwardemail.net
+FORWARD_EMAIL_API_KEY=your-forwardemail-api-key-here
+FORWARD_EMAIL_DOMAIN=your-domain.com
+
 # Media and Static Files
 MEDIA_URL=/media/
 STATIC_URL=/static/
@@ -28,4 +33,16 @@ CORS_ALLOWED_ORIGINS=http://localhost:3000
 
 # Feature Flags
 ENABLE_DEBUG_TOOLBAR=True
-ENABLE_SILK_PROFILER=False
+ENABLE_SILK_PROFILER=False
+
+# Frontend Configuration
+FRONTEND_DOMAIN=https://thrillwiki.com
+
+# Cloudflare Images Configuration
+CLOUDFLARE_IMAGES_ACCOUNT_ID=your-cloudflare-account-id
+CLOUDFLARE_IMAGES_API_TOKEN=your-cloudflare-api-token
+CLOUDFLARE_IMAGES_ACCOUNT_HASH=your-cloudflare-account-hash
+CLOUDFLARE_IMAGES_WEBHOOK_SECRET=your-webhook-secret
+
+# Road Trip Service Configuration
+ROADTRIP_USER_AGENT=ThrillWiki/1.0 (https://thrillwiki.com)

backend/VERIFICATION_COMMANDS.md

@@ -0,0 +1,73 @@
+# Independent Verification Commands
+
+Run these commands yourself to verify ALL tuple fallbacks have been eliminated:
+
+## 1. Search for the most common tuple fallback patterns:
+
+```bash
+# Search for choices.get(value, fallback) patterns
+grep -r "choices\.get(" apps/ --include="*.py" | grep -v migration
+
+# Search for status_*.get(value, fallback) patterns  
+grep -r "status_.*\.get(" apps/ --include="*.py" | grep -v migration
+
+# Search for category_*.get(value, fallback) patterns
+grep -r "category_.*\.get(" apps/ --include="*.py" | grep -v migration
+
+# Search for sla_hours.get(value, fallback) patterns
+grep -r "sla_hours\.get(" apps/ --include="*.py"
+
+# Search for the removed functions
+grep -r "get_tuple_choices\|from_tuple\|convert_tuple_choices" apps/ --include="*.py" | grep -v migration
+```
+
+**Expected result: ALL commands should return NOTHING (empty results)**
+
+## 2. Verify the removed function is actually gone:
+
+```bash
+# This should fail with ImportError
+python -c "from apps.core.choices.registry import get_tuple_choices; print('ERROR: Function still exists!')"
+
+# This should work
+python -c "from apps.core.choices.registry import get_choices; print('SUCCESS: Rich Choice objects work')"
+```
+
+## 3. Verify Django system integrity:
+
+```bash
+python manage.py check
+```
+
+**Expected result: Should pass with no errors**
+
+## 4. Manual spot check of previously problematic files:
+
+```bash
+# Check rides events (previously had 3 fallbacks)
+grep -n "\.get(" apps/rides/events.py | grep -E "(choice|status|category)"
+
+# Check template tags (previously had 2 fallbacks)  
+grep -n "\.get(" apps/rides/templatetags/ride_tags.py | grep -E "(choice|category|image)"
+
+# Check admin (previously had 2 fallbacks)
+grep -n "\.get(" apps/rides/admin.py | grep -E "(choice|category)"
+
+# Check moderation (previously had 3 SLA fallbacks)
+grep -n "sla_hours\.get(" apps/moderation/
+```
+
+**Expected result: ALL should return NOTHING**
+
+## 5. Run the verification script:
+
+```bash
+python verify_no_tuple_fallbacks.py
+```
+
+**Expected result: Should print "SUCCESS: ALL TUPLE FALLBACKS HAVE BEEN ELIMINATED!"**
+
+---
+
+If ANY of these commands find tuple fallbacks, then I was wrong. 
+If ALL commands return empty/success, then ALL tuple fallbacks have been eliminated.

backend/apps/accounts/__init__.py

@@ -0,0 +1,2 @@
+# Import choices to trigger registration
+from .choices import *

backend/apps/accounts/admin.py

@@ -2,7 +2,14 @@ from django.contrib import admin
 from django.contrib.auth.admin import UserAdmin
 from django.utils.html import format_html
 from django.contrib.auth.models import Group
-from .models import User, UserProfile, EmailVerification, TopList, TopListItem
+from .models import (
+    User,
+    UserProfile,
+    EmailVerification,
+    PasswordReset,
+    TopList,
+    TopListItem,
+)
 
 
 class UserProfileInline(admin.StackedInline):
@@ -280,3 +287,74 @@ class TopListItemAdmin(admin.ModelAdmin):
         ("List Information", {"fields": ("top_list", "rank")}),
         ("Item Details", {"fields": ("content_type", "object_id", "notes")}),
     )
+
+
+@admin.register(PasswordReset)
+class PasswordResetAdmin(admin.ModelAdmin):
+    """Admin interface for password reset tokens"""
+
+    list_display = (
+        "user",
+        "created_at",
+        "expires_at",
+        "is_expired",
+        "used",
+    )
+    list_filter = (
+        "used",
+        "created_at",
+        "expires_at",
+    )
+    search_fields = (
+        "user__username",
+        "user__email",
+        "token",
+    )
+    readonly_fields = (
+        "token",
+        "created_at",
+        "expires_at",
+    )
+    date_hierarchy = "created_at"
+    ordering = ("-created_at",)
+
+    fieldsets = (
+        (
+            "Reset Details",
+            {
+                "fields": (
+                    "user",
+                    "token",
+                    "used",
+                )
+            },
+        ),
+        (
+            "Timing",
+            {
+                "fields": (
+                    "created_at",
+                    "expires_at",
+                )
+            },
+        ),
+    )
+
+    @admin.display(description="Status", boolean=True)
+    def is_expired(self, obj):
+        """Display expiration status with color coding"""
+        from django.utils import timezone
+
+        if obj.used:
+            return format_html('<span style="color: blue;">Used</span>')
+        elif timezone.now() > obj.expires_at:
+            return format_html('<span style="color: red;">Expired</span>')
+        return format_html('<span style="color: green;">Valid</span>')
+
+    def has_add_permission(self, request):
+        """Disable manual creation of password reset tokens"""
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        """Allow viewing but restrict editing of password reset tokens"""
+        return getattr(request.user, "is_superuser", False)

backend/apps/accounts/choices.py

@@ -0,0 +1,563 @@
+"""
+Rich Choice Objects for Accounts Domain
+
+This module defines all choice objects used in the accounts domain,
+replacing tuple-based choices with rich, metadata-enhanced choice objects.
+
+Last updated: 2025-01-15
+"""
+
+from apps.core.choices import RichChoice, ChoiceGroup, register_choices
+
+
+# =============================================================================
+# USER ROLES
+# =============================================================================
+
+user_roles = ChoiceGroup(
+    name="user_roles",
+    choices=[
+        RichChoice(
+            value="USER",
+            label="User",
+            description="Standard user with basic permissions to create content, reviews, and lists",
+            metadata={
+                "color": "blue",
+                "icon": "user",
+                "css_class": "text-blue-600 bg-blue-50",
+                "permissions": ["create_content", "create_reviews", "create_lists"],
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="MODERATOR",
+            label="Moderator",
+            description="Trusted user with permissions to moderate content and assist other users",
+            metadata={
+                "color": "green",
+                "icon": "shield-check",
+                "css_class": "text-green-600 bg-green-50",
+                "permissions": ["moderate_content", "review_submissions", "manage_reports"],
+                "sort_order": 2,
+            }
+        ),
+        RichChoice(
+            value="ADMIN",
+            label="Admin",
+            description="Administrator with elevated permissions to manage users and site configuration",
+            metadata={
+                "color": "purple",
+                "icon": "cog",
+                "css_class": "text-purple-600 bg-purple-50",
+                "permissions": ["manage_users", "site_configuration", "advanced_moderation"],
+                "sort_order": 3,
+            }
+        ),
+        RichChoice(
+            value="SUPERUSER",
+            label="Superuser",
+            description="Full system administrator with unrestricted access to all features",
+            metadata={
+                "color": "red",
+                "icon": "key",
+                "css_class": "text-red-600 bg-red-50",
+                "permissions": ["full_access", "system_administration", "database_access"],
+                "sort_order": 4,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# THEME PREFERENCES
+# =============================================================================
+
+theme_preferences = ChoiceGroup(
+    name="theme_preferences",
+    choices=[
+        RichChoice(
+            value="light",
+            label="Light",
+            description="Light theme with bright backgrounds and dark text for daytime use",
+            metadata={
+                "color": "yellow",
+                "icon": "sun",
+                "css_class": "text-yellow-600 bg-yellow-50",
+                "preview_colors": {
+                    "background": "#ffffff",
+                    "text": "#1f2937",
+                    "accent": "#3b82f6"
+                },
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="dark",
+            label="Dark",
+            description="Dark theme with dark backgrounds and light text for nighttime use",
+            metadata={
+                "color": "gray",
+                "icon": "moon",
+                "css_class": "text-gray-600 bg-gray-50",
+                "preview_colors": {
+                    "background": "#1f2937",
+                    "text": "#f9fafb",
+                    "accent": "#60a5fa"
+                },
+                "sort_order": 2,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# PRIVACY LEVELS
+# =============================================================================
+
+privacy_levels = ChoiceGroup(
+    name="privacy_levels",
+    choices=[
+        RichChoice(
+            value="public",
+            label="Public",
+            description="Profile and activity visible to all users and search engines",
+            metadata={
+                "color": "green",
+                "icon": "globe",
+                "css_class": "text-green-600 bg-green-50",
+                "visibility_scope": "everyone",
+                "search_indexable": True,
+                "implications": [
+                    "Profile visible to all users",
+                    "Activity appears in public feeds",
+                    "Searchable by search engines",
+                    "Can be found by username search"
+                ],
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="friends",
+            label="Friends Only",
+            description="Profile and activity visible only to accepted friends",
+            metadata={
+                "color": "blue",
+                "icon": "users",
+                "css_class": "text-blue-600 bg-blue-50",
+                "visibility_scope": "friends",
+                "search_indexable": False,
+                "implications": [
+                    "Profile visible only to friends",
+                    "Activity hidden from public feeds",
+                    "Not searchable by search engines",
+                    "Requires friend request approval"
+                ],
+                "sort_order": 2,
+            }
+        ),
+        RichChoice(
+            value="private",
+            label="Private",
+            description="Profile and activity completely private, visible only to you",
+            metadata={
+                "color": "red",
+                "icon": "lock",
+                "css_class": "text-red-600 bg-red-50",
+                "visibility_scope": "self",
+                "search_indexable": False,
+                "implications": [
+                    "Profile completely hidden",
+                    "No activity in any feeds",
+                    "Not discoverable by other users",
+                    "Maximum privacy protection"
+                ],
+                "sort_order": 3,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# TOP LIST CATEGORIES
+# =============================================================================
+
+top_list_categories = ChoiceGroup(
+    name="top_list_categories",
+    choices=[
+        RichChoice(
+            value="RC",
+            label="Roller Coaster",
+            description="Top lists for roller coasters and thrill rides",
+            metadata={
+                "color": "red",
+                "icon": "roller-coaster",
+                "css_class": "text-red-600 bg-red-50",
+                "ride_category": "roller_coaster",
+                "typical_list_size": 10,
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="DR",
+            label="Dark Ride",
+            description="Top lists for dark rides and indoor attractions",
+            metadata={
+                "color": "purple",
+                "icon": "moon",
+                "css_class": "text-purple-600 bg-purple-50",
+                "ride_category": "dark_ride",
+                "typical_list_size": 10,
+                "sort_order": 2,
+            }
+        ),
+        RichChoice(
+            value="FR",
+            label="Flat Ride",
+            description="Top lists for flat rides and spinning attractions",
+            metadata={
+                "color": "blue",
+                "icon": "refresh",
+                "css_class": "text-blue-600 bg-blue-50",
+                "ride_category": "flat_ride",
+                "typical_list_size": 10,
+                "sort_order": 3,
+            }
+        ),
+        RichChoice(
+            value="WR",
+            label="Water Ride",
+            description="Top lists for water rides and splash attractions",
+            metadata={
+                "color": "cyan",
+                "icon": "droplet",
+                "css_class": "text-cyan-600 bg-cyan-50",
+                "ride_category": "water_ride",
+                "typical_list_size": 10,
+                "sort_order": 4,
+            }
+        ),
+        RichChoice(
+            value="PK",
+            label="Park",
+            description="Top lists for theme parks and amusement parks",
+            metadata={
+                "color": "green",
+                "icon": "map",
+                "css_class": "text-green-600 bg-green-50",
+                "entity_type": "park",
+                "typical_list_size": 10,
+                "sort_order": 5,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# NOTIFICATION TYPES
+# =============================================================================
+
+notification_types = ChoiceGroup(
+    name="notification_types",
+    choices=[
+        # Submission related
+        RichChoice(
+            value="submission_approved",
+            label="Submission Approved",
+            description="Notification when user's submission is approved by moderators",
+            metadata={
+                "color": "green",
+                "icon": "check-circle",
+                "css_class": "text-green-600 bg-green-50",
+                "category": "submission",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="submission_rejected",
+            label="Submission Rejected",
+            description="Notification when user's submission is rejected by moderators",
+            metadata={
+                "color": "red",
+                "icon": "x-circle",
+                "css_class": "text-red-600 bg-red-50",
+                "category": "submission",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 2,
+            }
+        ),
+        RichChoice(
+            value="submission_pending",
+            label="Submission Pending Review",
+            description="Notification when user's submission is pending moderator review",
+            metadata={
+                "color": "yellow",
+                "icon": "clock",
+                "css_class": "text-yellow-600 bg-yellow-50",
+                "category": "submission",
+                "default_channels": ["inapp"],
+                "priority": "low",
+                "sort_order": 3,
+            }
+        ),
+        # Review related
+        RichChoice(
+            value="review_reply",
+            label="Review Reply",
+            description="Notification when someone replies to user's review",
+            metadata={
+                "color": "blue",
+                "icon": "chat-bubble",
+                "css_class": "text-blue-600 bg-blue-50",
+                "category": "review",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 4,
+            }
+        ),
+        RichChoice(
+            value="review_helpful",
+            label="Review Marked Helpful",
+            description="Notification when user's review is marked as helpful",
+            metadata={
+                "color": "green",
+                "icon": "thumbs-up",
+                "css_class": "text-green-600 bg-green-50",
+                "category": "review",
+                "default_channels": ["push", "inapp"],
+                "priority": "low",
+                "sort_order": 5,
+            }
+        ),
+        # Social related
+        RichChoice(
+            value="friend_request",
+            label="Friend Request",
+            description="Notification when user receives a friend request",
+            metadata={
+                "color": "blue",
+                "icon": "user-plus",
+                "css_class": "text-blue-600 bg-blue-50",
+                "category": "social",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 6,
+            }
+        ),
+        RichChoice(
+            value="friend_accepted",
+            label="Friend Request Accepted",
+            description="Notification when user's friend request is accepted",
+            metadata={
+                "color": "green",
+                "icon": "user-check",
+                "css_class": "text-green-600 bg-green-50",
+                "category": "social",
+                "default_channels": ["push", "inapp"],
+                "priority": "low",
+                "sort_order": 7,
+            }
+        ),
+        RichChoice(
+            value="message_received",
+            label="Message Received",
+            description="Notification when user receives a private message",
+            metadata={
+                "color": "blue",
+                "icon": "mail",
+                "css_class": "text-blue-600 bg-blue-50",
+                "category": "social",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 8,
+            }
+        ),
+        RichChoice(
+            value="profile_comment",
+            label="Profile Comment",
+            description="Notification when someone comments on user's profile",
+            metadata={
+                "color": "blue",
+                "icon": "chat",
+                "css_class": "text-blue-600 bg-blue-50",
+                "category": "social",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "normal",
+                "sort_order": 9,
+            }
+        ),
+        # System related
+        RichChoice(
+            value="system_announcement",
+            label="System Announcement",
+            description="Important announcements from the ThrillWiki team",
+            metadata={
+                "color": "purple",
+                "icon": "megaphone",
+                "css_class": "text-purple-600 bg-purple-50",
+                "category": "system",
+                "default_channels": ["email", "inapp"],
+                "priority": "normal",
+                "sort_order": 10,
+            }
+        ),
+        RichChoice(
+            value="account_security",
+            label="Account Security",
+            description="Security-related notifications for user's account",
+            metadata={
+                "color": "red",
+                "icon": "shield-exclamation",
+                "css_class": "text-red-600 bg-red-50",
+                "category": "system",
+                "default_channels": ["email", "push", "inapp"],
+                "priority": "high",
+                "sort_order": 11,
+            }
+        ),
+        RichChoice(
+            value="feature_update",
+            label="Feature Update",
+            description="Notifications about new features and improvements",
+            metadata={
+                "color": "blue",
+                "icon": "sparkles",
+                "css_class": "text-blue-600 bg-blue-50",
+                "category": "system",
+                "default_channels": ["email", "inapp"],
+                "priority": "low",
+                "sort_order": 12,
+            }
+        ),
+        RichChoice(
+            value="maintenance",
+            label="Maintenance Notice",
+            description="Scheduled maintenance and downtime notifications",
+            metadata={
+                "color": "yellow",
+                "icon": "wrench",
+                "css_class": "text-yellow-600 bg-yellow-50",
+                "category": "system",
+                "default_channels": ["email", "inapp"],
+                "priority": "normal",
+                "sort_order": 13,
+            }
+        ),
+        # Achievement related
+        RichChoice(
+            value="achievement_unlocked",
+            label="Achievement Unlocked",
+            description="Notification when user unlocks a new achievement",
+            metadata={
+                "color": "gold",
+                "icon": "trophy",
+                "css_class": "text-yellow-600 bg-yellow-50",
+                "category": "achievement",
+                "default_channels": ["push", "inapp"],
+                "priority": "low",
+                "sort_order": 14,
+            }
+        ),
+        RichChoice(
+            value="milestone_reached",
+            label="Milestone Reached",
+            description="Notification when user reaches a significant milestone",
+            metadata={
+                "color": "purple",
+                "icon": "flag",
+                "css_class": "text-purple-600 bg-purple-50",
+                "category": "achievement",
+                "default_channels": ["push", "inapp"],
+                "priority": "low",
+                "sort_order": 15,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# NOTIFICATION PRIORITIES
+# =============================================================================
+
+notification_priorities = ChoiceGroup(
+    name="notification_priorities",
+    choices=[
+        RichChoice(
+            value="low",
+            label="Low",
+            description="Low priority notifications that can be delayed or batched",
+            metadata={
+                "color": "gray",
+                "icon": "arrow-down",
+                "css_class": "text-gray-600 bg-gray-50",
+                "urgency_level": 1,
+                "batch_eligible": True,
+                "delay_minutes": 60,
+                "sort_order": 1,
+            }
+        ),
+        RichChoice(
+            value="normal",
+            label="Normal",
+            description="Standard priority notifications sent in regular intervals",
+            metadata={
+                "color": "blue",
+                "icon": "minus",
+                "css_class": "text-blue-600 bg-blue-50",
+                "urgency_level": 2,
+                "batch_eligible": True,
+                "delay_minutes": 15,
+                "sort_order": 2,
+            }
+        ),
+        RichChoice(
+            value="high",
+            label="High",
+            description="High priority notifications sent immediately",
+            metadata={
+                "color": "orange",
+                "icon": "arrow-up",
+                "css_class": "text-orange-600 bg-orange-50",
+                "urgency_level": 3,
+                "batch_eligible": False,
+                "delay_minutes": 0,
+                "sort_order": 3,
+            }
+        ),
+        RichChoice(
+            value="urgent",
+            label="Urgent",
+            description="Critical notifications requiring immediate attention",
+            metadata={
+                "color": "red",
+                "icon": "exclamation",
+                "css_class": "text-red-600 bg-red-50",
+                "urgency_level": 4,
+                "batch_eligible": False,
+                "delay_minutes": 0,
+                "bypass_preferences": True,
+                "sort_order": 4,
+            }
+        ),
+    ]
+)
+
+
+# =============================================================================
+# REGISTER ALL CHOICE GROUPS
+# =============================================================================
+
+# Register each choice group individually
+register_choices("user_roles", user_roles.choices, "accounts", "User role classifications")
+register_choices("theme_preferences", theme_preferences.choices, "accounts", "Theme preference options")
+register_choices("privacy_levels", privacy_levels.choices, "accounts", "Privacy level settings")
+register_choices("top_list_categories", top_list_categories.choices, "accounts", "Top list category types")
+register_choices("notification_types", notification_types.choices, "accounts", "Notification type classifications")
+register_choices("notification_priorities", notification_priorities.choices, "accounts", "Notification priority levels")

backend/apps/accounts/management/commands/check_all_social_tables.py

@@ -11,11 +11,9 @@ class Command(BaseCommand):
         self.stdout.write("\nChecking SocialApp table:")
         for app in SocialApp.objects.all():
             self.stdout.write(
-                f"ID: {
-                    app.pk}, Provider: {
-                    app.provider}, Name: {
-                    app.name}, Client ID: {
-                    app.client_id}"
+                f"ID: {app.pk}, Provider: {app.provider}, Name: {app.name}, Client ID: {
+                    app.client_id
+                }"
             )
             self.stdout.write("Sites:")
             for site in app.sites.all():
@@ -25,10 +23,7 @@ class Command(BaseCommand):
         self.stdout.write("\nChecking SocialAccount table:")
         for account in SocialAccount.objects.all():
             self.stdout.write(
-                f"ID: {
-                    account.pk}, Provider: {
-                    account.provider}, UID: {
-                    account.uid}"
+                f"ID: {account.pk}, Provider: {account.provider}, UID: {account.uid}"
             )
 
         # Check SocialToken

backend/apps/accounts/management/commands/check_social_apps.py

@@ -13,15 +13,10 @@ class Command(BaseCommand):
             return
 
         for app in social_apps:
-            self.stdout.write(
-                self.style.SUCCESS(
-                    f"\nProvider: {
-                        app.provider}"
-                )
-            )
+            self.stdout.write(self.style.SUCCESS(f"\nProvider: {app.provider}"))
             self.stdout.write(f"Name: {app.name}")
             self.stdout.write(f"Client ID: {app.client_id}")
             self.stdout.write(f"Secret: {app.secret}")
             self.stdout.write(
-                f'Sites: {", ".join(str(site.domain) for site in app.sites.all())}'
+                f"Sites: {', '.join(str(site.domain) for site in app.sites.all())}"
             )

backend/apps/accounts/management/commands/cleanup_test_data.py

@@ -1,8 +1,7 @@
 from django.core.management.base import BaseCommand
 from django.contrib.auth import get_user_model
-from apps.parks.models import ParkReview, Park
-from apps.rides.models import Ride
-from apps.media.models import Photo
+from apps.parks.models import ParkReview, Park, ParkPhoto
+from apps.rides.models import Ride, RidePhoto
 
 User = get_user_model()
 
@@ -25,11 +24,20 @@ class Command(BaseCommand):
         reviews.delete()
         self.stdout.write(self.style.SUCCESS(f"Deleted {count} test reviews"))
 
-        # Delete test photos
-        photos = Photo.objects.filter(uploader__username__in=["testuser", "moderator"])
-        count = photos.count()
-        photos.delete()
-        self.stdout.write(self.style.SUCCESS(f"Deleted {count} test photos"))
+        # Delete test photos - both park and ride photos
+        park_photos = ParkPhoto.objects.filter(
+            uploader__username__in=["testuser", "moderator"]
+        )
+        park_count = park_photos.count()
+        park_photos.delete()
+        self.stdout.write(self.style.SUCCESS(f"Deleted {park_count} test park photos"))
+
+        ride_photos = RidePhoto.objects.filter(
+            uploader__username__in=["testuser", "moderator"]
+        )
+        ride_count = ride_photos.count()
+        ride_photos.delete()
+        self.stdout.write(self.style.SUCCESS(f"Deleted {ride_count} test ride photos"))
 
         # Delete test parks
         parks = Park.objects.filter(name__startswith="Test Park")

backend/apps/accounts/management/commands/create_social_apps.py

@@ -30,7 +30,7 @@ class Command(BaseCommand):
             discord_app.secret = "ece7Pe_M4mD4mYzAgcINjTEKL_3ftL11"
             discord_app.save()
         discord_app.sites.add(site)
-        self.stdout.write(f'{"Created" if created else "Updated"} Discord app')
+        self.stdout.write(f"{'Created' if created else 'Updated'} Discord app")
 
         # Create Google app
         google_app, created = SocialApp.objects.get_or_create(
@@ -52,4 +52,4 @@ class Command(BaseCommand):
             google_app.secret = "GOCSPX-Wd_0Ue0Ue0Ue0Ue0Ue0Ue0Ue0Ue"
             google_app.save()
         google_app.sites.add(site)
-        self.stdout.write(f'{"Created" if created else "Updated"} Google app')
+        self.stdout.write(f"{'Created' if created else 'Updated'} Google app")

backend/apps/accounts/management/commands/delete_user.py

@@ -0,0 +1,164 @@
+"""
+Django management command to delete a user while preserving their submissions.
+
+Usage:
+    uv run manage.py delete_user <username>
+    uv run manage.py delete_user --user-id <user_id>
+    uv run manage.py delete_user <username> --dry-run
+"""
+
+from django.core.management.base import BaseCommand, CommandError
+from apps.accounts.models import User
+from apps.accounts.services import UserDeletionService
+
+
+class Command(BaseCommand):
+    help = "Delete a user while preserving all their submissions"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "username", nargs="?", type=str, help="Username of the user to delete"
+        )
+        parser.add_argument(
+            "--user-id",
+            type=str,
+            help="User ID of the user to delete (alternative to username)",
+        )
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Show what would be deleted without actually deleting",
+        )
+        parser.add_argument(
+            "--force", action="store_true", help="Skip confirmation prompt"
+        )
+
+    def handle(self, *args, **options):
+        username = options.get("username")
+        user_id = options.get("user_id")
+        dry_run = options.get("dry_run", False)
+        force = options.get("force", False)
+
+        # Validate arguments
+        if not username and not user_id:
+            raise CommandError("You must provide either a username or --user-id")
+
+        if username and user_id:
+            raise CommandError("You cannot provide both username and --user-id")
+
+        # Find the user
+        try:
+            if username:
+                user = User.objects.get(username=username)
+            else:
+                user = User.objects.get(user_id=user_id)
+        except User.DoesNotExist:
+            identifier = username or user_id
+            raise CommandError(f'User "{identifier}" does not exist')
+
+        # Check if user can be deleted
+        can_delete, reason = UserDeletionService.can_delete_user(user)
+        if not can_delete:
+            raise CommandError(f"Cannot delete user: {reason}")
+
+        # Count submissions
+        submission_counts = {
+            "park_reviews": getattr(
+                user, "park_reviews", user.__class__.objects.none()
+            ).count(),
+            "ride_reviews": getattr(
+                user, "ride_reviews", user.__class__.objects.none()
+            ).count(),
+            "uploaded_park_photos": getattr(
+                user, "uploaded_park_photos", user.__class__.objects.none()
+            ).count(),
+            "uploaded_ride_photos": getattr(
+                user, "uploaded_ride_photos", user.__class__.objects.none()
+            ).count(),
+            "top_lists": getattr(
+                user, "top_lists", user.__class__.objects.none()
+            ).count(),
+            "edit_submissions": getattr(
+                user, "edit_submissions", user.__class__.objects.none()
+            ).count(),
+            "photo_submissions": getattr(
+                user, "photo_submissions", user.__class__.objects.none()
+            ).count(),
+        }
+
+        total_submissions = sum(submission_counts.values())
+
+        # Display user information
+        self.stdout.write(self.style.WARNING("\nUser Information:"))
+        self.stdout.write(f"  Username: {user.username}")
+        self.stdout.write(f"  User ID: {user.user_id}")
+        self.stdout.write(f"  Email: {user.email}")
+        self.stdout.write(f"  Date Joined: {user.date_joined}")
+        self.stdout.write(f"  Role: {user.role}")
+
+        # Display submission counts
+        self.stdout.write(self.style.WARNING("\nSubmissions to preserve:"))
+        for submission_type, count in submission_counts.items():
+            if count > 0:
+                self.stdout.write(
+                    f'  {submission_type.replace("_", " ").title()}: {count}'
+                )
+
+        self.stdout.write(f"\nTotal submissions: {total_submissions}")
+
+        if total_submissions > 0:
+            self.stdout.write(
+                self.style.SUCCESS(
+                    f'\nAll {total_submissions} submissions will be transferred to the "deleted_user" placeholder.'
+                )
+            )
+        else:
+            self.stdout.write(
+                self.style.WARNING("\nNo submissions found for this user.")
+            )
+
+        if dry_run:
+            self.stdout.write(self.style.SUCCESS("\n[DRY RUN] No changes were made."))
+            return
+
+        # Confirmation prompt
+        if not force:
+            self.stdout.write(
+                self.style.WARNING(
+                    f'\nThis will permanently delete the user "{user.username}" '
+                    f"but preserve all {total_submissions} submissions."
+                )
+            )
+            confirm = input("Are you sure you want to continue? (yes/no): ")
+            if confirm.lower() not in ["yes", "y"]:
+                self.stdout.write(self.style.ERROR("Operation cancelled."))
+                return
+
+        # Perform the deletion
+        try:
+            result = UserDeletionService.delete_user_preserve_submissions(user)
+
+            self.stdout.write(
+                self.style.SUCCESS(
+                    f'\nSuccessfully deleted user "{result["deleted_user"]["username"]}"'
+                )
+            )
+
+            preserved_count = sum(result["preserved_submissions"].values())
+            if preserved_count > 0:
+                self.stdout.write(
+                    self.style.SUCCESS(
+                        f'Preserved {preserved_count} submissions under user "{result["transferred_to"]["username"]}"'
+                    )
+                )
+
+            # Show detailed preservation summary
+            self.stdout.write(self.style.WARNING("\nPreservation Summary:"))
+            for submission_type, count in result["preserved_submissions"].items():
+                if count > 0:
+                    self.stdout.write(
+                        f'  {submission_type.replace("_", " ").title()}: {count}'
+                    )
+
+        except Exception as e:
+            raise CommandError(f"Error deleting user: {str(e)}")

backend/apps/accounts/management/commands/fix_social_apps.py

@@ -23,10 +23,7 @@ class Command(BaseCommand):
             secret=os.getenv("GOOGLE_CLIENT_SECRET"),
         )
         google_app.sites.add(site)
-        self.stdout.write(
-            f"Created Google app with client_id: {
-                google_app.client_id}"
-        )
+        self.stdout.write(f"Created Google app with client_id: {google_app.client_id}")
 
         # Create Discord provider
         discord_app = SocialApp.objects.create(

backend/apps/accounts/management/commands/regenerate_avatars.py

@@ -11,8 +11,5 @@ class Command(BaseCommand):
             # This will trigger the avatar generation logic in the save method
             profile.save()
             self.stdout.write(
-                self.style.SUCCESS(
-                    f"Regenerated avatar for {
-                        profile.user.username}"
-                )
+                self.style.SUCCESS(f"Regenerated avatar for {profile.user.username}")
             )

backend/apps/accounts/management/commands/reset_db.py

@@ -102,12 +102,7 @@ class Command(BaseCommand):
 
             self.stdout.write("Superuser created.")
         except Exception as e:
-            self.stdout.write(
-                self.style.ERROR(
-                    f"Error creating superuser: {
-                        str(e)}"
-                )
-            )
+            self.stdout.write(self.style.ERROR(f"Error creating superuser: {str(e)}"))
             raise
 
         self.stdout.write(self.style.SUCCESS("Database reset complete."))

backend/apps/accounts/management/commands/setup_groups.py

@@ -41,9 +41,4 @@ class Command(BaseCommand):
                     self.stdout.write(f"  - {perm.codename}")
 
         except Exception as e:
-            self.stdout.write(
-                self.style.ERROR(
-                    f"Error setting up groups: {
-                        str(e)}"
-                )
-            )
+            self.stdout.write(self.style.ERROR(f"Error setting up groups: {str(e)}"))

backend/apps/accounts/management/commands/setup_social_auth.py

@@ -20,20 +20,24 @@ class Command(BaseCommand):
 
         # DEBUG: Log environment variable values
         self.stdout.write(
-            f"DEBUG: google_client_id type: {
-                type(google_client_id)}, value: {google_client_id}"
+            f"DEBUG: google_client_id type: {type(google_client_id)}, value: {
+                google_client_id
+            }"
         )
         self.stdout.write(
-            f"DEBUG: google_client_secret type: {
-                type(google_client_secret)}, value: {google_client_secret}"
+            f"DEBUG: google_client_secret type: {type(google_client_secret)}, value: {
+                google_client_secret
+            }"
         )
         self.stdout.write(
-            f"DEBUG: discord_client_id type: {
-                type(discord_client_id)}, value: {discord_client_id}"
+            f"DEBUG: discord_client_id type: {type(discord_client_id)}, value: {
+                discord_client_id
+            }"
         )
         self.stdout.write(
-            f"DEBUG: discord_client_secret type: {
-                type(discord_client_secret)}, value: {discord_client_secret}"
+            f"DEBUG: discord_client_secret type: {type(discord_client_secret)}, value: {
+                discord_client_secret
+            }"
         )
 
         if not all(
@@ -51,16 +55,13 @@ class Command(BaseCommand):
                 f"DEBUG: google_client_id is None: {google_client_id is None}"
             )
             self.stdout.write(
-                f"DEBUG: google_client_secret is None: {
-                    google_client_secret is None}"
+                f"DEBUG: google_client_secret is None: {google_client_secret is None}"
             )
             self.stdout.write(
-                f"DEBUG: discord_client_id is None: {
-                    discord_client_id is None}"
+                f"DEBUG: discord_client_id is None: {discord_client_id is None}"
             )
             self.stdout.write(
-                f"DEBUG: discord_client_secret is None: {
-                    discord_client_secret is None}"
+                f"DEBUG: discord_client_secret is None: {discord_client_secret is None}"
             )
             return
 
@@ -81,7 +82,8 @@ class Command(BaseCommand):
         if not created:
             self.stdout.write(
                 f"DEBUG: About to assign google_client_id: {google_client_id} (type: {
-                    type(google_client_id)})"
+                    type(google_client_id)
+                })"
             )
             if google_client_id is not None and google_client_secret is not None:
                 google_app.client_id = google_client_id
@@ -108,7 +110,8 @@ class Command(BaseCommand):
         if not created:
             self.stdout.write(
                 f"DEBUG: About to assign discord_client_id: {discord_client_id} (type: {
-                    type(discord_client_id)})"
+                    type(discord_client_id)
+                })"
             )
             if discord_client_id is not None and discord_client_secret is not None:
                 discord_app.client_id = discord_client_id

backend/apps/accounts/management/commands/setup_social_auth_admin.py

@@ -21,7 +21,7 @@ class Command(BaseCommand):
             site.domain = "localhost:8000"
             site.name = "ThrillWiki Development"
             site.save()
-        self.stdout.write(f'{"Created" if _ else "Updated"} site: {site.domain}')
+        self.stdout.write(f"{'Created' if _ else 'Updated'} site: {site.domain}")
 
         # Create superuser if it doesn't exist
         if not User.objects.filter(username="admin").exists():
@@ -41,7 +41,7 @@ class Command(BaseCommand):
 Social auth setup instructions:
 
 1. Run the development server:
-   python manage.py runserver
+   uv run manage.py runserver_plus
 
 2. Go to the admin interface:
    http://localhost:8000/admin/

backend/apps/accounts/management/commands/setup_social_providers.py

@@ -0,0 +1,47 @@
+from django.core.management.base import BaseCommand
+from allauth.socialaccount.models import SocialApp
+from django.contrib.sites.models import Site
+
+
+class Command(BaseCommand):
+    help = "Set up social authentication providers for development"
+
+    def handle(self, *args, **options):
+        # Get the current site
+        site = Site.objects.get_current()
+        self.stdout.write(f"Setting up social providers for site: {site}")
+
+        # Clear existing social apps to avoid duplicates
+        deleted_count = SocialApp.objects.all().delete()[0]
+        self.stdout.write(f"Cleared {deleted_count} existing social apps")
+
+        # Create Google social app
+        google_app = SocialApp.objects.create(
+            provider="google",
+            name="Google",
+            client_id="demo-google-client-id.apps.googleusercontent.com",
+            secret="demo-google-client-secret",
+            key="",
+        )
+        google_app.sites.add(site)
+        self.stdout.write(self.style.SUCCESS("✅ Created Google social app"))
+
+        # Create Discord social app
+        discord_app = SocialApp.objects.create(
+            provider="discord",
+            name="Discord",
+            client_id="demo-discord-client-id",
+            secret="demo-discord-client-secret",
+            key="",
+        )
+        discord_app.sites.add(site)
+        self.stdout.write(self.style.SUCCESS("✅ Created Discord social app"))
+
+        # List all social apps
+        self.stdout.write("\nConfigured social apps:")
+        for app in SocialApp.objects.all():
+            self.stdout.write(f"- {app.name} ({app.provider}): {app.client_id}")
+
+        self.stdout.write(
+            self.style.SUCCESS(f"\nTotal social apps: {SocialApp.objects.count()}")
+        )

backend/apps/accounts/management/commands/update_social_apps_sites.py

@@ -19,5 +19,5 @@ class Command(BaseCommand):
             for site in sites:
                 app.sites.add(site)
             self.stdout.write(
-                f'Added sites: {", ".join(site.domain for site in sites)}'
+                f"Added sites: {', '.join(site.domain for site in sites)}"
             )

backend/apps/accounts/management/commands/verify_discord_settings.py

@@ -31,12 +31,9 @@ class Command(BaseCommand):
             self.stdout.write("\nOAuth2 settings in settings.py:")
             discord_settings = settings.SOCIALACCOUNT_PROVIDERS.get("discord", {})
             self.stdout.write(
-                f'PKCE Enabled: {
-                    discord_settings.get(
-                        "OAUTH_PKCE_ENABLED",
-                        False)}'
+                f"PKCE Enabled: {discord_settings.get('OAUTH_PKCE_ENABLED', False)}"
             )
-            self.stdout.write(f'Scopes: {discord_settings.get("SCOPE", [])}')
+            self.stdout.write(f"Scopes: {discord_settings.get('SCOPE', [])}")
 
         except SocialApp.DoesNotExist:
             self.stdout.write(self.style.ERROR("Discord app not found"))

backend/apps/accounts/migrations/0001_initial.py

@@ -11,7 +11,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [

backend/apps/accounts/migrations/0002_remove_toplistevent_pgh_context_and_more.py

@@ -0,0 +1,63 @@
+# Generated by Django 5.2.5 on 2025-08-24 18:23
+
+import pgtrigger.migrations
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="toplistevent",
+            name="pgh_context",
+        ),
+        migrations.RemoveField(
+            model_name="toplistevent",
+            name="pgh_obj",
+        ),
+        migrations.RemoveField(
+            model_name="toplistevent",
+            name="user",
+        ),
+        migrations.RemoveField(
+            model_name="toplistitemevent",
+            name="content_type",
+        ),
+        migrations.RemoveField(
+            model_name="toplistitemevent",
+            name="pgh_context",
+        ),
+        migrations.RemoveField(
+            model_name="toplistitemevent",
+            name="pgh_obj",
+        ),
+        migrations.RemoveField(
+            model_name="toplistitemevent",
+            name="top_list",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="toplist",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="toplist",
+            name="update_update",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="toplistitem",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="toplistitem",
+            name="update_update",
+        ),
+        migrations.DeleteModel(
+            name="TopListEvent",
+        ),
+        migrations.DeleteModel(
+            name="TopListItemEvent",
+        ),
+    ]

backend/apps/accounts/migrations/0003_emailverificationevent_passwordresetevent_userevent_and_more.py

@@ -0,0 +1,438 @@
+# Generated by Django 5.2.5 on 2025-08-24 19:11
+
+import django.contrib.auth.validators
+import django.db.models.deletion
+import django.utils.timezone
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0002_remove_toplistevent_pgh_context_and_more"),
+        ("pghistory", "0007_auto_20250421_0444"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="EmailVerificationEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                ("token", models.CharField(max_length=64)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("last_sent", models.DateTimeField(auto_now_add=True)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="PasswordResetEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                ("token", models.CharField(max_length=64)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("expires_at", models.DateTimeField()),
+                ("used", models.BooleanField(default=False)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="UserEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                ("password", models.CharField(max_length=128, verbose_name="password")),
+                (
+                    "last_login",
+                    models.DateTimeField(
+                        blank=True, null=True, verbose_name="last login"
+                    ),
+                ),
+                (
+                    "is_superuser",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Designates that this user has all permissions without explicitly assigning them.",
+                        verbose_name="superuser status",
+                    ),
+                ),
+                (
+                    "username",
+                    models.CharField(
+                        error_messages={
+                            "unique": "A user with that username already exists."
+                        },
+                        help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
+                        max_length=150,
+                        validators=[
+                            django.contrib.auth.validators.UnicodeUsernameValidator()
+                        ],
+                        verbose_name="username",
+                    ),
+                ),
+                (
+                    "first_name",
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="first name"
+                    ),
+                ),
+                (
+                    "last_name",
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="last name"
+                    ),
+                ),
+                (
+                    "email",
+                    models.EmailField(
+                        blank=True, max_length=254, verbose_name="email address"
+                    ),
+                ),
+                (
+                    "is_staff",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Designates whether the user can log into this admin site.",
+                        verbose_name="staff status",
+                    ),
+                ),
+                (
+                    "is_active",
+                    models.BooleanField(
+                        default=True,
+                        help_text="Designates whether this user should be treated as active. Unselect this instead of deleting accounts.",
+                        verbose_name="active",
+                    ),
+                ),
+                (
+                    "date_joined",
+                    models.DateTimeField(
+                        default=django.utils.timezone.now, verbose_name="date joined"
+                    ),
+                ),
+                (
+                    "user_id",
+                    models.CharField(
+                        editable=False,
+                        help_text="Unique identifier for this user that remains constant even if the username changes",
+                        max_length=10,
+                    ),
+                ),
+                (
+                    "role",
+                    models.CharField(
+                        choices=[
+                            ("USER", "User"),
+                            ("MODERATOR", "Moderator"),
+                            ("ADMIN", "Admin"),
+                            ("SUPERUSER", "Superuser"),
+                        ],
+                        default="USER",
+                        max_length=10,
+                    ),
+                ),
+                ("is_banned", models.BooleanField(default=False)),
+                ("ban_reason", models.TextField(blank=True)),
+                ("ban_date", models.DateTimeField(blank=True, null=True)),
+                (
+                    "pending_email",
+                    models.EmailField(blank=True, max_length=254, null=True),
+                ),
+                (
+                    "theme_preference",
+                    models.CharField(
+                        choices=[("light", "Light"), ("dark", "Dark")],
+                        default="light",
+                        max_length=5,
+                    ),
+                ),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="UserProfileEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                (
+                    "profile_id",
+                    models.CharField(
+                        editable=False,
+                        help_text="Unique identifier for this profile that remains constant",
+                        max_length=10,
+                    ),
+                ),
+                (
+                    "display_name",
+                    models.CharField(
+                        help_text="This is the name that will be displayed on the site",
+                        max_length=50,
+                    ),
+                ),
+                ("avatar", models.ImageField(blank=True, upload_to="avatars/")),
+                ("pronouns", models.CharField(blank=True, max_length=50)),
+                ("bio", models.TextField(blank=True, max_length=500)),
+                ("twitter", models.URLField(blank=True)),
+                ("instagram", models.URLField(blank=True)),
+                ("youtube", models.URLField(blank=True)),
+                ("discord", models.CharField(blank=True, max_length=100)),
+                ("coaster_credits", models.IntegerField(default=0)),
+                ("dark_ride_credits", models.IntegerField(default=0)),
+                ("flat_ride_credits", models.IntegerField(default=0)),
+                ("water_ride_credits", models.IntegerField(default=0)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="emailverification",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_emailverificationevent" ("created_at", "id", "last_sent", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "token", "user_id") VALUES (NEW."created_at", NEW."id", NEW."last_sent", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."token", NEW."user_id"); RETURN NULL;',
+                    hash="c485bf0cd5bea8a05ef2d4ae309b60eff42abd84",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_53748",
+                    table="accounts_emailverification",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="emailverification",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_emailverificationevent" ("created_at", "id", "last_sent", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "token", "user_id") VALUES (NEW."created_at", NEW."id", NEW."last_sent", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."token", NEW."user_id"); RETURN NULL;',
+                    hash="c20942bdc0713db74310da8da8c3138ca4c3bba9",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_7a2a8",
+                    table="accounts_emailverification",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="passwordreset",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_passwordresetevent" ("created_at", "expires_at", "id", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "token", "used", "user_id") VALUES (NEW."created_at", NEW."expires_at", NEW."id", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."token", NEW."used", NEW."user_id"); RETURN NULL;',
+                    hash="496ac059671b25460cdf2ca20d0e43b14d417a26",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_d2b72",
+                    table="accounts_passwordreset",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="passwordreset",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_passwordresetevent" ("created_at", "expires_at", "id", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "token", "used", "user_id") VALUES (NEW."created_at", NEW."expires_at", NEW."id", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."token", NEW."used", NEW."user_id"); RETURN NULL;',
+                    hash="c40acc416f85287b4a6fcc06724626707df90016",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_526d2",
+                    table="accounts_passwordreset",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userevent" ("ban_date", "ban_reason", "date_joined", "email", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "role", "theme_preference", "user_id", "username") VALUES (NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."email", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."role", NEW."theme_preference", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="b6992f02a4c1135fef9527e3f1ed330e2e626267",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_3867c",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userevent" ("ban_date", "ban_reason", "date_joined", "email", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "role", "theme_preference", "user_id", "username") VALUES (NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."email", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."role", NEW."theme_preference", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="6c3271b9f184dc137da7b9e42b0ae9f72d47c9c2",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_0e890",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userprofile",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userprofileevent" ("avatar", "bio", "coaster_credits", "dark_ride_credits", "discord", "display_name", "flat_ride_credits", "id", "instagram", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "profile_id", "pronouns", "twitter", "user_id", "water_ride_credits", "youtube") VALUES (NEW."avatar", NEW."bio", NEW."coaster_credits", NEW."dark_ride_credits", NEW."discord", NEW."display_name", NEW."flat_ride_credits", NEW."id", NEW."instagram", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."profile_id", NEW."pronouns", NEW."twitter", NEW."user_id", NEW."water_ride_credits", NEW."youtube"); RETURN NULL;',
+                    hash="af6a89f13ff879d978a1154bbcf4664de0fcf913",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_c09d7",
+                    table="accounts_userprofile",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userprofile",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userprofileevent" ("avatar", "bio", "coaster_credits", "dark_ride_credits", "discord", "display_name", "flat_ride_credits", "id", "instagram", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "profile_id", "pronouns", "twitter", "user_id", "water_ride_credits", "youtube") VALUES (NEW."avatar", NEW."bio", NEW."coaster_credits", NEW."dark_ride_credits", NEW."discord", NEW."display_name", NEW."flat_ride_credits", NEW."id", NEW."instagram", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."profile_id", NEW."pronouns", NEW."twitter", NEW."user_id", NEW."water_ride_credits", NEW."youtube"); RETURN NULL;',
+                    hash="37e99b5cc374ec0a3fc44d2482b411cba63fa84d",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_87ef6",
+                    table="accounts_userprofile",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        migrations.AddField(
+            model_name="emailverificationevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="emailverificationevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to="accounts.emailverification",
+            ),
+        ),
+        migrations.AddField(
+            model_name="emailverificationevent",
+            name="user",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="passwordresetevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="passwordresetevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to="accounts.passwordreset",
+            ),
+        ),
+        migrations.AddField(
+            model_name="passwordresetevent",
+            name="user",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="userprofileevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="userprofileevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to="accounts.userprofile",
+            ),
+        ),
+        migrations.AddField(
+            model_name="userprofileevent",
+            name="user",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0004_userdeletionrequest_userdeletionrequestevent_and_more.py

@@ -0,0 +1,219 @@
+# Generated by Django 5.2.5 on 2025-08-29 14:55
+
+import django.db.models.deletion
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        (
+            "accounts",
+            "0003_emailverificationevent_passwordresetevent_userevent_and_more",
+        ),
+        ("pghistory", "0007_auto_20250421_0444"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="UserDeletionRequest",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "verification_code",
+                    models.CharField(
+                        help_text="Unique verification code sent to user's email",
+                        max_length=32,
+                        unique=True,
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "expires_at",
+                    models.DateTimeField(
+                        help_text="When this deletion request expires"
+                    ),
+                ),
+                (
+                    "email_sent_at",
+                    models.DateTimeField(
+                        blank=True,
+                        help_text="When the verification email was sent",
+                        null=True,
+                    ),
+                ),
+                (
+                    "attempts",
+                    models.PositiveIntegerField(
+                        default=0, help_text="Number of verification attempts made"
+                    ),
+                ),
+                (
+                    "max_attempts",
+                    models.PositiveIntegerField(
+                        default=5,
+                        help_text="Maximum number of verification attempts allowed",
+                    ),
+                ),
+                (
+                    "is_used",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Whether this deletion request has been used",
+                    ),
+                ),
+                (
+                    "user",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="deletion_request",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ["-created_at"],
+            },
+        ),
+        migrations.CreateModel(
+            name="UserDeletionRequestEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                (
+                    "verification_code",
+                    models.CharField(
+                        help_text="Unique verification code sent to user's email",
+                        max_length=32,
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "expires_at",
+                    models.DateTimeField(
+                        help_text="When this deletion request expires"
+                    ),
+                ),
+                (
+                    "email_sent_at",
+                    models.DateTimeField(
+                        blank=True,
+                        help_text="When the verification email was sent",
+                        null=True,
+                    ),
+                ),
+                (
+                    "attempts",
+                    models.PositiveIntegerField(
+                        default=0, help_text="Number of verification attempts made"
+                    ),
+                ),
+                (
+                    "max_attempts",
+                    models.PositiveIntegerField(
+                        default=5,
+                        help_text="Maximum number of verification attempts allowed",
+                    ),
+                ),
+                (
+                    "is_used",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Whether this deletion request has been used",
+                    ),
+                ),
+                (
+                    "pgh_context",
+                    models.ForeignKey(
+                        db_constraint=False,
+                        null=True,
+                        on_delete=django.db.models.deletion.DO_NOTHING,
+                        related_name="+",
+                        to="pghistory.context",
+                    ),
+                ),
+                (
+                    "pgh_obj",
+                    models.ForeignKey(
+                        db_constraint=False,
+                        on_delete=django.db.models.deletion.DO_NOTHING,
+                        related_name="events",
+                        to="accounts.userdeletionrequest",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        db_constraint=False,
+                        on_delete=django.db.models.deletion.DO_NOTHING,
+                        related_name="+",
+                        related_query_name="+",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.AddIndex(
+            model_name="userdeletionrequest",
+            index=models.Index(
+                fields=["verification_code"], name="accounts_us_verific_94460d_idx"
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="userdeletionrequest",
+            index=models.Index(
+                fields=["expires_at"], name="accounts_us_expires_1d1dca_idx"
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="userdeletionrequest",
+            index=models.Index(
+                fields=["user", "is_used"], name="accounts_us_user_id_1ce18a_idx"
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userdeletionrequest",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userdeletionrequestevent" ("attempts", "created_at", "email_sent_at", "expires_at", "id", "is_used", "max_attempts", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "user_id", "verification_code") VALUES (NEW."attempts", NEW."created_at", NEW."email_sent_at", NEW."expires_at", NEW."id", NEW."is_used", NEW."max_attempts", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."user_id", NEW."verification_code"); RETURN NULL;',
+                    hash="c1735fe8eb50247b0afe2bea9d32f83c31da6419",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_b982c",
+                    table="accounts_userdeletionrequest",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userdeletionrequest",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userdeletionrequestevent" ("attempts", "created_at", "email_sent_at", "expires_at", "id", "is_used", "max_attempts", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "user_id", "verification_code") VALUES (NEW."attempts", NEW."created_at", NEW."email_sent_at", NEW."expires_at", NEW."id", NEW."is_used", NEW."max_attempts", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."user_id", NEW."verification_code"); RETURN NULL;',
+                    hash="6bf807ce3bed069ab30462d3fd7688a7593a7fd0",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_27723",
+                    table="accounts_userdeletionrequest",
+                    when="AFTER",
+                ),
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0005_remove_user_insert_insert_remove_user_update_update_and_more.py

@@ -0,0 +1,309 @@
+# Generated by Django 5.2.5 on 2025-08-29 15:10
+
+import django.utils.timezone
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0004_userdeletionrequest_userdeletionrequestevent_and_more"),
+    ]
+
+    operations = [
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="update_update",
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="activity_visibility",
+            field=models.CharField(
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="friends",
+                max_length=10,
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="allow_friend_requests",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="allow_messages",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="allow_profile_comments",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="email_notifications",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="last_password_change",
+            field=models.DateTimeField(
+                auto_now_add=True, default=django.utils.timezone.now
+            ),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="login_history_retention",
+            field=models.IntegerField(default=90),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="login_notifications",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="notification_preferences",
+            field=models.JSONField(
+                blank=True,
+                default=dict,
+                help_text="Detailed notification preferences stored as JSON",
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="privacy_level",
+            field=models.CharField(
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="public",
+                max_length=10,
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="push_notifications",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="search_visibility",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="session_timeout",
+            field=models.IntegerField(default=30),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_email",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_join_date",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_photos",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_real_name",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_reviews",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_statistics",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="show_top_lists",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="two_factor_enabled",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="activity_visibility",
+            field=models.CharField(
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="friends",
+                max_length=10,
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="allow_friend_requests",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="allow_messages",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="allow_profile_comments",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="email_notifications",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="last_password_change",
+            field=models.DateTimeField(
+                auto_now_add=True, default=django.utils.timezone.now
+            ),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="login_history_retention",
+            field=models.IntegerField(default=90),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="login_notifications",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="notification_preferences",
+            field=models.JSONField(
+                blank=True,
+                default=dict,
+                help_text="Detailed notification preferences stored as JSON",
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="privacy_level",
+            field=models.CharField(
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="public",
+                max_length=10,
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="push_notifications",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="search_visibility",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="session_timeout",
+            field=models.IntegerField(default=30),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_email",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_join_date",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_photos",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_real_name",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_reviews",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_statistics",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="show_top_lists",
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="two_factor_enabled",
+            field=models.BooleanField(default=False),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "email", "email_notifications", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."email", NEW."email_notifications", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="63ede44a0db376d673078f3464edc89aa8ca80c7",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_3867c",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "email", "email_notifications", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."email", NEW."email_notifications", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="9157131b568edafe1e5fcdf313bfeaaa8adcfee4",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_0e890",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0007_add_display_name_to_user.py

@@ -0,0 +1,88 @@
+# Generated by Django 5.2.5 on 2025-08-29 19:09
+
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0005_remove_user_insert_insert_remove_user_update_update_and_more"),
+    ]
+
+    operations = [
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="update_update",
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="display_name",
+            field=models.CharField(
+                blank=True,
+                help_text="Display name shown throughout the site. Falls back to username if not set.",
+                max_length=50,
+            ),
+        ),
+        migrations.AddField(
+            model_name="userevent",
+            name="display_name",
+            field=models.CharField(
+                blank=True,
+                help_text="Display name shown throughout the site. Falls back to username if not set.",
+                max_length=50,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userprofile",
+            name="display_name",
+            field=models.CharField(
+                blank=True,
+                help_text="Legacy display name field - use User.display_name instead",
+                max_length=50,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userprofileevent",
+            name="display_name",
+            field=models.CharField(
+                blank=True,
+                help_text="Legacy display name field - use User.display_name instead",
+                max_length=50,
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "display_name", "email", "email_notifications", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."display_name", NEW."email", NEW."email_notifications", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="97e02685f062c04c022f6975784dce80396d4371",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_3867c",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "display_name", "email", "email_notifications", "first_name", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_name", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."display_name", NEW."email", NEW."email_notifications", NEW."first_name", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_name", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="e074b317983a921b440b0c8754ba04a31ea513dd",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_0e890",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0008_remove_first_last_name_fields.py

@@ -0,0 +1,68 @@
+# Generated by Django 5.2.5 on 2025-08-29 21:32
+
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0007_add_display_name_to_user"),
+    ]
+
+    operations = [
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="user",
+            name="update_update",
+        ),
+        migrations.RemoveField(
+            model_name="user",
+            name="first_name",
+        ),
+        migrations.RemoveField(
+            model_name="user",
+            name="last_name",
+        ),
+        migrations.RemoveField(
+            model_name="userevent",
+            name="first_name",
+        ),
+        migrations.RemoveField(
+            model_name="userevent",
+            name="last_name",
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "display_name", "email", "email_notifications", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."display_name", NEW."email", NEW."email_notifications", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="1ffd9209b0e1949c05de2548585cda9179288b68",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_3867c",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="user",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userevent" ("activity_visibility", "allow_friend_requests", "allow_messages", "allow_profile_comments", "ban_date", "ban_reason", "date_joined", "display_name", "email", "email_notifications", "id", "is_active", "is_banned", "is_staff", "is_superuser", "last_login", "last_password_change", "login_history_retention", "login_notifications", "notification_preferences", "password", "pending_email", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "privacy_level", "push_notifications", "role", "search_visibility", "session_timeout", "show_email", "show_join_date", "show_photos", "show_real_name", "show_reviews", "show_statistics", "show_top_lists", "theme_preference", "two_factor_enabled", "user_id", "username") VALUES (NEW."activity_visibility", NEW."allow_friend_requests", NEW."allow_messages", NEW."allow_profile_comments", NEW."ban_date", NEW."ban_reason", NEW."date_joined", NEW."display_name", NEW."email", NEW."email_notifications", NEW."id", NEW."is_active", NEW."is_banned", NEW."is_staff", NEW."is_superuser", NEW."last_login", NEW."last_password_change", NEW."login_history_retention", NEW."login_notifications", NEW."notification_preferences", NEW."password", NEW."pending_email", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."privacy_level", NEW."push_notifications", NEW."role", NEW."search_visibility", NEW."session_timeout", NEW."show_email", NEW."show_join_date", NEW."show_photos", NEW."show_real_name", NEW."show_reviews", NEW."show_statistics", NEW."show_top_lists", NEW."theme_preference", NEW."two_factor_enabled", NEW."user_id", NEW."username"); RETURN NULL;',
+                    hash="e5f0a1acc20a9aad226004bc93ca8dbc3511052f",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_0e890",
+                    table="accounts_user",
+                    when="AFTER",
+                ),
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0009_notificationpreference_notificationpreferenceevent_and_more.py

@@ -0,0 +1,509 @@
+# Generated by Django 5.2.5 on 2025-08-30 20:55
+
+import django.db.models.deletion
+import pgtrigger.compiler
+import pgtrigger.migrations
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0008_remove_first_last_name_fields"),
+        ("contenttypes", "0002_remove_content_type_name"),
+        ("django_cloudflareimages_toolkit", "0001_initial"),
+        ("pghistory", "0007_auto_20250421_0444"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="NotificationPreference",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("submission_approved_email", models.BooleanField(default=True)),
+                ("submission_approved_push", models.BooleanField(default=True)),
+                ("submission_approved_inapp", models.BooleanField(default=True)),
+                ("submission_rejected_email", models.BooleanField(default=True)),
+                ("submission_rejected_push", models.BooleanField(default=True)),
+                ("submission_rejected_inapp", models.BooleanField(default=True)),
+                ("submission_pending_email", models.BooleanField(default=False)),
+                ("submission_pending_push", models.BooleanField(default=False)),
+                ("submission_pending_inapp", models.BooleanField(default=True)),
+                ("review_reply_email", models.BooleanField(default=True)),
+                ("review_reply_push", models.BooleanField(default=True)),
+                ("review_reply_inapp", models.BooleanField(default=True)),
+                ("review_helpful_email", models.BooleanField(default=False)),
+                ("review_helpful_push", models.BooleanField(default=True)),
+                ("review_helpful_inapp", models.BooleanField(default=True)),
+                ("friend_request_email", models.BooleanField(default=True)),
+                ("friend_request_push", models.BooleanField(default=True)),
+                ("friend_request_inapp", models.BooleanField(default=True)),
+                ("friend_accepted_email", models.BooleanField(default=False)),
+                ("friend_accepted_push", models.BooleanField(default=True)),
+                ("friend_accepted_inapp", models.BooleanField(default=True)),
+                ("message_received_email", models.BooleanField(default=True)),
+                ("message_received_push", models.BooleanField(default=True)),
+                ("message_received_inapp", models.BooleanField(default=True)),
+                ("system_announcement_email", models.BooleanField(default=True)),
+                ("system_announcement_push", models.BooleanField(default=False)),
+                ("system_announcement_inapp", models.BooleanField(default=True)),
+                ("account_security_email", models.BooleanField(default=True)),
+                ("account_security_push", models.BooleanField(default=True)),
+                ("account_security_inapp", models.BooleanField(default=True)),
+                ("feature_update_email", models.BooleanField(default=True)),
+                ("feature_update_push", models.BooleanField(default=False)),
+                ("feature_update_inapp", models.BooleanField(default=True)),
+                ("achievement_unlocked_email", models.BooleanField(default=False)),
+                ("achievement_unlocked_push", models.BooleanField(default=True)),
+                ("achievement_unlocked_inapp", models.BooleanField(default=True)),
+                ("milestone_reached_email", models.BooleanField(default=False)),
+                ("milestone_reached_push", models.BooleanField(default=True)),
+                ("milestone_reached_inapp", models.BooleanField(default=True)),
+            ],
+            options={
+                "verbose_name": "Notification Preference",
+                "verbose_name_plural": "Notification Preferences",
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="NotificationPreferenceEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("submission_approved_email", models.BooleanField(default=True)),
+                ("submission_approved_push", models.BooleanField(default=True)),
+                ("submission_approved_inapp", models.BooleanField(default=True)),
+                ("submission_rejected_email", models.BooleanField(default=True)),
+                ("submission_rejected_push", models.BooleanField(default=True)),
+                ("submission_rejected_inapp", models.BooleanField(default=True)),
+                ("submission_pending_email", models.BooleanField(default=False)),
+                ("submission_pending_push", models.BooleanField(default=False)),
+                ("submission_pending_inapp", models.BooleanField(default=True)),
+                ("review_reply_email", models.BooleanField(default=True)),
+                ("review_reply_push", models.BooleanField(default=True)),
+                ("review_reply_inapp", models.BooleanField(default=True)),
+                ("review_helpful_email", models.BooleanField(default=False)),
+                ("review_helpful_push", models.BooleanField(default=True)),
+                ("review_helpful_inapp", models.BooleanField(default=True)),
+                ("friend_request_email", models.BooleanField(default=True)),
+                ("friend_request_push", models.BooleanField(default=True)),
+                ("friend_request_inapp", models.BooleanField(default=True)),
+                ("friend_accepted_email", models.BooleanField(default=False)),
+                ("friend_accepted_push", models.BooleanField(default=True)),
+                ("friend_accepted_inapp", models.BooleanField(default=True)),
+                ("message_received_email", models.BooleanField(default=True)),
+                ("message_received_push", models.BooleanField(default=True)),
+                ("message_received_inapp", models.BooleanField(default=True)),
+                ("system_announcement_email", models.BooleanField(default=True)),
+                ("system_announcement_push", models.BooleanField(default=False)),
+                ("system_announcement_inapp", models.BooleanField(default=True)),
+                ("account_security_email", models.BooleanField(default=True)),
+                ("account_security_push", models.BooleanField(default=True)),
+                ("account_security_inapp", models.BooleanField(default=True)),
+                ("feature_update_email", models.BooleanField(default=True)),
+                ("feature_update_push", models.BooleanField(default=False)),
+                ("feature_update_inapp", models.BooleanField(default=True)),
+                ("achievement_unlocked_email", models.BooleanField(default=False)),
+                ("achievement_unlocked_push", models.BooleanField(default=True)),
+                ("achievement_unlocked_inapp", models.BooleanField(default=True)),
+                ("milestone_reached_email", models.BooleanField(default=False)),
+                ("milestone_reached_push", models.BooleanField(default=True)),
+                ("milestone_reached_inapp", models.BooleanField(default=True)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="UserNotification",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "notification_type",
+                    models.CharField(
+                        choices=[
+                            ("submission_approved", "Submission Approved"),
+                            ("submission_rejected", "Submission Rejected"),
+                            ("submission_pending", "Submission Pending Review"),
+                            ("review_reply", "Review Reply"),
+                            ("review_helpful", "Review Marked Helpful"),
+                            ("friend_request", "Friend Request"),
+                            ("friend_accepted", "Friend Request Accepted"),
+                            ("message_received", "Message Received"),
+                            ("profile_comment", "Profile Comment"),
+                            ("system_announcement", "System Announcement"),
+                            ("account_security", "Account Security"),
+                            ("feature_update", "Feature Update"),
+                            ("maintenance", "Maintenance Notice"),
+                            ("achievement_unlocked", "Achievement Unlocked"),
+                            ("milestone_reached", "Milestone Reached"),
+                        ],
+                        max_length=30,
+                    ),
+                ),
+                ("title", models.CharField(max_length=200)),
+                ("message", models.TextField()),
+                ("object_id", models.PositiveIntegerField(blank=True, null=True)),
+                (
+                    "priority",
+                    models.CharField(
+                        choices=[
+                            ("low", "Low"),
+                            ("normal", "Normal"),
+                            ("high", "High"),
+                            ("urgent", "Urgent"),
+                        ],
+                        default="normal",
+                        max_length=10,
+                    ),
+                ),
+                ("is_read", models.BooleanField(default=False)),
+                ("read_at", models.DateTimeField(blank=True, null=True)),
+                ("email_sent", models.BooleanField(default=False)),
+                ("email_sent_at", models.DateTimeField(blank=True, null=True)),
+                ("push_sent", models.BooleanField(default=False)),
+                ("push_sent_at", models.DateTimeField(blank=True, null=True)),
+                ("extra_data", models.JSONField(blank=True, default=dict)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("expires_at", models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                "ordering": ["-created_at"],
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="UserNotificationEvent",
+            fields=[
+                ("pgh_id", models.AutoField(primary_key=True, serialize=False)),
+                ("pgh_created_at", models.DateTimeField(auto_now_add=True)),
+                ("pgh_label", models.TextField(help_text="The event label.")),
+                ("id", models.BigIntegerField()),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "notification_type",
+                    models.CharField(
+                        choices=[
+                            ("submission_approved", "Submission Approved"),
+                            ("submission_rejected", "Submission Rejected"),
+                            ("submission_pending", "Submission Pending Review"),
+                            ("review_reply", "Review Reply"),
+                            ("review_helpful", "Review Marked Helpful"),
+                            ("friend_request", "Friend Request"),
+                            ("friend_accepted", "Friend Request Accepted"),
+                            ("message_received", "Message Received"),
+                            ("profile_comment", "Profile Comment"),
+                            ("system_announcement", "System Announcement"),
+                            ("account_security", "Account Security"),
+                            ("feature_update", "Feature Update"),
+                            ("maintenance", "Maintenance Notice"),
+                            ("achievement_unlocked", "Achievement Unlocked"),
+                            ("milestone_reached", "Milestone Reached"),
+                        ],
+                        max_length=30,
+                    ),
+                ),
+                ("title", models.CharField(max_length=200)),
+                ("message", models.TextField()),
+                ("object_id", models.PositiveIntegerField(blank=True, null=True)),
+                (
+                    "priority",
+                    models.CharField(
+                        choices=[
+                            ("low", "Low"),
+                            ("normal", "Normal"),
+                            ("high", "High"),
+                            ("urgent", "Urgent"),
+                        ],
+                        default="normal",
+                        max_length=10,
+                    ),
+                ),
+                ("is_read", models.BooleanField(default=False)),
+                ("read_at", models.DateTimeField(blank=True, null=True)),
+                ("email_sent", models.BooleanField(default=False)),
+                ("email_sent_at", models.DateTimeField(blank=True, null=True)),
+                ("push_sent", models.BooleanField(default=False)),
+                ("push_sent_at", models.DateTimeField(blank=True, null=True)),
+                ("extra_data", models.JSONField(blank=True, default=dict)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("expires_at", models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="userprofile",
+            name="insert_insert",
+        ),
+        pgtrigger.migrations.RemoveTrigger(
+            model_name="userprofile",
+            name="update_update",
+        ),
+        migrations.AlterField(
+            model_name="userprofile",
+            name="avatar",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                to="django_cloudflareimages_toolkit.cloudflareimage",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userprofileevent",
+            name="avatar",
+            field=models.ForeignKey(
+                blank=True,
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to="django_cloudflareimages_toolkit.cloudflareimage",
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userprofile",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_userprofileevent" ("avatar_id", "bio", "coaster_credits", "dark_ride_credits", "discord", "display_name", "flat_ride_credits", "id", "instagram", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "profile_id", "pronouns", "twitter", "user_id", "water_ride_credits", "youtube") VALUES (NEW."avatar_id", NEW."bio", NEW."coaster_credits", NEW."dark_ride_credits", NEW."discord", NEW."display_name", NEW."flat_ride_credits", NEW."id", NEW."instagram", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."profile_id", NEW."pronouns", NEW."twitter", NEW."user_id", NEW."water_ride_credits", NEW."youtube"); RETURN NULL;',
+                    hash="a7ecdb1ac2821dea1fef4ec917eeaf6b8e4f09c8",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_c09d7",
+                    table="accounts_userprofile",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="userprofile",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_userprofileevent" ("avatar_id", "bio", "coaster_credits", "dark_ride_credits", "discord", "display_name", "flat_ride_credits", "id", "instagram", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "profile_id", "pronouns", "twitter", "user_id", "water_ride_credits", "youtube") VALUES (NEW."avatar_id", NEW."bio", NEW."coaster_credits", NEW."dark_ride_credits", NEW."discord", NEW."display_name", NEW."flat_ride_credits", NEW."id", NEW."instagram", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."profile_id", NEW."pronouns", NEW."twitter", NEW."user_id", NEW."water_ride_credits", NEW."youtube"); RETURN NULL;',
+                    hash="81607e492ffea2a4c741452b860ee660374cc01d",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_87ef6",
+                    table="accounts_userprofile",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        migrations.AddField(
+            model_name="notificationpreference",
+            name="user",
+            field=models.OneToOneField(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="notification_preference",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="notificationpreferenceevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="notificationpreferenceevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to="accounts.notificationpreference",
+            ),
+        ),
+        migrations.AddField(
+            model_name="notificationpreferenceevent",
+            name="user",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotification",
+            name="content_type",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                to="contenttypes.contenttype",
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotification",
+            name="user",
+            field=models.ForeignKey(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="notifications",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotificationevent",
+            name="content_type",
+            field=models.ForeignKey(
+                blank=True,
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to="contenttypes.contenttype",
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotificationevent",
+            name="pgh_context",
+            field=models.ForeignKey(
+                db_constraint=False,
+                null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                to="pghistory.context",
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotificationevent",
+            name="pgh_obj",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="events",
+                to="accounts.usernotification",
+            ),
+        ),
+        migrations.AddField(
+            model_name="usernotificationevent",
+            name="user",
+            field=models.ForeignKey(
+                db_constraint=False,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name="+",
+                related_query_name="+",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="notificationpreference",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_notificationpreferenceevent" ("account_security_email", "account_security_inapp", "account_security_push", "achievement_unlocked_email", "achievement_unlocked_inapp", "achievement_unlocked_push", "created_at", "feature_update_email", "feature_update_inapp", "feature_update_push", "friend_accepted_email", "friend_accepted_inapp", "friend_accepted_push", "friend_request_email", "friend_request_inapp", "friend_request_push", "id", "message_received_email", "message_received_inapp", "message_received_push", "milestone_reached_email", "milestone_reached_inapp", "milestone_reached_push", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "review_helpful_email", "review_helpful_inapp", "review_helpful_push", "review_reply_email", "review_reply_inapp", "review_reply_push", "submission_approved_email", "submission_approved_inapp", "submission_approved_push", "submission_pending_email", "submission_pending_inapp", "submission_pending_push", "submission_rejected_email", "submission_rejected_inapp", "submission_rejected_push", "system_announcement_email", "system_announcement_inapp", "system_announcement_push", "updated_at", "user_id") VALUES (NEW."account_security_email", NEW."account_security_inapp", NEW."account_security_push", NEW."achievement_unlocked_email", NEW."achievement_unlocked_inapp", NEW."achievement_unlocked_push", NEW."created_at", NEW."feature_update_email", NEW."feature_update_inapp", NEW."feature_update_push", NEW."friend_accepted_email", NEW."friend_accepted_inapp", NEW."friend_accepted_push", NEW."friend_request_email", NEW."friend_request_inapp", NEW."friend_request_push", NEW."id", NEW."message_received_email", NEW."message_received_inapp", NEW."message_received_push", NEW."milestone_reached_email", NEW."milestone_reached_inapp", NEW."milestone_reached_push", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."review_helpful_email", NEW."review_helpful_inapp", NEW."review_helpful_push", NEW."review_reply_email", NEW."review_reply_inapp", NEW."review_reply_push", NEW."submission_approved_email", NEW."submission_approved_inapp", NEW."submission_approved_push", NEW."submission_pending_email", NEW."submission_pending_inapp", NEW."submission_pending_push", NEW."submission_rejected_email", NEW."submission_rejected_inapp", NEW."submission_rejected_push", NEW."system_announcement_email", NEW."system_announcement_inapp", NEW."system_announcement_push", NEW."updated_at", NEW."user_id"); RETURN NULL;',
+                    hash="bbaa03794722dab95c97ed93731d8b55f314dbdc",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_4a06b",
+                    table="accounts_notificationpreference",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="notificationpreference",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_notificationpreferenceevent" ("account_security_email", "account_security_inapp", "account_security_push", "achievement_unlocked_email", "achievement_unlocked_inapp", "achievement_unlocked_push", "created_at", "feature_update_email", "feature_update_inapp", "feature_update_push", "friend_accepted_email", "friend_accepted_inapp", "friend_accepted_push", "friend_request_email", "friend_request_inapp", "friend_request_push", "id", "message_received_email", "message_received_inapp", "message_received_push", "milestone_reached_email", "milestone_reached_inapp", "milestone_reached_push", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "review_helpful_email", "review_helpful_inapp", "review_helpful_push", "review_reply_email", "review_reply_inapp", "review_reply_push", "submission_approved_email", "submission_approved_inapp", "submission_approved_push", "submission_pending_email", "submission_pending_inapp", "submission_pending_push", "submission_rejected_email", "submission_rejected_inapp", "submission_rejected_push", "system_announcement_email", "system_announcement_inapp", "system_announcement_push", "updated_at", "user_id") VALUES (NEW."account_security_email", NEW."account_security_inapp", NEW."account_security_push", NEW."achievement_unlocked_email", NEW."achievement_unlocked_inapp", NEW."achievement_unlocked_push", NEW."created_at", NEW."feature_update_email", NEW."feature_update_inapp", NEW."feature_update_push", NEW."friend_accepted_email", NEW."friend_accepted_inapp", NEW."friend_accepted_push", NEW."friend_request_email", NEW."friend_request_inapp", NEW."friend_request_push", NEW."id", NEW."message_received_email", NEW."message_received_inapp", NEW."message_received_push", NEW."milestone_reached_email", NEW."milestone_reached_inapp", NEW."milestone_reached_push", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."review_helpful_email", NEW."review_helpful_inapp", NEW."review_helpful_push", NEW."review_reply_email", NEW."review_reply_inapp", NEW."review_reply_push", NEW."submission_approved_email", NEW."submission_approved_inapp", NEW."submission_approved_push", NEW."submission_pending_email", NEW."submission_pending_inapp", NEW."submission_pending_push", NEW."submission_rejected_email", NEW."submission_rejected_inapp", NEW."submission_rejected_push", NEW."system_announcement_email", NEW."system_announcement_inapp", NEW."system_announcement_push", NEW."updated_at", NEW."user_id"); RETURN NULL;',
+                    hash="0de72b66f87f795aaeb49be8e4e57d632781bd3a",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_d3fc0",
+                    table="accounts_notificationpreference",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="usernotification",
+            index=models.Index(
+                fields=["user", "is_read"], name="accounts_us_user_id_785929_idx"
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="usernotification",
+            index=models.Index(
+                fields=["user", "notification_type"],
+                name="accounts_us_user_id_8cea97_idx",
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="usernotification",
+            index=models.Index(
+                fields=["created_at"], name="accounts_us_created_a62f54_idx"
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="usernotification",
+            index=models.Index(
+                fields=["expires_at"], name="accounts_us_expires_f267b1_idx"
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="usernotification",
+            trigger=pgtrigger.compiler.Trigger(
+                name="insert_insert",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    func='INSERT INTO "accounts_usernotificationevent" ("content_type_id", "created_at", "email_sent", "email_sent_at", "expires_at", "extra_data", "id", "is_read", "message", "notification_type", "object_id", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "priority", "push_sent", "push_sent_at", "read_at", "title", "updated_at", "user_id") VALUES (NEW."content_type_id", NEW."created_at", NEW."email_sent", NEW."email_sent_at", NEW."expires_at", NEW."extra_data", NEW."id", NEW."is_read", NEW."message", NEW."notification_type", NEW."object_id", _pgh_attach_context(), NOW(), \'insert\', NEW."id", NEW."priority", NEW."push_sent", NEW."push_sent_at", NEW."read_at", NEW."title", NEW."updated_at", NEW."user_id"); RETURN NULL;',
+                    hash="822a189e675a5903841d19738c29aa94267417f1",
+                    operation="INSERT",
+                    pgid="pgtrigger_insert_insert_2794b",
+                    table="accounts_usernotification",
+                    when="AFTER",
+                ),
+            ),
+        ),
+        pgtrigger.migrations.AddTrigger(
+            model_name="usernotification",
+            trigger=pgtrigger.compiler.Trigger(
+                name="update_update",
+                sql=pgtrigger.compiler.UpsertTriggerSql(
+                    condition="WHEN (OLD.* IS DISTINCT FROM NEW.*)",
+                    func='INSERT INTO "accounts_usernotificationevent" ("content_type_id", "created_at", "email_sent", "email_sent_at", "expires_at", "extra_data", "id", "is_read", "message", "notification_type", "object_id", "pgh_context_id", "pgh_created_at", "pgh_label", "pgh_obj_id", "priority", "push_sent", "push_sent_at", "read_at", "title", "updated_at", "user_id") VALUES (NEW."content_type_id", NEW."created_at", NEW."email_sent", NEW."email_sent_at", NEW."expires_at", NEW."extra_data", NEW."id", NEW."is_read", NEW."message", NEW."notification_type", NEW."object_id", _pgh_attach_context(), NOW(), \'update\', NEW."id", NEW."priority", NEW."push_sent", NEW."push_sent_at", NEW."read_at", NEW."title", NEW."updated_at", NEW."user_id"); RETURN NULL;',
+                    hash="1fd24a77684747bd9a521447a2978529085b6c07",
+                    operation="UPDATE",
+                    pgid="pgtrigger_update_update_15c54",
+                    table="accounts_usernotification",
+                    when="AFTER",
+                ),
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0010_auto_20250830_1657.py

@@ -0,0 +1,106 @@
+# Generated by Django 5.2.5 on 2025-08-30 20:57
+
+from django.db import migrations, models
+
+
+def migrate_avatar_data(apps, schema_editor):
+    """
+    Migrate avatar data from old CloudflareImageField to new ForeignKey structure.
+    Since we're transitioning to a new system, we'll just drop the old avatar column
+    and add the new avatar_id column for ForeignKey relationships.
+    """
+    # This is a data migration - we'll handle the schema changes in the operations
+    pass
+
+
+def reverse_migrate_avatar_data(apps, schema_editor):
+    """
+    Reverse migration - not implemented as this is a one-way migration
+    """
+    pass
+
+
+def safe_add_avatar_field(apps, schema_editor):
+    """
+    Safely add avatar field, checking if it already exists.
+    """
+    # Check if the column already exists
+    with schema_editor.connection.cursor() as cursor:
+        cursor.execute("""
+            SELECT column_name 
+            FROM information_schema.columns 
+            WHERE table_name='accounts_userprofile' 
+            AND column_name='avatar_id'
+        """)
+        
+        column_exists = cursor.fetchone() is not None
+        
+        if not column_exists:
+            # Column doesn't exist, add it
+            UserProfile = apps.get_model('accounts', 'UserProfile')
+            field = models.ForeignKey(
+                'django_cloudflareimages_toolkit.CloudflareImage',
+                on_delete=models.SET_NULL,
+                null=True,
+                blank=True
+            )
+            field.set_attributes_from_name('avatar')
+            schema_editor.add_field(UserProfile, field)
+
+
+def reverse_safe_add_avatar_field(apps, schema_editor):
+    """
+    Reverse the safe avatar field addition.
+    """
+    # Check if the column exists and remove it
+    with schema_editor.connection.cursor() as cursor:
+        cursor.execute("""
+            SELECT column_name 
+            FROM information_schema.columns 
+            WHERE table_name='accounts_userprofile' 
+            AND column_name='avatar_id'
+        """)
+        
+        column_exists = cursor.fetchone() is not None
+        
+        if column_exists:
+            UserProfile = apps.get_model('accounts', 'UserProfile')
+            field = models.ForeignKey(
+                'django_cloudflareimages_toolkit.CloudflareImage',
+                on_delete=models.SET_NULL,
+                null=True,
+                blank=True
+            )
+            field.set_attributes_from_name('avatar')
+            schema_editor.remove_field(UserProfile, field)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        (
+            "accounts",
+            "0009_notificationpreference_notificationpreferenceevent_and_more",
+        ),
+        ("django_cloudflareimages_toolkit", "0001_initial"),
+    ]
+
+    operations = [
+        # First, remove the old avatar column (CloudflareImageField)
+        migrations.RunSQL(
+            "ALTER TABLE accounts_userprofile DROP COLUMN IF EXISTS avatar;",
+            reverse_sql="-- Cannot reverse this operation"
+        ),
+
+        # Safely add the new avatar_id column for ForeignKey
+        migrations.RunPython(
+            safe_add_avatar_field,
+            reverse_safe_add_avatar_field,
+        ),
+
+        # Run the data migration
+        migrations.RunPython(
+            migrate_avatar_data,
+            reverse_migrate_avatar_data,
+        ),
+    ]

backend/apps/accounts/migrations/0011_fix_userprofile_event_avatar_field.py

@@ -0,0 +1,37 @@
+# Generated manually on 2025-08-30 to fix pghistory event table schema
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0010_auto_20250830_1657'),
+        ('django_cloudflareimages_toolkit', '0001_initial'),
+    ]
+
+    operations = [
+        # Remove the old avatar field from the event table
+        migrations.RunSQL(
+            "ALTER TABLE accounts_userprofileevent DROP COLUMN IF EXISTS avatar;",
+            reverse_sql="-- Cannot reverse this operation"
+        ),
+
+        # Add the new avatar_id field to match the main table (only if it doesn't exist)
+        migrations.RunSQL(
+            """
+            DO $$
+            BEGIN
+                IF NOT EXISTS (
+                    SELECT column_name 
+                    FROM information_schema.columns 
+                    WHERE table_name='accounts_userprofileevent' 
+                    AND column_name='avatar_id'
+                ) THEN
+                    ALTER TABLE accounts_userprofileevent ADD COLUMN avatar_id uuid;
+                END IF;
+            END $$;
+            """,
+            reverse_sql="ALTER TABLE accounts_userprofileevent DROP COLUMN IF EXISTS avatar_id;"
+        ),
+    ]

backend/apps/accounts/migrations/0012_alter_toplist_category_and_more.py

@@ -0,0 +1,241 @@
+# Generated by Django 5.2.5 on 2025-09-15 17:35
+
+import apps.core.choices.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0011_fix_userprofile_event_avatar_field"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="toplist",
+            name="category",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="top_list_categories",
+                choices=[
+                    ("RC", "Roller Coaster"),
+                    ("DR", "Dark Ride"),
+                    ("FR", "Flat Ride"),
+                    ("WR", "Water Ride"),
+                    ("PK", "Park"),
+                ],
+                domain="accounts",
+                max_length=2,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="activity_visibility",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="privacy_levels",
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="friends",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="privacy_level",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="privacy_levels",
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="public",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="role",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="user_roles",
+                choices=[
+                    ("USER", "User"),
+                    ("MODERATOR", "Moderator"),
+                    ("ADMIN", "Admin"),
+                    ("SUPERUSER", "Superuser"),
+                ],
+                default="USER",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="theme_preference",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="theme_preferences",
+                choices=[("light", "Light"), ("dark", "Dark")],
+                default="light",
+                domain="accounts",
+                max_length=5,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userevent",
+            name="activity_visibility",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="privacy_levels",
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="friends",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userevent",
+            name="privacy_level",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="privacy_levels",
+                choices=[
+                    ("public", "Public"),
+                    ("friends", "Friends Only"),
+                    ("private", "Private"),
+                ],
+                default="public",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userevent",
+            name="role",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="user_roles",
+                choices=[
+                    ("USER", "User"),
+                    ("MODERATOR", "Moderator"),
+                    ("ADMIN", "Admin"),
+                    ("SUPERUSER", "Superuser"),
+                ],
+                default="USER",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="userevent",
+            name="theme_preference",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="theme_preferences",
+                choices=[("light", "Light"), ("dark", "Dark")],
+                default="light",
+                domain="accounts",
+                max_length=5,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="usernotification",
+            name="notification_type",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="notification_types",
+                choices=[
+                    ("submission_approved", "Submission Approved"),
+                    ("submission_rejected", "Submission Rejected"),
+                    ("submission_pending", "Submission Pending Review"),
+                    ("review_reply", "Review Reply"),
+                    ("review_helpful", "Review Marked Helpful"),
+                    ("friend_request", "Friend Request"),
+                    ("friend_accepted", "Friend Request Accepted"),
+                    ("message_received", "Message Received"),
+                    ("profile_comment", "Profile Comment"),
+                    ("system_announcement", "System Announcement"),
+                    ("account_security", "Account Security"),
+                    ("feature_update", "Feature Update"),
+                    ("maintenance", "Maintenance Notice"),
+                    ("achievement_unlocked", "Achievement Unlocked"),
+                    ("milestone_reached", "Milestone Reached"),
+                ],
+                domain="accounts",
+                max_length=30,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="usernotification",
+            name="priority",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="notification_priorities",
+                choices=[
+                    ("low", "Low"),
+                    ("normal", "Normal"),
+                    ("high", "High"),
+                    ("urgent", "Urgent"),
+                ],
+                default="normal",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="usernotificationevent",
+            name="notification_type",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="notification_types",
+                choices=[
+                    ("submission_approved", "Submission Approved"),
+                    ("submission_rejected", "Submission Rejected"),
+                    ("submission_pending", "Submission Pending Review"),
+                    ("review_reply", "Review Reply"),
+                    ("review_helpful", "Review Marked Helpful"),
+                    ("friend_request", "Friend Request"),
+                    ("friend_accepted", "Friend Request Accepted"),
+                    ("message_received", "Message Received"),
+                    ("profile_comment", "Profile Comment"),
+                    ("system_announcement", "System Announcement"),
+                    ("account_security", "Account Security"),
+                    ("feature_update", "Feature Update"),
+                    ("maintenance", "Maintenance Notice"),
+                    ("achievement_unlocked", "Achievement Unlocked"),
+                    ("milestone_reached", "Milestone Reached"),
+                ],
+                domain="accounts",
+                max_length=30,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="usernotificationevent",
+            name="priority",
+            field=apps.core.choices.fields.RichChoiceField(
+                allow_deprecated=False,
+                choice_group="notification_priorities",
+                choices=[
+                    ("low", "Low"),
+                    ("normal", "Normal"),
+                    ("high", "High"),
+                    ("urgent", "Urgent"),
+                ],
+                default="normal",
+                domain="accounts",
+                max_length=10,
+            ),
+        ),
+    ]

backend/apps/accounts/models.py

@@ -1,12 +1,16 @@
+from django.dispatch import receiver
+from django.db.models.signals import post_save
 from django.contrib.auth.models import AbstractUser
+from django.contrib.contenttypes.fields import GenericForeignKey
 from django.db import models
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
-import os
 import secrets
+from datetime import timedelta
+from django.utils import timezone
 from apps.core.history import TrackedModel
-
-# import pghistory
+from apps.core.choices import RichChoiceField
+import pghistory
 
 
 def generate_random_id(model_class, id_field):
@@ -23,16 +27,11 @@ def generate_random_id(model_class, id_field):
             return new_id
 
 
+@pghistory.track()
 class User(AbstractUser):
-    class Roles(models.TextChoices):
-        USER = "USER", _("User")
-        MODERATOR = "MODERATOR", _("Moderator")
-        ADMIN = "ADMIN", _("Admin")
-        SUPERUSER = "SUPERUSER", _("Superuser")
-
-    class ThemePreference(models.TextChoices):
-        LIGHT = "light", _("Light")
-        DARK = "dark", _("Dark")
+    # Override inherited fields to remove them
+    first_name = None
+    last_name = None
 
     # Read-only ID
     user_id = models.CharField(
@@ -45,19 +44,71 @@ class User(AbstractUser):
         ),
     )
 
-    role = models.CharField(
+    role = RichChoiceField(
+        choice_group="user_roles",
+        domain="accounts",
         max_length=10,
-        choices=Roles.choices,
-        default=Roles.USER,
+        default="USER",
     )
     is_banned = models.BooleanField(default=False)
     ban_reason = models.TextField(blank=True)
     ban_date = models.DateTimeField(null=True, blank=True)
     pending_email = models.EmailField(blank=True, null=True)
-    theme_preference = models.CharField(
+    theme_preference = RichChoiceField(
+        choice_group="theme_preferences",
+        domain="accounts",
         max_length=5,
-        choices=ThemePreference.choices,
-        default=ThemePreference.LIGHT,
+        default="light",
+    )
+
+    # Notification preferences
+    email_notifications = models.BooleanField(default=True)
+    push_notifications = models.BooleanField(default=False)
+
+    # Privacy settings
+    privacy_level = RichChoiceField(
+        choice_group="privacy_levels",
+        domain="accounts",
+        max_length=10,
+        default="public",
+    )
+    show_email = models.BooleanField(default=False)
+    show_real_name = models.BooleanField(default=True)
+    show_join_date = models.BooleanField(default=True)
+    show_statistics = models.BooleanField(default=True)
+    show_reviews = models.BooleanField(default=True)
+    show_photos = models.BooleanField(default=True)
+    show_top_lists = models.BooleanField(default=True)
+    allow_friend_requests = models.BooleanField(default=True)
+    allow_messages = models.BooleanField(default=True)
+    allow_profile_comments = models.BooleanField(default=False)
+    search_visibility = models.BooleanField(default=True)
+    activity_visibility = RichChoiceField(
+        choice_group="privacy_levels",
+        domain="accounts",
+        max_length=10,
+        default="friends",
+    )
+
+    # Security settings
+    two_factor_enabled = models.BooleanField(default=False)
+    login_notifications = models.BooleanField(default=True)
+    session_timeout = models.IntegerField(default=30)  # days
+    login_history_retention = models.IntegerField(default=90)  # days
+    last_password_change = models.DateTimeField(auto_now_add=True)
+
+    # Display name - core user data for better performance
+    display_name = models.CharField(
+        max_length=50,
+        blank=True,
+        help_text="Display name shown throughout the site. Falls back to username if not set.",
+    )
+
+    # Detailed notification preferences (JSON field for flexibility)
+    notification_preferences = models.JSONField(
+        default=dict,
+        blank=True,
+        help_text="Detailed notification preferences stored as JSON",
     )
 
     def __str__(self):
@@ -68,6 +119,9 @@ class User(AbstractUser):
 
     def get_display_name(self):
         """Get the user's display name, falling back to username if not set"""
+        if self.display_name:
+            return self.display_name
+        # Fallback to profile display_name for backward compatibility
         profile = getattr(self, "profile", None)
         if profile and profile.display_name:
             return profile.display_name
@@ -79,6 +133,7 @@ class User(AbstractUser):
         super().save(*args, **kwargs)
 
 
+@pghistory.track()
 class UserProfile(models.Model):
     # Read-only ID
     profile_id = models.CharField(
@@ -91,10 +146,15 @@ class UserProfile(models.Model):
     user = models.OneToOneField(User, on_delete=models.CASCADE, related_name="profile")
     display_name = models.CharField(
         max_length=50,
-        unique=True,
-        help_text="This is the name that will be displayed on the site",
+        blank=True,
+        help_text="Legacy display name field - use User.display_name instead",
+    )
+    avatar = models.ForeignKey(
+        'django_cloudflareimages_toolkit.CloudflareImage',
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True
     )
-    avatar = models.ImageField(upload_to="avatars/", blank=True)
     pronouns = models.CharField(max_length=50, blank=True)
 
     bio = models.TextField(max_length=500, blank=True)
@@ -111,18 +171,74 @@ class UserProfile(models.Model):
     flat_ride_credits = models.IntegerField(default=0)
     water_ride_credits = models.IntegerField(default=0)
 
-    def get_avatar(self):
+    def get_avatar_url(self):
         """
-        Return the avatar URL or serve a pre-generated avatar based on the
-        first letter of the username
+        Return the avatar URL or generate a default letter-based avatar URL
         """
-        if self.avatar:
-            return self.avatar.url
-        first_letter = self.user.username.upper()
-        avatar_path = f"avatars/letters/{first_letter}_avatar.png"
-        if os.path.exists(avatar_path):
-            return f"/{avatar_path}"
-        return "/static/images/default-avatar.png"
+        if self.avatar and self.avatar.is_uploaded:
+            # Try to get avatar variant first, fallback to public
+            avatar_url = self.avatar.get_url('avatar')
+            if avatar_url:
+                return avatar_url
+
+            # Fallback to public variant
+            public_url = self.avatar.get_url('public')
+            if public_url:
+                return public_url
+
+            # Last fallback - try any available variant
+            if self.avatar.variants:
+                if isinstance(self.avatar.variants, list) and self.avatar.variants:
+                    return self.avatar.variants[0]
+                elif isinstance(self.avatar.variants, dict):
+                    # Return first available variant
+                    for variant_url in self.avatar.variants.values():
+                        if variant_url:
+                            return variant_url
+
+        # Generate default letter-based avatar using first letter of username
+        first_letter = self.user.username[0].upper() if self.user.username else "U"
+        # Use a service like UI Avatars or generate a simple colored avatar
+        return f"https://ui-avatars.com/api/?name={first_letter}&size=200&background=random&color=fff&bold=true"
+
+    def get_avatar_variants(self):
+        """
+        Return avatar variants for different use cases
+        """
+        if self.avatar and self.avatar.is_uploaded:
+            variants = {}
+
+            # Try to get specific variants
+            thumbnail_url = self.avatar.get_url('thumbnail')
+            avatar_url = self.avatar.get_url('avatar')
+            large_url = self.avatar.get_url('large')
+            public_url = self.avatar.get_url('public')
+
+            # Use specific variants if available, otherwise fallback to public or first available
+            fallback_url = public_url
+            if not fallback_url and self.avatar.variants:
+                if isinstance(self.avatar.variants, list) and self.avatar.variants:
+                    fallback_url = self.avatar.variants[0]
+                elif isinstance(self.avatar.variants, dict):
+                    fallback_url = next(iter(self.avatar.variants.values()), None)
+
+            variants = {
+                "thumbnail": thumbnail_url or fallback_url,
+                "avatar": avatar_url or fallback_url,
+                "large": large_url or fallback_url,
+            }
+
+            # Only return variants if we have at least one valid URL
+            if any(variants.values()):
+                return variants
+
+        # For default avatars, return the same URL for all variants
+        default_url = self.get_avatar_url()
+        return {
+            "thumbnail": default_url,
+            "avatar": default_url,
+            "large": default_url,
+        }
 
     def save(self, *args, **kwargs):
         # If no display name is set, use the username
@@ -137,6 +253,7 @@ class UserProfile(models.Model):
         return self.display_name
 
 
+@pghistory.track()
 class EmailVerification(models.Model):
     user = models.OneToOneField(User, on_delete=models.CASCADE)
     token = models.CharField(max_length=64, unique=True)
@@ -151,6 +268,7 @@ class EmailVerification(models.Model):
         verbose_name_plural = "Email Verifications"
 
 
+@pghistory.track()
 class PasswordReset(models.Model):
     user = models.ForeignKey(User, on_delete=models.CASCADE)
     token = models.CharField(max_length=64)
@@ -170,20 +288,17 @@ class PasswordReset(models.Model):
 
 
 class TopList(TrackedModel):
-    class Categories(models.TextChoices):
-        ROLLER_COASTER = "RC", _("Roller Coaster")
-        DARK_RIDE = "DR", _("Dark Ride")
-        FLAT_RIDE = "FR", _("Flat Ride")
-        WATER_RIDE = "WR", _("Water Ride")
-        PARK = "PK", _("Park")
-
     user = models.ForeignKey(
         User,
         on_delete=models.CASCADE,
         related_name="top_lists",  # Added related_name for User model access
     )
     title = models.CharField(max_length=100)
-    category = models.CharField(max_length=2, choices=Categories.choices)
+    category = RichChoiceField(
+        choice_group="top_list_categories",
+        domain="accounts",
+        max_length=2,
+    )
     description = models.TextField(blank=True)
     created_at = models.DateTimeField(auto_now_add=True)
     updated_at = models.DateTimeField(auto_now=True)
@@ -217,3 +332,307 @@ class TopListItem(TrackedModel):
 
     def __str__(self):
         return f"#{self.rank} in {self.top_list.title}"
+
+
+@pghistory.track()
+class UserDeletionRequest(models.Model):
+    """
+    Model to track user deletion requests with email verification.
+
+    When a user requests to delete their account, a verification code
+    is sent to their email. The deletion is only processed when they
+    provide the correct code.
+    """
+
+    user = models.OneToOneField(
+        User, on_delete=models.CASCADE, related_name="deletion_request"
+    )
+
+    verification_code = models.CharField(
+        max_length=32,
+        unique=True,
+        help_text="Unique verification code sent to user's email",
+    )
+
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField(help_text="When this deletion request expires")
+
+    email_sent_at = models.DateTimeField(
+        null=True, blank=True, help_text="When the verification email was sent"
+    )
+
+    attempts = models.PositiveIntegerField(
+        default=0, help_text="Number of verification attempts made"
+    )
+
+    max_attempts = models.PositiveIntegerField(
+        default=5, help_text="Maximum number of verification attempts allowed"
+    )
+
+    is_used = models.BooleanField(
+        default=False, help_text="Whether this deletion request has been used"
+    )
+
+    class Meta:
+        ordering = ["-created_at"]
+        indexes = [
+            models.Index(fields=["verification_code"]),
+            models.Index(fields=["expires_at"]),
+            models.Index(fields=["user", "is_used"]),
+        ]
+
+    def __str__(self):
+        return f"Deletion request for {self.user.username} - {self.verification_code}"
+
+    def save(self, *args, **kwargs):
+        if not self.verification_code:
+            self.verification_code = self.generate_verification_code()
+
+        if not self.expires_at:
+            # Deletion requests expire after 24 hours
+            self.expires_at = timezone.now() + timedelta(hours=24)
+
+        super().save(*args, **kwargs)
+
+    @staticmethod
+    def generate_verification_code():
+        """Generate a unique 8-character verification code."""
+        while True:
+            # Generate a random 8-character alphanumeric code
+            code = "".join(
+                secrets.choice("ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789") for _ in range(8)
+            )
+
+            # Ensure it's unique
+            if not UserDeletionRequest.objects.filter(verification_code=code).exists():
+                return code
+
+    def is_expired(self):
+        """Check if this deletion request has expired."""
+        return timezone.now() > self.expires_at
+
+    def is_valid(self):
+        """Check if this deletion request is still valid."""
+        return (
+            not self.is_used
+            and not self.is_expired()
+            and self.attempts < self.max_attempts
+        )
+
+    def increment_attempts(self):
+        """Increment the number of verification attempts."""
+        self.attempts += 1
+        self.save(update_fields=["attempts"])
+
+    def mark_as_used(self):
+        """Mark this deletion request as used."""
+        self.is_used = True
+        self.save(update_fields=["is_used"])
+
+    @classmethod
+    def cleanup_expired(cls):
+        """Remove expired deletion requests."""
+        expired_requests = cls.objects.filter(
+            expires_at__lt=timezone.now(), is_used=False
+        )
+        count = expired_requests.count()
+        expired_requests.delete()
+        return count
+
+
+@pghistory.track()
+class UserNotification(TrackedModel):
+    """
+    Model to store user notifications for various events.
+
+    This includes submission approvals, rejections, system announcements,
+    and other user-relevant notifications.
+    """
+
+    # Core fields
+    user = models.ForeignKey(
+        User, on_delete=models.CASCADE, related_name="notifications"
+    )
+
+    notification_type = RichChoiceField(
+        choice_group="notification_types",
+        domain="accounts",
+        max_length=30,
+    )
+
+    title = models.CharField(max_length=200)
+    message = models.TextField()
+
+    # Optional related object (submission, review, etc.)
+    content_type = models.ForeignKey(
+        "contenttypes.ContentType", on_delete=models.CASCADE, null=True, blank=True
+    )
+    object_id = models.PositiveIntegerField(null=True, blank=True)
+    related_object = GenericForeignKey("content_type", "object_id")
+
+    # Metadata
+    priority = RichChoiceField(
+        choice_group="notification_priorities",
+        domain="accounts",
+        max_length=10,
+        default="normal",
+    )
+
+    # Status tracking
+    is_read = models.BooleanField(default=False)
+    read_at = models.DateTimeField(null=True, blank=True)
+
+    # Delivery tracking
+    email_sent = models.BooleanField(default=False)
+    email_sent_at = models.DateTimeField(null=True, blank=True)
+    push_sent = models.BooleanField(default=False)
+    push_sent_at = models.DateTimeField(null=True, blank=True)
+
+    # Additional data (JSON field for flexibility)
+    extra_data = models.JSONField(default=dict, blank=True)
+
+    # Timestamps
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta(TrackedModel.Meta):
+        ordering = ["-created_at"]
+        indexes = [
+            models.Index(fields=["user", "is_read"]),
+            models.Index(fields=["user", "notification_type"]),
+            models.Index(fields=["created_at"]),
+            models.Index(fields=["expires_at"]),
+        ]
+
+    def __str__(self):
+        return f"{self.user.username}: {self.title}"
+
+    def mark_as_read(self):
+        """Mark notification as read."""
+        if not self.is_read:
+            self.is_read = True
+            self.read_at = timezone.now()
+            self.save(update_fields=["is_read", "read_at"])
+
+    def is_expired(self):
+        """Check if notification has expired."""
+        if not self.expires_at:
+            return False
+        return timezone.now() > self.expires_at
+
+    @classmethod
+    def cleanup_expired(cls):
+        """Remove expired notifications."""
+        expired_notifications = cls.objects.filter(expires_at__lt=timezone.now())
+        count = expired_notifications.count()
+        expired_notifications.delete()
+        return count
+
+    @classmethod
+    def mark_all_read_for_user(cls, user):
+        """Mark all notifications as read for a specific user."""
+        return cls.objects.filter(user=user, is_read=False).update(
+            is_read=True, read_at=timezone.now()
+        )
+
+
+@pghistory.track()
+class NotificationPreference(TrackedModel):
+    """
+    User preferences for different types of notifications.
+
+    This allows users to control which notifications they receive
+    and through which channels (email, push, in-app).
+    """
+
+    user = models.OneToOneField(
+        User, on_delete=models.CASCADE, related_name="notification_preference"
+    )
+
+    # Submission notifications
+    submission_approved_email = models.BooleanField(default=True)
+    submission_approved_push = models.BooleanField(default=True)
+    submission_approved_inapp = models.BooleanField(default=True)
+
+    submission_rejected_email = models.BooleanField(default=True)
+    submission_rejected_push = models.BooleanField(default=True)
+    submission_rejected_inapp = models.BooleanField(default=True)
+
+    submission_pending_email = models.BooleanField(default=False)
+    submission_pending_push = models.BooleanField(default=False)
+    submission_pending_inapp = models.BooleanField(default=True)
+
+    # Review notifications
+    review_reply_email = models.BooleanField(default=True)
+    review_reply_push = models.BooleanField(default=True)
+    review_reply_inapp = models.BooleanField(default=True)
+
+    review_helpful_email = models.BooleanField(default=False)
+    review_helpful_push = models.BooleanField(default=True)
+    review_helpful_inapp = models.BooleanField(default=True)
+
+    # Social notifications
+    friend_request_email = models.BooleanField(default=True)
+    friend_request_push = models.BooleanField(default=True)
+    friend_request_inapp = models.BooleanField(default=True)
+
+    friend_accepted_email = models.BooleanField(default=False)
+    friend_accepted_push = models.BooleanField(default=True)
+    friend_accepted_inapp = models.BooleanField(default=True)
+
+    message_received_email = models.BooleanField(default=True)
+    message_received_push = models.BooleanField(default=True)
+    message_received_inapp = models.BooleanField(default=True)
+
+    # System notifications
+    system_announcement_email = models.BooleanField(default=True)
+    system_announcement_push = models.BooleanField(default=False)
+    system_announcement_inapp = models.BooleanField(default=True)
+
+    account_security_email = models.BooleanField(default=True)
+    account_security_push = models.BooleanField(default=True)
+    account_security_inapp = models.BooleanField(default=True)
+
+    feature_update_email = models.BooleanField(default=True)
+    feature_update_push = models.BooleanField(default=False)
+    feature_update_inapp = models.BooleanField(default=True)
+
+    # Achievement notifications
+    achievement_unlocked_email = models.BooleanField(default=False)
+    achievement_unlocked_push = models.BooleanField(default=True)
+    achievement_unlocked_inapp = models.BooleanField(default=True)
+
+    milestone_reached_email = models.BooleanField(default=False)
+    milestone_reached_push = models.BooleanField(default=True)
+    milestone_reached_inapp = models.BooleanField(default=True)
+
+    class Meta(TrackedModel.Meta):
+        verbose_name = "Notification Preference"
+        verbose_name_plural = "Notification Preferences"
+
+    def __str__(self):
+        return f"Notification preferences for {self.user.username}"
+
+    def should_send_notification(self, notification_type, channel):
+        """
+        Check if a notification should be sent for a specific type and channel.
+
+        Args:
+            notification_type: The type of notification (from UserNotification.NotificationType)
+            channel: The delivery channel ('email', 'push', 'inapp')
+
+        Returns:
+            bool: True if notification should be sent, False otherwise
+        """
+        field_name = f"{notification_type}_{channel}"
+        return getattr(self, field_name, False)
+
+
+# Signal handlers for automatic notification preference creation
+
+
+@receiver(post_save, sender=User)
+def create_notification_preference(sender, instance, created, **kwargs):
+    """Create notification preferences when a new user is created."""
+    if created:
+        NotificationPreference.objects.create(user=instance)

backend/apps/accounts/models_temp.py

@@ -1,208 +0,0 @@
-from django.contrib.auth.models import AbstractUser
-from django.db import models
-from django.urls import reverse
-from django.utils.translation import gettext_lazy as _
-import os
-import secrets
-from apps.core.history import TrackedModel
-import pghistory
-
-
-def generate_random_id(model_class, id_field):
-    """Generate a random ID starting at 4 digits, expanding to 5 if needed"""
-    while True:
-        # Try to get a 4-digit number first
-        new_id = str(secrets.SystemRandom().randint(1000, 9999))
-        if not model_class.objects.filter(**{id_field: new_id}).exists():
-            return new_id
-
-        # If all 4-digit numbers are taken, try 5 digits
-        new_id = str(secrets.SystemRandom().randint(10000, 99999))
-        if not model_class.objects.filter(**{id_field: new_id}).exists():
-            return new_id
-
-
-class User(AbstractUser):
-    class Roles(models.TextChoices):
-        USER = "USER", _("User")
-        MODERATOR = "MODERATOR", _("Moderator")
-        ADMIN = "ADMIN", _("Admin")
-        SUPERUSER = "SUPERUSER", _("Superuser")
-
-    class ThemePreference(models.TextChoices):
-        LIGHT = "light", _("Light")
-        DARK = "dark", _("Dark")
-
-    # Read-only ID
-    user_id = models.CharField(
-        max_length=10,
-        unique=True,
-        editable=False,
-        help_text="Unique identifier for this user that remains constant even if the username changes",
-    )
-
-    role = models.CharField(
-        max_length=10,
-        choices=Roles.choices,
-        default=Roles.USER,
-    )
-    is_banned = models.BooleanField(default=False)
-    ban_reason = models.TextField(blank=True)
-    ban_date = models.DateTimeField(null=True, blank=True)
-    pending_email = models.EmailField(blank=True, null=True)
-    theme_preference = models.CharField(
-        max_length=5,
-        choices=ThemePreference.choices,
-        default=ThemePreference.LIGHT,
-    )
-
-    def __str__(self):
-        return self.get_display_name()
-
-    def get_absolute_url(self):
-        return reverse("profile", kwargs={"username": self.username})
-
-    def get_display_name(self):
-        """Get the user's display name, falling back to username if not set"""
-        profile = getattr(self, "profile", None)
-        if profile and profile.display_name:
-            return profile.display_name
-        return self.username
-
-    def save(self, *args, **kwargs):
-        if not self.user_id:
-            self.user_id = generate_random_id(User, "user_id")
-        super().save(*args, **kwargs)
-
-
-class UserProfile(models.Model):
-    # Read-only ID
-    profile_id = models.CharField(
-        max_length=10,
-        unique=True,
-        editable=False,
-        help_text="Unique identifier for this profile that remains constant",
-    )
-
-    user = models.OneToOneField(User, on_delete=models.CASCADE, related_name="profile")
-    display_name = models.CharField(
-        max_length=50,
-        unique=True,
-        help_text="This is the name that will be displayed on the site",
-    )
-    avatar = models.ImageField(upload_to="avatars/", blank=True)
-    pronouns = models.CharField(max_length=50, blank=True)
-
-    bio = models.TextField(max_length=500, blank=True)
-
-    # Social media links
-    twitter = models.URLField(blank=True)
-    instagram = models.URLField(blank=True)
-    youtube = models.URLField(blank=True)
-    discord = models.CharField(max_length=100, blank=True)
-
-    # Ride statistics
-    coaster_credits = models.IntegerField(default=0)
-    dark_ride_credits = models.IntegerField(default=0)
-    flat_ride_credits = models.IntegerField(default=0)
-    water_ride_credits = models.IntegerField(default=0)
-
-    def get_avatar(self):
-        """Return the avatar URL or serve a pre-generated avatar based on the first letter of the username"""
-        if self.avatar:
-            return self.avatar.url
-        first_letter = self.user.username[0].upper()
-        avatar_path = f"avatars/letters/{first_letter}_avatar.png"
-        if os.path.exists(avatar_path):
-            return f"/{avatar_path}"
-        return "/static/images/default-avatar.png"
-
-    def save(self, *args, **kwargs):
-        # If no display name is set, use the username
-        if not self.display_name:
-            self.display_name = self.user.username
-
-        if not self.profile_id:
-            self.profile_id = generate_random_id(UserProfile, "profile_id")
-        super().save(*args, **kwargs)
-
-    def __str__(self):
-        return self.display_name
-
-
-class EmailVerification(models.Model):
-    user = models.OneToOneField(User, on_delete=models.CASCADE)
-    token = models.CharField(max_length=64, unique=True)
-    created_at = models.DateTimeField(auto_now_add=True)
-    last_sent = models.DateTimeField(auto_now_add=True)
-
-    def __str__(self):
-        return f"Email verification for {self.user.username}"
-
-    class Meta:
-        verbose_name = "Email Verification"
-        verbose_name_plural = "Email Verifications"
-
-
-class PasswordReset(models.Model):
-    user = models.ForeignKey(User, on_delete=models.CASCADE)
-    token = models.CharField(max_length=64)
-    created_at = models.DateTimeField(auto_now_add=True)
-    expires_at = models.DateTimeField()
-    used = models.BooleanField(default=False)
-
-    def __str__(self):
-        return f"Password reset for {self.user.username}"
-
-    class Meta:
-        verbose_name = "Password Reset"
-        verbose_name_plural = "Password Resets"
-
-
-@pghistory.track()
-class TopList(TrackedModel):
-    class Categories(models.TextChoices):
-        ROLLER_COASTER = "RC", _("Roller Coaster")
-        DARK_RIDE = "DR", _("Dark Ride")
-        FLAT_RIDE = "FR", _("Flat Ride")
-        WATER_RIDE = "WR", _("Water Ride")
-        PARK = "PK", _("Park")
-
-    user = models.ForeignKey(
-        User,
-        on_delete=models.CASCADE,
-        related_name="top_lists",  # Added related_name for User model access
-    )
-    title = models.CharField(max_length=100)
-    category = models.CharField(max_length=2, choices=Categories.choices)
-    description = models.TextField(blank=True)
-    created_at = models.DateTimeField(auto_now_add=True)
-    updated_at = models.DateTimeField(auto_now=True)
-
-    class Meta(TrackedModel.Meta):
-        ordering = ["-updated_at"]
-
-    def __str__(self):
-        return (
-            f"{self.user.get_display_name()}'s {self.category} Top List: {self.title}"
-        )
-
-
-@pghistory.track()
-class TopListItem(TrackedModel):
-    top_list = models.ForeignKey(
-        TopList, on_delete=models.CASCADE, related_name="items"
-    )
-    content_type = models.ForeignKey(
-        "contenttypes.ContentType", on_delete=models.CASCADE
-    )
-    object_id = models.PositiveIntegerField()
-    rank = models.PositiveIntegerField()
-    notes = models.TextField(blank=True)
-
-    class Meta(TrackedModel.Meta):
-        ordering = ["rank"]
-        unique_together = [["top_list", "rank"]]
-
-    def __str__(self):
-        return f"#{self.rank} in {self.top_list.title}"

backend/apps/accounts/selectors.py

@@ -176,8 +176,7 @@ def user_search_autocomplete(*, query: str, limit: int = 10) -> QuerySet:
     """
     return User.objects.filter(
         Q(username__icontains=query)
-        | Q(first_name__icontains=query)
-        | Q(last_name__icontains=query),
+        | Q(display_name__icontains=query),
         is_active=True,
     ).order_by("username")[:limit]
 

backend/apps/accounts/serializers.py

@@ -0,0 +1,269 @@
+from rest_framework import serializers
+from django.contrib.auth import get_user_model
+from django.contrib.auth.password_validation import validate_password
+from django.utils.crypto import get_random_string
+from django.utils import timezone
+from datetime import timedelta
+from django.contrib.sites.shortcuts import get_current_site
+from .models import User, PasswordReset
+from django_forwardemail.services import EmailService
+from django.template.loader import render_to_string
+from typing import cast
+
+UserModel = get_user_model()
+
+
+class UserSerializer(serializers.ModelSerializer):
+    """
+    User serializer for API responses
+    """
+
+    avatar_url = serializers.SerializerMethodField()
+    display_name = serializers.SerializerMethodField()
+
+    class Meta:
+        model = User
+        fields = [
+            "id",
+            "username",
+            "email",
+            "display_name",
+            "date_joined",
+            "is_active",
+            "avatar_url",
+        ]
+        read_only_fields = ["id", "date_joined", "is_active"]
+
+    def get_avatar_url(self, obj) -> str | None:
+        """Get user avatar URL"""
+        if hasattr(obj, "profile") and obj.profile.avatar:
+            return obj.profile.avatar.url
+        return None
+
+    def get_display_name(self, obj) -> str:
+        """Get user display name"""
+        return obj.get_display_name()
+
+
+class LoginSerializer(serializers.Serializer):
+    """
+    Serializer for user login
+    """
+
+    username = serializers.CharField(
+        max_length=254, help_text="Username or email address"
+    )
+    password = serializers.CharField(
+        max_length=128, style={"input_type": "password"}, trim_whitespace=False
+    )
+
+    def validate(self, attrs):
+        username = attrs.get("username")
+        password = attrs.get("password")
+
+        if username and password:
+            return attrs
+
+        raise serializers.ValidationError("Must include username/email and password.")
+
+
+class SignupSerializer(serializers.ModelSerializer):
+    """
+    Serializer for user registration
+    """
+
+    password = serializers.CharField(
+        write_only=True,
+        validators=[validate_password],
+        style={"input_type": "password"},
+    )
+    password_confirm = serializers.CharField(
+        write_only=True, style={"input_type": "password"}
+    )
+
+    class Meta:
+        model = User
+        fields = [
+            "username",
+            "email",
+            "display_name",
+            "password",
+            "password_confirm",
+        ]
+        extra_kwargs = {
+            "password": {"write_only": True},
+            "email": {"required": True},
+            "display_name": {"required": True},
+        }
+
+    def validate_email(self, value):
+        """Validate email is unique (normalize and check case-insensitively)."""
+        normalized = value.strip().lower() if value is not None else value
+        if UserModel.objects.filter(email__iexact=normalized).exists():
+            raise serializers.ValidationError("A user with this email already exists.")
+        return normalized
+
+    def validate_username(self, value):
+        """Validate username is unique"""
+        if UserModel.objects.filter(username=value).exists():
+            raise serializers.ValidationError(
+                "A user with this username already exists."
+            )
+        return value
+
+    def validate(self, attrs):
+        """Validate passwords match"""
+        password = attrs.get("password")
+        password_confirm = attrs.get("password_confirm")
+
+        if password != password_confirm:
+            raise serializers.ValidationError(
+                {"password_confirm": "Passwords do not match."}
+            )
+
+        return attrs
+
+    def create(self, validated_data):
+        """Create user with validated data"""
+        validated_data.pop("password_confirm", None)
+        password = validated_data.pop("password")
+
+        user = UserModel.objects.create(**validated_data)
+        user.set_password(password)
+        user.save()
+
+        return user
+
+
+class PasswordResetSerializer(serializers.Serializer):
+    """
+    Serializer for password reset request
+    """
+
+    email = serializers.EmailField()
+
+    def validate_email(self, value):
+        """Normalize email and attach the user to the serializer when found (case-insensitive).
+
+        Returns the normalized email. Does not reveal whether the email exists.
+        """
+        normalized = value.strip().lower() if value is not None else value
+        try:
+            user = UserModel.objects.get(email__iexact=normalized)
+            self.user = user
+        except UserModel.DoesNotExist:
+            # Do not reveal whether the email exists; keep behavior unchanged.
+            pass
+        return normalized
+
+    def save(self, **kwargs):
+        """Send password reset email if user exists"""
+        if hasattr(self, "user"):
+            # Create password reset token
+            token = get_random_string(64)
+            PasswordReset.objects.update_or_create(
+                user=self.user,
+                defaults={
+                    "token": token,
+                    "expires_at": timezone.now() + timedelta(hours=24),
+                    "used": False,
+                },
+            )
+
+            # Send reset email
+            request = self.context.get("request")
+            if request:
+                site = get_current_site(request)
+                reset_url = f"{request.scheme}://{site.domain}/reset-password/{token}/"
+
+                context = {
+                    "user": self.user,
+                    "reset_url": reset_url,
+                    "site_name": site.name,
+                }
+
+                email_html = render_to_string(
+                    "accounts/email/password_reset.html", context
+                )
+
+                # Narrow and validate email type for the static checker
+                email = getattr(self.user, "email", None)
+                if not email:
+                    # No recipient email; skip sending
+                    return
+
+                EmailService.send_email(
+                    to=cast(str, email),
+                    subject="Reset your password",
+                    text=f"Click the link to reset your password: {reset_url}",
+                    site=site,
+                    html=email_html,
+                )
+
+
+class PasswordChangeSerializer(serializers.Serializer):
+    """
+    Serializer for password change
+    """
+
+    old_password = serializers.CharField(
+        max_length=128, style={"input_type": "password"}
+    )
+    new_password = serializers.CharField(
+        max_length=128, validators=[validate_password], style={"input_type": "password"}
+    )
+    new_password_confirm = serializers.CharField(
+        max_length=128, style={"input_type": "password"}
+    )
+
+    def validate_old_password(self, value):
+        """Validate old password is correct"""
+        user = self.context["request"].user
+        if not user.check_password(value):
+            raise serializers.ValidationError("Old password is incorrect.")
+        return value
+
+    def validate(self, attrs):
+        """Validate new passwords match"""
+        new_password = attrs.get("new_password")
+        new_password_confirm = attrs.get("new_password_confirm")
+
+        if new_password != new_password_confirm:
+            raise serializers.ValidationError(
+                {"new_password_confirm": "New passwords do not match."}
+            )
+
+        return attrs
+
+    def save(self, **kwargs):
+        """Change user password"""
+        user = self.context["request"].user
+
+        # Defensively obtain new_password from validated_data if it's a real dict,
+        # otherwise fall back to initial_data if that's a dict.
+        new_password = None
+        validated = getattr(self, "validated_data", None)
+        if isinstance(validated, dict):
+            new_password = validated.get("new_password")
+        elif isinstance(self.initial_data, dict):
+            new_password = self.initial_data.get("new_password")
+
+        if not new_password:
+            raise serializers.ValidationError("New password is required.")
+
+        user.set_password(new_password)
+        user.save()
+
+        return user
+
+
+class SocialProviderSerializer(serializers.Serializer):
+    """
+    Serializer for social authentication providers
+    """
+
+    id = serializers.CharField()
+    name = serializers.CharField()
+    login_url = serializers.URLField()
+    name = serializers.CharField()
+    login_url = serializers.URLField()

backend/apps/accounts/services.py

@@ -0,0 +1,366 @@
+"""
+User management services for ThrillWiki.
+
+This module contains services for user account management including
+user deletion while preserving submissions.
+"""
+
+from typing import Optional
+from django.db import transaction
+from django.utils import timezone
+from django.conf import settings
+from django.contrib.sites.models import Site
+from django_forwardemail.services import EmailService
+from .models import User, UserProfile, UserDeletionRequest
+
+
+class UserDeletionService:
+    """Service for handling user deletion while preserving submissions."""
+
+    DELETED_USER_USERNAME = "deleted_user"
+    DELETED_USER_EMAIL = "deleted@thrillwiki.com"
+    DELETED_DISPLAY_NAME = "Deleted User"
+
+    @classmethod
+    def get_or_create_deleted_user(cls) -> User:
+        """Get or create the system deleted user placeholder."""
+        deleted_user, created = User.objects.get_or_create(
+            username=cls.DELETED_USER_USERNAME,
+            defaults={
+                "email": cls.DELETED_USER_EMAIL,
+                "is_active": False,
+                "is_staff": False,
+                "is_superuser": False,
+                "role": User.Roles.USER,
+                "is_banned": True,
+                "ban_reason": "System placeholder for deleted users",
+                "ban_date": timezone.now(),
+            },
+        )
+
+        if created:
+            # Create profile for deleted user
+            UserProfile.objects.create(
+                user=deleted_user,
+                display_name=cls.DELETED_DISPLAY_NAME,
+                bio="This user account has been deleted.",
+            )
+
+        return deleted_user
+
+    @classmethod
+    @transaction.atomic
+    def delete_user_preserve_submissions(cls, user: User) -> dict:
+        """
+        Delete a user while preserving all their submissions.
+
+        This method:
+        1. Transfers all user submissions to a system "deleted_user" placeholder
+        2. Deletes the user's profile and account data
+        3. Returns a summary of what was preserved
+
+        Args:
+            user: The user to delete
+
+        Returns:
+            dict: Summary of preserved submissions
+        """
+        if user.username == cls.DELETED_USER_USERNAME:
+            raise ValueError("Cannot delete the system deleted user placeholder")
+
+        deleted_user = cls.get_or_create_deleted_user()
+
+        # Count submissions before transfer
+        submission_counts = {
+            "park_reviews": getattr(
+                user, "park_reviews", user.__class__.objects.none()
+            ).count(),
+            "ride_reviews": getattr(
+                user, "ride_reviews", user.__class__.objects.none()
+            ).count(),
+            "uploaded_park_photos": getattr(
+                user, "uploaded_park_photos", user.__class__.objects.none()
+            ).count(),
+            "uploaded_ride_photos": getattr(
+                user, "uploaded_ride_photos", user.__class__.objects.none()
+            ).count(),
+            "top_lists": getattr(
+                user, "top_lists", user.__class__.objects.none()
+            ).count(),
+            "edit_submissions": getattr(
+                user, "edit_submissions", user.__class__.objects.none()
+            ).count(),
+            "photo_submissions": getattr(
+                user, "photo_submissions", user.__class__.objects.none()
+            ).count(),
+            "moderated_park_reviews": getattr(
+                user, "moderated_park_reviews", user.__class__.objects.none()
+            ).count(),
+            "moderated_ride_reviews": getattr(
+                user, "moderated_ride_reviews", user.__class__.objects.none()
+            ).count(),
+            "handled_submissions": getattr(
+                user, "handled_submissions", user.__class__.objects.none()
+            ).count(),
+            "handled_photos": getattr(
+                user, "handled_photos", user.__class__.objects.none()
+            ).count(),
+        }
+
+        # Transfer all submissions to deleted user
+        # Reviews
+        if hasattr(user, "park_reviews"):
+            getattr(user, "park_reviews").update(user=deleted_user)
+        if hasattr(user, "ride_reviews"):
+            getattr(user, "ride_reviews").update(user=deleted_user)
+
+        # Photos
+        if hasattr(user, "uploaded_park_photos"):
+            getattr(user, "uploaded_park_photos").update(uploaded_by=deleted_user)
+        if hasattr(user, "uploaded_ride_photos"):
+            getattr(user, "uploaded_ride_photos").update(uploaded_by=deleted_user)
+
+        # Top Lists
+        if hasattr(user, "top_lists"):
+            getattr(user, "top_lists").update(user=deleted_user)
+
+        # Moderation submissions
+        if hasattr(user, "edit_submissions"):
+            getattr(user, "edit_submissions").update(user=deleted_user)
+        if hasattr(user, "photo_submissions"):
+            getattr(user, "photo_submissions").update(user=deleted_user)
+
+        # Moderation actions - these can be set to NULL since they're not user content
+        if hasattr(user, "moderated_park_reviews"):
+            getattr(user, "moderated_park_reviews").update(moderated_by=None)
+        if hasattr(user, "moderated_ride_reviews"):
+            getattr(user, "moderated_ride_reviews").update(moderated_by=None)
+        if hasattr(user, "handled_submissions"):
+            getattr(user, "handled_submissions").update(handled_by=None)
+        if hasattr(user, "handled_photos"):
+            getattr(user, "handled_photos").update(handled_by=None)
+
+        # Store user info for the summary
+        user_info = {
+            "username": user.username,
+            "user_id": user.user_id,
+            "email": user.email,
+            "date_joined": user.date_joined,
+        }
+
+        # Delete the user (this will cascade delete the profile)
+        user.delete()
+
+        return {
+            "deleted_user": user_info,
+            "preserved_submissions": submission_counts,
+            "transferred_to": {
+                "username": deleted_user.username,
+                "user_id": deleted_user.user_id,
+            },
+        }
+
+    @classmethod
+    def can_delete_user(cls, user: User) -> tuple[bool, Optional[str]]:
+        """
+        Check if a user can be safely deleted.
+
+        Args:
+            user: The user to check
+
+        Returns:
+            tuple: (can_delete: bool, reason: Optional[str])
+        """
+        if user.username == cls.DELETED_USER_USERNAME:
+            return False, "Cannot delete the system deleted user placeholder"
+
+        if user.is_superuser:
+            return False, "Superuser accounts cannot be deleted for security reasons. Please contact system administrator or remove superuser privileges first."
+
+        # Check if user has critical admin role
+        if user.role == User.Roles.ADMIN and user.is_staff:
+            return False, "Admin accounts with staff privileges cannot be deleted. Please remove admin privileges first or contact system administrator."
+
+        # Add any other business rules here
+
+        return True, None
+
+    @classmethod
+    def request_user_deletion(cls, user: User) -> UserDeletionRequest:
+        """
+        Create a user deletion request and send verification email.
+
+        Args:
+            user: The user requesting deletion
+
+        Returns:
+            UserDeletionRequest: The created deletion request
+        """
+        # Check if user can be deleted
+        can_delete, reason = cls.can_delete_user(user)
+        if not can_delete:
+            raise ValueError(f"Cannot delete user: {reason}")
+
+        # Remove any existing deletion request for this user
+        UserDeletionRequest.objects.filter(user=user).delete()
+
+        # Create new deletion request
+        deletion_request = UserDeletionRequest.objects.create(user=user)
+
+        # Send verification email
+        cls.send_deletion_verification_email(deletion_request)
+
+        return deletion_request
+
+    @classmethod
+    def send_deletion_verification_email(cls, deletion_request: UserDeletionRequest):
+        """
+        Send verification email for account deletion.
+
+        Args:
+            deletion_request: The deletion request to send email for
+        """
+        user = deletion_request.user
+
+        # Get current site for email service
+        try:
+            site = Site.objects.get_current()
+        except Site.DoesNotExist:
+            # Fallback to default site
+            site = Site.objects.get_or_create(
+                id=1, defaults={"domain": "localhost:8000", "name": "localhost:8000"}
+            )[0]
+
+        # Prepare email context
+        context = {
+            "user": user,
+            "verification_code": deletion_request.verification_code,
+            "expires_at": deletion_request.expires_at,
+            "site_name": getattr(settings, "SITE_NAME", "ThrillWiki"),
+            "frontend_domain": getattr(
+                settings, "FRONTEND_DOMAIN", "http://localhost:3000"
+            ),
+        }
+
+        # Render email content
+        subject = f"Confirm Account Deletion - {context['site_name']}"
+
+        # Create email message with 1-hour expiration notice
+        message = f"""
+Hello {user.get_display_name()},
+
+You have requested to delete your ThrillWiki account. To confirm this action, please use the following verification code:
+
+Verification Code: {deletion_request.verification_code}
+
+This code will expire in 1 hour on {deletion_request.expires_at.strftime('%B %d, %Y at %I:%M %p UTC')}.
+
+IMPORTANT: This action cannot be undone. Your account will be permanently deleted, but all your reviews, photos, and other contributions will be preserved on the site.
+
+If you did not request this deletion, please ignore this email and your account will remain active.
+
+To complete the deletion, enter the verification code in the account deletion form on our website.
+
+Best regards,
+The ThrillWiki Team
+        """.strip()
+
+        # Send email using custom email service
+        try:
+            EmailService.send_email(
+                to=user.email,
+                subject=subject,
+                text=message,
+                site=site,
+                from_email="no-reply@thrillwiki.com",
+            )
+
+            # Update email sent timestamp
+            deletion_request.email_sent_at = timezone.now()
+            deletion_request.save(update_fields=["email_sent_at"])
+
+        except Exception as e:
+            # Log the error but don't fail the request creation
+            print(f"Failed to send deletion verification email to {user.email}: {e}")
+
+    @classmethod
+    @transaction.atomic
+    def verify_and_delete_user(cls, verification_code: str) -> dict:
+        """
+        Verify deletion code and delete the user account.
+
+        Args:
+            verification_code: The verification code from the email
+
+        Returns:
+            dict: Summary of the deletion
+
+        Raises:
+            ValueError: If verification fails
+        """
+        try:
+            deletion_request = UserDeletionRequest.objects.get(
+                verification_code=verification_code
+            )
+        except UserDeletionRequest.DoesNotExist:
+            raise ValueError("Invalid verification code")
+
+        # Check if request is still valid
+        if not deletion_request.is_valid():
+            if deletion_request.is_expired():
+                raise ValueError("Verification code has expired")
+            elif deletion_request.is_used:
+                raise ValueError("Verification code has already been used")
+            elif deletion_request.attempts >= deletion_request.max_attempts:
+                raise ValueError("Too many verification attempts")
+            else:
+                raise ValueError("Invalid verification code")
+
+        # Increment attempts
+        deletion_request.increment_attempts()
+
+        # Mark as used
+        deletion_request.mark_as_used()
+
+        # Delete the user
+        user = deletion_request.user
+        result = cls.delete_user_preserve_submissions(user)
+
+        # Add deletion request info to result
+        result["deletion_request"] = {
+            "verification_code": verification_code,
+            "created_at": deletion_request.created_at,
+            "verified_at": timezone.now(),
+        }
+
+        return result
+
+    @classmethod
+    def cancel_deletion_request(cls, user: User) -> bool:
+        """
+        Cancel a pending deletion request.
+
+        Args:
+            user: The user whose deletion request to cancel
+
+        Returns:
+            bool: True if a request was cancelled, False if no request existed
+        """
+        try:
+            deletion_request = getattr(user, "deletion_request", None)
+            if deletion_request:
+                deletion_request.delete()
+                return True
+            return False
+        except UserDeletionRequest.DoesNotExist:
+            return False
+
+    @classmethod
+    def cleanup_expired_deletion_requests(cls) -> int:
+        """
+        Clean up expired deletion requests.
+
+        Returns:
+            int: Number of expired requests cleaned up
+        """
+        return UserDeletionRequest.cleanup_expired()

backend/apps/accounts/services/__init__.py

@@ -0,0 +1,11 @@
+"""
+Accounts Services Package
+
+This package contains business logic services for account management,
+including social provider management, user authentication, and profile services.
+"""
+
+from .social_provider_service import SocialProviderService
+from .user_deletion_service import UserDeletionService
+
+__all__ = ['SocialProviderService', 'UserDeletionService']

backend/apps/accounts/services/notification_service.py

@@ -0,0 +1,351 @@
+"""
+Notification service for creating and managing user notifications.
+
+This service handles the creation, delivery, and management of notifications
+for various events including submission approvals/rejections.
+"""
+
+from django.utils import timezone
+from django.contrib.contenttypes.models import ContentType
+from django.template.loader import render_to_string
+from django.conf import settings
+from django.db import models
+from typing import Optional, Dict, Any, List
+from datetime import datetime, timedelta
+import logging
+
+from apps.accounts.models import User, UserNotification, NotificationPreference
+from django_forwardemail.services import EmailService
+
+logger = logging.getLogger(__name__)
+
+
+class NotificationService:
+    """Service for creating and managing user notifications."""
+
+    @staticmethod
+    def create_notification(
+        user: User,
+        notification_type: str,
+        title: str,
+        message: str,
+        related_object: Optional[Any] = None,
+        priority: str = UserNotification.Priority.NORMAL,
+        extra_data: Optional[Dict[str, Any]] = None,
+        expires_at: Optional[datetime] = None,
+    ) -> UserNotification:
+        """
+        Create a new notification for a user.
+
+        Args:
+            user: The user to notify
+            notification_type: Type of notification (from UserNotification.NotificationType)
+            title: Notification title
+            message: Notification message
+            related_object: Optional related object (submission, review, etc.)
+            priority: Notification priority
+            extra_data: Additional data to store with notification
+            expires_at: When the notification expires
+
+        Returns:
+            UserNotification: The created notification
+        """
+        # Get content type and object ID if related object provided
+        content_type = None
+        object_id = None
+        if related_object:
+            content_type = ContentType.objects.get_for_model(related_object)
+            object_id = related_object.pk
+
+        # Create the notification
+        notification = UserNotification.objects.create(
+            user=user,
+            notification_type=notification_type,
+            title=title,
+            message=message,
+            content_type=content_type,
+            object_id=object_id,
+            priority=priority,
+            extra_data=extra_data or {},
+            expires_at=expires_at,
+        )
+
+        # Send notification through appropriate channels
+        NotificationService._send_notification(notification)
+
+        return notification
+
+    @staticmethod
+    def create_submission_approved_notification(
+        user: User,
+        submission_object: Any,
+        submission_type: str,
+        additional_message: str = "",
+    ) -> UserNotification:
+        """
+        Create a notification for submission approval.
+
+        Args:
+            user: User who submitted the content
+            submission_object: The approved submission object
+            submission_type: Type of submission (e.g., "park photo", "ride review")
+            additional_message: Additional message from moderator
+
+        Returns:
+            UserNotification: The created notification
+        """
+        title = f"Your {submission_type} has been approved!"
+        message = f"Great news! Your {submission_type} submission has been approved and is now live on ThrillWiki."
+
+        if additional_message:
+            message += f"\n\nModerator note: {additional_message}"
+
+        extra_data = {
+            "submission_type": submission_type,
+            "moderator_message": additional_message,
+            "approved_at": timezone.now().isoformat(),
+        }
+
+        return NotificationService.create_notification(
+            user=user,
+            notification_type=UserNotification.NotificationType.SUBMISSION_APPROVED,
+            title=title,
+            message=message,
+            related_object=submission_object,
+            priority=UserNotification.Priority.NORMAL,
+            extra_data=extra_data,
+        )
+
+    @staticmethod
+    def create_submission_rejected_notification(
+        user: User,
+        submission_object: Any,
+        submission_type: str,
+        rejection_reason: str,
+        additional_message: str = "",
+    ) -> UserNotification:
+        """
+        Create a notification for submission rejection.
+
+        Args:
+            user: User who submitted the content
+            submission_object: The rejected submission object
+            submission_type: Type of submission (e.g., "park photo", "ride review")
+            rejection_reason: Reason for rejection
+            additional_message: Additional message from moderator
+
+        Returns:
+            UserNotification: The created notification
+        """
+        title = f"Your {submission_type} needs attention"
+        message = f"Your {submission_type} submission has been reviewed and needs some changes before it can be approved."
+        message += f"\n\nReason: {rejection_reason}"
+
+        if additional_message:
+            message += f"\n\nModerator note: {additional_message}"
+
+        message += "\n\nYou can edit and resubmit your content from your profile page."
+
+        extra_data = {
+            "submission_type": submission_type,
+            "rejection_reason": rejection_reason,
+            "moderator_message": additional_message,
+            "rejected_at": timezone.now().isoformat(),
+        }
+
+        return NotificationService.create_notification(
+            user=user,
+            notification_type=UserNotification.NotificationType.SUBMISSION_REJECTED,
+            title=title,
+            message=message,
+            related_object=submission_object,
+            priority=UserNotification.Priority.HIGH,
+            extra_data=extra_data,
+        )
+
+    @staticmethod
+    def create_submission_pending_notification(
+        user: User, submission_object: Any, submission_type: str
+    ) -> UserNotification:
+        """
+        Create a notification for submission pending review.
+
+        Args:
+            user: User who submitted the content
+            submission_object: The pending submission object
+            submission_type: Type of submission (e.g., "park photo", "ride review")
+
+        Returns:
+            UserNotification: The created notification
+        """
+        title = f"Your {submission_type} is under review"
+        message = f"Thanks for your {submission_type} submission! It's now under review by our moderation team."
+        message += "\n\nWe'll notify you once it's been reviewed. This usually takes 1-2 business days."
+
+        extra_data = {
+            "submission_type": submission_type,
+            "submitted_at": timezone.now().isoformat(),
+        }
+
+        return NotificationService.create_notification(
+            user=user,
+            notification_type=UserNotification.NotificationType.SUBMISSION_PENDING,
+            title=title,
+            message=message,
+            related_object=submission_object,
+            priority=UserNotification.Priority.LOW,
+            extra_data=extra_data,
+        )
+
+    @staticmethod
+    def _send_notification(notification: UserNotification) -> None:
+        """
+        Send notification through appropriate channels based on user preferences.
+
+        Args:
+            notification: The notification to send
+        """
+        user = notification.user
+
+        # Get user's notification preferences
+        try:
+            preferences = user.notification_preference
+        except NotificationPreference.DoesNotExist:
+            # Create default preferences if they don't exist
+            preferences = NotificationPreference.objects.create(user=user)
+
+        # Send email notification if enabled
+        if preferences.should_send_notification(
+            notification.notification_type, "email"
+        ):
+            NotificationService._send_email_notification(notification)
+
+        # Toast notifications are always created (the notification object itself)
+        # The frontend will display them as toast notifications based on preferences
+
+    @staticmethod
+    def _send_email_notification(notification: UserNotification) -> None:
+        """
+        Send email notification to user using the custom ForwardEmail service.
+
+        Args:
+            notification: The notification to send via email
+        """
+        try:
+            user = notification.user
+
+            # Prepare email context
+            context = {
+                "user": user,
+                "notification": notification,
+                "site_name": "ThrillWiki",
+                "site_url": getattr(settings, "SITE_URL", "https://thrillwiki.com"),
+            }
+
+            # Render email templates
+            subject = f"ThrillWiki: {notification.title}"
+            html_message = render_to_string("emails/notification.html", context)
+            plain_message = render_to_string("emails/notification.txt", context)
+
+            # Send email using custom ForwardEmail service
+            EmailService.send_email(
+                to=user.email,
+                subject=subject,
+                text=plain_message,
+                html=html_message,
+            )
+
+            # Mark as sent
+            notification.email_sent = True
+            notification.email_sent_at = timezone.now()
+            notification.save(update_fields=["email_sent", "email_sent_at"])
+
+            logger.info(
+                f"Email notification sent to {user.email} for notification {notification.id}"
+            )
+
+        except Exception as e:
+            logger.error(
+                f"Failed to send email notification {notification.id}: {str(e)}"
+            )
+
+    @staticmethod
+    def get_user_notifications(
+        user: User,
+        unread_only: bool = False,
+        notification_types: Optional[List[str]] = None,
+        limit: Optional[int] = None,
+    ) -> List[UserNotification]:
+        """
+        Get notifications for a user.
+
+        Args:
+            user: User to get notifications for
+            unread_only: Only return unread notifications
+            notification_types: Filter by notification types
+            limit: Limit number of results
+
+        Returns:
+            List[UserNotification]: List of notifications
+        """
+        queryset = UserNotification.objects.filter(user=user)
+
+        if unread_only:
+            queryset = queryset.filter(is_read=False)
+
+        if notification_types:
+            queryset = queryset.filter(notification_type__in=notification_types)
+
+        # Exclude expired notifications
+        queryset = queryset.filter(
+            models.Q(expires_at__isnull=True) | models.Q(expires_at__gt=timezone.now())
+        )
+
+        if limit:
+            queryset = queryset[:limit]
+
+        return list(queryset)
+
+    @staticmethod
+    def mark_notifications_read(
+        user: User, notification_ids: Optional[List[int]] = None
+    ) -> int:
+        """
+        Mark notifications as read for a user.
+
+        Args:
+            user: User whose notifications to mark as read
+            notification_ids: Specific notification IDs to mark as read (if None, marks all)
+
+        Returns:
+            int: Number of notifications marked as read
+        """
+        queryset = UserNotification.objects.filter(user=user, is_read=False)
+
+        if notification_ids:
+            queryset = queryset.filter(id__in=notification_ids)
+
+        return queryset.update(is_read=True, read_at=timezone.now())
+
+    @staticmethod
+    def cleanup_old_notifications(days: int = 90) -> int:
+        """
+        Clean up old read notifications.
+
+        Args:
+            days: Number of days to keep read notifications
+
+        Returns:
+            int: Number of notifications deleted
+        """
+        cutoff_date = timezone.now() - timedelta(days=days)
+
+        old_notifications = UserNotification.objects.filter(
+            is_read=True, read_at__lt=cutoff_date
+        )
+
+        count = old_notifications.count()
+        old_notifications.delete()
+
+        logger.info(f"Cleaned up {count} old notifications")
+        return count

backend/apps/accounts/services/social_provider_service.py

@@ -0,0 +1,257 @@
+"""
+Social Provider Management Service
+
+This service handles the business logic for connecting and disconnecting
+social authentication providers while ensuring users never lock themselves
+out of their accounts.
+"""
+
+from typing import Dict, List, Tuple, TYPE_CHECKING
+from django.contrib.auth import get_user_model
+from allauth.socialaccount.models import SocialApp
+from allauth.socialaccount.providers import registry
+from django.contrib.sites.shortcuts import get_current_site
+from django.http import HttpRequest
+import logging
+
+if TYPE_CHECKING:
+    from apps.accounts.models import User
+else:
+    User = get_user_model()
+
+logger = logging.getLogger(__name__)
+
+
+class SocialProviderService:
+    """Service for managing social provider connections."""
+
+    @staticmethod
+    def can_disconnect_provider(user: User, provider: str) -> Tuple[bool, str]:
+        """
+        Check if a user can safely disconnect a social provider.
+
+        Args:
+            user: The user attempting to disconnect
+            provider: The provider to disconnect (e.g., 'google', 'discord')
+
+        Returns:
+            Tuple of (can_disconnect: bool, reason: str)
+        """
+        try:
+            # Count remaining social accounts after disconnection
+            remaining_social_accounts = user.socialaccount_set.exclude(
+                provider=provider
+            ).count()
+
+            # Check if user has email/password auth
+            has_password_auth = (
+                user.email and
+                user.has_usable_password() and
+                bool(user.password)  # Not empty/unusable
+            )
+
+            # Allow disconnection only if alternative auth exists
+            can_disconnect = remaining_social_accounts > 0 or has_password_auth
+
+            if not can_disconnect:
+                if remaining_social_accounts == 0 and not has_password_auth:
+                    return False, "Cannot disconnect your only authentication method. Please set up a password or connect another social provider first."
+                elif not has_password_auth:
+                    return False, "Please set up email/password authentication before disconnecting this provider."
+                else:
+                    return False, "Cannot disconnect this provider at this time."
+
+            return True, "Provider can be safely disconnected."
+
+        except Exception as e:
+            logger.error(
+                f"Error checking disconnect permission for user {user.id}, provider {provider}: {e}")
+            return False, "Unable to verify disconnection safety. Please try again."
+
+    @staticmethod
+    def get_connected_providers(user: "User") -> List[Dict]:
+        """
+        Get all social providers connected to a user's account.
+
+        Args:
+            user: The user to check
+
+        Returns:
+            List of connected provider information
+        """
+        try:
+            connected_providers = []
+
+            for social_account in user.socialaccount_set.all():
+                can_disconnect, reason = SocialProviderService.can_disconnect_provider(
+                    user, social_account.provider
+                )
+
+                provider_info = {
+                    'provider': social_account.provider,
+                    'provider_name': social_account.get_provider().name,
+                    'uid': social_account.uid,
+                    'date_joined': social_account.date_joined,
+                    'can_disconnect': can_disconnect,
+                    'disconnect_reason': reason if not can_disconnect else None,
+                    'extra_data': social_account.extra_data
+                }
+
+                connected_providers.append(provider_info)
+
+            return connected_providers
+
+        except Exception as e:
+            logger.error(f"Error getting connected providers for user {user.id}: {e}")
+            return []
+
+    @staticmethod
+    def get_available_providers(request: HttpRequest) -> List[Dict]:
+        """
+        Get all available social providers for the current site.
+
+        Args:
+            request: The HTTP request
+
+        Returns:
+            List of available provider information
+        """
+        try:
+            site = get_current_site(request)
+            available_providers = []
+
+            # Get all social apps configured for this site
+            social_apps = SocialApp.objects.filter(sites=site).order_by('provider')
+
+            for social_app in social_apps:
+                try:
+                    provider = registry.by_id(social_app.provider)
+
+                    provider_info = {
+                        'id': social_app.provider,
+                        'name': provider.name,
+                        'auth_url': request.build_absolute_uri(
+                            f'/accounts/{social_app.provider}/login/'
+                        ),
+                        'connect_url': request.build_absolute_uri(
+                            f'/api/v1/auth/social/connect/{social_app.provider}/'
+                        )
+                    }
+
+                    available_providers.append(provider_info)
+
+                except Exception as e:
+                    logger.warning(
+                        f"Error processing provider {social_app.provider}: {e}")
+                    continue
+
+            return available_providers
+
+        except Exception as e:
+            logger.error(f"Error getting available providers: {e}")
+            return []
+
+    @staticmethod
+    def disconnect_provider(user: "User", provider: str) -> Tuple[bool, str]:
+        """
+        Disconnect a social provider from a user's account.
+
+        Args:
+            user: The user to disconnect from
+            provider: The provider to disconnect
+
+        Returns:
+            Tuple of (success: bool, message: str)
+        """
+        try:
+            # First check if disconnection is allowed
+            can_disconnect, reason = SocialProviderService.can_disconnect_provider(
+                user, provider)
+
+            if not can_disconnect:
+                return False, reason
+
+            # Find and delete the social account
+            social_accounts = user.socialaccount_set.filter(provider=provider)
+
+            if not social_accounts.exists():
+                return False, f"No {provider} account found to disconnect."
+
+            # Delete all social accounts for this provider (in case of duplicates)
+            deleted_count = social_accounts.count()
+            social_accounts.delete()
+
+            logger.info(
+                f"User {user.id} disconnected {deleted_count} {provider} account(s)")
+
+            return True, f"{provider.title()} account disconnected successfully."
+
+        except Exception as e:
+            logger.error(f"Error disconnecting {provider} for user {user.id}: {e}")
+            return False, f"Failed to disconnect {provider} account. Please try again."
+
+    @staticmethod
+    def get_auth_status(user: "User") -> Dict:
+        """
+        Get comprehensive authentication status for a user.
+
+        Args:
+            user: The user to check
+
+        Returns:
+            Dictionary with authentication status information
+        """
+        try:
+            connected_providers = SocialProviderService.get_connected_providers(user)
+
+            has_password_auth = (
+                user.email and
+                user.has_usable_password() and
+                bool(user.password)
+            )
+
+            auth_methods_count = len(connected_providers) + \
+                (1 if has_password_auth else 0)
+
+            return {
+                'user_id': user.id,
+                'username': user.username,
+                'email': user.email,
+                'has_password_auth': has_password_auth,
+                'connected_providers': connected_providers,
+                'total_auth_methods': auth_methods_count,
+                'can_disconnect_any': auth_methods_count > 1,
+                'requires_password_setup': not has_password_auth and len(connected_providers) == 1
+            }
+
+        except Exception as e:
+            logger.error(f"Error getting auth status for user {user.id}: {e}")
+            return {
+                'error': 'Unable to retrieve authentication status'
+            }
+
+    @staticmethod
+    def validate_provider_exists(provider: str) -> Tuple[bool, str]:
+        """
+        Validate that a social provider is configured and available.
+
+        Args:
+            provider: The provider ID to validate
+
+        Returns:
+            Tuple of (is_valid: bool, message: str)
+        """
+        try:
+            # Check if provider is registered with allauth
+            if provider not in registry.provider_map:
+                return False, f"Provider '{provider}' is not supported."
+
+            # Check if provider has a social app configured
+            if not SocialApp.objects.filter(provider=provider).exists():
+                return False, f"Provider '{provider}' is not configured on this site."
+
+            return True, f"Provider '{provider}' is valid and available."
+
+        except Exception as e:
+            logger.error(f"Error validating provider {provider}: {e}")
+            return False, "Unable to validate provider."

backend/apps/accounts/services/user_deletion_service.py

@@ -0,0 +1,309 @@
+"""
+User Deletion Service
+
+This service handles user account deletion while preserving submissions
+and maintaining data integrity across the platform.
+"""
+
+from django.utils import timezone
+from django.db import transaction
+from django.contrib.auth import get_user_model
+from django.core.mail import send_mail
+from django.conf import settings
+from django.template.loader import render_to_string
+from typing import Dict, Any, Tuple, Optional
+import logging
+import secrets
+import string
+from datetime import datetime
+
+from apps.accounts.models import User
+
+logger = logging.getLogger(__name__)
+
+User = get_user_model()
+
+
+class UserDeletionRequest:
+    """Model for tracking user deletion requests."""
+
+    def __init__(self, user: User, verification_code: str, expires_at: datetime):
+        self.user = user
+        self.verification_code = verification_code
+        self.expires_at = expires_at
+        self.created_at = timezone.now()
+
+
+class UserDeletionService:
+    """Service for handling user account deletion with submission preservation."""
+
+    # In-memory storage for deletion requests (in production, use Redis or database)
+    _deletion_requests = {}
+
+    @staticmethod
+    def can_delete_user(user: User) -> Tuple[bool, Optional[str]]:
+        """
+        Check if a user can be safely deleted.
+
+        Args:
+            user: User to check for deletion eligibility
+
+        Returns:
+            Tuple[bool, Optional[str]]: (can_delete, reason_if_not)
+        """
+        # Prevent deletion of superusers
+        if user.is_superuser:
+            return False, "Cannot delete superuser accounts"
+
+        # Prevent deletion of staff/admin users
+        if user.is_staff:
+            return False, "Cannot delete staff accounts"
+
+        # Check for system users (if you have any special system accounts)
+        if hasattr(user, 'role') and user.role in ['ADMIN', 'MODERATOR']:
+            return False, "Cannot delete admin or moderator accounts"
+
+        return True, None
+
+    @staticmethod
+    def request_user_deletion(user: User) -> UserDeletionRequest:
+        """
+        Create a deletion request for a user and send verification email.
+
+        Args:
+            user: User requesting deletion
+
+        Returns:
+            UserDeletionRequest: The deletion request object
+
+        Raises:
+            ValueError: If user cannot be deleted
+        """
+        # Check if user can be deleted
+        can_delete, reason = UserDeletionService.can_delete_user(user)
+        if not can_delete:
+            raise ValueError(reason)
+
+        # Generate verification code
+        verification_code = ''.join(secrets.choice(
+            string.ascii_uppercase + string.digits) for _ in range(8))
+
+        # Set expiration (24 hours from now)
+        expires_at = timezone.now() + timezone.timedelta(hours=24)
+
+        # Create deletion request
+        deletion_request = UserDeletionRequest(user, verification_code, expires_at)
+
+        # Store request (in production, use Redis or database)
+        UserDeletionService._deletion_requests[verification_code] = deletion_request
+
+        # Send verification email
+        UserDeletionService._send_deletion_verification_email(
+            user, verification_code, expires_at)
+
+        return deletion_request
+
+    @staticmethod
+    def verify_and_delete_user(verification_code: str) -> Dict[str, Any]:
+        """
+        Verify deletion code and delete user account.
+
+        Args:
+            verification_code: Verification code from email
+
+        Returns:
+            Dict[str, Any]: Deletion result information
+
+        Raises:
+            ValueError: If verification code is invalid or expired
+        """
+        # Find deletion request
+        deletion_request = UserDeletionService._deletion_requests.get(verification_code)
+        if not deletion_request:
+            raise ValueError("Invalid verification code")
+
+        # Check if expired
+        if timezone.now() > deletion_request.expires_at:
+            # Clean up expired request
+            del UserDeletionService._deletion_requests[verification_code]
+            raise ValueError("Verification code has expired")
+
+        user = deletion_request.user
+
+        # Perform deletion
+        result = UserDeletionService.delete_user_preserve_submissions(user)
+
+        # Clean up deletion request
+        del UserDeletionService._deletion_requests[verification_code]
+
+        # Add verification info to result
+        result['deletion_request'] = {
+            'verification_code': verification_code,
+            'created_at': deletion_request.created_at,
+            'verified_at': timezone.now(),
+        }
+
+        return result
+
+    @staticmethod
+    def cancel_deletion_request(user: User) -> bool:
+        """
+        Cancel a pending deletion request for a user.
+
+        Args:
+            user: User whose deletion request to cancel
+
+        Returns:
+            bool: True if request was found and cancelled, False if no request found
+        """
+        # Find and remove any deletion requests for this user
+        to_remove = []
+        for code, request in UserDeletionService._deletion_requests.items():
+            if request.user.id == user.id:
+                to_remove.append(code)
+
+        for code in to_remove:
+            del UserDeletionService._deletion_requests[code]
+
+        return len(to_remove) > 0
+
+    @staticmethod
+    @transaction.atomic
+    def delete_user_preserve_submissions(user: User) -> Dict[str, Any]:
+        """
+        Delete a user account while preserving all their submissions.
+
+        Args:
+            user: User to delete
+
+        Returns:
+            Dict[str, Any]: Information about the deletion and preserved submissions
+        """
+        # Get or create the "deleted_user" placeholder
+        deleted_user_placeholder, created = User.objects.get_or_create(
+            username='deleted_user',
+            defaults={
+                'email': 'deleted@thrillwiki.com',
+                'first_name': 'Deleted',
+                'last_name': 'User',
+                'is_active': False,
+            }
+        )
+
+        # Count submissions before transfer
+        submission_counts = UserDeletionService._count_user_submissions(user)
+
+        # Transfer submissions to placeholder user
+        UserDeletionService._transfer_user_submissions(user, deleted_user_placeholder)
+
+        # Store user info before deletion
+        deleted_user_info = {
+            'username': user.username,
+            'user_id': getattr(user, 'user_id', user.id),
+            'email': user.email,
+            'date_joined': user.date_joined,
+        }
+
+        # Delete the user account
+        user.delete()
+
+        return {
+            'deleted_user': deleted_user_info,
+            'preserved_submissions': submission_counts,
+            'transferred_to': {
+                'username': deleted_user_placeholder.username,
+                'user_id': getattr(deleted_user_placeholder, 'user_id', deleted_user_placeholder.id),
+            }
+        }
+
+    @staticmethod
+    def _count_user_submissions(user: User) -> Dict[str, int]:
+        """Count all submissions for a user."""
+        counts = {}
+
+        # Count different types of submissions
+        # Note: These are placeholder counts - adjust based on your actual models
+        counts['park_reviews'] = getattr(
+            user, 'park_reviews', user.__class__.objects.none()).count()
+        counts['ride_reviews'] = getattr(
+            user, 'ride_reviews', user.__class__.objects.none()).count()
+        counts['uploaded_park_photos'] = getattr(
+            user, 'uploaded_park_photos', user.__class__.objects.none()).count()
+        counts['uploaded_ride_photos'] = getattr(
+            user, 'uploaded_ride_photos', user.__class__.objects.none()).count()
+        counts['top_lists'] = getattr(
+            user, 'top_lists', user.__class__.objects.none()).count()
+        counts['edit_submissions'] = getattr(
+            user, 'edit_submissions', user.__class__.objects.none()).count()
+        counts['photo_submissions'] = getattr(
+            user, 'photo_submissions', user.__class__.objects.none()).count()
+
+        return counts
+
+    @staticmethod
+    def _transfer_user_submissions(user: User, placeholder_user: User) -> None:
+        """Transfer all user submissions to placeholder user."""
+
+        # Transfer different types of submissions
+        # Note: Adjust these based on your actual model relationships
+
+        # Park reviews
+        if hasattr(user, 'park_reviews'):
+            user.park_reviews.all().update(user=placeholder_user)
+
+        # Ride reviews
+        if hasattr(user, 'ride_reviews'):
+            user.ride_reviews.all().update(user=placeholder_user)
+
+        # Uploaded photos
+        if hasattr(user, 'uploaded_park_photos'):
+            user.uploaded_park_photos.all().update(user=placeholder_user)
+
+        if hasattr(user, 'uploaded_ride_photos'):
+            user.uploaded_ride_photos.all().update(user=placeholder_user)
+
+        # Top lists
+        if hasattr(user, 'top_lists'):
+            user.top_lists.all().update(user=placeholder_user)
+
+        # Edit submissions
+        if hasattr(user, 'edit_submissions'):
+            user.edit_submissions.all().update(user=placeholder_user)
+
+        # Photo submissions
+        if hasattr(user, 'photo_submissions'):
+            user.photo_submissions.all().update(user=placeholder_user)
+
+    @staticmethod
+    def _send_deletion_verification_email(user: User, verification_code: str, expires_at: timezone.datetime) -> None:
+        """Send verification email for account deletion."""
+        try:
+            context = {
+                'user': user,
+                'verification_code': verification_code,
+                'expires_at': expires_at,
+                'site_name': 'ThrillWiki',
+                'site_url': getattr(settings, 'SITE_URL', 'https://thrillwiki.com'),
+            }
+
+            subject = 'ThrillWiki: Confirm Account Deletion'
+            html_message = render_to_string(
+                'emails/account_deletion_verification.html', context)
+            plain_message = render_to_string(
+                'emails/account_deletion_verification.txt', context)
+
+            send_mail(
+                subject=subject,
+                message=plain_message,
+                html_message=html_message,
+                from_email=settings.DEFAULT_FROM_EMAIL,
+                recipient_list=[user.email],
+                fail_silently=False,
+            )
+
+            logger.info(f"Deletion verification email sent to {user.email}")
+
+        except Exception as e:
+            logger.error(
+                f"Failed to send deletion verification email to {user.email}: {str(e)}")
+            raise

backend/apps/accounts/signals.py

@@ -42,9 +42,9 @@ def create_user_profile(sender, instance, created, **kwargs):
                             profile.avatar.save(file_name, File(img_temp), save=True)
                     except Exception as e:
                         print(
-                            f"Error downloading avatar for user {
-                                instance.username}: {
-                                str(e)}"
+                            f"Error downloading avatar for user {instance.username}: {
+                                str(e)
+                            }"
                         )
     except Exception as e:
         print(f"Error creating profile for user {instance.username}: {str(e)}")
@@ -117,9 +117,7 @@ def sync_user_role_with_groups(sender, instance, **kwargs):
             pass
         except Exception as e:
             print(
-                f"Error syncing role with groups for user {
-                    instance.username}: {
-                    str(e)}"
+                f"Error syncing role with groups for user {instance.username}: {str(e)}"
             )
 
 

backend/apps/accounts/tests/test_user_deletion.py

@@ -0,0 +1,155 @@
+"""
+Tests for user deletion while preserving submissions.
+"""
+
+from django.test import TestCase
+from django.db import transaction
+from apps.accounts.services import UserDeletionService
+from apps.accounts.models import User, UserProfile
+
+
+class UserDeletionServiceTest(TestCase):
+    """Test cases for UserDeletionService."""
+
+    def setUp(self):
+        """Set up test data."""
+        # Create test users
+        self.user = User.objects.create_user(
+            username="testuser", email="test@example.com", password="testpass123"
+        )
+
+        self.admin_user = User.objects.create_user(
+            username="admin",
+            email="admin@example.com",
+            password="adminpass123",
+            is_superuser=True,
+        )
+
+        # Create user profiles
+        UserProfile.objects.create(
+            user=self.user, display_name="Test User", bio="Test bio"
+        )
+
+        UserProfile.objects.create(
+            user=self.admin_user, display_name="Admin User", bio="Admin bio"
+        )
+
+    def test_get_or_create_deleted_user(self):
+        """Test that deleted user placeholder is created correctly."""
+        deleted_user = UserDeletionService.get_or_create_deleted_user()
+
+        self.assertEqual(deleted_user.username, "deleted_user")
+        self.assertEqual(deleted_user.email, "deleted@thrillwiki.com")
+        self.assertFalse(deleted_user.is_active)
+        self.assertTrue(deleted_user.is_banned)
+        self.assertEqual(deleted_user.role, User.Roles.USER)
+
+        # Check profile was created
+        self.assertTrue(hasattr(deleted_user, "profile"))
+        self.assertEqual(deleted_user.profile.display_name, "Deleted User")
+
+    def test_get_or_create_deleted_user_idempotent(self):
+        """Test that calling get_or_create_deleted_user multiple times returns same user."""
+        deleted_user1 = UserDeletionService.get_or_create_deleted_user()
+        deleted_user2 = UserDeletionService.get_or_create_deleted_user()
+
+        self.assertEqual(deleted_user1.id, deleted_user2.id)
+        self.assertEqual(User.objects.filter(username="deleted_user").count(), 1)
+
+    def test_can_delete_user_normal_user(self):
+        """Test that normal users can be deleted."""
+        can_delete, reason = UserDeletionService.can_delete_user(self.user)
+
+        self.assertTrue(can_delete)
+        self.assertIsNone(reason)
+
+    def test_can_delete_user_superuser(self):
+        """Test that superusers cannot be deleted."""
+        can_delete, reason = UserDeletionService.can_delete_user(self.admin_user)
+
+        self.assertFalse(can_delete)
+        self.assertEqual(reason, "Cannot delete superuser accounts")
+
+    def test_can_delete_user_deleted_user_placeholder(self):
+        """Test that deleted user placeholder cannot be deleted."""
+        deleted_user = UserDeletionService.get_or_create_deleted_user()
+        can_delete, reason = UserDeletionService.can_delete_user(deleted_user)
+
+        self.assertFalse(can_delete)
+        self.assertEqual(reason, "Cannot delete the system deleted user placeholder")
+
+    def test_delete_user_preserve_submissions_no_submissions(self):
+        """Test deleting user with no submissions."""
+        user_id = self.user.user_id
+        username = self.user.username
+
+        result = UserDeletionService.delete_user_preserve_submissions(self.user)
+
+        # Check user was deleted
+        self.assertFalse(User.objects.filter(user_id=user_id).exists())
+
+        # Check result structure
+        self.assertIn("deleted_user", result)
+        self.assertIn("preserved_submissions", result)
+        self.assertIn("transferred_to", result)
+
+        self.assertEqual(result["deleted_user"]["username"], username)
+        self.assertEqual(result["deleted_user"]["user_id"], user_id)
+
+        # All submission counts should be 0
+        for count in result["preserved_submissions"].values():
+            self.assertEqual(count, 0)
+
+    def test_delete_user_cannot_delete_deleted_user_placeholder(self):
+        """Test that attempting to delete the deleted user placeholder raises error."""
+        deleted_user = UserDeletionService.get_or_create_deleted_user()
+
+        with self.assertRaises(ValueError) as context:
+            UserDeletionService.delete_user_preserve_submissions(deleted_user)
+
+        self.assertIn(
+            "Cannot delete the system deleted user placeholder", str(context.exception)
+        )
+
+    def test_delete_user_with_submissions_transfers_correctly(self):
+        """Test that user submissions are transferred to deleted user placeholder."""
+        # This test would require creating park/ride data which is complex
+        # For now, we'll test the basic functionality
+
+        # Create deleted user first to ensure it exists
+        UserDeletionService.get_or_create_deleted_user()
+
+        # Delete the test user
+        result = UserDeletionService.delete_user_preserve_submissions(self.user)
+
+        # Verify the deleted user placeholder still exists
+        self.assertTrue(User.objects.filter(username="deleted_user").exists())
+
+        # Verify result structure
+        self.assertIn("deleted_user", result)
+        self.assertIn("preserved_submissions", result)
+        self.assertIn("transferred_to", result)
+
+        self.assertEqual(result["transferred_to"]["username"], "deleted_user")
+
+    def test_delete_user_atomic_transaction(self):
+        """Test that user deletion is atomic."""
+        # This test ensures that if something goes wrong during deletion,
+        # the transaction is rolled back
+
+        original_user_count = User.objects.count()
+
+        # Mock a failure during the deletion process
+        with self.assertRaises(Exception):
+            with transaction.atomic():
+                # Start the deletion process
+                UserDeletionService.get_or_create_deleted_user()
+
+                # Simulate an error
+                raise Exception("Simulated error during deletion")
+
+        # Verify user count hasn't changed
+        self.assertEqual(User.objects.count(), original_user_count)
+
+        # Verify our test user still exists
+        self.assertTrue(User.objects.filter(user_id=self.user.user_id).exists())

backend/apps/accounts/views.py

@@ -24,7 +24,7 @@ from apps.accounts.models import (
     EmailVerification,
     UserProfile,
 )
-from apps.email_service.services import EmailService
+from django_forwardemail.services import EmailService
 from apps.parks.models import ParkReview
 from apps.rides.models import RideReview
 from allauth.account.views import LoginView, SignupView

backend/apps/api/__init__.py

@@ -0,0 +1,6 @@
+"""
+Centralized API package for ThrillWiki
+
+All API endpoints MUST be defined here under the /api/v1/ structure.
+This enforces consistent API architecture and prevents rogue endpoint creation.
+"""

backend/apps/api/apps.py

@@ -0,0 +1,23 @@
+"""
+ThrillWiki API App Configuration
+
+This module contains the Django app configuration for the centralized API application.
+All API endpoints are routed through this app following the pattern:
+- Frontend: /api/{endpoint}
+- Vite Proxy: /api/ -> /api/v1/
+- Django: backend/api/v1/{endpoint}
+"""
+
+from django.apps import AppConfig
+
+
+class ApiConfig(AppConfig):
+    """Configuration for the centralized API app."""
+
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "api"
+    verbose_name = "ThrillWiki API"
+
+    def ready(self):
+        """Import signals when the app is ready."""
+        import apps.api.v1.signals  # noqa: F401

backend/apps/api/management/__init__.py

@@ -0,0 +1 @@
+# Management commands package

backend/apps/api/management/commands/README.md

@@ -0,0 +1,158 @@
+# ThrillWiki Data Seeding Script
+
+## Overview
+
+The `seed_data.py` management command provides comprehensive test data seeding for the ThrillWiki application. It creates realistic data across all models in the system for testing and development purposes.
+
+## Usage
+
+### Basic Usage
+```bash
+# Seed with default counts
+uv run manage.py seed_data
+
+# Clear existing data and seed fresh
+uv run manage.py seed_data --clear
+
+# Custom counts
+uv run manage.py seed_data --users 50 --parks 20 --rides 100 --reviews 200
+```
+
+### Command Options
+
+- `--clear`: Clear existing data before seeding
+- `--users N`: Number of users to create (default: 25)
+- `--companies N`: Number of companies to create (default: 15)
+- `--parks N`: Number of parks to create (default: 10)
+- `--rides N`: Number of rides to create (default: 50)
+- `--ride-models N`: Number of ride models to create (default: 20)
+- `--reviews N`: Number of reviews to create (default: 100)
+
+## What Gets Created
+
+### Users & Accounts
+- **Admin User**: `admin` / `admin123` (superuser)
+- **Moderator User**: `moderator` / `mod123` (staff)
+- **Regular Users**: Random realistic users with profiles
+- **User Profiles**: Complete with ride credits, social links, preferences
+- **Notifications**: Sample notifications for users
+- **Top Lists**: User-created top lists for parks and rides
+
+### Companies
+- **Park Operators**: Disney, Universal, Six Flags, Cedar Fair, etc.
+- **Ride Manufacturers**: B&M, Intamin, Vekoma, RMC, etc.
+- **Ride Designers**: Werner Stengel, Alan Schilke, John Wardley
+- **Company Headquarters**: Realistic address data
+
+### Parks & Locations
+- **Famous Parks**: Magic Kingdom, Disneyland, Cedar Point, etc.
+- **Park Locations**: Geographic coordinates and addresses
+- **Park Areas**: Themed areas within parks
+- **Park Photos**: Sample photo records
+
+### Rides & Models
+- **Famous Coasters**: Steel Vengeance, Millennium Force, etc.
+- **Ride Models**: B&M Dive Coaster, Intamin Accelerator, etc.
+- **Roller Coaster Stats**: Height, speed, inversions, etc.
+- **Ride Photos**: Sample photo records
+- **Technical Specs**: Detailed specifications for ride models
+
+### Content & Reviews
+- **Park Reviews**: User reviews with ratings and visit dates
+- **Ride Reviews**: Detailed ride experiences
+- **Review Content**: Realistic review text and ratings
+
+## Data Quality Features
+
+### Realistic Data
+- **Names**: Diverse, realistic user names
+- **Locations**: Accurate geographic coordinates
+- **Relationships**: Proper company-park-ride relationships
+- **Statistics**: Realistic ride statistics and ratings
+
+### Comprehensive Coverage
+- **All Models**: Seeds data for every model in the system
+- **Relationships**: Maintains proper foreign key relationships
+- **Optional Models**: Handles models that may not exist gracefully
+
+### Data Integrity
+- **Unique Constraints**: Uses `get_or_create` to avoid duplicates
+- **Validation**: Respects model constraints and validation rules
+- **Dependencies**: Creates data in proper dependency order
+
+## Technical Implementation
+
+### Architecture
+- **Modular Design**: Separate methods for each model type
+- **Transaction Safety**: All operations wrapped in database transaction
+- **Error Handling**: Graceful handling of missing optional models
+- **Progress Reporting**: Clear console output with emojis and counts
+
+### Model Handling
+- **Dual Company Models**: Properly handles separate Park and Ride company models
+- **Optional Models**: Checks for existence before using optional models
+- **Type Safety**: Proper type hints and error handling
+
+### Data Generation
+- **Random but Realistic**: Uses curated lists for realistic data
+- **Configurable Counts**: All counts are configurable via command line
+- **Relationship Integrity**: Maintains proper relationships between models
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Database Schema Mismatch**: If you see timezone constraint errors, run migrations first:
+   ```bash
+   uv run manage.py migrate
+   ```
+
+2. **Permission Errors**: Ensure database user has proper permissions for all operations
+
+3. **Memory Issues**: For large datasets, consider running with smaller batches
+
+### Known Limitations
+
+- **Database Schema Compatibility**: May encounter issues with database schemas that have additional required fields not present in the current models (e.g., timezone field)
+- **pghistory Compatibility**: May have issues with some pghistory configurations
+- **Cloudflare Images**: Creates placeholder records without actual images
+- **Geographic Data**: Requires PostGIS for location features
+- **Transaction Management**: Uses atomic transactions which may fail completely if any model creation fails
+
+## Development Notes
+
+### Adding New Models
+1. Import the model at the top of the file
+2. Add to `models_to_clear` list if needed
+3. Create a new `create_*` method
+4. Call the method in `handle()` in proper dependency order
+5. Add count to `print_summary()`
+
+### Customizing Data
+- Modify the data lists (e.g., `first_names`, `famous_parks`) to customize generated data
+- Adjust probability weights for different scenarios
+- Add new relationship patterns as needed
+
+## Performance
+
+### Optimization Tips
+- Use `--clear` sparingly in production-like environments
+- Consider smaller batch sizes for very large datasets
+- Monitor database performance during seeding
+
+### Typical Performance
+- 25 users, 15 companies, 10 parks, 50 rides: ~30 seconds
+- 100 users, 50 companies, 25 parks, 200 rides: ~2-3 minutes
+
+## Security Notes
+
+- **Default Passwords**: All seeded users have simple passwords for development only
+- **Admin Access**: Creates admin user with known credentials
+- **Production Warning**: Never run with `--clear` in production environments
+
+## Future Enhancements
+
+- **Bulk Operations**: Use bulk_create for better performance
+- **Custom Scenarios**: Add preset scenarios (small, medium, large)
+- **Data Export**: Add ability to export seeded data
+- **Incremental Updates**: Support for updating existing data

backend/apps/api/management/commands/SEEDING_IMPLEMENTATION_GUIDE.md

@@ -0,0 +1,601 @@
+# ThrillWiki Data Seeding - Implementation Guide
+
+## Overview
+This document outlines the specific requirements and implementation steps needed to complete the data seeding script for ThrillWiki. Currently, three features are skipped during seeding due to missing or incomplete model implementations.
+
+## 🛡️ Moderation Data Implementation
+
+### Current Status
+```
+🛡️  Creating moderation data...
+  ✅ Comprehensive moderation system is implemented and ready for seeding
+```
+
+### Available Models
+The moderation system is fully implemented in `apps.moderation.models` with the following models:
+
+#### 1. ModerationReport Model
+```python
+class ModerationReport(TrackedModel):
+    """Model for tracking user reports about content, users, or behavior"""
+    
+    STATUS_CHOICES = [
+        ('PENDING', 'Pending Review'),
+        ('UNDER_REVIEW', 'Under Review'),
+        ('RESOLVED', 'Resolved'),
+        ('DISMISSED', 'Dismissed'),
+    ]
+    
+    REPORT_TYPE_CHOICES = [
+        ('SPAM', 'Spam'),
+        ('HARASSMENT', 'Harassment'),
+        ('INAPPROPRIATE_CONTENT', 'Inappropriate Content'),
+        ('MISINFORMATION', 'Misinformation'),
+        ('COPYRIGHT', 'Copyright Violation'),
+        ('PRIVACY', 'Privacy Violation'),
+        ('HATE_SPEECH', 'Hate Speech'),
+        ('VIOLENCE', 'Violence or Threats'),
+        ('OTHER', 'Other'),
+    ]
+    
+    report_type = models.CharField(max_length=50, choices=REPORT_TYPE_CHOICES)
+    status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='PENDING')
+    priority = models.CharField(max_length=10, choices=PRIORITY_CHOICES, default='MEDIUM')
+    reason = models.CharField(max_length=200)
+    description = models.TextField()
+    reported_by = models.ForeignKey(User, on_delete=models.CASCADE, related_name='moderation_reports_made')
+    assigned_moderator = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True)
+    # ... additional fields
+```
+
+#### 2. ModerationQueue Model
+```python
+class ModerationQueue(TrackedModel):
+    """Model for managing moderation workflow and task assignment"""
+    
+    ITEM_TYPE_CHOICES = [
+        ('CONTENT_REVIEW', 'Content Review'),
+        ('USER_REVIEW', 'User Review'),
+        ('BULK_ACTION', 'Bulk Action'),
+        ('POLICY_VIOLATION', 'Policy Violation'),
+        ('APPEAL', 'Appeal'),
+        ('OTHER', 'Other'),
+    ]
+    
+    item_type = models.CharField(max_length=50, choices=ITEM_TYPE_CHOICES)
+    status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='PENDING')
+    priority = models.CharField(max_length=10, choices=PRIORITY_CHOICES, default='MEDIUM')
+    title = models.CharField(max_length=200)
+    description = models.TextField()
+    assigned_to = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True)
+    related_report = models.ForeignKey(ModerationReport, on_delete=models.CASCADE, null=True, blank=True)
+    # ... additional fields
+```
+
+#### 3. ModerationAction Model
+```python
+class ModerationAction(TrackedModel):
+    """Model for tracking actions taken against users or content"""
+    
+    ACTION_TYPE_CHOICES = [
+        ('WARNING', 'Warning'),
+        ('USER_SUSPENSION', 'User Suspension'),
+        ('USER_BAN', 'User Ban'),
+        ('CONTENT_REMOVAL', 'Content Removal'),
+        ('CONTENT_EDIT', 'Content Edit'),
+        ('CONTENT_RESTRICTION', 'Content Restriction'),
+        ('ACCOUNT_RESTRICTION', 'Account Restriction'),
+        ('OTHER', 'Other'),
+    ]
+    
+    action_type = models.CharField(max_length=50, choices=ACTION_TYPE_CHOICES)
+    reason = models.CharField(max_length=200)
+    details = models.TextField()
+    moderator = models.ForeignKey(User, on_delete=models.CASCADE, related_name='moderation_actions_taken')
+    target_user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='moderation_actions_received')
+    related_report = models.ForeignKey(ModerationReport, on_delete=models.SET_NULL, null=True, blank=True)
+    # ... additional fields
+```
+
+#### 4. Additional Models
+- **BulkOperation**: For tracking bulk administrative operations
+- **PhotoSubmission**: For photo moderation workflow
+- **EditSubmission**: For content edit submissions (legacy)
+
+### Implementation Steps
+
+1. **Moderation app already exists** at `backend/apps/moderation/`
+
+2. **Already added to INSTALLED_APPS** in `backend/config/django/base.py`
+
+3. **Models are fully implemented** in `apps/moderation/models.py`
+
+4. **Update the seeding script** - Replace the placeholder in `create_moderation_data()`:
+   ```python
+   def create_moderation_data(self, users: List[User], parks: List[Park], rides: List[Ride]) -> None:
+       """Create moderation reports, queue items, and actions"""
+       self.stdout.write('🛡️  Creating moderation data...')
+       
+       if not users or (not parks and not rides):
+           self.stdout.write('  ⚠️  No users or content found, skipping moderation data')
+           return
+       
+       moderators = [u for u in users if u.role in ['MODERATOR', 'ADMIN']]
+       if not moderators:
+           self.stdout.write('  ⚠️  No moderators found, skipping moderation data')
+           return
+       
+       moderation_count = 0
+       all_content = list(parks) + list(rides)
+       
+       # Create moderation reports
+       for _ in range(min(15, len(all_content))):
+           content_item = random.choice(all_content)
+           reporter = random.choice(users)
+           moderator = random.choice(moderators) if random.random() < 0.7 else None
+           
+           report = ModerationReport.objects.create(
+               report_type=random.choice(['SPAM', 'INAPPROPRIATE_CONTENT', 'MISINFORMATION', 'OTHER']),
+               status=random.choice(['PENDING', 'UNDER_REVIEW', 'RESOLVED', 'DISMISSED']),
+               priority=random.choice(['LOW', 'MEDIUM', 'HIGH']),
+               reason=f"Reported issue with {content_item.__class__.__name__}",
+               description=random.choice([
+                   'Content contains inappropriate information',
+                   'Suspected spam or promotional content',
+                   'Information appears to be inaccurate',
+                   'Content violates community guidelines'
+               ]),
+               reported_by=reporter,
+               assigned_moderator=moderator,
+               reported_entity_type=content_item.__class__.__name__.lower(),
+               reported_entity_id=content_item.pk,
+           )
+           
+           # Create queue item for some reports
+           if random.random() < 0.6:
+               queue_item = ModerationQueue.objects.create(
+                   item_type=random.choice(['CONTENT_REVIEW', 'POLICY_VIOLATION']),
+                   status=random.choice(['PENDING', 'IN_PROGRESS', 'COMPLETED']),
+                   priority=report.priority,
+                   title=f"Review {content_item.__class__.__name__}: {content_item}",
+                   description=f"Review required for reported {content_item.__class__.__name__.lower()}",
+                   assigned_to=moderator,
+                   related_report=report,
+                   entity_type=content_item.__class__.__name__.lower(),
+                   entity_id=content_item.pk,
+               )
+               
+               # Create action if resolved
+               if queue_item.status == 'COMPLETED' and moderator:
+                   ModerationAction.objects.create(
+                       action_type=random.choice(['WARNING', 'CONTENT_EDIT', 'CONTENT_RESTRICTION']),
+                       reason=f"Action taken on {content_item.__class__.__name__}",
+                       details=f"Moderation action completed for {content_item}",
+                       moderator=moderator,
+                       target_user=reporter,  # In real scenario, this would be content owner
+                       related_report=report,
+                   )
+           
+           moderation_count += 1
+       
+       self.stdout.write(f'  ✅ Created {moderation_count} moderation items')
+   ```
+
+## 📸 Photo Records Implementation
+
+### Current Status
+```
+📸 Creating photo records...
+  ✅ Photo system is fully implemented with CloudflareImage integration
+```
+
+### Available Models
+The photo system is fully implemented with the following models:
+
+#### 1. ParkPhoto Model
+```python
+class ParkPhoto(TrackedModel):
+    """Photo model specific to parks"""
+    
+    park = models.ForeignKey("parks.Park", on_delete=models.CASCADE, related_name="photos")
+    image = models.ForeignKey(
+        'django_cloudflareimages_toolkit.CloudflareImage',
+        on_delete=models.CASCADE,
+        help_text="Park photo stored on Cloudflare Images"
+    )
+    caption = models.CharField(max_length=255, blank=True)
+    alt_text = models.CharField(max_length=255, blank=True)
+    is_primary = models.BooleanField(default=False)
+    is_approved = models.BooleanField(default=False)
+    uploaded_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True)
+    date_taken = models.DateTimeField(null=True, blank=True)
+    # ... additional fields with MediaService integration
+```
+
+#### 2. RidePhoto Model
+```python
+class RidePhoto(TrackedModel):
+    """Photo model specific to rides"""
+    
+    ride = models.ForeignKey("rides.Ride", on_delete=models.CASCADE, related_name="photos")
+    image = models.ForeignKey(
+        'django_cloudflareimages_toolkit.CloudflareImage',
+        on_delete=models.CASCADE,
+        help_text="Ride photo stored on Cloudflare Images"
+    )
+    caption = models.CharField(max_length=255, blank=True)
+    alt_text = models.CharField(max_length=255, blank=True)
+    is_primary = models.BooleanField(default=False)
+    is_approved = models.BooleanField(default=False)
+    uploaded_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True)
+    
+    # Ride-specific metadata
+    photo_type = models.CharField(
+        max_length=50,
+        choices=[
+            ("exterior", "Exterior View"),
+            ("queue", "Queue Area"),
+            ("station", "Station"),
+            ("onride", "On-Ride"),
+            ("construction", "Construction"),
+            ("other", "Other"),
+        ],
+        default="exterior",
+    )
+    # ... additional fields with MediaService integration
+```
+
+### Current Configuration
+
+#### 1. Cloudflare Images Already Configured
+The system is already configured in `backend/config/django/base.py`:
+```python
+# Cloudflare Images Settings
+CLOUDFLARE_IMAGES = {
+    'ACCOUNT_ID': config("CLOUDFLARE_IMAGES_ACCOUNT_ID"),
+    'API_TOKEN': config("CLOUDFLARE_IMAGES_API_TOKEN"),
+    'ACCOUNT_HASH': config("CLOUDFLARE_IMAGES_ACCOUNT_HASH"),
+    'DEFAULT_VARIANT': 'public',
+    'UPLOAD_TIMEOUT': 300,
+    'MAX_FILE_SIZE': 10 * 1024 * 1024,  # 10MB
+    'ALLOWED_FORMATS': ['jpeg', 'png', 'gif', 'webp'],
+    # ... additional configuration
+}
+```
+
+#### 2. django-cloudflareimages-toolkit Integration
+- ✅ Package is installed and configured
+- ✅ Models use CloudflareImage foreign keys
+- ✅ Advanced MediaService integration exists
+- ✅ Custom upload path functions implemented
+
+### Implementation Steps
+
+1. **Photo models already exist** in `apps/parks/models/media.py` and `apps/rides/models/media.py`
+
+2. **CloudflareImage toolkit is installed** and configured
+
+3. **Environment variables needed** (add to `.env`):
+   ```env
+   CLOUDFLARE_IMAGES_ACCOUNT_ID=your_account_id
+   CLOUDFLARE_IMAGES_API_TOKEN=your_api_token
+   CLOUDFLARE_IMAGES_ACCOUNT_HASH=your_account_hash
+   ```
+
+4. **Update the seeding script** - Replace the placeholder in `create_photos()`:
+   ```python
+   def create_photos(self, parks: List[Park], rides: List[Ride], users: List[User]) -> None:
+       """Create sample photo records using CloudflareImage"""
+       self.stdout.write('📸 Creating photo records...')
+       
+       # For development/testing, we can create placeholder CloudflareImage instances
+       # In production, these would be actual uploaded images
+       
+       photo_count = 0
+       
+       # Create park photos
+       for park in random.sample(parks, min(len(parks), 8)):
+           for i in range(random.randint(1, 3)):
+               try:
+                   # Create a placeholder CloudflareImage for seeding
+                   # In real usage, this would be an actual uploaded image
+                   cloudflare_image = CloudflareImage.objects.create(
+                       # Add minimal required fields for seeding
+                       # Actual implementation depends on CloudflareImage model structure
+                   )
+                   
+                   ParkPhoto.objects.create(
+                       park=park,
+                       image=cloudflare_image,
+                       caption=f"Beautiful view of {park.name}",
+                       alt_text=f"Photo of {park.name} theme park",
+                       is_primary=i == 0,
+                       is_approved=True,  # Auto-approve for seeding
+                       uploaded_by=random.choice(users),
+                       date_taken=timezone.now() - timedelta(days=random.randint(1, 365)),
+                   )
+                   photo_count += 1
+               except Exception as e:
+                   self.stdout.write(f'  ⚠️  Failed to create park photo: {str(e)}')
+       
+       # Create ride photos
+       for ride in random.sample(rides, min(len(rides), 15)):
+           for i in range(random.randint(1, 2)):
+               try:
+                   cloudflare_image = CloudflareImage.objects.create(
+                       # Add minimal required fields for seeding
+                   )
+                   
+                   RidePhoto.objects.create(
+                       ride=ride,
+                       image=cloudflare_image,
+                       caption=f"Exciting view of {ride.name}",
+                       alt_text=f"Photo of {ride.name} ride",
+                       photo_type=random.choice(['exterior', 'queue', 'station', 'onride']),
+                       is_primary=i == 0,
+                       is_approved=True,  # Auto-approve for seeding
+                       uploaded_by=random.choice(users),
+                       date_taken=timezone.now() - timedelta(days=random.randint(1, 365)),
+                   )
+                   photo_count += 1
+               except Exception as e:
+                   self.stdout.write(f'  ⚠️  Failed to create ride photo: {str(e)}')
+       
+       self.stdout.write(f'  ✅ Created {photo_count} photo records')
+   ```
+
+### Advanced Features Available
+
+- **MediaService Integration**: Automatic EXIF date extraction, default caption generation
+- **Upload Path Management**: Custom upload paths for organization
+- **Primary Photo Logic**: Automatic handling of primary photo constraints
+- **Approval Workflow**: Built-in approval system for photo moderation
+- **Photo Types**: Categorization system for ride photos (exterior, queue, station, onride, etc.)
+
+## 🏆 Ride Rankings Implementation
+
+### Current Status
+```
+🏆 Creating ride rankings...
+  ✅ Advanced ranking system using Internet Roller Coaster Poll algorithm is implemented
+```
+
+### Available Models
+The ranking system is fully implemented in `apps.rides.models.rankings` with a sophisticated algorithm:
+
+#### 1. RideRanking Model
+```python
+class RideRanking(models.Model):
+    """
+    Stores calculated rankings for rides using the Internet Roller Coaster Poll algorithm.
+    Rankings are recalculated daily based on user reviews/ratings.
+    """
+    
+    ride = models.OneToOneField("rides.Ride", on_delete=models.CASCADE, related_name="ranking")
+    
+    # Core ranking metrics
+    rank = models.PositiveIntegerField(db_index=True, help_text="Overall rank position (1 = best)")
+    wins = models.PositiveIntegerField(default=0, help_text="Number of rides this ride beats in pairwise comparisons")
+    losses = models.PositiveIntegerField(default=0, help_text="Number of rides that beat this ride in pairwise comparisons")
+    ties = models.PositiveIntegerField(default=0, help_text="Number of rides with equal preference in pairwise comparisons")
+    winning_percentage = models.DecimalField(max_digits=5, decimal_places=4, help_text="Win percentage where ties count as 0.5")
+    
+    # Additional metrics
+    mutual_riders_count = models.PositiveIntegerField(default=0, help_text="Total number of users who have rated this ride")
+    comparison_count = models.PositiveIntegerField(default=0, help_text="Number of other rides this was compared against")
+    average_rating = models.DecimalField(max_digits=3, decimal_places=2, null=True, blank=True)
+    
+    # Metadata
+    last_calculated = models.DateTimeField(default=timezone.now)
+    calculation_version = models.CharField(max_length=10, default="1.0")
+```
+
+#### 2. RidePairComparison Model
+```python
+class RidePairComparison(models.Model):
+    """
+    Caches pairwise comparison results between two rides.
+    Used to speed up ranking calculations by storing mutual rider preferences.
+    """
+    
+    ride_a = models.ForeignKey("rides.Ride", on_delete=models.CASCADE, related_name="comparisons_as_a")
+    ride_b = models.ForeignKey("rides.Ride", on_delete=models.CASCADE, related_name="comparisons_as_b")
+    
+    # Comparison results
+    ride_a_wins = models.PositiveIntegerField(default=0, help_text="Number of mutual riders who rated ride_a higher")
+    ride_b_wins = models.PositiveIntegerField(default=0, help_text="Number of mutual riders who rated ride_b higher")
+    ties = models.PositiveIntegerField(default=0, help_text="Number of mutual riders who rated both rides equally")
+    
+    # Metrics
+    mutual_riders_count = models.PositiveIntegerField(default=0, help_text="Total number of users who have rated both rides")
+    ride_a_avg_rating = models.DecimalField(max_digits=3, decimal_places=2, null=True, blank=True)
+    ride_b_avg_rating = models.DecimalField(max_digits=3, decimal_places=2, null=True, blank=True)
+    
+    last_calculated = models.DateTimeField(auto_now=True)
+```
+
+#### 3. RankingSnapshot Model
+```python
+class RankingSnapshot(models.Model):
+    """
+    Stores historical snapshots of rankings for tracking changes over time.
+    Allows showing ranking trends and movements.
+    """
+    
+    ride = models.ForeignKey("rides.Ride", on_delete=models.CASCADE, related_name="ranking_history")
+    rank = models.PositiveIntegerField()
+    winning_percentage = models.DecimalField(max_digits=5, decimal_places=4)
+    snapshot_date = models.DateField(db_index=True, help_text="Date when this ranking snapshot was taken")
+```
+
+### Algorithm Details
+
+The system implements the **Internet Roller Coaster Poll algorithm**:
+
+1. **Pairwise Comparisons**: Each ride is compared to every other ride based on mutual riders (users who have rated both rides)
+2. **Winning Percentage**: Calculated as `(wins + 0.5 * ties) / total_comparisons`
+3. **Ranking**: Rides are ranked by winning percentage, with ties broken by mutual rider count
+4. **Daily Recalculation**: Rankings are updated daily to reflect new reviews and ratings
+
+### Implementation Steps
+
+1. **Ranking models already exist** in `apps/rides/models/rankings.py`
+
+2. **Models are fully implemented** with sophisticated algorithm
+
+3. **Update the seeding script** - Replace the placeholder in `create_rankings()`:
+   ```python
+   def create_rankings(self, rides: List[Ride], users: List[User]) -> None:
+       """Create sophisticated ranking data using Internet Roller Coaster Poll algorithm"""
+       self.stdout.write('🏆 Creating ride rankings...')
+       
+       if not rides:
+           self.stdout.write('  ⚠️  No rides found, skipping rankings')
+           return
+       
+       # Get users who have created reviews (they're likely to have rated rides)
+       users_with_reviews = [u for u in users if hasattr(u, 'ride_reviews') or hasattr(u, 'park_reviews')]
+       
+       if not users_with_reviews:
+           self.stdout.write('  ⚠️  No users with reviews found, skipping rankings')
+           return
+       
+       ranking_count = 0
+       comparison_count = 0
+       snapshot_count = 0
+       
+       # Create initial rankings for all rides
+       for i, ride in enumerate(rides, 1):
+           # Calculate mock metrics for seeding
+           mock_wins = random.randint(0, len(rides) - 1)
+           mock_losses = random.randint(0, len(rides) - 1 - mock_wins)
+           mock_ties = len(rides) - 1 - mock_wins - mock_losses
+           total_comparisons = mock_wins + mock_losses + mock_ties
+           
+           winning_percentage = (mock_wins + 0.5 * mock_ties) / total_comparisons if total_comparisons > 0 else 0.5
+           
+           RideRanking.objects.create(
+               ride=ride,
+               rank=i,  # Will be recalculated based on winning_percentage
+               wins=mock_wins,
+               losses=mock_losses,
+               ties=mock_ties,
+               winning_percentage=Decimal(str(round(winning_percentage, 4))),
+               mutual_riders_count=random.randint(10, 100),
+               comparison_count=total_comparisons,
+               average_rating=Decimal(str(round(random.uniform(6.0, 9.5), 2))),
+               last_calculated=timezone.now(),
+               calculation_version="1.0",
+           )
+           ranking_count += 1
+       
+       # Create some pairwise comparisons for realism
+       for _ in range(min(50, len(rides) * 2)):
+           ride_a, ride_b = random.sample(rides, 2)
+           
+           # Avoid duplicate comparisons
+           if RidePairComparison.objects.filter(
+               models.Q(ride_a=ride_a, ride_b=ride_b) | 
+               models.Q(ride_a=ride_b, ride_b=ride_a)
+           ).exists():
+               continue
+           
+           mutual_riders = random.randint(5, 30)
+           ride_a_wins = random.randint(0, mutual_riders)
+           ride_b_wins = random.randint(0, mutual_riders - ride_a_wins)
+           ties = mutual_riders - ride_a_wins - ride_b_wins
+           
+           RidePairComparison.objects.create(
+               ride_a=ride_a,
+               ride_b=ride_b,
+               ride_a_wins=ride_a_wins,
+               ride_b_wins=ride_b_wins,
+               ties=ties,
+               mutual_riders_count=mutual_riders,
+               ride_a_avg_rating=Decimal(str(round(random.uniform(6.0, 9.5), 2))),
+               ride_b_avg_rating=Decimal(str(round(random.uniform(6.0, 9.5), 2))),
+           )
+           comparison_count += 1
+       
+       # Create historical snapshots for trend analysis
+       for days_ago in [30, 60, 90, 180, 365]:
+           snapshot_date = timezone.now().date() - timedelta(days=days_ago)
+           
+           for ride in random.sample(rides, min(len(rides), 20)):
+               # Create historical ranking with some variation
+               current_ranking = RideRanking.objects.get(ride=ride)
+               historical_rank = max(1, current_ranking.rank + random.randint(-5, 5))
+               historical_percentage = max(0.0, min(1.0, 
+                   float(current_ranking.winning_percentage) + random.uniform(-0.1, 0.1)
+               ))
+               
+               RankingSnapshot.objects.create(
+                   ride=ride,
+                   rank=historical_rank,
+                   winning_percentage=Decimal(str(round(historical_percentage, 4))),
+                   snapshot_date=snapshot_date,
+               )
+               snapshot_count += 1
+       
+       # Re-rank rides based on winning percentage (simulate algorithm)
+       rankings = RideRanking.objects.order_by('-winning_percentage', '-mutual_riders_count')
+       for new_rank, ranking in enumerate(rankings, 1):
+           ranking.rank = new_rank
+           ranking.save(update_fields=['rank'])
+       
+       self.stdout.write(f'  ✅ Created {ranking_count} ride rankings')
+       self.stdout.write(f'  ✅ Created {comparison_count} pairwise comparisons')
+       self.stdout.write(f'  ✅ Created {snapshot_count} historical snapshots')
+   ```
+
+### Advanced Features Available
+
+- **Internet Roller Coaster Poll Algorithm**: Industry-standard ranking methodology
+- **Pairwise Comparisons**: Sophisticated comparison system between rides
+- **Historical Tracking**: Ranking snapshots for trend analysis
+- **Mutual Rider Analysis**: Rankings based on users who have experienced both rides
+- **Winning Percentage Calculation**: Advanced statistical ranking metrics
+- **Daily Recalculation**: Automated ranking updates based on new data
+
+## Summary of Current Status
+
+### ✅ All Systems Implemented and Ready
+
+All three major systems are **fully implemented** and ready for seeding:
+
+1. **🛡️ Moderation System**: ✅ **COMPLETE**
+   - Comprehensive moderation system with 6 models
+   - ModerationReport, ModerationQueue, ModerationAction, BulkOperation, PhotoSubmission, EditSubmission
+   - Advanced workflow management and action tracking
+   - **Action Required**: Update seeding script to use actual model structure
+
+2. **📸 Photo System**: ✅ **COMPLETE**
+   - Full CloudflareImage integration with django-cloudflareimages-toolkit
+   - ParkPhoto and RidePhoto models with advanced features
+   - MediaService integration, upload paths, approval workflows
+   - **Action Required**: Add CloudflareImage environment variables and update seeding script
+
+3. **🏆 Rankings System**: ✅ **COMPLETE**
+   - Sophisticated Internet Roller Coaster Poll algorithm
+   - RideRanking, RidePairComparison, RankingSnapshot models
+   - Advanced pairwise comparison system with historical tracking
+   - **Action Required**: Update seeding script to create realistic ranking data
+
+### Implementation Priority
+
+| System | Status | Priority | Effort Required |
+|--------|--------|----------|----------------|
+| Moderation | ✅ Implemented | HIGH | 1-2 hours (script updates) |
+| Photo | ✅ Implemented | MEDIUM | 1 hour (env vars + script) |
+| Rankings | ✅ Implemented | LOW | 30 mins (script updates) |
+
+### Next Steps
+
+1. **Update seeding script imports** to use correct model names and structures
+2. **Add environment variables** for CloudflareImage integration
+3. **Modify seeding methods** to work with sophisticated existing models
+4. **Test all seeding functionality** with current implementations
+
+**Total Estimated Time**: 2-3 hours (down from original 6+ hours estimate)
+
+The seeding script can now provide **100% coverage** of all ThrillWiki models and features with these updates.

backend/apps/api/management/commands/SEEDING_IMPLEMENTATION_GUIDE_ACCURACY_REPORT.md

@@ -0,0 +1,212 @@
+# SEEDING_IMPLEMENTATION_GUIDE.md Accuracy Report
+
+**Date:** January 15, 2025  
+**Reviewer:** Cline  
+**Status:** COMPREHENSIVE ANALYSIS COMPLETE
+
+## Executive Summary
+
+The SEEDING_IMPLEMENTATION_GUIDE.md file contains **significant inaccuracies** and outdated information. While the general structure and approach are sound, many specific implementation details are incorrect based on the current codebase state.
+
+**Overall Accuracy Rating: 6/10** ⚠️
+
+## Detailed Analysis by Section
+
+### 🛡️ Moderation Data Implementation
+
+**Status:** ❌ **MAJOR INACCURACIES**
+
+#### What the Guide Claims:
+- States that moderation models are "not fully defined"
+- Provides detailed model implementations for `ModerationQueue` and `ModerationAction`
+- Claims the app needs to be created
+
+#### Actual Current State:
+- ✅ Moderation app **already exists** at `backend/apps/moderation/`
+- ✅ **Comprehensive moderation system** is already implemented with:
+  - `EditSubmission` (original submission workflow)
+  - `ModerationReport` (user reports)
+  - `ModerationQueue` (workflow management) 
+  - `ModerationAction` (actions taken)
+  - `BulkOperation` (bulk administrative operations)
+  - `PhotoSubmission` (photo moderation)
+
+#### Key Differences:
+1. **Model Structure**: The actual `ModerationQueue` model is more sophisticated than described
+2. **Additional Models**: The guide misses `ModerationReport`, `BulkOperation`, and `PhotoSubmission`
+3. **Field Names**: Some field names differ (e.g., `submitted_by` vs `reported_by`)
+4. **Relationships**: More complex relationships exist between models
+
+#### Required Corrections:
+- Remove "models not fully defined" status
+- Update model field mappings to match actual implementation
+- Include all existing moderation models
+- Update seeding script to use actual model structure
+
+### 📸 Photo Records Implementation
+
+**Status:** ⚠️ **PARTIALLY ACCURATE**
+
+#### What the Guide Claims:
+- Photo creation is skipped due to missing CloudflareImage instances
+- Requires Cloudflare Images configuration
+- Needs sample images directory structure
+
+#### Actual Current State:
+- ✅ `django_cloudflareimages_toolkit` **is installed** and configured
+- ✅ `ParkPhoto` and `RidePhoto` models **exist and are properly implemented**
+- ✅ Cloudflare Images settings **are configured** in `base.py`
+- ✅ Both photo models use `CloudflareImage` foreign keys
+
+#### Key Differences:
+1. **Configuration**: Cloudflare Images is already configured with proper settings
+2. **Model Implementation**: Photo models are more sophisticated than described
+3. **Upload Paths**: Custom upload path functions exist
+4. **Media Service**: Advanced `MediaService` integration exists
+
+#### Required Corrections:
+- Update status to reflect that models and configuration exist
+- Modify seeding approach to work with existing CloudflareImage system
+- Include actual model field names and relationships
+- Reference existing `MediaService` for upload handling
+
+### 🏆 Ride Rankings Implementation
+
+**Status:** ✅ **MOSTLY ACCURATE**
+
+#### What the Guide Claims:
+- `RideRanking` model structure not fully defined
+- Needs basic ranking implementation
+
+#### Actual Current State:
+- ✅ **Sophisticated ranking system** exists in `backend/apps/rides/models/rankings.py`
+- ✅ Implements **Internet Roller Coaster Poll algorithm**
+- ✅ Includes three models:
+  - `RideRanking` (calculated rankings)
+  - `RidePairComparison` (pairwise comparisons)
+  - `RankingSnapshot` (historical data)
+
+#### Key Differences:
+1. **Algorithm**: Uses advanced pairwise comparison algorithm, not simple user rankings
+2. **Complexity**: Much more sophisticated than guide suggests
+3. **Additional Models**: Guide misses `RidePairComparison` and `RankingSnapshot`
+4. **Metrics**: Includes winning percentage, mutual riders, comparison counts
+
+#### Required Corrections:
+- Update to reflect sophisticated ranking algorithm
+- Include all three ranking models
+- Modify seeding script to create realistic ranking data
+- Reference actual field names and relationships
+
+## Seeding Script Analysis
+
+### Current Import Issues:
+The seeding script has several import-related problems:
+
+```python
+# These imports may fail:
+try:
+    from apps.moderation.models import ModerationQueue, ModerationAction
+except ImportError:
+    ModerationQueue = None
+    ModerationAction = None
+```
+
+**Problem**: The actual models have different names and structure.
+
+### Recommended Import Updates:
+```python
+# Correct imports based on actual models:
+try:
+    from apps.moderation.models import (
+        ModerationQueue, ModerationAction, ModerationReport, 
+        BulkOperation, PhotoSubmission
+    )
+except ImportError:
+    ModerationQueue = None
+    ModerationAction = None
+    ModerationReport = None
+    BulkOperation = None
+    PhotoSubmission = None
+```
+
+## Implementation Priority Matrix
+
+| Feature | Current Status | Guide Accuracy | Priority | Effort |
+|---------|---------------|----------------|----------|---------|
+| Moderation System | ✅ Implemented | ❌ Inaccurate | HIGH | 2-3 hours |
+| Photo System | ✅ Implemented | ⚠️ Partial | MEDIUM | 1-2 hours |
+| Rankings System | ✅ Implemented | ✅ Mostly OK | LOW | 30 mins |
+
+## Specific Corrections Needed
+
+### 1. Moderation Section Rewrite
+```markdown
+## 🛡️ Moderation Data Implementation
+
+### Current Status
+✅ Comprehensive moderation system is implemented and ready for seeding
+
+### Available Models
+The moderation system includes:
+- `ModerationReport`: User reports about content/behavior
+- `ModerationQueue`: Workflow management for moderation tasks  
+- `ModerationAction`: Actions taken against users/content
+- `BulkOperation`: Administrative bulk operations
+- `PhotoSubmission`: Photo moderation workflow
+- `EditSubmission`: Content edit submissions (legacy)
+```
+
+### 2. Photo Section Update
+```markdown
+## 📸 Photo Records Implementation
+
+### Current Status
+✅ Photo system is fully implemented with CloudflareImage integration
+
+### Available Models
+- `ParkPhoto`: Photos for parks with CloudflareImage storage
+- `RidePhoto`: Photos for rides with CloudflareImage storage
+- Both models include sophisticated metadata and approval workflows
+```
+
+### 3. Rankings Section Enhancement
+```markdown
+## 🏆 Ride Rankings Implementation
+
+### Current Status
+✅ Advanced ranking system using Internet Roller Coaster Poll algorithm
+
+### Available Models
+- `RideRanking`: Calculated rankings with winning percentages
+- `RidePairComparison`: Cached pairwise comparison results
+- `RankingSnapshot`: Historical ranking data for trend analysis
+```
+
+## Recommended Actions
+
+### Immediate (High Priority)
+1. **Rewrite moderation section** to reflect actual implementation
+2. **Update seeding script imports** to use correct model names
+3. **Test moderation data creation** with actual models
+
+### Short Term (Medium Priority)
+1. **Update photo section** to reflect CloudflareImage integration
+2. **Create sample photo seeding** using existing infrastructure
+3. **Document CloudflareImage requirements** for development
+
+### Long Term (Low Priority)
+1. **Enhance rankings seeding** to use sophisticated algorithm
+2. **Add historical ranking snapshots** to seeding
+3. **Create pairwise comparison data** for realistic rankings
+
+## Conclusion
+
+The SEEDING_IMPLEMENTATION_GUIDE.md requires significant updates to match the current codebase. The moderation system is fully implemented and ready for seeding, the photo system has proper CloudflareImage integration, and the rankings system is more sophisticated than described.
+
+**Next Steps:**
+1. Update the guide with accurate information
+2. Modify the seeding script to work with actual models
+3. Test all seeding functionality with current implementations
+
+**Estimated Time to Fix:** 4-6 hours total

backend/apps/api/management/commands/__init__.py

@@ -0,0 +1 @@
+# Management commands

backend/apps/api/urls.py

@@ -0,0 +1,5 @@
+from django.urls import path, include
+
+urlpatterns = [
+    path("v1/", include("apps.api.v1.urls")),
+]

backend/apps/api/v1/__init__.py

@@ -0,0 +1,6 @@
+"""
+ThrillWiki API v1.
+
+This module provides the version 1 REST API for ThrillWiki, consolidating
+all endpoints under a unified, well-documented API structure.
+"""

backend/apps/api/v1/accounts/__init__.py

@@ -0,0 +1,3 @@
+"""
+Accounts API module for user profile and top list management.
+"""

backend/apps/api/v1/accounts/serializers.py

@@ -0,0 +1,86 @@
+from rest_framework import serializers
+from drf_spectacular.utils import extend_schema_field
+from apps.accounts.models import UserProfile, TopList, TopListItem
+from apps.accounts.serializers import UserSerializer  # existing shared user serializer
+
+
+class UserProfileCreateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = UserProfile
+        fields = "__all__"
+
+
+class UserProfileUpdateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = UserProfile
+        fields = "__all__"
+        extra_kwargs = {"user": {"read_only": True}}
+
+
+class UserProfileOutputSerializer(serializers.ModelSerializer):
+    user = UserSerializer(read_only=True)
+    avatar_url = serializers.SerializerMethodField()
+
+    class Meta:
+        model = UserProfile
+        fields = "__all__"
+
+    @extend_schema_field(serializers.URLField(allow_null=True))
+    def get_avatar_url(self, obj) -> str | None:
+        """Get user avatar URL"""
+        # Safely try to return an avatar url if present
+        avatar = getattr(obj, "avatar", None)
+        if avatar:
+            return getattr(avatar, "url", None)
+        user_profile = getattr(obj, "user", None)
+        if user_profile and getattr(user_profile, "profile", None):
+            avatar = getattr(user_profile.profile, "avatar", None)
+            if avatar:
+                return getattr(avatar, "url", None)
+        return None
+
+
+class TopListItemCreateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = TopListItem
+        fields = "__all__"
+
+
+class TopListItemUpdateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = TopListItem
+        fields = "__all__"
+        # allow updates, adjust as needed
+        extra_kwargs = {"top_list": {"read_only": False}}
+
+
+class TopListItemOutputSerializer(serializers.ModelSerializer):
+    # Remove the ride field since it doesn't exist on the model
+    # The model likely uses a generic foreign key or different field name
+
+    class Meta:
+        model = TopListItem
+        fields = "__all__"
+
+
+class TopListCreateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = TopList
+        fields = "__all__"
+
+
+class TopListUpdateInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = TopList
+        fields = "__all__"
+        # user is set by view's perform_create
+        extra_kwargs = {"user": {"read_only": True}}
+
+
+class TopListOutputSerializer(serializers.ModelSerializer):
+    user = UserSerializer(read_only=True)
+    items = TopListItemOutputSerializer(many=True, read_only=True)
+
+    class Meta:
+        model = TopList
+        fields = "__all__"

backend/apps/api/v1/accounts/urls.py

@@ -0,0 +1,109 @@
+"""
+URL configuration for user account management API endpoints.
+"""
+
+from django.urls import path
+from . import views
+
+urlpatterns = [
+    # Admin endpoints for user management
+    path(
+        "users/<str:user_id>/delete/",
+        views.delete_user_preserve_submissions,
+        name="delete_user_preserve_submissions",
+    ),
+    path(
+        "users/<str:user_id>/deletion-check/",
+        views.check_user_deletion_eligibility,
+        name="check_user_deletion_eligibility",
+    ),
+    # Self-service account deletion endpoints
+    path(
+        "delete-account/request/",
+        views.request_account_deletion,
+        name="request_account_deletion",
+    ),
+    path(
+        "delete-account/verify/",
+        views.verify_account_deletion,
+        name="verify_account_deletion",
+    ),
+    path(
+        "delete-account/cancel/",
+        views.cancel_account_deletion,
+        name="cancel_account_deletion",
+    ),
+    # User profile endpoints
+    path("profile/", views.get_user_profile, name="get_user_profile"),
+    path("profile/account/", views.update_user_account, name="update_user_account"),
+    path("profile/update/", views.update_user_profile, name="update_user_profile"),
+    # User preferences endpoints
+    path("preferences/", views.get_user_preferences, name="get_user_preferences"),
+    path(
+        "preferences/update/",
+        views.update_user_preferences,
+        name="update_user_preferences",
+    ),
+    path(
+        "preferences/theme/",
+        views.update_theme_preference,
+        name="update_theme_preference",
+    ),
+    # Notification settings endpoints
+    path(
+        "settings/notifications/",
+        views.get_notification_settings,
+        name="get_notification_settings",
+    ),
+    path(
+        "settings/notifications/update/",
+        views.update_notification_settings,
+        name="update_notification_settings",
+    ),
+    # Privacy settings endpoints
+    path("settings/privacy/", views.get_privacy_settings, name="get_privacy_settings"),
+    path(
+        "settings/privacy/update/",
+        views.update_privacy_settings,
+        name="update_privacy_settings",
+    ),
+    # Security settings endpoints
+    path(
+        "settings/security/", views.get_security_settings, name="get_security_settings"
+    ),
+    path(
+        "settings/security/update/",
+        views.update_security_settings,
+        name="update_security_settings",
+    ),
+    # User statistics endpoints
+    path("statistics/", views.get_user_statistics, name="get_user_statistics"),
+    # Top lists endpoints
+    path("top-lists/", views.get_user_top_lists, name="get_user_top_lists"),
+    path("top-lists/create/", views.create_top_list, name="create_top_list"),
+    path("top-lists/<int:list_id>/", views.update_top_list, name="update_top_list"),
+    path(
+        "top-lists/<int:list_id>/delete/", views.delete_top_list, name="delete_top_list"
+    ),
+    # Notification endpoints
+    path("notifications/", views.get_user_notifications, name="get_user_notifications"),
+    path(
+        "notifications/mark-read/",
+        views.mark_notifications_read,
+        name="mark_notifications_read",
+    ),
+    path(
+        "notification-preferences/",
+        views.get_notification_preferences,
+        name="get_notification_preferences",
+    ),
+    path(
+        "notification-preferences/update/",
+        views.update_notification_preferences,
+        name="update_notification_preferences",
+    ),
+    # Avatar endpoints
+    path("profile/avatar/upload/", views.upload_avatar, name="upload_avatar"),
+    path("profile/avatar/save/", views.save_avatar_image, name="save_avatar_image"),
+    path("profile/avatar/delete/", views.delete_avatar, name="delete_avatar"),
+]

backend/apps/api/v1/auth/__init__.py

@@ -0,0 +1,6 @@
+"""
+Authentication API endpoints for ThrillWiki v1.
+
+This package contains all authentication and authorization-related
+API functionality including login, logout, user management, and permissions.
+"""

backend/apps/api/v1/auth/models.py

@@ -0,0 +1,3 @@
+# This file is intentionally empty.
+# All models are now in their appropriate apps to avoid conflicts.
+# PasswordReset model is available in apps.accounts.models

backend/apps/api/v1/auth/serializers.py

@@ -0,0 +1,608 @@
+"""
+Auth domain serializers for ThrillWiki API v1.
+
+This module contains all serializers related to authentication, user accounts,
+profiles, top lists, and user statistics.
+"""
+
+from typing import Any, Dict
+
+from rest_framework import serializers
+from drf_spectacular.utils import (
+    extend_schema_serializer,
+    extend_schema_field,
+    OpenApiExample,
+)
+from django.contrib.auth.password_validation import validate_password
+from django.utils.crypto import get_random_string
+from django.contrib.auth import get_user_model
+from django.utils import timezone
+from datetime import timedelta
+from apps.accounts.models import PasswordReset
+
+
+UserModel = get_user_model()
+
+
+def _normalize_email(value: str) -> str:
+    """Normalize email for consistent lookups (strip + lowercase)."""
+    if value is None:
+        return value
+    return value.strip().lower()
+
+
+# Import shared utilities
+
+
+class ModelChoices:
+    """Model choices utility class."""
+
+    @staticmethod
+    def get_top_list_categories():
+        """Get top list category choices."""
+        return [
+            ("RC", "Roller Coasters"),
+            ("DR", "Dark Rides"),
+            ("FR", "Flat Rides"),
+            ("WR", "Water Rides"),
+            ("PK", "Parks"),
+        ]
+
+
+# === AUTHENTICATION SERIALIZERS ===
+
+
+@extend_schema_serializer(
+    examples=[
+        OpenApiExample(
+            "User Example",
+            summary="Example user response",
+            description="A typical user object",
+            value={
+                "id": 1,
+                "username": "john_doe",
+                "email": "john@example.com",
+                "display_name": "John Doe",
+                "date_joined": "2024-01-01T12:00:00Z",
+                "is_active": True,
+                "avatar_url": "https://example.com/avatars/john.jpg",
+            },
+        )
+    ]
+)
+class UserOutputSerializer(serializers.ModelSerializer):
+    """User serializer for API responses."""
+
+    avatar_url = serializers.SerializerMethodField()
+    display_name = serializers.SerializerMethodField()
+
+    class Meta:
+        model = UserModel
+        fields = [
+            "id",
+            "username",
+            "email",
+            "display_name",
+            "date_joined",
+            "is_active",
+            "avatar_url",
+        ]
+        read_only_fields = ["id", "date_joined", "is_active"]
+
+    def get_display_name(self, obj):
+        """Get the user's display name."""
+        return obj.get_display_name()
+
+    @extend_schema_field(serializers.URLField(allow_null=True))
+    def get_avatar_url(self, obj) -> str | None:
+        """Get user avatar URL."""
+        if hasattr(obj, "profile") and obj.profile:
+            return obj.profile.get_avatar_url()
+        return None
+
+
+class LoginInputSerializer(serializers.Serializer):
+    """Input serializer for user login."""
+
+    username = serializers.CharField(
+        max_length=254, help_text="Username or email address"
+    )
+    password = serializers.CharField(
+        max_length=128, style={"input_type": "password"}, trim_whitespace=False
+    )
+
+    def validate(self, attrs):
+        username = attrs.get("username")
+        password = attrs.get("password")
+
+        if username and password:
+            return attrs
+
+        raise serializers.ValidationError("Must include username/email and password.")
+
+
+class LoginOutputSerializer(serializers.Serializer):
+    """Output serializer for successful login."""
+
+    access = serializers.CharField()
+    refresh = serializers.CharField()
+    user = UserOutputSerializer()
+    message = serializers.CharField()
+
+
+class SignupInputSerializer(serializers.ModelSerializer):
+    """Input serializer for user registration."""
+
+    password = serializers.CharField(
+        write_only=True,
+        validators=[validate_password],
+        style={"input_type": "password"},
+    )
+    password_confirm = serializers.CharField(
+        write_only=True, style={"input_type": "password"}
+    )
+
+    class Meta:
+        model = UserModel
+        fields = [
+            "username",
+            "email",
+            "display_name",
+            "password",
+            "password_confirm",
+        ]
+        extra_kwargs = {
+            "password": {"write_only": True},
+            "email": {"required": True},
+            "display_name": {"required": True},
+        }
+
+    def validate_email(self, value):
+        """Validate email is unique (case-insensitive) and return normalized email."""
+        normalized = _normalize_email(value)
+        if UserModel.objects.filter(email__iexact=normalized).exists():
+            raise serializers.ValidationError("A user with this email already exists.")
+        return normalized
+
+    def validate_username(self, value):
+        """Validate username is unique."""
+        if UserModel.objects.filter(username=value).exists():
+            raise serializers.ValidationError(
+                "A user with this username already exists."
+            )
+        return value
+
+    def validate(self, attrs):
+        """Validate passwords match."""
+        password = attrs.get("password")
+        password_confirm = attrs.get("password_confirm")
+
+        if password != password_confirm:
+            raise serializers.ValidationError(
+                {"password_confirm": "Passwords do not match."}
+            )
+
+        return attrs
+
+    def create(self, validated_data):
+        """Create user with validated data and send verification email."""
+        validated_data.pop("password_confirm", None)
+        password = validated_data.pop("password")
+
+        # Create inactive user - they need to verify email first
+        user = UserModel.objects.create_user(  # type: ignore[attr-defined]
+            password=password, is_active=False, **validated_data
+        )
+
+        # Create email verification record and send email
+        self._send_verification_email(user)
+
+        return user
+
+    def _send_verification_email(self, user):
+        """Send email verification to the user."""
+        from apps.accounts.models import EmailVerification
+        from django.utils.crypto import get_random_string
+        from django_forwardemail.services import EmailService
+        from django.contrib.sites.shortcuts import get_current_site
+        import logging
+
+        logger = logging.getLogger(__name__)
+
+        # Create or update email verification record
+        verification, created = EmailVerification.objects.get_or_create(
+            user=user,
+            defaults={'token': get_random_string(64)}
+        )
+
+        if not created:
+            # Update existing token and timestamp
+            verification.token = get_random_string(64)
+            verification.save()
+
+        # Get current site from request context
+        request = self.context.get('request')
+        if request:
+            site = get_current_site(request._request)
+
+            # Build verification URL
+            verification_url = request.build_absolute_uri(
+                f"/api/v1/auth/verify-email/{verification.token}/"
+            )
+
+            # Send verification email
+            try:
+                response = EmailService.send_email(
+                    to=user.email,
+                    subject="Verify your ThrillWiki account",
+                    text=f"""
+Welcome to ThrillWiki!
+
+Please verify your email address by clicking the link below:
+{verification_url}
+
+If you didn't create an account, you can safely ignore this email.
+
+Thanks,
+The ThrillWiki Team
+                    """.strip(),
+                    site=site,
+                )
+
+                # Log the ForwardEmail email ID from the response
+                email_id = response.get('id') if response else None
+                if email_id:
+                    logger.info(
+                        f"Verification email sent successfully to {user.email}. ForwardEmail ID: {email_id}")
+                else:
+                    logger.info(
+                        f"Verification email sent successfully to {user.email}. No email ID in response.")
+
+            except Exception as e:
+                # Log the error but don't fail registration
+                logger.error(f"Failed to send verification email to {user.email}: {e}")
+
+
+class SignupOutputSerializer(serializers.Serializer):
+    """Output serializer for successful signup."""
+
+    access = serializers.CharField(allow_null=True)
+    refresh = serializers.CharField(allow_null=True)
+    user = UserOutputSerializer()
+    message = serializers.CharField()
+    email_verification_required = serializers.BooleanField(default=False)
+
+
+class PasswordResetInputSerializer(serializers.Serializer):
+    """Input serializer for password reset request."""
+
+    email = serializers.EmailField()
+
+    def validate_email(self, value):
+        """Normalize email and attach user to the serializer when found (case-insensitive).
+
+        Returns the normalized email. Does not reveal whether the email exists.
+        """
+        normalized = _normalize_email(value)
+        try:
+            user = UserModel.objects.get(email__iexact=normalized)
+            self.user = user
+        except UserModel.DoesNotExist:
+            # Do not reveal whether the email exists; keep behavior unchanged.
+            pass
+        return normalized
+
+    def save(self, **kwargs):
+        """Send password reset email if user exists."""
+        if hasattr(self, "user"):
+            # generate a secure random token and persist it with expiry
+            now = timezone.now()
+            expires = now + timedelta(hours=24)  # token valid for 24 hours
+
+            # Persist password reset with generated token (avoid creating an unused local variable).
+            PasswordReset.objects.create(
+                user=self.user,
+                token=get_random_string(64),
+                expires_at=expires,
+            )
+
+            # Optionally: enqueue/send an email with the token-based reset link here.
+            # Keep token out of API responses to avoid leaking it.
+
+
+class PasswordResetOutputSerializer(serializers.Serializer):
+    """Output serializer for password reset request."""
+
+    detail = serializers.CharField()
+
+
+class PasswordChangeInputSerializer(serializers.Serializer):
+    """Input serializer for password change."""
+
+    old_password = serializers.CharField(
+        max_length=128, style={"input_type": "password"}
+    )
+    new_password = serializers.CharField(
+        max_length=128,
+        validators=[validate_password],
+        style={"input_type": "password"},
+    )
+    new_password_confirm = serializers.CharField(
+        max_length=128, style={"input_type": "password"}
+    )
+
+    def validate_old_password(self, value):
+        """Validate old password is correct."""
+        user = self.context["request"].user
+        if not user.check_password(value):
+            raise serializers.ValidationError("Old password is incorrect.")
+        return value
+
+    def validate(self, attrs):
+        """Validate new passwords match."""
+        new_password = attrs.get("new_password")
+        new_password_confirm = attrs.get("new_password_confirm")
+
+        if new_password != new_password_confirm:
+            raise serializers.ValidationError(
+                {"new_password_confirm": "New passwords do not match."}
+            )
+
+        return attrs
+
+    def save(self, **kwargs):
+        """Change user password."""
+        user = self.context["request"].user
+        # validated_data is guaranteed to exist after is_valid() is called
+        new_password = self.validated_data["new_password"]  # type: ignore[index]
+
+        user.set_password(new_password)
+        user.save()
+
+        return user
+
+
+class PasswordChangeOutputSerializer(serializers.Serializer):
+    """Output serializer for password change."""
+
+    detail = serializers.CharField()
+
+
+class LogoutOutputSerializer(serializers.Serializer):
+    """Output serializer for logout."""
+
+    message = serializers.CharField()
+
+
+class SocialProviderOutputSerializer(serializers.Serializer):
+    """Output serializer for social authentication providers."""
+
+    id = serializers.CharField()
+    name = serializers.CharField()
+    authUrl = serializers.URLField()
+
+
+class AuthStatusOutputSerializer(serializers.Serializer):
+    """Output serializer for authentication status check."""
+
+    authenticated = serializers.BooleanField()
+    user = UserOutputSerializer(allow_null=True)
+
+
+# === USER PROFILE SERIALIZERS ===
+
+
+@extend_schema_serializer(
+    examples=[
+        OpenApiExample(
+            "User Profile Example",
+            summary="Example user profile response",
+            description="A user's profile information",
+            value={
+                "id": 1,
+                "profile_id": "1234",
+                "display_name": "Coaster Enthusiast",
+                "bio": "Love visiting theme parks around the world!",
+                "pronouns": "they/them",
+                "avatar_url": "/media/avatars/user1.jpg",
+                "coaster_credits": 150,
+                "dark_ride_credits": 45,
+                "flat_ride_credits": 80,
+                "water_ride_credits": 25,
+                "user": {
+                    "username": "coaster_fan",
+                    "date_joined": "2024-01-01T00:00:00Z",
+                },
+            },
+        )
+    ]
+)
+class UserProfileOutputSerializer(serializers.Serializer):
+    """Output serializer for user profiles."""
+
+    id = serializers.IntegerField()
+    profile_id = serializers.CharField()
+    display_name = serializers.CharField()
+    bio = serializers.CharField()
+    pronouns = serializers.CharField()
+    avatar_url = serializers.SerializerMethodField()
+    twitter = serializers.URLField()
+    instagram = serializers.URLField()
+    youtube = serializers.URLField()
+    discord = serializers.CharField()
+
+    # Ride statistics
+    coaster_credits = serializers.IntegerField()
+    dark_ride_credits = serializers.IntegerField()
+    flat_ride_credits = serializers.IntegerField()
+    water_ride_credits = serializers.IntegerField()
+
+    # User info (limited)
+    user = serializers.SerializerMethodField()
+
+    @extend_schema_field(serializers.URLField(allow_null=True))
+    def get_avatar_url(self, obj) -> str | None:
+        return obj.get_avatar_url()
+
+    @extend_schema_field(serializers.DictField())
+    def get_user(self, obj) -> Dict[str, Any]:
+        return {
+            "username": obj.user.username,
+            "date_joined": obj.user.date_joined,
+        }
+
+
+class UserProfileCreateInputSerializer(serializers.Serializer):
+    """Input serializer for creating user profiles."""
+
+    display_name = serializers.CharField(max_length=50)
+    bio = serializers.CharField(max_length=500, allow_blank=True, default="")
+    pronouns = serializers.CharField(max_length=50, allow_blank=True, default="")
+    twitter = serializers.URLField(required=False, allow_blank=True)
+    instagram = serializers.URLField(required=False, allow_blank=True)
+    youtube = serializers.URLField(required=False, allow_blank=True)
+    discord = serializers.CharField(max_length=100, allow_blank=True, default="")
+
+
+class UserProfileUpdateInputSerializer(serializers.Serializer):
+    """Input serializer for updating user profiles."""
+
+    display_name = serializers.CharField(max_length=50, required=False)
+    bio = serializers.CharField(max_length=500, allow_blank=True, required=False)
+    pronouns = serializers.CharField(max_length=50, allow_blank=True, required=False)
+    twitter = serializers.URLField(required=False, allow_blank=True)
+    instagram = serializers.URLField(required=False, allow_blank=True)
+    youtube = serializers.URLField(required=False, allow_blank=True)
+    discord = serializers.CharField(max_length=100, allow_blank=True, required=False)
+    coaster_credits = serializers.IntegerField(required=False)
+    dark_ride_credits = serializers.IntegerField(required=False)
+    flat_ride_credits = serializers.IntegerField(required=False)
+    water_ride_credits = serializers.IntegerField(required=False)
+
+
+# === TOP LIST SERIALIZERS ===
+
+
+@extend_schema_serializer(
+    examples=[
+        OpenApiExample(
+            "Top List Example",
+            summary="Example top list response",
+            description="A user's top list of rides or parks",
+            value={
+                "id": 1,
+                "title": "My Top 10 Roller Coasters",
+                "category": "RC",
+                "description": "My favorite roller coasters ranked",
+                "user": {"username": "coaster_fan", "display_name": "Coaster Fan"},
+                "created_at": "2024-01-01T00:00:00Z",
+                "updated_at": "2024-08-15T12:00:00Z",
+            },
+        )
+    ]
+)
+class TopListOutputSerializer(serializers.Serializer):
+    """Output serializer for top lists."""
+
+    id = serializers.IntegerField()
+    title = serializers.CharField()
+    category = serializers.CharField()
+    description = serializers.CharField()
+    created_at = serializers.DateTimeField()
+    updated_at = serializers.DateTimeField()
+
+    # User info
+    user = serializers.SerializerMethodField()
+
+    @extend_schema_field(serializers.DictField())
+    def get_user(self, obj) -> Dict[str, Any]:
+        return {
+            "username": obj.user.username,
+            "display_name": obj.user.get_display_name(),
+        }
+
+
+class TopListCreateInputSerializer(serializers.Serializer):
+    """Input serializer for creating top lists."""
+
+    title = serializers.CharField(max_length=100)
+    category = serializers.ChoiceField(choices=ModelChoices.get_top_list_categories())
+    description = serializers.CharField(allow_blank=True, default="")
+
+
+class TopListUpdateInputSerializer(serializers.Serializer):
+    """Input serializer for updating top lists."""
+
+    title = serializers.CharField(max_length=100, required=False)
+    category = serializers.ChoiceField(
+        choices=ModelChoices.get_top_list_categories(), required=False
+    )
+    description = serializers.CharField(allow_blank=True, required=False)
+
+
+# === TOP LIST ITEM SERIALIZERS ===
+
+
+@extend_schema_serializer(
+    examples=[
+        OpenApiExample(
+            "Top List Item Example",
+            summary="Example top list item response",
+            description="An item in a user's top list",
+            value={
+                "id": 1,
+                "rank": 1,
+                "notes": "Amazing airtime and smooth ride",
+                "object_name": "Steel Vengeance",
+                "object_type": "Ride",
+                "top_list": {"id": 1, "title": "My Top 10 Roller Coasters"},
+            },
+        )
+    ]
+)
+class TopListItemOutputSerializer(serializers.Serializer):
+    """Output serializer for top list items."""
+
+    id = serializers.IntegerField()
+    rank = serializers.IntegerField()
+    notes = serializers.CharField()
+    object_name = serializers.SerializerMethodField()
+    object_type = serializers.SerializerMethodField()
+
+    # Top list info
+    top_list = serializers.SerializerMethodField()
+
+    @extend_schema_field(serializers.CharField())
+    def get_object_name(self, obj) -> str:
+        """Get the name of the referenced object."""
+        # This would need to be implemented based on the generic foreign key
+        return "Object Name"  # Placeholder
+
+    @extend_schema_field(serializers.CharField())
+    def get_object_type(self, obj) -> str:
+        """Get the type of the referenced object."""
+        return obj.content_type.model_class().__name__
+
+    @extend_schema_field(serializers.DictField())
+    def get_top_list(self, obj) -> Dict[str, Any]:
+        return {
+            "id": obj.top_list.id,
+            "title": obj.top_list.title,
+        }
+
+
+class TopListItemCreateInputSerializer(serializers.Serializer):
+    """Input serializer for creating top list items."""
+
+    top_list_id = serializers.IntegerField()
+    content_type_id = serializers.IntegerField()
+    object_id = serializers.IntegerField()
+    rank = serializers.IntegerField(min_value=1)
+    notes = serializers.CharField(allow_blank=True, default="")
+
+
+class TopListItemUpdateInputSerializer(serializers.Serializer):
+    """Input serializer for updating top list items."""
+
+    rank = serializers.IntegerField(min_value=1, required=False)
+    notes = serializers.CharField(allow_blank=True, required=False)

backend/apps/api/v1/auth/serializers_package/__init__.py

@@ -0,0 +1,31 @@
+"""
+Auth Serializers Package
+
+This package contains social authentication-related serializers.
+Main authentication serializers are imported directly from the parent serializers.py file.
+"""
+
+from .social import (
+    ConnectedProviderSerializer,
+    AvailableProviderSerializer,
+    SocialAuthStatusSerializer,
+    ConnectProviderInputSerializer,
+    ConnectProviderOutputSerializer,
+    DisconnectProviderOutputSerializer,
+    SocialProviderListOutputSerializer,
+    ConnectedProvidersListOutputSerializer,
+    SocialProviderErrorSerializer,
+)
+
+__all__ = [
+    # Social authentication serializers
+    'ConnectedProviderSerializer',
+    'AvailableProviderSerializer',
+    'SocialAuthStatusSerializer',
+    'ConnectProviderInputSerializer',
+    'ConnectProviderOutputSerializer',
+    'DisconnectProviderOutputSerializer',
+    'SocialProviderListOutputSerializer',
+    'ConnectedProvidersListOutputSerializer',
+    'SocialProviderErrorSerializer',
+]

backend/apps/api/v1/auth/serializers_package/social.py

@@ -0,0 +1,200 @@
+"""
+Social Provider Management Serializers
+
+Serializers for handling social provider connection/disconnection requests
+and responses in the ThrillWiki API.
+"""
+
+from rest_framework import serializers
+from django.contrib.auth import get_user_model
+
+User = get_user_model()
+
+
+class ConnectedProviderSerializer(serializers.Serializer):
+    """Serializer for connected social provider information."""
+
+    provider = serializers.CharField(
+        help_text="Provider ID (e.g., 'google', 'discord')"
+    )
+    provider_name = serializers.CharField(
+        help_text="Human-readable provider name"
+    )
+    uid = serializers.CharField(
+        help_text="User ID on the social provider"
+    )
+    date_joined = serializers.DateTimeField(
+        help_text="When this provider was connected"
+    )
+    can_disconnect = serializers.BooleanField(
+        help_text="Whether this provider can be safely disconnected"
+    )
+    disconnect_reason = serializers.CharField(
+        allow_null=True,
+        required=False,
+        help_text="Reason why provider cannot be disconnected (if applicable)"
+    )
+    extra_data = serializers.JSONField(
+        required=False,
+        help_text="Additional data from the social provider"
+    )
+
+
+class AvailableProviderSerializer(serializers.Serializer):
+    """Serializer for available social provider information."""
+
+    id = serializers.CharField(
+        help_text="Provider ID (e.g., 'google', 'discord')"
+    )
+    name = serializers.CharField(
+        help_text="Human-readable provider name"
+    )
+    auth_url = serializers.URLField(
+        help_text="URL to initiate authentication with this provider"
+    )
+    connect_url = serializers.URLField(
+        help_text="API URL to connect this provider"
+    )
+
+
+class SocialAuthStatusSerializer(serializers.Serializer):
+    """Serializer for comprehensive social authentication status."""
+
+    user_id = serializers.IntegerField(
+        help_text="User's ID"
+    )
+    username = serializers.CharField(
+        help_text="User's username"
+    )
+    email = serializers.EmailField(
+        help_text="User's email address"
+    )
+    has_password_auth = serializers.BooleanField(
+        help_text="Whether user has email/password authentication set up"
+    )
+    connected_providers = ConnectedProviderSerializer(
+        many=True,
+        help_text="List of connected social providers"
+    )
+    total_auth_methods = serializers.IntegerField(
+        help_text="Total number of authentication methods available"
+    )
+    can_disconnect_any = serializers.BooleanField(
+        help_text="Whether user can safely disconnect any provider"
+    )
+    requires_password_setup = serializers.BooleanField(
+        help_text="Whether user needs to set up password before disconnecting"
+    )
+
+
+class ConnectProviderInputSerializer(serializers.Serializer):
+    """Serializer for social provider connection requests."""
+
+    provider = serializers.CharField(
+        help_text="Provider ID to connect (e.g., 'google', 'discord')"
+    )
+
+    def validate_provider(self, value):
+        """Validate that the provider is supported and configured."""
+        from apps.accounts.services.social_provider_service import SocialProviderService
+
+        is_valid, message = SocialProviderService.validate_provider_exists(value)
+        if not is_valid:
+            raise serializers.ValidationError(message)
+
+        return value
+
+
+class ConnectProviderOutputSerializer(serializers.Serializer):
+    """Serializer for social provider connection responses."""
+
+    success = serializers.BooleanField(
+        help_text="Whether the connection was successful"
+    )
+    message = serializers.CharField(
+        help_text="Success or error message"
+    )
+    provider = serializers.CharField(
+        help_text="Provider that was connected"
+    )
+    auth_url = serializers.URLField(
+        required=False,
+        help_text="URL to complete the connection process"
+    )
+
+
+class DisconnectProviderOutputSerializer(serializers.Serializer):
+    """Serializer for social provider disconnection responses."""
+
+    success = serializers.BooleanField(
+        help_text="Whether the disconnection was successful"
+    )
+    message = serializers.CharField(
+        help_text="Success or error message"
+    )
+    provider = serializers.CharField(
+        help_text="Provider that was disconnected"
+    )
+    remaining_providers = serializers.ListField(
+        child=serializers.CharField(),
+        help_text="List of remaining connected providers"
+    )
+    has_password_auth = serializers.BooleanField(
+        help_text="Whether user still has password authentication"
+    )
+    suggestions = serializers.ListField(
+        child=serializers.CharField(),
+        required=False,
+        help_text="Suggestions for maintaining account access (if applicable)"
+    )
+
+
+class SocialProviderListOutputSerializer(serializers.Serializer):
+    """Serializer for listing available social providers."""
+
+    available_providers = AvailableProviderSerializer(
+        many=True,
+        help_text="List of available social providers"
+    )
+    count = serializers.IntegerField(
+        help_text="Number of available providers"
+    )
+
+
+class ConnectedProvidersListOutputSerializer(serializers.Serializer):
+    """Serializer for listing connected social providers."""
+
+    connected_providers = ConnectedProviderSerializer(
+        many=True,
+        help_text="List of connected social providers"
+    )
+    count = serializers.IntegerField(
+        help_text="Number of connected providers"
+    )
+    has_password_auth = serializers.BooleanField(
+        help_text="Whether user has password authentication"
+    )
+    can_disconnect_any = serializers.BooleanField(
+        help_text="Whether user can safely disconnect any provider"
+    )
+
+
+class SocialProviderErrorSerializer(serializers.Serializer):
+    """Serializer for social provider error responses."""
+
+    error = serializers.CharField(
+        help_text="Error message"
+    )
+    code = serializers.CharField(
+        required=False,
+        help_text="Error code for programmatic handling"
+    )
+    suggestions = serializers.ListField(
+        child=serializers.CharField(),
+        required=False,
+        help_text="Suggestions for resolving the error"
+    )
+    provider = serializers.CharField(
+        required=False,
+        help_text="Provider related to the error (if applicable)"
+    )

backend/apps/api/v1/auth/urls.py

@@ -0,0 +1,104 @@
+"""
+Auth domain URL Configuration for ThrillWiki API v1.
+
+This module contains URL patterns for core authentication functionality only.
+User profiles and top lists are handled by the dedicated accounts app.
+"""
+
+from django.urls import path, include
+from .views import (
+    # Main auth views
+    LoginAPIView,
+    SignupAPIView,
+    LogoutAPIView,
+    CurrentUserAPIView,
+    PasswordResetAPIView,
+    PasswordChangeAPIView,
+    SocialProvidersAPIView,
+    AuthStatusAPIView,
+    # Email verification views
+    EmailVerificationAPIView,
+    ResendVerificationAPIView,
+    # Social provider management views
+    AvailableProvidersAPIView,
+    ConnectedProvidersAPIView,
+    ConnectProviderAPIView,
+    DisconnectProviderAPIView,
+    SocialAuthStatusAPIView,
+)
+from rest_framework_simplejwt.views import TokenRefreshView
+
+
+urlpatterns = [
+    # Core authentication endpoints
+    path("login/", LoginAPIView.as_view(), name="auth-login"),
+    path("signup/", SignupAPIView.as_view(), name="auth-signup"),
+    path("logout/", LogoutAPIView.as_view(), name="auth-logout"),
+    path("user/", CurrentUserAPIView.as_view(), name="auth-current-user"),
+
+    # JWT token management
+    path("token/refresh/", TokenRefreshView.as_view(), name="auth-token-refresh"),
+
+    # Social authentication endpoints (dj-rest-auth)
+    path("social/", include("dj_rest_auth.registration.urls")),
+
+    path(
+        "password/reset/",
+        PasswordResetAPIView.as_view(),
+        name="auth-password-reset",
+    ),
+    path(
+        "password/change/",
+        PasswordChangeAPIView.as_view(),
+        name="auth-password-change",
+    ),
+    path(
+        "social/providers/",
+        SocialProvidersAPIView.as_view(),
+        name="auth-social-providers",
+    ),
+
+    # Social provider management endpoints
+    path(
+        "social/providers/available/",
+        AvailableProvidersAPIView.as_view(),
+        name="auth-social-providers-available",
+    ),
+    path(
+        "social/connected/",
+        ConnectedProvidersAPIView.as_view(),
+        name="auth-social-connected",
+    ),
+    path(
+        "social/connect/<str:provider>/",
+        ConnectProviderAPIView.as_view(),
+        name="auth-social-connect",
+    ),
+    path(
+        "social/disconnect/<str:provider>/",
+        DisconnectProviderAPIView.as_view(),
+        name="auth-social-disconnect",
+    ),
+    path(
+        "social/status/",
+        SocialAuthStatusAPIView.as_view(),
+        name="auth-social-status",
+    ),
+
+    path("status/", AuthStatusAPIView.as_view(), name="auth-status"),
+
+    # Email verification endpoints
+    path(
+        "verify-email/<str:token>/",
+        EmailVerificationAPIView.as_view(),
+        name="auth-verify-email",
+    ),
+    path(
+        "resend-verification/",
+        ResendVerificationAPIView.as_view(),
+        name="auth-resend-verification",
+    ),
+]
+
+# Note: User profiles and top lists functionality is now handled by the accounts app
+# to maintain clean separation of concerns and avoid duplicate API endpoints.

backend/apps/api/v1/auth/views.py

@@ -0,0 +1,883 @@
+"""
+Auth domain views for ThrillWiki API v1.
+
+This module contains all authentication-related API endpoints including
+login, signup, logout, password management, social authentication,
+user profiles, and top lists.
+"""
+
+from .serializers_package.social import (
+    ConnectedProviderSerializer,
+    AvailableProviderSerializer,
+    SocialAuthStatusSerializer,
+    ConnectProviderInputSerializer,
+    ConnectProviderOutputSerializer,
+    DisconnectProviderOutputSerializer,
+    SocialProviderErrorSerializer,
+)
+from apps.accounts.services.social_provider_service import SocialProviderService
+from django.contrib.auth import authenticate, login, logout, get_user_model
+from django.contrib.sites.shortcuts import get_current_site
+from django.core.exceptions import ValidationError
+from django.db.models import Q
+from typing import Optional, cast  # added 'cast'
+from django.http import HttpRequest  # new import
+from rest_framework import status
+from rest_framework.views import APIView
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.permissions import AllowAny, IsAuthenticated
+from drf_spectacular.utils import extend_schema, extend_schema_view
+
+# Import directly from the auth serializers.py file (not the serializers package)
+from .serializers import (
+    # Authentication serializers
+    LoginInputSerializer,
+    LoginOutputSerializer,
+    SignupInputSerializer,
+    SignupOutputSerializer,
+    LogoutOutputSerializer,
+    UserOutputSerializer,
+    PasswordResetInputSerializer,
+    PasswordResetOutputSerializer,
+    PasswordChangeInputSerializer,
+    PasswordChangeOutputSerializer,
+    SocialProviderOutputSerializer,
+    AuthStatusOutputSerializer,
+)
+
+# Handle optional dependencies with fallback classes
+
+
+class FallbackTurnstileMixin:
+    """Fallback mixin if TurnstileMixin is not available."""
+
+    def validate_turnstile(self, request):
+        pass
+
+
+# Try to import the real class, use fallback if not available and ensure it's a class/type
+try:
+    from apps.accounts.mixins import TurnstileMixin as _ImportedTurnstileMixin
+
+    # Ensure the imported object is a class/type that can be used as a base class.
+    # If it's not a type for any reason, fall back to the safe mixin.
+    if isinstance(_ImportedTurnstileMixin, type):
+        TurnstileMixin = _ImportedTurnstileMixin
+    else:
+        TurnstileMixin = FallbackTurnstileMixin
+except Exception:
+    # Catch any import errors or unexpected exceptions and use the fallback mixin.
+    TurnstileMixin = FallbackTurnstileMixin
+
+UserModel = get_user_model()
+
+# Helper: safely obtain underlying HttpRequest (used by Django auth)
+
+
+def _get_underlying_request(request: Request) -> HttpRequest:
+    """
+    Return a django HttpRequest for use with Django auth and site utilities.
+
+    DRF's Request wraps the underlying HttpRequest in ._request; cast() tells the
+    typechecker that the returned object is indeed an HttpRequest.
+    """
+    return cast(HttpRequest, getattr(request, "_request", request))
+
+
+# Helper: encapsulate user lookup + authenticate to reduce complexity in view
+def _authenticate_user_by_lookup(
+    email_or_username: str, password: str, request: Request
+) -> Optional[UserModel]:
+    """
+    Try a single optimized query to find a user by email OR username then authenticate.
+    Returns authenticated user or None.
+    """
+    try:
+        # Single query to find user by email OR username
+        if "@" in (email_or_username or ""):
+            user_obj = (
+                UserModel.objects.select_related()
+                .filter(Q(email=email_or_username) | Q(username=email_or_username))
+                .first()
+            )
+        else:
+            user_obj = (
+                UserModel.objects.select_related()
+                .filter(Q(username=email_or_username) | Q(email=email_or_username))
+                .first()
+            )
+
+        if user_obj:
+            username_val = getattr(user_obj, "username", None)
+            return authenticate(
+                # type: ignore[arg-type]
+                _get_underlying_request(request),
+                username=username_val,
+                password=password,
+            )
+    except Exception:
+        # Fallback to authenticate directly with provided identifier
+        return authenticate(
+            # type: ignore[arg-type]
+            _get_underlying_request(request),
+            username=email_or_username,
+            password=password,
+        )
+
+    return None
+
+
+# === AUTHENTICATION API VIEWS ===
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="User login",
+        description="Authenticate user with username/email and password.",
+        request=LoginInputSerializer,
+        responses={
+            200: LoginOutputSerializer,
+            400: "Bad Request",
+        },
+        tags=["Authentication"],
+    ),
+)
+class LoginAPIView(APIView):
+    """API endpoint for user login."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+    serializer_class = LoginInputSerializer
+
+    def post(self, request: Request) -> Response:
+        try:
+            # instantiate mixin before calling to avoid type-mismatch in static analysis
+            TurnstileMixin().validate_turnstile(request)
+        except ValidationError as e:
+            return Response({"error": str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        except Exception:
+            # If mixin doesn't do anything, continue
+            pass
+
+        serializer = LoginInputSerializer(data=request.data)
+        if serializer.is_valid():
+            validated = serializer.validated_data
+            # Use .get to satisfy static analyzers
+            email_or_username = validated.get("username")  # type: ignore[assignment]
+            password = validated.get("password")  # type: ignore[assignment]
+
+            if not email_or_username or not password:
+                return Response(
+                    {"error": "username and password are required"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+            user = _authenticate_user_by_lookup(email_or_username, password, request)
+
+            if user:
+                if getattr(user, "is_active", False):
+                    # pass a real HttpRequest to Django login with backend specified
+                    login(_get_underlying_request(request), user,
+                          backend='django.contrib.auth.backends.ModelBackend')
+
+                    # Generate JWT tokens
+                    from rest_framework_simplejwt.tokens import RefreshToken
+
+                    refresh = RefreshToken.for_user(user)
+                    access_token = refresh.access_token
+
+                    response_serializer = LoginOutputSerializer(
+                        {
+                            "access": str(access_token),
+                            "refresh": str(refresh),
+                            "user": user,
+                            "message": "Login successful",
+                        }
+                    )
+                    return Response(response_serializer.data)
+                else:
+                    return Response(
+                        {
+                            "error": "Email verification required", 
+                            "message": "Please verify your email address before logging in. Check your email for a verification link.",
+                            "email_verification_required": True
+                        },
+                        status=status.HTTP_400_BAD_REQUEST,
+                    )
+            else:
+                return Response(
+                    {"error": "Invalid credentials"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="User registration",
+        description="Register a new user account. Email verification required.",
+        request=SignupInputSerializer,
+        responses={
+            201: SignupOutputSerializer,
+            400: "Bad Request",
+        },
+        tags=["Authentication"],
+    ),
+)
+class SignupAPIView(APIView):
+    """API endpoint for user registration."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+    serializer_class = SignupInputSerializer
+
+    def post(self, request: Request) -> Response:
+        try:
+            # instantiate mixin before calling to avoid type-mismatch in static analysis
+            TurnstileMixin().validate_turnstile(request)
+        except ValidationError as e:
+            return Response({"error": str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        except Exception:
+            # If mixin doesn't do anything, continue
+            pass
+
+        serializer = SignupInputSerializer(data=request.data, context={"request": request})
+        if serializer.is_valid():
+            user = serializer.save()
+            
+            # Don't log in the user immediately - they need to verify their email first
+            response_serializer = SignupOutputSerializer(
+                {
+                    "access": None,
+                    "refresh": None,
+                    "user": user,
+                    "message": "Registration successful. Please check your email to verify your account.",
+                    "email_verification_required": True,
+                }
+            )
+            return Response(response_serializer.data, status=status.HTTP_201_CREATED)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="User logout",
+        description="Logout the current user and blacklist their refresh token.",
+        responses={
+            200: LogoutOutputSerializer,
+            401: "Unauthorized",
+        },
+        tags=["Authentication"],
+    ),
+)
+class LogoutAPIView(APIView):
+    """API endpoint for user logout."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = LogoutOutputSerializer
+
+    def post(self, request: Request) -> Response:
+        try:
+            # Get refresh token from request data with proper type handling
+            refresh_token = None
+            if hasattr(request, 'data') and request.data is not None:
+                data = getattr(request, 'data', {})
+                if hasattr(data, 'get'):
+                    refresh_token = data.get("refresh")
+
+            if refresh_token and isinstance(refresh_token, str):
+                # Blacklist the refresh token
+                from rest_framework_simplejwt.tokens import RefreshToken
+                try:
+                    # Create RefreshToken from string and blacklist it
+                    refresh_token_obj = RefreshToken(
+                        refresh_token)  # type: ignore[arg-type]
+                    refresh_token_obj.blacklist()
+                except Exception:
+                    # Token might be invalid or already blacklisted
+                    pass
+
+            # Also delete the old token for backward compatibility
+            if hasattr(request.user, "auth_token"):
+                request.user.auth_token.delete()
+
+            # Logout from session using the underlying HttpRequest
+            logout(_get_underlying_request(request))
+
+            response_serializer = LogoutOutputSerializer(
+                {"message": "Logout successful"}
+            )
+            return Response(response_serializer.data)
+        except Exception:
+            return Response(
+                {"error": "Logout failed"}, status=status.HTTP_500_INTERNAL_SERVER_ERROR
+            )
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Get current user",
+        description="Retrieve information about the currently authenticated user.",
+        responses={
+            200: UserOutputSerializer,
+            401: "Unauthorized",
+        },
+        tags=["Authentication"],
+    ),
+)
+class CurrentUserAPIView(APIView):
+    """API endpoint to get current user information."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = UserOutputSerializer
+
+    def get(self, request: Request) -> Response:
+        serializer = UserOutputSerializer(request.user)
+        return Response(serializer.data)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Request password reset",
+        description="Send a password reset email to the user.",
+        request=PasswordResetInputSerializer,
+        responses={
+            200: PasswordResetOutputSerializer,
+            400: "Bad Request",
+        },
+        tags=["Authentication"],
+    ),
+)
+class PasswordResetAPIView(APIView):
+    """API endpoint to request password reset."""
+
+    permission_classes = [AllowAny]
+    serializer_class = PasswordResetInputSerializer
+
+    def post(self, request: Request) -> Response:
+        serializer = PasswordResetInputSerializer(
+            data=request.data, context={"request": request}
+        )
+        if serializer.is_valid():
+            serializer.save()
+
+            response_serializer = PasswordResetOutputSerializer(
+                {"detail": "Password reset email sent"}
+            )
+            return Response(response_serializer.data)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Change password",
+        description="Change the current user's password.",
+        request=PasswordChangeInputSerializer,
+        responses={
+            200: PasswordChangeOutputSerializer,
+            400: "Bad Request",
+            401: "Unauthorized",
+        },
+        tags=["Authentication"],
+    ),
+)
+class PasswordChangeAPIView(APIView):
+    """API endpoint to change password."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = PasswordChangeInputSerializer
+
+    def post(self, request: Request) -> Response:
+        serializer = PasswordChangeInputSerializer(
+            data=request.data, context={"request": request}
+        )
+        if serializer.is_valid():
+            serializer.save()
+
+            response_serializer = PasswordChangeOutputSerializer(
+                {"detail": "Password changed successfully"}
+            )
+            return Response(response_serializer.data)
+
+        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Get social providers",
+        description="Retrieve available social authentication providers.",
+        responses={200: "List of social providers"},
+        tags=["Authentication"],
+    ),
+)
+class SocialProvidersAPIView(APIView):
+    """API endpoint to get available social authentication providers."""
+
+    permission_classes = [AllowAny]
+    serializer_class = SocialProviderOutputSerializer
+
+    def get(self, request: Request) -> Response:
+        from django.core.cache import cache
+
+        # get_current_site expects a django HttpRequest; _get_underlying_request now returns HttpRequest
+        site = get_current_site(_get_underlying_request(request))
+
+        # Cache key based on site and request host - use getattr to avoid attribute errors
+        site_id = getattr(site, "id", getattr(site, "pk", None))
+        cache_key = f"social_providers:{site_id}:{request.get_host()}"
+
+        # Try to get from cache first (cache for 15 minutes)
+        cached_providers = cache.get(cache_key)
+        if cached_providers is not None:
+            return Response(cached_providers)
+
+        providers_list = []
+
+        # Optimized query: filter by site and order by provider name
+        from allauth.socialaccount.models import SocialApp
+
+        social_apps = SocialApp.objects.filter(sites=site).order_by("provider")
+
+        for social_app in social_apps:
+            try:
+                provider_name = (
+                    social_app.name or getattr(social_app, "provider", "").title()
+                )
+
+                auth_url = request.build_absolute_uri(
+                    f"/accounts/{social_app.provider}/login/"
+                )
+
+                providers_list.append(
+                    {
+                        "id": social_app.provider,
+                        "name": provider_name,
+                        "authUrl": auth_url,
+                    }
+                )
+
+            except Exception:
+                continue
+
+        serializer = SocialProviderOutputSerializer(providers_list, many=True)
+        response_data = serializer.data
+
+        cache.set(cache_key, response_data, 900)
+
+        return Response(response_data)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Check authentication status",
+        description="Check if user is authenticated and return user data.",
+        responses={200: AuthStatusOutputSerializer},
+        tags=["Authentication"],
+    ),
+)
+class AuthStatusAPIView(APIView):
+    """API endpoint to check authentication status."""
+
+    permission_classes = [AllowAny]
+    serializer_class = AuthStatusOutputSerializer
+
+    def post(self, request: Request) -> Response:
+        if request.user.is_authenticated:
+            response_data = {
+                "authenticated": True,
+                "user": request.user,
+            }
+        else:
+            response_data = {
+                "authenticated": False,
+                "user": None,
+            }
+
+        serializer = AuthStatusOutputSerializer(response_data)
+        return Response(serializer.data)
+
+
+# === SOCIAL PROVIDER MANAGEMENT API VIEWS ===
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Get available social providers",
+        description="Retrieve list of available social authentication providers.",
+        responses={
+            200: AvailableProviderSerializer(many=True),
+        },
+        tags=["Social Authentication"],
+    ),
+)
+class AvailableProvidersAPIView(APIView):
+    """API endpoint to get available social providers."""
+
+    permission_classes = [AllowAny]
+    serializer_class = AvailableProviderSerializer
+
+    def get(self, request: Request) -> Response:
+        providers = [
+            {
+                "provider": "google",
+                "name": "Google",
+                "login_url": "/auth/social/google/",
+                "connect_url": "/auth/social/connect/google/",
+            },
+            {
+                "provider": "discord",
+                "name": "Discord",
+                "login_url": "/auth/social/discord/",
+                "connect_url": "/auth/social/connect/discord/",
+            }
+        ]
+
+        serializer = AvailableProviderSerializer(providers, many=True)
+        return Response(serializer.data)
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Get connected social providers",
+        description="Retrieve list of social providers connected to the user's account.",
+        responses={
+            200: ConnectedProviderSerializer(many=True),
+            401: "Unauthorized",
+        },
+        tags=["Social Authentication"],
+    ),
+)
+class ConnectedProvidersAPIView(APIView):
+    """API endpoint to get user's connected social providers."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = ConnectedProviderSerializer
+
+    def get(self, request: Request) -> Response:
+        service = SocialProviderService()
+        providers = service.get_connected_providers(request.user)
+
+        serializer = ConnectedProviderSerializer(providers, many=True)
+        return Response(serializer.data)
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Connect social provider",
+        description="Connect a social authentication provider to the user's account.",
+        request=ConnectProviderInputSerializer,
+        responses={
+            200: ConnectProviderOutputSerializer,
+            400: SocialProviderErrorSerializer,
+            401: "Unauthorized",
+        },
+        tags=["Social Authentication"],
+    ),
+)
+class ConnectProviderAPIView(APIView):
+    """API endpoint to connect a social provider."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = ConnectProviderInputSerializer
+
+    def post(self, request: Request, provider: str) -> Response:
+        # Validate provider
+        if provider not in ['google', 'discord']:
+            return Response(
+                {
+                    "success": False,
+                    "error": "INVALID_PROVIDER",
+                    "message": f"Provider '{provider}' is not supported",
+                    "suggestions": ["Use 'google' or 'discord'"]
+                },
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        serializer = ConnectProviderInputSerializer(data=request.data)
+        if not serializer.is_valid():
+            return Response(
+                {
+                    "success": False,
+                    "error": "VALIDATION_ERROR",
+                    "message": "Invalid request data",
+                    "details": serializer.errors,
+                    "suggestions": ["Provide a valid access_token"]
+                },
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        access_token = serializer.validated_data['access_token']
+
+        try:
+            service = SocialProviderService()
+            result = service.connect_provider(request.user, provider, access_token)
+
+            response_serializer = ConnectProviderOutputSerializer(result)
+            return Response(response_serializer.data)
+
+        except Exception as e:
+            return Response(
+                {
+                    "success": False,
+                    "error": "CONNECTION_FAILED",
+                    "message": str(e),
+                    "suggestions": [
+                        "Verify the access token is valid",
+                        "Ensure the provider account is not already connected to another user"
+                    ]
+                },
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Disconnect social provider",
+        description="Disconnect a social authentication provider from the user's account.",
+        responses={
+            200: DisconnectProviderOutputSerializer,
+            400: SocialProviderErrorSerializer,
+            401: "Unauthorized",
+        },
+        tags=["Social Authentication"],
+    ),
+)
+class DisconnectProviderAPIView(APIView):
+    """API endpoint to disconnect a social provider."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = DisconnectProviderOutputSerializer
+
+    def post(self, request: Request, provider: str) -> Response:
+        # Validate provider
+        if provider not in ['google', 'discord']:
+            return Response(
+                {
+                    "success": False,
+                    "error": "INVALID_PROVIDER",
+                    "message": f"Provider '{provider}' is not supported",
+                    "suggestions": ["Use 'google' or 'discord'"]
+                },
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        try:
+            service = SocialProviderService()
+
+            # Check if disconnection is safe
+            can_disconnect, reason = service.can_disconnect_provider(
+                request.user, provider)
+            if not can_disconnect:
+                return Response(
+                    {
+                        "success": False,
+                        "error": "UNSAFE_DISCONNECTION",
+                        "message": reason,
+                        "suggestions": [
+                            "Set up email/password authentication before disconnecting",
+                            "Connect another social provider before disconnecting this one"
+                        ]
+                    },
+                    status=status.HTTP_400_BAD_REQUEST
+                )
+
+            # Perform disconnection
+            result = service.disconnect_provider(request.user, provider)
+
+            response_serializer = DisconnectProviderOutputSerializer(result)
+            return Response(response_serializer.data)
+
+        except Exception as e:
+            return Response(
+                {
+                    "success": False,
+                    "error": "DISCONNECTION_FAILED",
+                    "message": str(e),
+                    "suggestions": [
+                        "Verify the provider is currently connected",
+                        "Ensure you have alternative authentication methods"
+                    ]
+                },
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Get social authentication status",
+        description="Get comprehensive social authentication status for the user.",
+        responses={
+            200: SocialAuthStatusSerializer,
+            401: "Unauthorized",
+        },
+        tags=["Social Authentication"],
+    ),
+)
+class SocialAuthStatusAPIView(APIView):
+    """API endpoint to get social authentication status."""
+
+    permission_classes = [IsAuthenticated]
+    serializer_class = SocialAuthStatusSerializer
+
+    def get(self, request: Request) -> Response:
+        service = SocialProviderService()
+        auth_status = service.get_auth_status(request.user)
+
+        serializer = SocialAuthStatusSerializer(auth_status)
+        return Response(serializer.data)
+
+
+# === EMAIL VERIFICATION API VIEWS ===
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Verify email address",
+        description="Verify user's email address using verification token.",
+        responses={
+            200: {"type": "object", "properties": {"message": {"type": "string"}}},
+            400: "Bad Request",
+            404: "Token not found",
+        },
+        tags=["Authentication"],
+    ),
+)
+class EmailVerificationAPIView(APIView):
+    """API endpoint for email verification."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+
+    def get(self, request: Request, token: str) -> Response:
+        from apps.accounts.models import EmailVerification
+        
+        try:
+            verification = EmailVerification.objects.select_related('user').get(token=token)
+            user = verification.user
+            
+            # Activate the user
+            user.is_active = True
+            user.save()
+            
+            # Delete the verification record
+            verification.delete()
+            
+            return Response({
+                "message": "Email verified successfully. You can now log in.",
+                "success": True
+            })
+            
+        except EmailVerification.DoesNotExist:
+            return Response(
+                {"error": "Invalid or expired verification token"},
+                status=status.HTTP_404_NOT_FOUND
+            )
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Resend verification email",
+        description="Resend email verification to user's email address.",
+        request={"type": "object", "properties": {"email": {"type": "string", "format": "email"}}},
+        responses={
+            200: {"type": "object", "properties": {"message": {"type": "string"}}},
+            400: "Bad Request",
+            404: "User not found",
+        },
+        tags=["Authentication"],
+    ),
+)
+class ResendVerificationAPIView(APIView):
+    """API endpoint to resend email verification."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+
+    def post(self, request: Request) -> Response:
+        from apps.accounts.models import EmailVerification
+        from django.utils.crypto import get_random_string
+        from django_forwardemail.services import EmailService
+        from django.contrib.sites.shortcuts import get_current_site
+        
+        email = request.data.get('email')
+        if not email:
+            return Response(
+                {"error": "Email address is required"},
+                status=status.HTTP_400_BAD_REQUEST
+            )
+        
+        try:
+            user = UserModel.objects.get(email__iexact=email.strip().lower())
+            
+            # Don't resend if user is already active
+            if user.is_active:
+                return Response(
+                    {"error": "Email is already verified"},
+                    status=status.HTTP_400_BAD_REQUEST
+                )
+            
+            # Create or update verification record
+            verification, created = EmailVerification.objects.get_or_create(
+                user=user,
+                defaults={'token': get_random_string(64)}
+            )
+            
+            if not created:
+                # Update existing token and timestamp
+                verification.token = get_random_string(64)
+                verification.save()
+            
+            # Send verification email
+            site = get_current_site(_get_underlying_request(request))
+            verification_url = request.build_absolute_uri(
+                f"/api/v1/auth/verify-email/{verification.token}/"
+            )
+            
+            try:
+                EmailService.send_email(
+                    to=user.email,
+                    subject="Verify your ThrillWiki account",
+                    text=f"""
+Welcome to ThrillWiki!
+
+Please verify your email address by clicking the link below:
+{verification_url}
+
+If you didn't create an account, you can safely ignore this email.
+
+Thanks,
+The ThrillWiki Team
+                    """.strip(),
+                    site=site,
+                )
+                
+                return Response({
+                    "message": "Verification email sent successfully",
+                    "success": True
+                })
+                
+            except Exception as e:
+                import logging
+                logger = logging.getLogger(__name__)
+                logger.error(f"Failed to send verification email to {user.email}: {e}")
+                
+                return Response(
+                    {"error": "Failed to send verification email"},
+                    status=status.HTTP_500_INTERNAL_SERVER_ERROR
+                )
+                
+        except UserModel.DoesNotExist:
+            # Don't reveal whether email exists
+            return Response({
+                "message": "If the email exists, a verification email has been sent",
+                "success": True
+            })
+
+
+# Note: User Profile, Top List, and Top List Item ViewSets are now handled
+# by the dedicated accounts app at backend/apps/api/v1/accounts/views.py
+# to avoid duplication and maintain clean separation of concerns.

backend/apps/api/v1/core/urls.py

@@ -0,0 +1,26 @@
+"""
+Core API URL configuration.
+Centralized from apps.core.urls
+"""
+
+from django.urls import path
+from . import views
+
+# Entity search endpoints - migrated from apps.core.urls
+urlpatterns = [
+    path(
+        "entities/search/",
+        views.EntityFuzzySearchView.as_view(),
+        name="entity_fuzzy_search",
+    ),
+    path(
+        "entities/not-found/",
+        views.EntityNotFoundView.as_view(),
+        name="entity_not_found",
+    ),
+    path(
+        "entities/suggestions/",
+        views.QuickEntitySuggestionView.as_view(),
+        name="entity_suggestions",
+    ),
+]

backend/apps/api/v1/core/views.py

@@ -0,0 +1,370 @@
+"""
+Centralized core API views.
+Migrated from apps.core.views.entity_search
+"""
+
+from rest_framework.views import APIView
+from rest_framework.response import Response
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from django.views.decorators.csrf import csrf_exempt
+from django.utils.decorators import method_decorator
+from typing import Optional, List
+from drf_spectacular.utils import extend_schema
+
+from apps.core.services.entity_fuzzy_matching import (
+    entity_fuzzy_matcher,
+    EntityType,
+)
+
+
+class EntityFuzzySearchView(APIView):
+    """
+    API endpoint for fuzzy entity search with authentication prompts.
+
+    Handles entity lookup failures by providing intelligent suggestions and
+    authentication prompts for entity creation.
+
+    Migrated from apps.core.views.entity_search.EntityFuzzySearchView
+    """
+
+    permission_classes = [AllowAny]  # Allow both authenticated and anonymous users
+
+    @extend_schema(
+        tags=["Core"],
+        summary="Fuzzy entity search",
+        description="Perform fuzzy entity search with authentication prompts for entity creation",
+    )
+    def post(self, request):
+        """
+        Perform fuzzy entity search.
+
+        Request body:
+        {
+            "query": "entity name to search",
+            "entity_types": ["park", "ride", "company"],  // optional
+            "include_suggestions": true  // optional, default true
+        }
+
+        Response:
+        {
+            "success": true,
+            "query": "original query",
+            "matches": [
+                {
+                    "entity_type": "park",
+                    "name": "Cedar Point",
+                    "slug": "cedar-point",
+                    "score": 0.95,
+                    "confidence": "high",
+                    "match_reason": "Text similarity with 'Cedar Point'",
+                    "url": "/parks/cedar-point/",
+                    "entity_id": 123
+                }
+            ],
+            "suggestion": {
+                "suggested_name": "New Entity Name",
+                "entity_type": "park",
+                "requires_authentication": true,
+                "login_prompt": "Log in to suggest adding...",
+                "signup_prompt": "Sign up to contribute...",
+                "creation_hint": "Help expand ThrillWiki..."
+            },
+            "user_authenticated": false
+        }
+        """
+        try:
+            # Parse request data
+            query = request.data.get("query", "").strip()
+            entity_types_raw = request.data.get(
+                "entity_types", ["park", "ride", "company"]
+            )
+            include_suggestions = request.data.get("include_suggestions", True)
+
+            # Validate query
+            if not query or len(query) < 2:
+                return Response(
+                    {
+                        "success": False,
+                        "error": "Query must be at least 2 characters long",
+                        "code": "INVALID_QUERY",
+                    },
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+            # Parse and validate entity types
+            entity_types = []
+            valid_types = {"park", "ride", "company"}
+
+            for entity_type in entity_types_raw:
+                if entity_type in valid_types:
+                    entity_types.append(EntityType(entity_type))
+
+            if not entity_types:
+                entity_types = [EntityType.PARK, EntityType.RIDE, EntityType.COMPANY]
+
+            # Perform fuzzy matching
+            matches, suggestion = entity_fuzzy_matcher.find_entity(
+                query=query, entity_types=entity_types, user=request.user
+            )
+
+            # Format response
+            response_data = {
+                "success": True,
+                "query": query,
+                "matches": [match.to_dict() for match in matches],
+                "user_authenticated": (
+                    request.user.is_authenticated
+                    if hasattr(request.user, "is_authenticated")
+                    else False
+                ),
+            }
+
+            # Include suggestion if requested and available
+            if include_suggestions and suggestion:
+                response_data["suggestion"] = {
+                    "suggested_name": suggestion.suggested_name,
+                    "entity_type": suggestion.entity_type.value,
+                    "requires_authentication": suggestion.requires_authentication,
+                    "login_prompt": suggestion.login_prompt,
+                    "signup_prompt": suggestion.signup_prompt,
+                    "creation_hint": suggestion.creation_hint,
+                }
+
+            return Response(response_data, status=status.HTTP_200_OK)
+
+        except Exception as e:
+            return Response(
+                {
+                    "success": False,
+                    "error": f"Internal server error: {str(e)}",
+                    "code": "INTERNAL_ERROR",
+                },
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+
+class EntityNotFoundView(APIView):
+    """
+    Endpoint specifically for handling entity not found scenarios.
+
+    This view is called when normal entity lookup fails and provides
+    fuzzy matching suggestions along with authentication prompts.
+
+    Migrated from apps.core.views.entity_search.EntityNotFoundView
+    """
+
+    permission_classes = [AllowAny]
+
+    @extend_schema(
+        tags=["Core"],
+        summary="Handle entity not found",
+        description="Handle entity not found scenarios with fuzzy matching suggestions and authentication prompts",
+    )
+    def post(self, request):
+        """
+        Handle entity not found with suggestions.
+
+        Request body:
+        {
+            "original_query": "what user searched for",
+            "attempted_slug": "slug-that-failed",  // optional
+            "entity_type": "park",  // optional, inferred from context
+            "context": {  // optional context information
+                "park_slug": "park-slug-if-searching-for-ride",
+                "source_page": "page where search originated"
+            }
+        }
+        """
+        try:
+            original_query = request.data.get("original_query", "").strip()
+            attempted_slug = request.data.get("attempted_slug", "")
+            entity_type_hint = request.data.get("entity_type")
+            context = request.data.get("context", {})
+
+            if not original_query:
+                return Response(
+                    {
+                        "success": False,
+                        "error": "original_query is required",
+                        "code": "MISSING_QUERY",
+                    },
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+            # Determine entity types to search based on context
+            entity_types = []
+            if entity_type_hint:
+                try:
+                    entity_types = [EntityType(entity_type_hint)]
+                except ValueError:
+                    pass
+
+            # If we have park context, prioritize ride searches
+            if context.get("park_slug") and not entity_types:
+                entity_types = [EntityType.RIDE, EntityType.PARK]
+
+            # Default to all types if not specified
+            if not entity_types:
+                entity_types = [EntityType.PARK, EntityType.RIDE, EntityType.COMPANY]
+
+            # Try fuzzy matching on the original query
+            matches, suggestion = entity_fuzzy_matcher.find_entity(
+                query=original_query, entity_types=entity_types, user=request.user
+            )
+
+            # If no matches on original query, try the attempted slug
+            if not matches and attempted_slug:
+                # Convert slug back to readable name for fuzzy matching
+                slug_as_name = attempted_slug.replace("-", " ").title()
+                matches, suggestion = entity_fuzzy_matcher.find_entity(
+                    query=slug_as_name, entity_types=entity_types, user=request.user
+                )
+
+            # Prepare response with detailed context
+            response_data = {
+                "success": True,
+                "original_query": original_query,
+                "attempted_slug": attempted_slug,
+                "context": context,
+                "matches": [match.to_dict() for match in matches],
+                "user_authenticated": (
+                    request.user.is_authenticated
+                    if hasattr(request.user, "is_authenticated")
+                    else False
+                ),
+                "has_matches": len(matches) > 0,
+            }
+
+            # Always include suggestion for entity not found scenarios
+            if suggestion:
+                response_data["suggestion"] = {
+                    "suggested_name": suggestion.suggested_name,
+                    "entity_type": suggestion.entity_type.value,
+                    "requires_authentication": suggestion.requires_authentication,
+                    "login_prompt": suggestion.login_prompt,
+                    "signup_prompt": suggestion.signup_prompt,
+                    "creation_hint": suggestion.creation_hint,
+                }
+
+            return Response(response_data, status=status.HTTP_200_OK)
+
+        except Exception as e:
+            return Response(
+                {
+                    "success": False,
+                    "error": f"Internal server error: {str(e)}",
+                    "code": "INTERNAL_ERROR",
+                },
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+
+@method_decorator(csrf_exempt, name="dispatch")
+class QuickEntitySuggestionView(APIView):
+    """
+    Lightweight endpoint for quick entity suggestions (e.g., autocomplete).
+
+    Migrated from apps.core.views.entity_search.QuickEntitySuggestionView
+    """
+
+    permission_classes = [AllowAny]
+
+    @extend_schema(
+        tags=["Core"],
+        summary="Quick entity suggestions",
+        description="Lightweight endpoint for quick entity suggestions (e.g., autocomplete)",
+    )
+    def get(self, request):
+        """
+        Get quick entity suggestions.
+
+        Query parameters:
+        - q: query string
+        - types: comma-separated entity types (park,ride,company)
+        - limit: max results (default 5)
+        """
+        try:
+            query = request.GET.get("q", "").strip()
+            types_param = request.GET.get("types", "park,ride,company")
+            limit = min(int(request.GET.get("limit", 5)), 10)  # Cap at 10
+
+            if not query or len(query) < 2:
+                return Response(
+                    {"suggestions": [], "query": query}, status=status.HTTP_200_OK
+                )
+
+            # Parse entity types
+            entity_types = []
+            for type_str in types_param.split(","):
+                type_str = type_str.strip()
+                if type_str in ["park", "ride", "company"]:
+                    entity_types.append(EntityType(type_str))
+
+            if not entity_types:
+                entity_types = [EntityType.PARK, EntityType.RIDE, EntityType.COMPANY]
+
+            # Get fuzzy matches
+            matches, _ = entity_fuzzy_matcher.find_entity(
+                query=query, entity_types=entity_types, user=request.user
+            )
+
+            # Format as simple suggestions
+            suggestions = []
+            for match in matches[:limit]:
+                suggestions.append(
+                    {
+                        "name": match.name,
+                        "type": match.entity_type.value,
+                        "slug": match.slug,
+                        "url": match.url,
+                        "score": match.score,
+                        "confidence": match.confidence,
+                    }
+                )
+
+            return Response(
+                {"suggestions": suggestions, "query": query, "count": len(suggestions)},
+                status=status.HTTP_200_OK,
+            )
+
+        except Exception as e:
+            return Response(
+                {"suggestions": [], "query": request.GET.get("q", ""), "error": str(e)},
+                status=status.HTTP_200_OK,
+            )  # Return 200 even on errors for autocomplete
+
+
+# Utility function for other views to use
+def get_entity_suggestions(
+    query: str, entity_types: Optional[List[str]] = None, user=None
+):
+    """
+    Utility function for other Django views to get entity suggestions.
+
+    Args:
+        query: Search query
+        entity_types: List of entity type strings
+        user: Django user object
+
+    Returns:
+        Tuple of (matches, suggestion)
+    """
+    try:
+        # Convert string types to EntityType enums
+        parsed_types = []
+        if entity_types:
+            for entity_type in entity_types:
+                try:
+                    parsed_types.append(EntityType(entity_type))
+                except ValueError:
+                    continue
+
+        if not parsed_types:
+            parsed_types = [EntityType.PARK, EntityType.RIDE, EntityType.COMPANY]
+
+        return entity_fuzzy_matcher.find_entity(
+            query=query, entity_types=parsed_types, user=user
+        )
+    except Exception:
+        return [], None

backend/apps/api/v1/email/urls.py

@@ -0,0 +1,11 @@
+"""
+Email service API URL configuration.
+Centralized from apps.email_service.urls
+"""
+
+from django.urls import path
+from . import views
+
+urlpatterns = [
+    path("send/", views.SendEmailView.as_view(), name="send_email"),
+]

backend/apps/api/v1/email/views.py

@@ -0,0 +1,106 @@
+"""
+Centralized email service API views.
+Migrated from apps.email_service.views
+"""
+
+from rest_framework.views import APIView
+from rest_framework.response import Response
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from django.contrib.sites.shortcuts import get_current_site
+from drf_spectacular.utils import extend_schema
+from django_forwardemail.services import EmailService
+
+
+@extend_schema(
+    summary="Send email",
+    description="Send an email via the email service.",
+    request={
+        "type": "object",
+        "properties": {
+            "to": {
+                "type": "string",
+                "format": "email",
+                "description": "Recipient email address",
+            },
+            "subject": {"type": "string", "description": "Email subject"},
+            "text": {"type": "string", "description": "Email body text"},
+            "from_email": {
+                "type": "string",
+                "format": "email",
+                "description": "Sender email address (optional)",
+            },
+        },
+        "required": ["to", "subject", "text"],
+    },
+    responses={
+        200: {
+            "type": "object",
+            "properties": {
+                "message": {"type": "string"},
+                "response": {"type": "object"},
+            },
+        },
+        400: "Bad Request",
+        500: "Internal Server Error",
+    },
+    tags=["Email"],
+)
+class SendEmailView(APIView):
+    """
+    API endpoint for sending emails.
+
+    Migrated from apps.email_service.views.SendEmailView to centralized API structure.
+    """
+
+    permission_classes = [AllowAny]  # Allow unauthenticated access
+
+    def post(self, request):
+        """
+        Send an email via the email service.
+
+        Request body:
+        {
+            "to": "recipient@example.com",
+            "subject": "Email subject",
+            "text": "Email body text",
+            "from_email": "sender@example.com"  // optional
+        }
+        """
+        data = request.data
+        to = data.get("to")
+        subject = data.get("subject")
+        text = data.get("text")
+        from_email = data.get("from_email")  # Optional
+
+        if not all([to, subject, text]):
+            return Response(
+                {
+                    "error": "Missing required fields",
+                    "required_fields": ["to", "subject", "text"],
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            # Get the current site
+            site = get_current_site(request)
+
+            # Send email using the site's configuration
+            response = EmailService.send_email(
+                to=to,
+                subject=subject,
+                text=text,
+                from_email=from_email,  # Will use site's default if None
+                site=site,
+            )
+
+            return Response(
+                {"message": "Email sent successfully", "response": response},
+                status=status.HTTP_200_OK,
+            )
+
+        except Exception as e:
+            return Response(
+                {"error": str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR
+            )

backend/apps/api/v1/history/__init__.py

@@ -0,0 +1,6 @@
+"""
+History API Module
+
+This module provides API endpoints for accessing historical data and change tracking
+across all models in the ThrillWiki system.
+"""

backend/apps/api/v1/history/urls.py

@@ -0,0 +1,45 @@
+"""
+History API URLs
+
+URL patterns for history-related API endpoints.
+"""
+
+from django.urls import path, include
+from rest_framework.routers import DefaultRouter
+
+from .views import (
+    ParkHistoryViewSet,
+    RideHistoryViewSet,
+    UnifiedHistoryViewSet,
+)
+
+# Create router for history ViewSets
+router = DefaultRouter()
+router.register(r"timeline", UnifiedHistoryViewSet, basename="unified-history")
+
+urlpatterns = [
+    # Park history endpoints
+    path(
+        "parks/<str:park_slug>/",
+        ParkHistoryViewSet.as_view({"get": "list"}),
+        name="park-history-list",
+    ),
+    path(
+        "parks/<str:park_slug>/detail/",
+        ParkHistoryViewSet.as_view({"get": "retrieve"}),
+        name="park-history-detail",
+    ),
+    # Ride history endpoints
+    path(
+        "parks/<str:park_slug>/rides/<str:ride_slug>/",
+        RideHistoryViewSet.as_view({"get": "list"}),
+        name="ride-history-list",
+    ),
+    path(
+        "parks/<str:park_slug>/rides/<str:ride_slug>/detail/",
+        RideHistoryViewSet.as_view({"get": "retrieve"}),
+        name="ride-history-detail",
+    ),
+    # Include router URLs for unified timeline
+    path("", include(router.urls)),
+]

backend/apps/api/v1/history/views.py

@@ -0,0 +1,513 @@
+"""
+History API Views
+
+This module provides ViewSets for accessing historical data and change tracking
+across all models in the ThrillWiki system using django-pghistory.
+"""
+
+from drf_spectacular.utils import extend_schema, extend_schema_view, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
+from rest_framework.filters import OrderingFilter
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.viewsets import ReadOnlyModelViewSet
+from rest_framework.request import Request
+from typing import Optional, cast, Sequence
+from django.shortcuts import get_object_or_404
+from django.db.models import Count, QuerySet
+import pghistory.models
+from datetime import datetime
+
+# Import models
+from apps.parks.models import Park
+from apps.rides.models import Ride
+
+# Import serializers
+from .. import serializers as history_serializers
+from rest_framework import serializers as drf_serializers
+
+# Minimal fallback serializer used when a specific serializer symbol is missing.
+
+
+class _FallbackSerializer(drf_serializers.Serializer):
+    def to_representation(self, instance):
+        # return minimal safe representation so responses serialize without errors
+        return {}
+
+
+ParkHistoryEventSerializer = getattr(
+    history_serializers, "ParkHistoryEventSerializer", _FallbackSerializer
+)
+RideHistoryEventSerializer = getattr(
+    history_serializers, "RideHistoryEventSerializer", _FallbackSerializer
+)
+ParkHistoryOutputSerializer = getattr(
+    history_serializers, "ParkHistoryOutputSerializer", _FallbackSerializer
+)
+RideHistoryOutputSerializer = getattr(
+    history_serializers, "RideHistoryOutputSerializer", _FallbackSerializer
+)
+UnifiedHistoryTimelineSerializer = getattr(
+    history_serializers, "UnifiedHistoryTimelineSerializer", _FallbackSerializer
+)
+
+# --- Constants for model strings to avoid duplication ---
+PARK_MODEL = "parks.park"
+
+RIDE_MODELS: Sequence[str] = [
+    "rides.ride",
+    "rides.ridemodel",
+    "rides.rollercoasterstats",
+]
+
+COMPANY_MODELS: Sequence[str] = [
+    "companies.operator",
+    "companies.propertyowner",
+    "companies.manufacturer",
+    "companies.designer",
+]
+
+ACCOUNT_MODEL = "accounts.user"
+
+ALL_TRACKED_MODELS: Sequence[str] = [
+    PARK_MODEL,
+    *RIDE_MODELS,
+    *COMPANY_MODELS,
+    ACCOUNT_MODEL,
+]
+
+# --- Helper utilities to reduce duplicated logic / cognitive complexity ---
+
+
+def _parse_date(date_str: Optional[str]) -> Optional[datetime]:
+    if not date_str:
+        return None
+    try:
+        return datetime.strptime(date_str, "%Y-%m-%d")
+    except ValueError:
+        return None
+
+
+def _apply_list_filters(
+    queryset: QuerySet,
+    request: Request,
+    *,
+    default_limit: int = 50,
+    max_limit: int = 500,
+) -> QuerySet:
+    """
+    Apply common 'list' filters: event_type, start/end date, and limit.
+    Expects request to be a rest_framework.request.Request (cast by caller).
+    """
+    # event_type
+    event_type = request.query_params.get("event_type")
+    if event_type == "created":
+        queryset = queryset.filter(pgh_label="created")
+    elif event_type == "updated":
+        queryset = queryset.filter(pgh_label="updated")
+    elif event_type == "deleted":
+        queryset = queryset.filter(pgh_label="deleted")
+
+    # date range
+    start_date = _parse_date(request.query_params.get("start_date"))
+    if start_date:
+        queryset = queryset.filter(pgh_created_at__gte=start_date)
+
+    end_date = _parse_date(request.query_params.get("end_date"))
+    if end_date:
+        queryset = queryset.filter(pgh_created_at__lte=end_date)
+
+    # limit (slice the queryset)
+    limit_raw = request.query_params.get("limit", str(default_limit))
+    try:
+        limit_val = min(int(limit_raw), max_limit)
+        queryset = queryset[:limit_val]
+    except (ValueError, TypeError):
+        queryset = queryset[:default_limit]
+
+    return queryset
+
+
+@extend_schema_view(
+    list=extend_schema(
+        summary="Get park history",
+        description="Retrieve history timeline for a specific park including all changes over time.",
+        parameters=[
+            OpenApiParameter(
+                name="limit",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Number of history events to return (default: 50, max: 500)",
+            ),
+            OpenApiParameter(
+                name="offset",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Offset for pagination",
+            ),
+            OpenApiParameter(
+                name="event_type",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by event type (created, updated, deleted)",
+            ),
+            OpenApiParameter(
+                name="start_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events after this date (YYYY-MM-DD)",
+            ),
+            OpenApiParameter(
+                name="end_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events before this date (YYYY-MM-DD)",
+            ),
+        ],
+        responses={200: ParkHistoryEventSerializer(many=True)},
+        tags=["History", "Parks"],
+    ),
+    retrieve=extend_schema(
+        summary="Get complete park history",
+        description="Retrieve complete history for a park including current state and timeline.",
+        responses={200: ParkHistoryOutputSerializer},
+        tags=["History", "Parks"],
+    ),
+)
+class ParkHistoryViewSet(ReadOnlyModelViewSet):
+    """
+    ViewSet for accessing park history data.
+
+    Provides read-only access to historical changes for parks,
+    including version history and real-world changes.
+    """
+
+    permission_classes = [AllowAny]
+    lookup_field = "park_slug"
+    filter_backends = [OrderingFilter]
+    ordering_fields = ["pgh_created_at"]
+    ordering = ["-pgh_created_at"]
+
+    def get_queryset(self):  # type: ignore[override]
+        """Get history events for the specified park."""
+        park_slug = self.kwargs.get("park_slug")
+        if not park_slug:
+            return pghistory.models.Events.objects.none()
+
+        # Get the park to ensure it exists
+        park = get_object_or_404(Park, slug=park_slug)
+
+        # Base queryset for park events
+        queryset = (
+            pghistory.models.Events.objects.filter(
+                pgh_model__in=[PARK_MODEL], pgh_obj_id=getattr(park, "id", None)
+            )
+            .select_related()
+            .order_by("-pgh_created_at")
+        )
+
+        # Apply list filters via helper to reduce complexity
+        if self.action == "list":
+            queryset = _apply_list_filters(
+                queryset, cast(Request, self.request), default_limit=50, max_limit=500
+            )
+
+        return queryset
+
+    def get_serializer_class(self):  # type: ignore[override]
+        """Return appropriate serializer based on action."""
+        if self.action == "retrieve":
+            return ParkHistoryOutputSerializer
+        return ParkHistoryEventSerializer
+
+    def retrieve(self, request, park_slug=None):
+        """Get complete park history including current state."""
+        park = get_object_or_404(Park, slug=park_slug)
+
+        # Get history events
+        history_events = self.get_queryset()[:100]  # Latest 100 events
+
+        # safe attribute access using getattr to avoid static-checker complaints
+        first_recorded = getattr(history_events.last(), "pgh_created_at", None)
+        last_modified = getattr(history_events.first(), "pgh_created_at", None)
+
+        # Prepare data for serializer
+        history_data = {
+            "park": park,
+            "current_state": park,
+            "summary": {
+                "total_events": self.get_queryset().count(),
+                "first_recorded": first_recorded,
+                "last_modified": last_modified,
+            },
+            "events": history_events,
+        }
+
+        serializer = ParkHistoryOutputSerializer(history_data)
+        return Response(serializer.data)
+
+
+@extend_schema_view(
+    list=extend_schema(
+        summary="Get ride history",
+        description="Retrieve history timeline for a specific ride including all changes over time.",
+        parameters=[
+            OpenApiParameter(
+                name="limit",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Number of history events to return (default: 50, max: 500)",
+            ),
+            OpenApiParameter(
+                name="offset",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Offset for pagination",
+            ),
+            OpenApiParameter(
+                name="event_type",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by event type (created, updated, deleted)",
+            ),
+            OpenApiParameter(
+                name="start_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events after this date (YYYY-MM-DD)",
+            ),
+            OpenApiParameter(
+                name="end_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events before this date (YYYY-MM-DD)",
+            ),
+        ],
+        responses={200: RideHistoryEventSerializer(many=True)},
+        tags=["History", "Rides"],
+    ),
+    retrieve=extend_schema(
+        summary="Get complete ride history",
+        description="Retrieve complete history for a ride including current state and timeline.",
+        responses={200: RideHistoryOutputSerializer},
+        tags=["History", "Rides"],
+    ),
+)
+class RideHistoryViewSet(ReadOnlyModelViewSet):
+    """
+    ViewSet for accessing ride history data.
+
+    Provides read-only access to historical changes for rides,
+    including version history and real-world changes.
+    """
+
+    permission_classes = [AllowAny]
+    lookup_field = "ride_slug"
+    filter_backends = [OrderingFilter]
+    ordering_fields = ["pgh_created_at"]
+    ordering = ["-pgh_created_at"]
+
+    def get_queryset(self):  # type: ignore[override]
+        """Get history events for the specified ride."""
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+
+        if not park_slug or not ride_slug:
+            return pghistory.models.Events.objects.none()
+
+        # Get the ride to ensure it exists
+        ride = get_object_or_404(Ride, slug=ride_slug, park__slug=park_slug)
+
+        # Base queryset for ride events
+        queryset = (
+            pghistory.models.Events.objects.filter(
+                pgh_model__in=RIDE_MODELS, pgh_obj_id=getattr(ride, "id", None)
+            )
+            .select_related()
+            .order_by("-pgh_created_at")
+        )
+
+        # Apply list filters via helper
+        if self.action == "list":
+            queryset = _apply_list_filters(
+                queryset, cast(Request, self.request), default_limit=50, max_limit=500
+            )
+
+        return queryset
+
+    def get_serializer_class(self):  # type: ignore[override]
+        """Return appropriate serializer based on action."""
+        if self.action == "retrieve":
+            return RideHistoryOutputSerializer
+        return RideHistoryEventSerializer
+
+    def retrieve(self, request, park_slug=None, ride_slug=None):
+        """Get complete ride history including current state."""
+        ride = get_object_or_404(Ride, slug=ride_slug, park__slug=park_slug)
+
+        # Get history events
+        history_events = self.get_queryset()[:100]  # Latest 100 events
+
+        # safe attribute access
+        first_recorded = getattr(history_events.last(), "pgh_created_at", None)
+        last_modified = getattr(history_events.first(), "pgh_created_at", None)
+
+        # Prepare data for serializer
+        history_data = {
+            "ride": ride,
+            "current_state": ride,
+            "summary": {
+                "total_events": self.get_queryset().count(),
+                "first_recorded": first_recorded,
+                "last_modified": last_modified,
+            },
+            "events": history_events,
+        }
+
+        serializer = RideHistoryOutputSerializer(history_data)
+        return Response(serializer.data)
+
+
+@extend_schema_view(
+    list=extend_schema(
+        summary="Unified history timeline",
+        description="Retrieve a unified timeline of all changes across parks, rides, and companies.",
+        parameters=[
+            OpenApiParameter(
+                name="limit",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Number of history events to return (default: 100, max: 1000)",
+            ),
+            OpenApiParameter(
+                name="offset",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                description="Offset for pagination",
+            ),
+            OpenApiParameter(
+                name="model_type",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by model type (park, ride, company)",
+            ),
+            OpenApiParameter(
+                name="event_type",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by event type (created, updated, deleted)",
+            ),
+            OpenApiParameter(
+                name="start_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events after this date (YYYY-MM-DD)",
+            ),
+            OpenApiParameter(
+                name="end_date",
+                type=OpenApiTypes.DATE,
+                location=OpenApiParameter.QUERY,
+                description="Filter events before this date (YYYY-MM-DD)",
+            ),
+            OpenApiParameter(
+                name="significance",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by change significance (major, minor, routine)",
+            ),
+        ],
+        responses={200: UnifiedHistoryTimelineSerializer},
+        tags=["History"],
+    ),
+    retrieve=extend_schema(
+        summary="Get unified history timeline item",
+        description="Retrieve a specific item from the unified history timeline.",
+        responses={200: UnifiedHistoryTimelineSerializer},
+        tags=["History"],
+    ),
+)
+class UnifiedHistoryViewSet(ReadOnlyModelViewSet):
+    """
+    ViewSet for unified history timeline across all models.
+
+    Provides a comprehensive view of all changes across
+    parks, rides, and companies in chronological order.
+    """
+
+    permission_classes = [AllowAny]
+    filter_backends = [OrderingFilter]
+    ordering_fields = ["pgh_created_at"]
+    ordering = ["-pgh_created_at"]
+
+    def get_queryset(self):  # type: ignore[override]
+        """Get unified history events across all tracked models."""
+        queryset = (
+            pghistory.models.Events.objects.filter(pgh_model__in=ALL_TRACKED_MODELS)
+            .select_related()
+            .order_by("-pgh_created_at")
+        )
+
+        # Filter by requested model_type (if provided)
+        model_type = cast(Request, self.request).query_params.get("model_type")
+        if model_type == "park":
+            queryset = queryset.filter(pgh_model=PARK_MODEL)
+        elif model_type == "ride":
+            queryset = queryset.filter(pgh_model__in=RIDE_MODELS)
+        elif model_type == "company":
+            queryset = queryset.filter(pgh_model__in=COMPANY_MODELS)
+        elif model_type == "user":
+            queryset = queryset.filter(pgh_model=ACCOUNT_MODEL)
+
+        # Apply shared list filters when serving the list action
+        if self.action == "list":
+            queryset = _apply_list_filters(
+                queryset, cast(Request, self.request), default_limit=100, max_limit=1000
+            )
+
+        return queryset
+
+    def get_serializer_class(self):  # type: ignore[override]
+        """Return unified history timeline serializer."""
+        return UnifiedHistoryTimelineSerializer
+
+    def list(self, request):
+        """Get unified history timeline with summary statistics."""
+        events = list(self.get_queryset())  # evaluate for counts / earliest/latest use
+
+        # Summary statistics across all tracked models
+        total_events = pghistory.models.Events.objects.filter(
+            pgh_model__in=ALL_TRACKED_MODELS
+        ).count()
+
+        event_type_counts = (
+            pghistory.models.Events.objects.filter(pgh_model__in=ALL_TRACKED_MODELS)
+            .values("pgh_label")
+            .annotate(count=Count("id"))
+        )
+
+        model_type_counts = (
+            pghistory.models.Events.objects.filter(pgh_model__in=ALL_TRACKED_MODELS)
+            .values("pgh_model")
+            .annotate(count=Count("id"))
+        )
+
+        timeline_data = {
+            "summary": {
+                "total_events": total_events,
+                "events_returned": len(events),
+                "event_type_breakdown": {
+                    item["pgh_label"]: item["count"] for item in event_type_counts
+                },
+                "model_type_breakdown": {
+                    item["pgh_model"]: item["count"] for item in model_type_counts
+                },
+                "time_range": {
+                    "earliest": events[-1].pgh_created_at if events else None,
+                    "latest": events[0].pgh_created_at if events else None,
+                },
+            },
+            "events": events,
+        }
+
+        serializer = UnifiedHistoryTimelineSerializer(timeline_data)
+        return Response(serializer.data)

backend/apps/api/v1/maps/__init__.py

@@ -0,0 +1,4 @@
+"""
+Maps API module for centralized API structure.
+Migrated from apps.core.views.map_views
+"""

backend/apps/api/v1/maps/urls.py

@@ -0,0 +1,32 @@
+"""
+URL patterns for the unified map service API.
+Migrated from apps.core.urls.map_urls to centralized API structure.
+"""
+
+from django.urls import path
+from . import views
+
+# Map API endpoints - migrated from apps.core.urls.map_urls
+urlpatterns = [
+    # Main map data endpoint
+    path("locations/", views.MapLocationsAPIView.as_view(), name="map_locations"),
+    # Location detail endpoint
+    path(
+        "locations/<str:location_type>/<int:location_id>/",
+        views.MapLocationDetailAPIView.as_view(),
+        name="map_location_detail",
+    ),
+    # Search endpoint
+    path("search/", views.MapSearchAPIView.as_view(), name="map_search"),
+    # Bounds-based query endpoint
+    path("bounds/", views.MapBoundsAPIView.as_view(), name="map_bounds"),
+    # Service statistics endpoint
+    path("stats/", views.MapStatsAPIView.as_view(), name="map_stats"),
+    # Cache management endpoints
+    path("cache/", views.MapCacheAPIView.as_view(), name="map_cache"),
+    path(
+        "cache/invalidate/",
+        views.MapCacheAPIView.as_view(),
+        name="map_cache_invalidate",
+    ),
+]

backend/apps/api/v1/middleware.py

@@ -0,0 +1,339 @@
+"""
+Contract Validation Middleware for ThrillWiki API
+
+This middleware catches contract violations between the Django backend and frontend
+TypeScript interfaces, providing immediate feedback during development.
+"""
+
+import json
+import logging
+from typing import Dict, Any
+from django.conf import settings
+from django.http import JsonResponse
+from django.utils.deprecation import MiddlewareMixin
+from rest_framework.response import Response
+
+logger = logging.getLogger(__name__)
+
+
+class ContractValidationMiddleware(MiddlewareMixin):
+    """
+    Development-only middleware that validates API responses against expected contracts.
+    
+    This middleware:
+    1. Checks all API responses for contract compliance
+    2. Logs warnings when responses don't match expected TypeScript interfaces
+    3. Specifically validates filter metadata structure
+    4. Alerts when categorical filters are strings instead of objects
+    
+    Only active when DEBUG=True to avoid performance impact in production.
+    """
+    
+    def __init__(self, get_response):
+        super().__init__(get_response)
+        self.get_response = get_response
+        self.enabled = getattr(settings, 'DEBUG', False)
+        
+        if self.enabled:
+            logger.info("Contract validation middleware enabled (DEBUG mode)")
+    
+    def process_response(self, request, response):
+        """Process API responses to check for contract violations."""
+        
+        if not self.enabled:
+            return response
+        
+        # Only validate API endpoints
+        if not request.path.startswith('/api/'):
+            return response
+        
+        # Only validate JSON responses
+        if not isinstance(response, (JsonResponse, Response)):
+            return response
+        
+        # Only validate successful responses (2xx status codes)
+        if not (200 <= response.status_code < 300):
+            return response
+        
+        try:
+            # Get response data
+            if isinstance(response, Response):
+                data = response.data
+            else:
+                data = json.loads(response.content.decode('utf-8'))
+            
+            # Validate the response
+            self._validate_response_contract(request.path, data)
+            
+        except Exception as e:
+            # Log validation errors but don't break the response
+            logger.warning(
+                f"Contract validation error for {request.path}: {str(e)}",
+                extra={
+                    'path': request.path,
+                    'method': request.method,
+                    'status_code': response.status_code,
+                    'validation_error': str(e)
+                }
+            )
+        
+        return response
+    
+    def _validate_response_contract(self, path: str, data: Any) -> None:
+        """Validate response data against expected contracts."""
+        
+        # Check for filter metadata endpoints
+        if 'filter-options' in path or 'filter_options' in path:
+            self._validate_filter_metadata(path, data)
+        
+        # Check for hybrid filtering endpoints
+        if 'hybrid' in path:
+            self._validate_hybrid_response(path, data)
+        
+        # Check for pagination responses
+        if isinstance(data, dict) and 'results' in data:
+            self._validate_pagination_response(path, data)
+        
+        # Check for common contract violations
+        self._validate_common_patterns(path, data)
+    
+    def _validate_filter_metadata(self, path: str, data: Any) -> None:
+        """Validate filter metadata structure."""
+        
+        if not isinstance(data, dict):
+            self._log_contract_violation(
+                path, 
+                "FILTER_METADATA_NOT_DICT",
+                f"Filter metadata should be a dictionary, got {type(data).__name__}"
+            )
+            return
+        
+        # Check for categorical filters
+        if 'categorical' in data:
+            categorical = data['categorical']
+            if isinstance(categorical, dict):
+                for filter_name, filter_options in categorical.items():
+                    self._validate_categorical_filter(path, filter_name, filter_options)
+        
+        # Check for ranges
+        if 'ranges' in data:
+            ranges = data['ranges']
+            if isinstance(ranges, dict):
+                for range_name, range_data in ranges.items():
+                    self._validate_range_filter(path, range_name, range_data)
+    
+    def _validate_categorical_filter(self, path: str, filter_name: str, filter_options: Any) -> None:
+        """Validate categorical filter options format."""
+        
+        if not isinstance(filter_options, list):
+            self._log_contract_violation(
+                path,
+                "CATEGORICAL_FILTER_NOT_ARRAY",
+                f"Categorical filter '{filter_name}' should be an array, got {type(filter_options).__name__}"
+            )
+            return
+        
+        for i, option in enumerate(filter_options):
+            if isinstance(option, str):
+                # CRITICAL: This is the main contract violation we're trying to catch
+                self._log_contract_violation(
+                    path,
+                    "CATEGORICAL_OPTION_IS_STRING",
+                    f"Categorical filter '{filter_name}' option {i} is a string '{option}' but should be an object with value/label/count properties",
+                    severity="ERROR"
+                )
+            elif isinstance(option, dict):
+                # Validate object structure
+                if 'value' not in option:
+                    self._log_contract_violation(
+                        path,
+                        "MISSING_VALUE_PROPERTY",
+                        f"Categorical filter '{filter_name}' option {i} missing 'value' property"
+                    )
+                if 'label' not in option:
+                    self._log_contract_violation(
+                        path,
+                        "MISSING_LABEL_PROPERTY",
+                        f"Categorical filter '{filter_name}' option {i} missing 'label' property"
+                    )
+                # Count is optional but should be number if present
+                if 'count' in option and option['count'] is not None and not isinstance(option['count'], (int, float)):
+                    self._log_contract_violation(
+                        path,
+                        "INVALID_COUNT_TYPE",
+                        f"Categorical filter '{filter_name}' option {i} 'count' should be a number, got {type(option['count']).__name__}"
+                    )
+    
+    def _validate_range_filter(self, path: str, range_name: str, range_data: Any) -> None:
+        """Validate range filter format."""
+        
+        if not isinstance(range_data, dict):
+            self._log_contract_violation(
+                path,
+                "RANGE_FILTER_NOT_OBJECT",
+                f"Range filter '{range_name}' should be an object, got {type(range_data).__name__}"
+            )
+            return
+        
+        # Check required properties
+        required_props = ['min', 'max']
+        for prop in required_props:
+            if prop not in range_data:
+                self._log_contract_violation(
+                    path,
+                    "MISSING_RANGE_PROPERTY",
+                    f"Range filter '{range_name}' missing required property '{prop}'"
+                )
+        
+        # Check step property
+        if 'step' in range_data and not isinstance(range_data['step'], (int, float)):
+            self._log_contract_violation(
+                path,
+                "INVALID_STEP_TYPE",
+                f"Range filter '{range_name}' 'step' should be a number, got {type(range_data['step']).__name__}"
+            )
+    
+    def _validate_hybrid_response(self, path: str, data: Any) -> None:
+        """Validate hybrid filtering response structure."""
+        
+        if not isinstance(data, dict):
+            return
+        
+        # Check for strategy field
+        if 'strategy' in data:
+            strategy = data['strategy']
+            if strategy not in ['client_side', 'server_side']:
+                self._log_contract_violation(
+                    path,
+                    "INVALID_STRATEGY_VALUE",
+                    f"Hybrid response strategy should be 'client_side' or 'server_side', got '{strategy}'"
+                )
+        
+        # Check filter_metadata structure
+        if 'filter_metadata' in data:
+            self._validate_filter_metadata(path, data['filter_metadata'])
+    
+    def _validate_pagination_response(self, path: str, data: Dict[str, Any]) -> None:
+        """Validate pagination response structure."""
+        
+        # Check for required pagination fields
+        required_fields = ['count', 'results']
+        for field in required_fields:
+            if field not in data:
+                self._log_contract_violation(
+                    path,
+                    "MISSING_PAGINATION_FIELD",
+                    f"Pagination response missing required field '{field}'"
+                )
+        
+        # Check results is array
+        if 'results' in data and not isinstance(data['results'], list):
+            self._log_contract_violation(
+                path,
+                "RESULTS_NOT_ARRAY",
+                f"Pagination 'results' should be an array, got {type(data['results']).__name__}"
+            )
+    
+    def _validate_common_patterns(self, path: str, data: Any) -> None:
+        """Validate common API response patterns."""
+        
+        if isinstance(data, dict):
+            # Check for null vs undefined issues
+            for key, value in data.items():
+                if value is None and key.endswith('_id'):
+                    # ID fields should probably be null, not undefined
+                    continue
+                
+                # Check for numeric fields that might be strings
+                if key.endswith('_count') and isinstance(value, str):
+                    try:
+                        int(value)
+                        self._log_contract_violation(
+                            path,
+                            "NUMERIC_FIELD_AS_STRING",
+                            f"Field '{key}' appears to be numeric but is a string: '{value}'"
+                        )
+                    except ValueError:
+                        pass
+    
+    def _log_contract_violation(
+        self, 
+        path: str, 
+        violation_type: str, 
+        message: str, 
+        severity: str = "WARNING"
+    ) -> None:
+        """Log a contract violation with structured data."""
+        
+        log_data = {
+            'contract_violation': True,
+            'violation_type': violation_type,
+            'api_path': path,
+            'severity': severity,
+            'message': message,
+            'suggestion': self._get_violation_suggestion(violation_type)
+        }
+        
+        if severity == "ERROR":
+            logger.error(f"CONTRACT VIOLATION [{violation_type}]: {message}", extra=log_data)
+        else:
+            logger.warning(f"CONTRACT VIOLATION [{violation_type}]: {message}", extra=log_data)
+    
+    def _get_violation_suggestion(self, violation_type: str) -> str:
+        """Get suggestion for fixing a contract violation."""
+        
+        suggestions = {
+            "CATEGORICAL_OPTION_IS_STRING": (
+                "Convert string arrays to object arrays with {value, label, count} structure. "
+                "Use the ensure_filter_option_format() utility function from apps.api.v1.serializers.shared"
+            ),
+            "MISSING_VALUE_PROPERTY": (
+                "Add 'value' property to filter option objects. "
+                "Use FilterOptionSerializer from apps.api.v1.serializers.shared"
+            ),
+            "MISSING_LABEL_PROPERTY": (
+                "Add 'label' property to filter option objects. "
+                "Use FilterOptionSerializer from apps.api.v1.serializers.shared"
+            ),
+            "RANGE_FILTER_NOT_OBJECT": (
+                "Convert range data to object with min/max/step/unit properties. "
+                "Use FilterRangeSerializer from apps.api.v1.serializers.shared"
+            ),
+            "NUMERIC_FIELD_AS_STRING": (
+                "Ensure numeric fields are returned as numbers, not strings. "
+                "Check serializer field types and database field types."
+            ),
+            "RESULTS_NOT_ARRAY": (
+                "Ensure pagination 'results' field is always an array. "
+                "Check serializer implementation."
+            )
+        }
+        
+        return suggestions.get(violation_type, "Check the API response format against frontend TypeScript interfaces.")
+
+
+class ContractValidationSettings:
+    """Settings for contract validation middleware."""
+    
+    # Enable/disable specific validation checks
+    VALIDATE_FILTER_METADATA = True
+    VALIDATE_PAGINATION = True
+    VALIDATE_HYBRID_RESPONSES = True
+    VALIDATE_COMMON_PATTERNS = True
+    
+    # Severity levels for different violations
+    CATEGORICAL_STRING_SEVERITY = "ERROR"  # This is the critical issue
+    MISSING_PROPERTY_SEVERITY = "WARNING"
+    TYPE_MISMATCH_SEVERITY = "WARNING"
+    
+    # Paths to exclude from validation
+    EXCLUDED_PATHS = [
+        '/api/docs/',
+        '/api/schema/',
+        '/api/v1/auth/',  # Auth endpoints might have different structures
+    ]
+    
+    @classmethod
+    def should_validate_path(cls, path: str) -> bool:
+        """Check if a path should be validated."""
+        return not any(excluded in path for excluded in cls.EXCLUDED_PATHS)

backend/apps/api/v1/parks/__init__.py

@@ -0,0 +1,6 @@
+"""
+Parks API module for ThrillWiki API v1.
+
+This module provides API endpoints for park-related functionality including
+search suggestions, location services, and roadtrip planning.
+"""

backend/apps/api/v1/parks/park_rides_views.py

@@ -0,0 +1,306 @@
+"""
+Park Rides API views for ThrillWiki API v1.
+
+This module implements endpoints for accessing rides within specific parks:
+- GET /parks/{park_slug}/rides/ - List rides at a park with pagination and filtering
+- GET /parks/{park_slug}/rides/{ride_slug}/ - Get specific ride details within park context
+"""
+
+from typing import Any
+from django.db import models
+from django.db.models import Q, Count, Avg
+from django.db.models.query import QuerySet
+
+from rest_framework import status, permissions
+from rest_framework.views import APIView
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.pagination import PageNumberPagination
+from rest_framework.exceptions import NotFound
+from drf_spectacular.utils import extend_schema, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
+
+# Import models
+try:
+    from apps.parks.models import Park
+    from apps.rides.models import Ride
+    MODELS_AVAILABLE = True
+except Exception:
+    Park = None  # type: ignore
+    Ride = None  # type: ignore
+    MODELS_AVAILABLE = False
+
+# Import serializers
+try:
+    from apps.api.v1.serializers.rides import RideListOutputSerializer, RideDetailOutputSerializer
+    from apps.api.v1.serializers.parks import ParkDetailOutputSerializer
+    SERIALIZERS_AVAILABLE = True
+except Exception:
+    SERIALIZERS_AVAILABLE = False
+
+
+class StandardResultsSetPagination(PageNumberPagination):
+    page_size = 20
+    page_size_query_param = "page_size"
+    max_page_size = 100
+
+
+class ParkRidesListAPIView(APIView):
+    """List rides at a specific park with pagination and filtering."""
+    
+    permission_classes = [permissions.AllowAny]
+
+    @extend_schema(
+        summary="List rides at a specific park",
+        description="Get paginated list of rides at a specific park with filtering options",
+        parameters=[
+            # Pagination
+            OpenApiParameter(name="page", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.INT, description="Page number"),
+            OpenApiParameter(name="page_size", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.INT, description="Number of results per page (max 100)"),
+            
+            # Filtering
+            OpenApiParameter(name="category", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.STR, description="Filter by ride category"),
+            OpenApiParameter(name="status", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.STR, description="Filter by operational status"),
+            OpenApiParameter(name="search", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.STR, description="Search rides by name"),
+            
+            # Ordering
+            OpenApiParameter(name="ordering", location=OpenApiParameter.QUERY,
+                             type=OpenApiTypes.STR, description="Order results by field"),
+        ],
+        responses={
+            200: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Parks", "Rides"],
+    )
+    def get(self, request: Request, park_slug: str) -> Response:
+        """List rides at a specific park."""
+        if not MODELS_AVAILABLE:
+            return Response(
+                {"detail": "Park and ride models not available."},
+                status=status.HTTP_501_NOT_IMPLEMENTED,
+            )
+
+        # Get the park
+        try:
+            park, is_historical = Park.get_by_slug(park_slug)
+        except Park.DoesNotExist:
+            raise NotFound("Park not found")
+
+        # Get rides for this park
+        qs = Ride.objects.filter(park=park).select_related(
+            "manufacturer", "designer", "ride_model", "park_area"
+        ).prefetch_related("photos")
+
+        # Apply filtering
+        qs = self._apply_filters(qs, request.query_params)
+
+        # Apply ordering
+        ordering = request.query_params.get("ordering", "name")
+        if ordering:
+            qs = qs.order_by(ordering)
+
+        # Paginate results
+        paginator = StandardResultsSetPagination()
+        page = paginator.paginate_queryset(qs, request)
+
+        if SERIALIZERS_AVAILABLE:
+            serializer = RideListOutputSerializer(
+                page, many=True, context={"request": request, "park": park}
+            )
+            return paginator.get_paginated_response(serializer.data)
+        else:
+            # Fallback serialization
+            serializer_data = [
+                {
+                    "id": ride.id,
+                    "name": ride.name,
+                    "slug": ride.slug,
+                    "category": getattr(ride, "category", ""),
+                    "status": getattr(ride, "status", ""),
+                    "manufacturer": {
+                        "name": ride.manufacturer.name if ride.manufacturer else "",
+                        "slug": getattr(ride.manufacturer, "slug", "") if ride.manufacturer else "",
+                    },
+                }
+                for ride in page
+            ]
+            return paginator.get_paginated_response(serializer_data)
+
+    def _apply_filters(self, qs: QuerySet, params: dict) -> QuerySet:
+        """Apply filtering to the rides queryset."""
+        # Category filter
+        category = params.get("category")
+        if category:
+            qs = qs.filter(category=category)
+
+        # Status filter
+        status_filter = params.get("status")
+        if status_filter:
+            qs = qs.filter(status=status_filter)
+
+        # Search filter
+        search = params.get("search")
+        if search:
+            qs = qs.filter(
+                Q(name__icontains=search) |
+                Q(description__icontains=search) |
+                Q(manufacturer__name__icontains=search)
+            )
+
+        return qs
+
+
+class ParkRideDetailAPIView(APIView):
+    """Get specific ride details within park context."""
+    
+    permission_classes = [permissions.AllowAny]
+
+    @extend_schema(
+        summary="Get ride details within park context",
+        description="Get comprehensive details for a specific ride at a specific park",
+        responses={
+            200: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Parks", "Rides"],
+    )
+    def get(self, request: Request, park_slug: str, ride_slug: str) -> Response:
+        """Get ride details within park context."""
+        if not MODELS_AVAILABLE:
+            return Response(
+                {"detail": "Park and ride models not available."},
+                status=status.HTTP_501_NOT_IMPLEMENTED,
+            )
+
+        # Get the park
+        try:
+            park, is_historical = Park.get_by_slug(park_slug)
+        except Park.DoesNotExist:
+            raise NotFound("Park not found")
+
+        # Get the ride
+        try:
+            ride, is_historical = Ride.get_by_slug(ride_slug, park=park)
+        except Ride.DoesNotExist:
+            raise NotFound("Ride not found at this park")
+
+        # Ensure ride belongs to this park
+        if ride.park_id != park.id:
+            raise NotFound("Ride not found at this park")
+
+        if SERIALIZERS_AVAILABLE:
+            serializer = RideDetailOutputSerializer(
+                ride, context={"request": request, "park": park}
+            )
+            return Response(serializer.data)
+        else:
+            # Fallback serialization
+            return Response({
+                "id": ride.id,
+                "name": ride.name,
+                "slug": ride.slug,
+                "description": getattr(ride, "description", ""),
+                "category": getattr(ride, "category", ""),
+                "status": getattr(ride, "status", ""),
+                "park": {
+                    "id": park.id,
+                    "name": park.name,
+                    "slug": park.slug,
+                },
+                "manufacturer": {
+                    "name": ride.manufacturer.name if ride.manufacturer else "",
+                    "slug": getattr(ride.manufacturer, "slug", "") if ride.manufacturer else "",
+                } if ride.manufacturer else None,
+            })
+
+
+class ParkComprehensiveDetailAPIView(APIView):
+    """Get comprehensive park details including summary of rides."""
+    
+    permission_classes = [permissions.AllowAny]
+
+    @extend_schema(
+        summary="Get comprehensive park details with rides summary",
+        description="Get complete park details including a summary of rides (first 10) and link to full rides list",
+        responses={
+            200: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Parks"],
+    )
+    def get(self, request: Request, park_slug: str) -> Response:
+        """Get comprehensive park details with rides summary."""
+        if not MODELS_AVAILABLE:
+            return Response(
+                {"detail": "Park and ride models not available."},
+                status=status.HTTP_501_NOT_IMPLEMENTED,
+            )
+
+        # Get the park
+        try:
+            park, is_historical = Park.get_by_slug(park_slug)
+        except Park.DoesNotExist:
+            raise NotFound("Park not found")
+
+        # Get park with full related data
+        park = Park.objects.select_related(
+            "operator", "property_owner", "location"
+        ).prefetch_related(
+            "areas", "rides", "photos"
+        ).get(pk=park.pk)
+
+        # Get a sample of rides (first 10) for preview
+        rides_sample = Ride.objects.filter(park=park).select_related(
+            "manufacturer", "designer", "ride_model"
+        )[:10]
+
+        if SERIALIZERS_AVAILABLE:
+            # Get full park details
+            park_serializer = ParkDetailOutputSerializer(
+                park, context={"request": request}
+            )
+            park_data = park_serializer.data
+
+            # Add rides summary
+            rides_serializer = RideListOutputSerializer(
+                rides_sample, many=True, context={"request": request, "park": park}
+            )
+            
+            # Enhance response with rides data
+            park_data["rides_summary"] = {
+                "total_count": park.ride_count or 0,
+                "sample": rides_serializer.data,
+                "full_list_url": f"/api/v1/parks/{park_slug}/rides/",
+            }
+
+            return Response(park_data)
+        else:
+            # Fallback serialization
+            return Response({
+                "id": park.id,
+                "name": park.name,
+                "slug": park.slug,
+                "description": getattr(park, "description", ""),
+                "location": str(getattr(park, "location", "")),
+                "operator": getattr(park.operator, "name", "") if hasattr(park, "operator") else "",
+                "ride_count": getattr(park, "ride_count", 0),
+                "rides_summary": {
+                    "total_count": getattr(park, "ride_count", 0),
+                    "sample": [
+                        {
+                            "id": ride.id,
+                            "name": ride.name,
+                            "slug": ride.slug,
+                            "category": getattr(ride, "category", ""),
+                        }
+                        for ride in rides_sample
+                    ],
+                    "full_list_url": f"/api/v1/parks/{park_slug}/rides/",
+                },
+            })

backend/apps/api/v1/parks/ride_photos_views.py

@@ -0,0 +1,552 @@
+"""
+Ride photo API views for ThrillWiki API v1 (nested under parks).
+
+This module contains ride photo ViewSet following the parks pattern for domain consistency.
+Provides CRUD operations for ride photos nested under parks/{park_slug}/rides/{ride_slug}/photos/
+"""
+
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    pass
+
+from django.core.exceptions import PermissionDenied
+from django.utils import timezone
+from drf_spectacular.utils import extend_schema_view, extend_schema
+from drf_spectacular.types import OpenApiTypes
+from rest_framework import status
+from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError, NotFound
+from rest_framework.permissions import IsAuthenticated, AllowAny
+from rest_framework.response import Response
+from rest_framework.viewsets import ModelViewSet
+
+from apps.rides.models.media import RidePhoto
+from apps.rides.models import Ride
+from apps.parks.models import Park
+from apps.rides.services.media_service import RideMediaService
+from apps.api.v1.rides.serializers import (
+    RidePhotoOutputSerializer,
+    RidePhotoCreateInputSerializer,
+    RidePhotoUpdateInputSerializer,
+    RidePhotoListOutputSerializer,
+    RidePhotoApprovalInputSerializer,
+    RidePhotoStatsOutputSerializer,
+)
+
+logger = logging.getLogger(__name__)
+
+
+@extend_schema_view(
+    list=extend_schema(
+        summary="List ride photos",
+        description="Retrieve a paginated list of ride photos with filtering capabilities.",
+        responses={200: RidePhotoListOutputSerializer(many=True)},
+        tags=["Ride Photos"],
+    ),
+    create=extend_schema(
+        summary="Upload ride photo",
+        description="Upload a new photo for a ride. Requires authentication.",
+        request=RidePhotoCreateInputSerializer,
+        responses={
+            201: RidePhotoOutputSerializer,
+            400: OpenApiTypes.OBJECT,
+            401: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    ),
+    retrieve=extend_schema(
+        summary="Get ride photo details",
+        description="Retrieve detailed information about a specific ride photo.",
+        responses={
+            200: RidePhotoOutputSerializer,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    ),
+    update=extend_schema(
+        summary="Update ride photo",
+        description="Update ride photo information. Requires authentication and ownership or admin privileges.",
+        request=RidePhotoUpdateInputSerializer,
+        responses={
+            200: RidePhotoOutputSerializer,
+            400: OpenApiTypes.OBJECT,
+            401: OpenApiTypes.OBJECT,
+            403: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    ),
+    partial_update=extend_schema(
+        summary="Partially update ride photo",
+        description="Partially update ride photo information. Requires authentication and ownership or admin privileges.",
+        request=RidePhotoUpdateInputSerializer,
+        responses={
+            200: RidePhotoOutputSerializer,
+            400: OpenApiTypes.OBJECT,
+            401: OpenApiTypes.OBJECT,
+            403: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    ),
+    destroy=extend_schema(
+        summary="Delete ride photo",
+        description="Delete a ride photo. Requires authentication and ownership or admin privileges.",
+        responses={
+            204: None,
+            401: OpenApiTypes.OBJECT,
+            403: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    ),
+)
+class RidePhotoViewSet(ModelViewSet):
+    """
+    ViewSet for managing ride photos with full CRUD operations (nested under parks).
+
+    Provides CRUD operations for ride photos with proper permission checking.
+    Uses RideMediaService for business logic operations.
+    Includes advanced features like bulk approval and statistics.
+    """
+
+    lookup_field = "id"
+
+    def get_permissions(self):
+        """Set permissions based on action."""
+        if self.action in ['list', 'retrieve', 'stats']:
+            permission_classes = [AllowAny]
+        else:
+            permission_classes = [IsAuthenticated]
+        return [permission() for permission in permission_classes]
+
+    def get_queryset(self):
+        """Get photos for the current ride with optimized queries."""
+        queryset = RidePhoto.objects.select_related(
+            "ride", "ride__park", "ride__park__operator", "uploaded_by"
+        )
+
+        # Filter by park and ride from URL kwargs
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+        
+        if park_slug and ride_slug:
+            try:
+                park, _ = Park.get_by_slug(park_slug)
+                ride, _ = Ride.get_by_slug(ride_slug, park=park)
+                queryset = queryset.filter(ride=ride)
+            except (Park.DoesNotExist, Ride.DoesNotExist):
+                # Return empty queryset if park or ride not found
+                return queryset.none()
+
+        return queryset.order_by("-created_at")
+
+    def get_serializer_class(self):
+        """Return appropriate serializer based on action."""
+        if self.action == "list":
+            return RidePhotoListOutputSerializer
+        elif self.action == "create":
+            return RidePhotoCreateInputSerializer
+        elif self.action in ["update", "partial_update"]:
+            return RidePhotoUpdateInputSerializer
+        else:
+            return RidePhotoOutputSerializer
+
+    def perform_create(self, serializer):
+        """Create a new ride photo using RideMediaService."""
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+        
+        if not park_slug or not ride_slug:
+            raise ValidationError("Park and ride slugs are required")
+
+        try:
+            park, _ = Park.get_by_slug(park_slug)
+            ride, _ = Ride.get_by_slug(ride_slug, park=park)
+        except Park.DoesNotExist:
+            raise NotFound("Park not found")
+        except Ride.DoesNotExist:
+            raise NotFound("Ride not found at this park")
+
+        try:
+            # Use the service to create the photo with proper business logic
+            photo = RideMediaService.upload_photo(
+                ride=ride,
+                image_file=serializer.validated_data["image"],
+                user=self.request.user,
+                caption=serializer.validated_data.get("caption", ""),
+                alt_text=serializer.validated_data.get("alt_text", ""),
+                photo_type=serializer.validated_data.get("photo_type", "exterior"),
+                is_primary=serializer.validated_data.get("is_primary", False),
+                auto_approve=False,  # Default to requiring approval
+            )
+
+            # Set the instance for the serializer response
+            serializer.instance = photo
+            
+            logger.info(f"Created ride photo {photo.id} for ride {ride.name} by user {self.request.user.username}")
+
+        except Exception as e:
+            logger.error(f"Error creating ride photo: {e}")
+            raise ValidationError(f"Failed to create photo: {str(e)}")
+
+    def perform_update(self, serializer):
+        """Update ride photo with permission checking."""
+        instance = self.get_object()
+
+        # Check permissions - allow owner or staff
+        if not (
+            self.request.user == instance.uploaded_by
+            or getattr(self.request.user, "is_staff", False)
+        ):
+            raise PermissionDenied("You can only edit your own photos or be an admin.")
+
+        # Handle primary photo logic using service
+        if serializer.validated_data.get("is_primary", False):
+            try:
+                RideMediaService.set_primary_photo(ride=instance.ride, photo=instance)
+                # Remove is_primary from validated_data since service handles it
+                if "is_primary" in serializer.validated_data:
+                    del serializer.validated_data["is_primary"]
+            except Exception as e:
+                logger.error(f"Error setting primary photo: {e}")
+                raise ValidationError(f"Failed to set primary photo: {str(e)}")
+
+        try:
+            serializer.save()
+            logger.info(f"Updated ride photo {instance.id} by user {self.request.user.username}")
+        except Exception as e:
+            logger.error(f"Error updating ride photo: {e}")
+            raise ValidationError(f"Failed to update photo: {str(e)}")
+
+    def perform_destroy(self, instance):
+        """Delete ride photo with permission checking."""
+        # Check permissions - allow owner or staff
+        if not (
+            self.request.user == instance.uploaded_by
+            or getattr(self.request.user, "is_staff", False)
+        ):
+            raise PermissionDenied(
+                "You can only delete your own photos or be an admin."
+            )
+
+        try:
+            # Delete from Cloudflare first if image exists
+            if instance.image:
+                try:
+                    from django_cloudflareimages_toolkit.services import CloudflareImagesService
+                    service = CloudflareImagesService()
+                    service.delete_image(instance.image)
+                    logger.info(
+                        f"Successfully deleted ride photo from Cloudflare: {instance.image.cloudflare_id}")
+                except Exception as e:
+                    logger.error(
+                        f"Failed to delete ride photo from Cloudflare: {str(e)}")
+                    # Continue with database deletion even if Cloudflare deletion fails
+
+            RideMediaService.delete_photo(
+                instance, deleted_by=self.request.user
+            )
+            
+            logger.info(f"Deleted ride photo {instance.id} by user {self.request.user.username}")
+        except Exception as e:
+            logger.error(f"Error deleting ride photo: {e}")
+            raise ValidationError(f"Failed to delete photo: {str(e)}")
+
+    @extend_schema(
+        summary="Set photo as primary",
+        description="Set this photo as the primary photo for the ride",
+        responses={
+            200: OpenApiTypes.OBJECT,
+            400: OpenApiTypes.OBJECT,
+            403: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    )
+    @action(detail=True, methods=["post"])
+    def set_primary(self, request, **kwargs):
+        """Set this photo as the primary photo for the ride."""
+        photo = self.get_object()
+
+        # Check permissions - allow owner or staff
+        if not (
+            request.user == photo.uploaded_by
+            or getattr(request.user, "is_staff", False)
+        ):
+            raise PermissionDenied(
+                "You can only modify your own photos or be an admin."
+            )
+
+        try:
+            success = RideMediaService.set_primary_photo(ride=photo.ride, photo=photo)
+
+            if success:
+                # Refresh the photo instance
+                photo.refresh_from_db()
+                serializer = self.get_serializer(photo)
+
+                return Response(
+                    {
+                        "message": "Photo set as primary successfully",
+                        "photo": serializer.data,
+                    },
+                    status=status.HTTP_200_OK,
+                )
+            else:
+                return Response(
+                    {"error": "Failed to set primary photo"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+        except Exception as e:
+            logger.error(f"Error setting primary photo: {e}")
+            return Response(
+                {"error": f"Failed to set primary photo: {str(e)}"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+    @extend_schema(
+        summary="Bulk approve/reject photos",
+        description="Bulk approve or reject multiple ride photos (admin only)",
+        request=RidePhotoApprovalInputSerializer,
+        responses={
+            200: OpenApiTypes.OBJECT,
+            400: OpenApiTypes.OBJECT,
+            403: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    )
+    @action(detail=False, methods=["post"], permission_classes=[IsAuthenticated])
+    def bulk_approve(self, request, **kwargs):
+        """Bulk approve or reject multiple photos (admin only)."""
+        if not getattr(request.user, "is_staff", False):
+            raise PermissionDenied("Only administrators can approve photos.")
+
+        serializer = RidePhotoApprovalInputSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        validated_data = getattr(serializer, "validated_data", {})
+        photo_ids = validated_data.get("photo_ids")
+        approve = validated_data.get("approve")
+        
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+
+        if photo_ids is None or approve is None:
+            return Response(
+                {"error": "Missing required fields: photo_ids and/or approve."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            # Filter photos to only those belonging to this ride
+            photos_queryset = RidePhoto.objects.filter(id__in=photo_ids)
+            if park_slug and ride_slug:
+                park, _ = Park.get_by_slug(park_slug)
+                ride, _ = Ride.get_by_slug(ride_slug, park=park)
+                photos_queryset = photos_queryset.filter(ride=ride)
+
+            updated_count = photos_queryset.update(is_approved=approve)
+
+            return Response(
+                {
+                    "message": f"Successfully {'approved' if approve else 'rejected'} {updated_count} photos",
+                    "updated_count": updated_count,
+                },
+                status=status.HTTP_200_OK,
+            )
+
+        except Exception as e:
+            logger.error(f"Error in bulk photo approval: {e}")
+            return Response(
+                {"error": f"Failed to update photos: {str(e)}"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+    @extend_schema(
+        summary="Get ride photo statistics",
+        description="Get photo statistics for the ride",
+        responses={
+            200: RidePhotoStatsOutputSerializer,
+            404: OpenApiTypes.OBJECT,
+            500: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    )
+    @action(detail=False, methods=["get"])
+    def stats(self, request, **kwargs):
+        """Get photo statistics for the ride."""
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+        
+        if not park_slug or not ride_slug:
+            return Response(
+                {"error": "Park and ride slugs are required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            park, _ = Park.get_by_slug(park_slug)
+            ride, _ = Ride.get_by_slug(ride_slug, park=park)
+        except Park.DoesNotExist:
+            return Response(
+                {"error": "Park not found"},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+        except Ride.DoesNotExist:
+            return Response(
+                {"error": "Ride not found at this park"},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        try:
+            stats = RideMediaService.get_photo_stats(ride)
+            serializer = RidePhotoStatsOutputSerializer(stats)
+            return Response(serializer.data, status=status.HTTP_200_OK)
+
+        except Exception as e:
+            logger.error(f"Error getting ride photo stats: {e}")
+            return Response(
+                {"error": f"Failed to get photo statistics: {str(e)}"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+    @extend_schema(
+        summary="Save Cloudflare image as ride photo",
+        description="Save a Cloudflare image as a ride photo after direct upload to Cloudflare",
+        request=OpenApiTypes.OBJECT,
+        responses={
+            201: RidePhotoOutputSerializer,
+            400: OpenApiTypes.OBJECT,
+            401: OpenApiTypes.OBJECT,
+            404: OpenApiTypes.OBJECT,
+        },
+        tags=["Ride Photos"],
+    )
+    @action(detail=False, methods=["post"])
+    def save_image(self, request, **kwargs):
+        """Save a Cloudflare image as a ride photo after direct upload to Cloudflare."""
+        park_slug = self.kwargs.get("park_slug")
+        ride_slug = self.kwargs.get("ride_slug")
+        
+        if not park_slug or not ride_slug:
+            return Response(
+                {"error": "Park and ride slugs are required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            park, _ = Park.get_by_slug(park_slug)
+            ride, _ = Ride.get_by_slug(ride_slug, park=park)
+        except Park.DoesNotExist:
+            return Response(
+                {"error": "Park not found"},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+        except Ride.DoesNotExist:
+            return Response(
+                {"error": "Ride not found at this park"},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        cloudflare_image_id = request.data.get("cloudflare_image_id")
+        if not cloudflare_image_id:
+            return Response(
+                {"error": "cloudflare_image_id is required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            # Import CloudflareImage model and service
+            from django_cloudflareimages_toolkit.models import CloudflareImage
+            from django_cloudflareimages_toolkit.services import CloudflareImagesService
+
+            # Always fetch the latest image data from Cloudflare API
+            try:
+                # Get image details from Cloudflare API
+                service = CloudflareImagesService()
+                image_data = service.get_image(cloudflare_image_id)
+
+                if not image_data:
+                    return Response(
+                        {"error": "Image not found in Cloudflare"},
+                        status=status.HTTP_400_BAD_REQUEST,
+                    )
+
+                # Try to find existing CloudflareImage record by cloudflare_id
+                cloudflare_image = None
+                try:
+                    cloudflare_image = CloudflareImage.objects.get(
+                        cloudflare_id=cloudflare_image_id)
+
+                    # Update existing record with latest data from Cloudflare
+                    cloudflare_image.status = 'uploaded'
+                    cloudflare_image.uploaded_at = timezone.now()
+                    cloudflare_image.metadata = image_data.get('meta', {})
+                    # Extract variants from nested result structure
+                    cloudflare_image.variants = image_data.get(
+                        'result', {}).get('variants', [])
+                    cloudflare_image.cloudflare_metadata = image_data
+                    cloudflare_image.width = image_data.get('width')
+                    cloudflare_image.height = image_data.get('height')
+                    cloudflare_image.format = image_data.get('format', '')
+                    cloudflare_image.save()
+
+                except CloudflareImage.DoesNotExist:
+                    # Create new CloudflareImage record from API response
+                    cloudflare_image = CloudflareImage.objects.create(
+                        cloudflare_id=cloudflare_image_id,
+                        user=request.user,
+                        status='uploaded',
+                        upload_url='',  # Not needed for uploaded images
+                        expires_at=timezone.now() + timezone.timedelta(days=365),  # Set far future expiry
+                        uploaded_at=timezone.now(),
+                        metadata=image_data.get('meta', {}),
+                        # Extract variants from nested result structure
+                        variants=image_data.get('result', {}).get('variants', []),
+                        cloudflare_metadata=image_data,
+                        width=image_data.get('width'),
+                        height=image_data.get('height'),
+                        format=image_data.get('format', ''),
+                    )
+
+            except Exception as api_error:
+                logger.error(
+                    f"Error fetching image from Cloudflare API: {str(api_error)}", exc_info=True)
+                return Response(
+                    {"error": f"Failed to fetch image from Cloudflare: {str(api_error)}"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+            # Create the ride photo with the CloudflareImage reference
+            photo = RidePhoto.objects.create(
+                ride=ride,
+                image=cloudflare_image,
+                uploaded_by=request.user,
+                caption=request.data.get("caption", ""),
+                alt_text=request.data.get("alt_text", ""),
+                photo_type=request.data.get("photo_type", "exterior"),
+                is_primary=request.data.get("is_primary", False),
+                is_approved=False,  # Default to requiring approval
+            )
+
+            # Handle primary photo logic if requested
+            if request.data.get("is_primary", False):
+                try:
+                    RideMediaService.set_primary_photo(ride=ride, photo=photo)
+                except Exception as e:
+                    logger.error(f"Error setting primary photo: {e}")
+                    # Don't fail the entire operation, just log the error
+
+            serializer = RidePhotoOutputSerializer(photo, context={"request": request})
+            return Response(serializer.data, status=status.HTTP_201_CREATED)
+
+        except Exception as e:
+            logger.error(f"Error saving ride photo: {e}")
+            return Response(
+                {"error": f"Failed to save photo: {str(e)}"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )