feat: implement album-level password protection

app/api/auth/route.ts

@@ -21,14 +21,13 @@ export async function POST(request: NextRequest) {
 
   try {
     const body = await request.json();
-    const { slug, password } = body;
+    const { slug, password, type = 'subpage' } = body;
 
     if (!slug || !password) {
       return NextResponse.json({ error: 'Missing slug or password' }, { status: 400 });
     }
 
     // 🛡️ SECURITY: Validate input types and limit length to prevent DoS attacks
-    // (e.g. from extremely long strings being passed to expensive crypto functions)
     if (typeof slug !== 'string' || slug.length > 100) {
       return NextResponse.json({ error: 'Invalid slug format or length' }, { status: 400 });
     }
@@ -37,11 +36,17 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Invalid password format or length' }, { status: 400 });
     }
 
-    if (!isProtected(slug)) {
-      return NextResponse.json({ error: 'Album is not password-protected' }, { status: 400 });
+    if (type !== 'subpage' && type !== 'album') {
+      return NextResponse.json({ error: 'Invalid type' }, { status: 400 });
     }
 
-    const setCookie = authenticate(slug, password);
+    if (!isProtected(slug, type)) {
+      return NextResponse.json({
+        error: `${type === 'subpage' ? 'Subpage' : 'Album'} is not password-protected`,
+      }, { status: 400 });
+    }
+
+    const setCookie = authenticate(slug, password, type);
     if (!setCookie) {
       return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
     }