chore(release): v0.10.0 (#400)

Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed.

See CHANGELOG.md for the full list and the health-check upgrade note.

app/api/admin/__tests__/admin-guards.test.ts

@@ -100,6 +100,27 @@ const ROUTES: {
       { params: Promise.resolve({ albumId: 'a1' }) },
     ],
   },
+  {
+    name: 'GET /api/admin/analytics',
+    path: 'analytics',
+    load: () => import('../analytics/route'),
+    method: 'GET',
+    args: () => [],
+  },
+  {
+    name: 'GET /api/admin/backups',
+    path: 'backups',
+    load: () => import('../backups/route'),
+    method: 'GET',
+    args: () => [],
+  },
+  {
+    name: 'POST /api/admin/backups',
+    path: 'backups',
+    load: () => import('../backups/route'),
+    method: 'POST',
+    args: () => [new Request('http://localhost/api/admin/backups', { method: 'POST', body: '{}' })],
+  },
 ];
 
 describe('admin route guards', () => {

app/api/admin/__tests__/status.test.ts

@@ -0,0 +1,67 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/admin/auth', () => ({
+  isAdminEnabled: () => true,
+  isAdminAuthenticated: async () => true,
+  COOKIE_NAME: 'folio_admin_session',
+}));
+
+vi.mock('@/lib/immich', () => ({
+  immich: { ping: vi.fn(async () => true) },
+}));
+
+vi.mock('@/lib/cache', () => ({
+  cache: { size: 0 },
+}));
+
+vi.mock('@/lib/admin/yaml-service', () => ({
+  readGalleryYaml: vi.fn(),
+  readSettingsYaml: vi.fn(),
+  listBackups: vi.fn(async () => []),
+}));
+
+import { GET } from '../status/route';
+import { readGalleryYaml, readSettingsYaml } from '@/lib/admin/yaml-service';
+
+const mockGallery = readGalleryYaml as unknown as ReturnType<typeof vi.fn>;
+const mockSettings = readSettingsYaml as unknown as ReturnType<typeof vi.fn>;
+
+async function status() {
+  return (await GET()).json();
+}
+
+describe('GET /api/admin/status — config integrity', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockGallery.mockResolvedValue({ albums: ['a'] });
+    mockSettings.mockResolvedValue({ title: 'Site' });
+  });
+
+  it('reports a fully configured install as valid', async () => {
+    expect((await status()).config).toMatchObject({ status: 'valid', settings: 'valid' });
+  });
+
+  /**
+   * settings.yaml is optional — getConfig() falls back to defaults when it is
+   * absent. Reporting that install as "Degraded" sent people hunting for a
+   * fault that did not exist (#341).
+   */
+  it('treats a missing settings.yaml as valid, not as a fault', async () => {
+    mockSettings.mockResolvedValue(null); // what readSettingsYaml returns on ENOENT
+
+    expect((await status()).config).toMatchObject({ status: 'valid', settings: 'valid' });
+  });
+
+  it('still reports a settings.yaml that cannot be parsed', async () => {
+    mockSettings.mockRejectedValue(new Error('bad indentation'));
+
+    expect((await status()).config).toMatchObject({ status: 'invalid', settings: 'invalid' });
+  });
+
+  // gallery.yaml, unlike settings.yaml, is genuinely required.
+  it('reports a missing gallery.yaml as invalid', async () => {
+    mockGallery.mockResolvedValue(null);
+
+    expect((await status()).config).toMatchObject({ status: 'invalid', gallery: 'invalid' });
+  });
+});

app/api/admin/analytics/route.ts

@@ -1,11 +1,19 @@
 import { NextResponse } from 'next/server';
 import fs from 'fs/promises';
 import path from 'path';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
 import { getConfigOrNull } from '@/lib/config';
 
 const ANALYTICS_FILE = path.join(process.cwd(), 'content', 'analytics.json');
 
 export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
   try {
     const config = getConfigOrNull();
     let data;
@@ -45,6 +53,9 @@ export async function GET() {
       },
     });
   } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to fetch analytics' }, { status: 500 });
+    return NextResponse.json(
+      { error: err.message || 'Failed to fetch analytics' },
+      { status: 500 },
+    );
   }
 }

app/api/admin/gallery/route.ts

@@ -63,6 +63,7 @@ export async function PUT(request: Request) {
     immich.invalidateAll();
     // Revalidate all pages so the homepage picks up new hero images immediately
     revalidatePath('/', 'layout');
+    revalidatePath('/[...path]', 'page');
     return NextResponse.json({
       success: true,
       message: 'Saved successfully. Backup of previous version created.',

app/api/admin/status/route.ts

@@ -22,7 +22,12 @@ export async function GET() {
 
   // 2. Config Health Check
   let galleryValid = false;
-  let settingsValid = false;
+  // settings.yaml is optional — getConfig() falls back to defaults when it is
+  // absent, so a missing file is a valid installation, not a fault. Only a file
+  // that exists and cannot be parsed counts as degraded: readSettingsYaml()
+  // returns null for ENOENT and rethrows everything else.
+  let settingsValid = true;
+
   try {
     const gallery = await readGalleryYaml();
     galleryValid = !!gallery;
@@ -31,17 +36,17 @@ export async function GET() {
   }
 
   try {
-    const settings = await readSettingsYaml();
-    settingsValid = !!settings;
+    await readSettingsYaml();
   } catch (err) {
     console.error('[Admin API] Settings YAML parse failed:', err);
+    settingsValid = false;
   }
 
   // 3. Backup Info
   const galleryBackups = await listBackups('gallery.yaml');
   const settingsBackups = await listBackups('settings.yaml');
   const backupCount = galleryBackups.length + settingsBackups.length;
-  
+
   // Find timestamp of the latest backup
   let lastBackup: string | null = null;
   const allBackups = [...galleryBackups, ...settingsBackups].sort().reverse();
@@ -60,7 +65,7 @@ export async function GET() {
       status: immichOk ? 'connected' : 'disconnected',
     },
     config: {
-      status: (galleryValid && settingsValid) ? 'valid' : 'invalid',
+      status: galleryValid && settingsValid ? 'valid' : 'invalid',
       gallery: galleryValid ? 'valid' : 'invalid',
       settings: settingsValid ? 'valid' : 'invalid',
     },