release: v0.17.0 (#677)

See CHANGELOG.md, section [0.17.0] — 2026-09-23.

app/api/admin/__tests__/auth-cookie.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+
+/**
+ * The admin session cookie is `Secure` only when the visitor came over HTTPS
+ * (#664). Keyed on NODE_ENV it was always `Secure` in the Docker image, so an
+ * instance opened at `http://host:7211` logged in with a 200 and then lost the
+ * cookie — every admin request after that was a 401.
+ */
+
+vi.mock('@/lib/admin/auth', () => ({
+  verifyAdminPassword: vi.fn(async () => true),
+  createAdminToken: vi.fn(() => 'session-token'),
+  isAdminAuthenticated: vi.fn(async () => true),
+  isAdminEnabled: vi.fn(() => true),
+  COOKIE_NAME: 'folio_admin_session',
+  SESSION_DURATION_MS: 24 * 60 * 60 * 1000,
+  MAX_PASSWORD_LENGTH: 1024,
+}));
+
+vi.mock('@/lib/rate-limit', () => ({
+  checkRateLimit: vi.fn(() => ({ success: true, resetAt: 0 })),
+  getClientIp: vi.fn(() => '127.0.0.1'),
+  retryAfterSeconds: vi.fn(() => 60),
+}));
+
+import { POST, DELETE } from '../auth/route';
+
+function login(url: string, headers: Record<string, string> = {}) {
+  return new NextRequest(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: JSON.stringify({ password: 'hunter2' }),
+  });
+}
+
+describe('admin session cookie', () => {
+  it('is not Secure when the admin is reached over plain HTTP', async () => {
+    const res = await POST(login('http://192.168.1.10:7211/api/admin/auth'));
+    expect(res.status).toBe(200);
+    const cookie = res.headers.get('set-cookie') ?? '';
+    expect(cookie).toContain('folio_admin_session=session-token');
+    expect(cookie.toLowerCase()).not.toContain('secure');
+  });
+
+  it('is Secure behind an HTTPS reverse proxy', async () => {
+    const res = await POST(
+      login('http://folio:3000/api/admin/auth', { 'x-forwarded-proto': 'https' }),
+    );
+    expect((res.headers.get('set-cookie') ?? '').toLowerCase()).toContain('secure');
+  });
+
+  it('clears the cookie with the same flag it was set with', async () => {
+    const res = await DELETE(
+      new NextRequest('http://192.168.1.10:7211/api/admin/auth', { method: 'DELETE' }),
+    );
+    const cookie = res.headers.get('set-cookie') ?? '';
+    expect(cookie).toContain('folio_admin_session=');
+    expect(cookie.toLowerCase()).not.toContain('secure');
+  });
+});

app/api/admin/auth/route.ts

@@ -9,6 +9,7 @@ import {
   MAX_PASSWORD_LENGTH,
 } from '@/lib/admin/auth';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
+import { isHttpsRequest } from '@/lib/auth';
 
 /** Admin login attempts per minute per IP — the highest-value credential in the app. */
 const ADMIN_AUTH_RPM = 5;
@@ -53,7 +54,7 @@ export async function POST(request: NextRequest) {
 
   response.cookies.set(COOKIE_NAME, token, {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
+    secure: isHttpsRequest(request),
     sameSite: 'strict',
     path: '/',
     maxAge: SESSION_DURATION_MS / 1000,
@@ -73,11 +74,11 @@ export async function GET() {
 }
 
 /** DELETE: Logout. */
-export async function DELETE() {
+export async function DELETE(request: NextRequest) {
   const response = NextResponse.json({ success: true });
   response.cookies.set(COOKIE_NAME, '', {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
+    secure: isHttpsRequest(request),
     sameSite: 'strict',
     path: '/',
     maxAge: 0,

app/api/admin/doctor/route.ts

@@ -107,7 +107,10 @@ export const GET = withAdmin(async (request: NextRequest) => {
       // it), which is only known once Immich has answered (#632).
       const slugGroups: AlbumSlugGroup[] = [
         { context: 'gallery.yaml albums', albumIds: config.standaloneAlbums },
-        ...config.subpages.map((sp) => ({ context: `subpage "${sp.name}"`, albumIds: sp.albumIds })),
+        ...config.subpages.map((sp) => ({
+          context: `subpage "${sp.name}"`,
+          albumIds: sp.albumIds,
+        })),
       ];
       findings.push(checkAlbumSlugCollisions(slugGroups, config.albumOverrides, albums, slugify));
     }