release: v0.16.0

See CHANGELOG.md for the full v0.16.0 entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>

lib/__tests__/auth.test.ts

@@ -43,6 +43,7 @@ import {
   authenticate,
   isAuthenticated,
   isAlbumReachable,
+  withoutLockedAlbums,
   findSubpageBySlug,
 } from '@/lib/auth';
 
@@ -258,3 +259,30 @@ describe('isAlbumReachable', () => {
     expect(isAlbumReachable(OWN_PASSWORD, (n) => subpage(n) ?? album(n))).toBe(true);
   });
 });
+
+/**
+ * The essay layout puts the photographs of several albums on one page and
+ * never passes through an album's own gate, so it has to leave out the ones
+ * that are still locked.
+ */
+describe('withoutLockedAlbums', () => {
+  const OPEN = { id: '00000000-0000-0000-0000-000000000002' };
+  const LOCKED = { id: '00000000-0000-0000-0000-000000000005' };
+
+  it('keeps an album that has no password of its own', () => {
+    expect(withoutLockedAlbums([OPEN], () => undefined)).toEqual([OPEN]);
+  });
+
+  it('leaves out an album whose password has not been given', () => {
+    expect(withoutLockedAlbums([OPEN, LOCKED], () => undefined)).toEqual([OPEN]);
+  });
+
+  it('brings it back once it has been unlocked, in the original order', async () => {
+    const header = (await authenticate(LOCKED.id, 'albumpass', 'album'))!;
+    const [name, rest] = header.split('=');
+    const token = rest.split(';')[0];
+    const getCookie = (asked: string) => (asked === name ? token : undefined);
+
+    expect(withoutLockedAlbums([LOCKED, OPEN], getCookie)).toEqual([LOCKED, OPEN]);
+  });
+});