release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/auth/__tests__/route.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+
+/**
+ * A slug without a password must be indistinguishable from a wrong password.
+ * A separate "not password-protected" answer let anyone probing slugs tell
+ * which ones exist behind a lock — drafts and offline subpages included, whose
+ * pages answer 404 and give nothing away themselves.
+ */
+
+const config = {
+  authSecret: 'test-secret-that-is-at-least-32-chars-long',
+  subpages: [
+    { slug: 'private', name: 'Private', password: 'letmein', albumIds: [] },
+    { slug: 'public', name: 'Public', albumIds: [] },
+  ],
+  albumPasswords: {},
+  sitePassword: undefined,
+};
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => config,
+  getConfigOrNull: () => config,
+}));
+
+const { POST } = await import('../route');
+
+async function attempt(slug: string, password: string, type = 'subpage') {
+  // Eight attempts in all, inside the route's limit of ten per minute.
+  const res = await POST(
+    new NextRequest('http://localhost/api/auth', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ slug, password, type }),
+    }),
+  );
+  return { status: res.status, body: await res.json() };
+}
+
+describe('POST /api/auth', () => {
+  it('unlocks a protected subpage with its password', async () => {
+    const res = await attempt('private', 'letmein');
+    expect(res.status).toBe(200);
+  });
+
+  it('answers a slug without a password like a wrong password', async () => {
+    const wrong = await attempt('private', 'nope');
+    expect(wrong.status).toBe(401);
+
+    for (const [slug, type] of [
+      ['public', 'subpage'],
+      ['does-not-exist', 'subpage'],
+      ['does-not-exist', 'journal'],
+      ['does-not-exist', 'page'],
+      ['00000000-0000-0000-0000-000000000000', 'album'],
+      ['__site__', 'site'],
+    ]) {
+      expect(await attempt(slug, 'nope', type)).toEqual(wrong);
+    }
+  });
+});

app/api/auth/route.ts

@@ -7,7 +7,7 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
-import { authenticate, isHttpsRequest, isProtected, type ProtectedType } from '@/lib/auth';
+import { authenticate, isHttpsRequest, type ProtectedType } from '@/lib/auth';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
 /** Tight limit for auth attempts — 10 per minute per IP. */
@@ -49,28 +49,16 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Invalid password format or length' }, { status: 400 });
     }
 
-    const TYPES: ProtectedType[] = ['subpage', 'album', 'journal', 'site'];
+    const TYPES: ProtectedType[] = ['subpage', 'album', 'journal', 'page', 'site'];
     if (!TYPES.includes(type)) {
       return NextResponse.json({ error: 'Invalid type' }, { status: 400 });
     }
 
-    if (!isProtected(slug, type)) {
-      const typeLabel =
-        type === 'journal'
-          ? 'Journal entry'
-          : type === 'subpage'
-            ? 'Subpage'
-            : type === 'site'
-              ? 'Site'
-              : 'Album';
-      return NextResponse.json(
-        {
-          error: `${typeLabel} is not password-protected`,
-        },
-        { status: 400 },
-      );
-    }
-
+    // A key with no password (or none at all) answers exactly like a wrong
+    // password: `authenticate()` returns null for both. A distinct "not
+    // password-protected" reply told anyone probing slugs which ones hold a
+    // locked entry — including drafts and offline subpages, whose pages answer
+    // 404 and so give nothing away themselves.
     const setCookie = await authenticate(slug, password, type, isHttpsRequest(request));
     if (!setCookie) {
       return NextResponse.json({ error: 'Invalid password' }, { status: 401 });