release: v0.16.0

See CHANGELOG.md for the full v0.16.0 entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>

lib/admin/withAdmin.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from './auth';
+
+/**
+ * Wraps an admin route handler in the enabled + authenticated check.
+ *
+ * Every handler under /api/admin is defined inside this wrapper, so a route
+ * that forgets its guard is not a diff that merely looks fine: there is no
+ * plain `export async function GET` left to copy from. The one exception is
+ * /api/admin/auth, the login endpoint, which must stay reachable without a
+ * session.
+ *
+ * The two refusals are kept distinct, as the hand-written copies had them:
+ * 403 means the admin panel is switched off for this deployment, 401 means it
+ * is on and this caller is not signed in.
+ *
+ * The handler's own parameters are passed through untouched, so routes taking
+ * `(request)`, `(request, context)` or nothing at all all wrap the same way.
+ */
+export function withAdmin<Args extends unknown[]>(
+  handler: (...args: Args) => Response | Promise<Response>,
+): (...args: Args) => Promise<Response> {
+  return async (...args: Args): Promise<Response> => {
+    if (!isAdminEnabled()) {
+      return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+    }
+    if (!(await isAdminAuthenticated())) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    return handler(...args);
+  };
+}