@serve.zone/dcrouter 16.1.1 → 16.2.0

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -791,7 +791,14 @@ export class GatewayClientHandler {
     const routeKey = metadata.externalKey?.startsWith(prefix)
       ? metadata.externalKey.slice(prefix.length)
       : '';
-    if (routeKey.startsWith('route:')) {
+    const combinedOwnership = this.parseCombinedGatewayClientRouteKey(routeKey);
+    if (combinedOwnership) {
+      ownership.hostname = combinedOwnership.hostname;
+      ownership.routeRef = combinedOwnership.routeRef;
+    } else if (routeKey.startsWith('v2:host-route:')) {
+      // A malformed versioned key must not be exposed as a hostname.
+      ownership.hostname = this.getRouteHostnames(routeArg.route)[0];
+    } else if (routeKey.startsWith('route:')) {
       ownership.routeRef = routeKey.slice('route:'.length);
     } else if (routeKey) {
       ownership.hostname = routeKey;
@@ -934,7 +941,7 @@ export class GatewayClientHandler {
       if (!existingRoute) {
         return { success: true, action: 'unchanged' };
       }
-      const result = await manager.deleteRoute(existingRoute.id);
+      const result = await manager.deleteManagedRoute(existingRoute.id);
       return result.success
         ? { success: true, action: 'deleted', routeId: existingRoute.id }
         : { success: false, message: result.message };
@@ -965,24 +972,35 @@ export class GatewayClientHandler {
     const normalizedRoute = this.normalizeGatewayClientRoute(route, resolvedOwnership, externalKey);
 
     if (existingRoute) {
-      const routePatch: Partial<interfaces.data.IDcRouterRouteConfig> = { ...normalizedRoute };
-      (routePatch as any).security = null;
-      const result = await manager.updateRoute(existingRoute.id, {
-        route: routePatch,
+      const result = await manager.updateManagedRoute(existingRoute.id, {
+        route: normalizedRoute,
         enabled: enabled ?? true,
         metadata,
+      }, {
+        replaceMetadata: true,
+        replaceRoute: true,
       });
       return result.success
         ? { success: true, action: 'updated', routeId: existingRoute.id }
         : { success: false, message: result.message };
     }
 
-    const routeId = await manager.createRoute(normalizedRoute, auth.userId, enabled ?? true, metadata);
+    const routeId = await manager.createManagedRoute(normalizedRoute, auth.userId, enabled ?? true, metadata);
     return { success: true, action: 'created', routeId };
   }
 
   private buildGatewayClientExternalKey(ownership: TResolvedGatewayClientOwnership): string {
-    const routeKey = ownership.hostname || `route:${ownership.routeRef}`;
+    const hostname = ownership.hostname?.trim().toLowerCase();
+    const routeRef = ownership.routeRef?.trim();
+    let routeKey: string;
+    if (hostname && routeRef) {
+      const payload = Buffer.from(JSON.stringify([hostname, routeRef]), 'utf8').toString('base64url');
+      routeKey = `v2:host-route:${payload}`;
+    } else if (hostname) {
+      routeKey = hostname;
+    } else {
+      routeKey = `route:${routeRef}`;
+    }
     return [
       ownership.gatewayClientType,
       ownership.gatewayClientId,
@@ -991,6 +1009,35 @@ export class GatewayClientHandler {
     ].map((part) => part.trim()).join(':');
   }
 
+  private parseCombinedGatewayClientRouteKey(
+    routeKeyArg: string,
+  ): { hostname: string; routeRef: string } | undefined {
+    const prefix = 'v2:host-route:';
+    if (!routeKeyArg.startsWith(prefix)) {
+      return undefined;
+    }
+    const payload = routeKeyArg.slice(prefix.length);
+    if (!payload || !/^[A-Za-z0-9_-]+$/.test(payload)) {
+      return undefined;
+    }
+    try {
+      const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+      if (
+        !Array.isArray(parsed)
+        || parsed.length !== 2
+        || parsed.some((value) => typeof value !== 'string' || !value.trim())
+      ) {
+        return undefined;
+      }
+      return {
+        hostname: parsed[0].trim().toLowerCase(),
+        routeRef: parsed[1].trim(),
+      };
+    } catch {
+      return undefined;
+    }
+  }
+
 
   private normalizeGatewayClientRoute(
     route: interfaces.data.IDcRouterRouteConfig,

package/ts/opsserver/handlers/route-management.handler.ts

@@ -122,5 +122,64 @@ export class RouteManagementHandler {
         },
       ),
     );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_CreateLetsEncryptHttp01Forward>(
+        'createLetsEncryptHttp01Forward',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'routes:write');
+          const manager = this.opsServerRef.dcRouterRef.routeConfigManager;
+          if (!manager) {
+            return { success: false, message: 'Route management not initialized' };
+          }
+          try {
+            const routeId = await manager.createLetsEncryptHttp01Forward(
+              dataArg.config,
+              userId,
+              dataArg.enabled ?? true,
+            );
+            return { success: true, routeId };
+          } catch (error) {
+            return { success: false, message: (error as Error).message };
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_UpdateLetsEncryptHttp01Forward>(
+        'updateLetsEncryptHttp01Forward',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'routes:write');
+          const manager = this.opsServerRef.dcRouterRef.routeConfigManager;
+          if (!manager) {
+            return { success: false, message: 'Route management not initialized' };
+          }
+          try {
+            return await manager.updateLetsEncryptHttp01Forward(
+              dataArg.id,
+              dataArg.config,
+              dataArg.enabled,
+            );
+          } catch (error) {
+            return { success: false, message: (error as Error).message };
+          }
+        },
+      ),
+    );
+
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_DeleteLetsEncryptHttp01Forward>(
+        'deleteLetsEncryptHttp01Forward',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'routes:write');
+          const manager = this.opsServerRef.dcRouterRef.routeConfigManager;
+          if (!manager) {
+            return { success: false, message: 'Route management not initialized' };
+          }
+          return await manager.deleteLetsEncryptHttp01Forward(dataArg.id);
+        },
+      ),
+    );
   }
 }

package/ts_apiclient/readme.md

@@ -63,7 +63,7 @@ const tokenClient = new DcRouterApiClient({
 
 | Manager | Purpose |
 | --- | --- |
-| `client.routes` | List merged routes, build API routes, update/delete API routes, and toggle routes. |
+| `client.routes` | List merged routes, build/update/delete ordinary operator routes, and toggle routes. |
 | `client.certificates` | Inspect certificate summaries and trigger certificate operations. |
 | `client.apiTokens` | Create, list, toggle, roll, and revoke API tokens. |
 | `client.remoteIngress` | Manage edge registrations, statuses, ports, tags, and connection tokens. |
@@ -98,7 +98,7 @@ await route.update({
 });
 ```
 
-System routes from `config`, `email`, and `dns` origins are designed to be toggled, not edited. Full create/update/delete behavior is for routes with origin `api`.
+System routes from `config`, `email`, and `dns` origins are designed to be toggled, not edited. Generic create/update/delete behavior is for ordinary operator-owned routes with origin `api`. API-origin routes carrying managed ownership metadata, including gateway-client routes and HTTP-01 Special Forwards, must be changed through their owning specialized TypedRequest workflow; `client.routes` does not bypass that protection.
 
 ## API Tokens and Remote Ingress
 

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '16.1.1',
+  version: '16.2.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/appstate/routes.ts

@@ -221,6 +221,90 @@ export const toggleRouteAction = routeManagementStatePart.createAction<{
   }
 });
 
+export const createLetsEncryptHttp01ForwardAction = routeManagementStatePart.createAction<{
+  config: interfaces.data.ILetsEncryptHttp01ForwardConfig;
+  enabled?: boolean;
+}>(async (statePartArg, dataArg, actionContext): Promise<IRouteManagementState> => {
+  const context = getActionContext();
+  const currentState = statePartArg.getState()!;
+
+  try {
+    const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
+      interfaces.requests.IReq_CreateLetsEncryptHttp01Forward
+    >('/typedrequest', 'createLetsEncryptHttp01Forward');
+    const response = await request.fire({
+      identity: context.identity!,
+      config: dataArg.config,
+      enabled: dataArg.enabled,
+    });
+    if (!response.success) {
+      throw new Error(response.message || 'Failed to create Special Forward');
+    }
+    return await actionContext!.dispatch(fetchMergedRoutesAction, null);
+  } catch (error: unknown) {
+    return {
+      ...currentState,
+      error: error instanceof Error ? error.message : 'Failed to create Special Forward',
+    };
+  }
+});
+
+export const updateLetsEncryptHttp01ForwardAction = routeManagementStatePart.createAction<{
+  id: string;
+  config: interfaces.data.ILetsEncryptHttp01ForwardConfig;
+  enabled?: boolean;
+}>(async (statePartArg, dataArg, actionContext): Promise<IRouteManagementState> => {
+  const context = getActionContext();
+  const currentState = statePartArg.getState()!;
+
+  try {
+    const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
+      interfaces.requests.IReq_UpdateLetsEncryptHttp01Forward
+    >('/typedrequest', 'updateLetsEncryptHttp01Forward');
+    const response = await request.fire({
+      identity: context.identity!,
+      id: dataArg.id,
+      config: dataArg.config,
+      enabled: dataArg.enabled,
+    });
+    if (!response.success) {
+      throw new Error(response.message || 'Failed to update Special Forward');
+    }
+    return await actionContext!.dispatch(fetchMergedRoutesAction, null);
+  } catch (error: unknown) {
+    return {
+      ...currentState,
+      error: error instanceof Error ? error.message : 'Failed to update Special Forward',
+    };
+  }
+});
+
+export const deleteLetsEncryptHttp01ForwardAction = routeManagementStatePart.createAction<string>(
+  async (statePartArg, routeId, actionContext): Promise<IRouteManagementState> => {
+    const context = getActionContext();
+    const currentState = statePartArg.getState()!;
+
+    try {
+      const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
+        interfaces.requests.IReq_DeleteLetsEncryptHttp01Forward
+      >('/typedrequest', 'deleteLetsEncryptHttp01Forward');
+      const response = await request.fire({
+        identity: context.identity!,
+        id: routeId,
+      });
+      if (!response.success) {
+        throw new Error(response.message || 'Failed to delete Special Forward');
+      }
+      return await actionContext!.dispatch(fetchMergedRoutesAction, null);
+    } catch (error: unknown) {
+      return {
+        ...currentState,
+        error: error instanceof Error ? error.message : 'Failed to delete Special Forward',
+      };
+    }
+  },
+);
+
 // ============================================================================
 // API Token Actions
 // ============================================================================

package/ts_web/elements/network/ops-view-redirects.ts

@@ -5,6 +5,7 @@ import {
   type TemplateResult,
   css,
   state,
+  property,
   cssManager,
 } from '@design.estate/dees-element';
 import { type IStatsTile } from '@design.estate/dees-catalog';
@@ -20,6 +21,9 @@ declare global {
 
 @customElement('ops-view-redirects')
 export class OpsViewRedirects extends DeesElement {
+  @property({ type: Boolean })
+  accessor embedded = false;
+
   @state()
   accessor routeState: appstate.IRouteManagementState = appstate.routeManagementStatePart.getState()!;
 
@@ -123,7 +127,7 @@ export class OpsViewRedirects extends DeesElement {
     ];
 
     return html`
-      <dees-heading level="3">Redirects</dees-heading>
+      ${this.embedded ? '' : html`<dees-heading level="3">Redirects</dees-heading>`}
       <div class="redirectsContainer">
         <dees-statsgrid .tiles=${statsTiles}></dees-statsgrid>
 

package/ts_web/elements/network/ops-view-routes.ts

@@ -1,7 +1,9 @@
 import * as appstate from '../../appstate.js';
 import * as interfaces from '../../../dist_ts_interfaces/index.js';
 import { viewHostCss } from '../shared/css.js';
-import { type IStatsTile } from '@design.estate/dees-catalog';
+import { type DeesAppuiTabs, type IStatsTile } from '@design.estate/dees-catalog';
+import './ops-view-redirects.js';
+import './ops-view-special-forwards.js';
 import type {
   IRoutePathClassOption as ISzRoutePathClassOption,
   IRouteSourcePolicyPreset as ISzRouteSourcePolicyPreset,
@@ -19,6 +21,10 @@ import {
   type TemplateResult,
 } from '@design.estate/dees-element';
 
+type TRoutesSection = 'standard' | 'special' | 'redirects';
+type TRouteOwnerFilter = 'all' | 'operator' | 'gatewayClient' | 'system';
+type IMenuItem = DeesAppuiTabs['tabs'][number];
+
 // TLS dropdown options shared by create and edit dialogs
 const tlsModeOptions = [
   { key: 'none', option: '(none — plain TCP/HTTP, use for SSH)' },
@@ -318,7 +324,42 @@ function setupTlsVisibility(formEl: any) {
 
 @customElement('ops-view-routes')
 export class OpsViewRoutes extends DeesElement {
-  @state() accessor routeFilter: 'User Routes' | 'System Routes' = 'User Routes';
+  @state() accessor activeSection: TRoutesSection = 'standard';
+  @state() accessor ownerFilter: TRouteOwnerFilter = 'all';
+
+  private readonly sectionTabs: IMenuItem[] = [
+    {
+      key: 'Standard Routes',
+      iconName: 'lucide:route',
+      action: () => this.setRouteView('standard'),
+    },
+    {
+      key: 'Special Forwards',
+      iconName: 'lucide:split',
+      action: () => this.setRouteView('special'),
+    },
+    {
+      key: 'Redirects',
+      iconName: 'lucide:cornerDownRight',
+      action: () => this.setRouteView('redirects'),
+    },
+  ];
+
+  private readonly ownerTabs: IMenuItem[] = [
+    { key: 'All', action: () => this.setRouteOwnerFilter('all') },
+    { key: 'Operator', action: () => this.setRouteOwnerFilter('operator') },
+    {
+      key: 'Gateway Client',
+      action: () => this.setRouteOwnerFilter('gatewayClient'),
+    },
+    { key: 'System', action: () => this.setRouteOwnerFilter('system') },
+  ];
+
+  private readonly popStateHandler = () => {
+    const urlState = this.readUrlState();
+    this.activeSection = urlState.section;
+    this.ownerFilter = urlState.owner;
+  };
 
   @state() accessor routeState: appstate.IRouteManagementState = {
     mergedRoutes: [],
@@ -341,6 +382,10 @@ export class OpsViewRoutes extends DeesElement {
 
   constructor() {
     super();
+    const urlState = this.readUrlState();
+    this.activeSection = urlState.section;
+    this.ownerFilter = urlState.owner;
+    this.writeUrlState(urlState.section, urlState.owner, 'replace');
     const sub = appstate.routeManagementStatePart
       .select((s) => s)
       .subscribe((routeState) => {
@@ -368,6 +413,16 @@ export class OpsViewRoutes extends DeesElement {
     this.rxSubscriptions.push(loginSub);
   }
 
+  async connectedCallback() {
+    await super.connectedCallback();
+    window.addEventListener('popstate', this.popStateHandler);
+  }
+
+  async disconnectedCallback() {
+    window.removeEventListener('popstate', this.popStateHandler);
+    await super.disconnectedCallback();
+  }
+
   public static styles = [
     cssManager.defaultStyles,
     viewHostCss,
@@ -415,7 +470,11 @@ export class OpsViewRoutes extends DeesElement {
 
     const disabledCount = mergedRoutes.filter((mr) => !mr.enabled).length;
     const configCount = mergedRoutes.filter((mr) => mr.origin !== 'api').length;
-    const apiCount = mergedRoutes.filter((mr) => mr.origin === 'api').length;
+    const operatorCount = mergedRoutes.filter((mr) => {
+      return mr.origin === 'api'
+        && mr.metadata?.ownerType !== 'gatewayClient'
+        && !mr.metadata?.managedRouteKind;
+    }).length;
 
     const statsTiles: IStatsTile[] = [
       {
@@ -437,12 +496,12 @@ export class OpsViewRoutes extends DeesElement {
         color: '#8b5cf6',
       },
       {
-        id: 'apiRoutes',
-        title: 'User Routes',
+        id: 'operatorRoutes',
+        title: 'Operator Routes',
         type: 'number',
-        value: apiCount,
+        value: operatorCount,
         icon: 'lucide:code',
-        description: 'Created via API',
+        description: 'Created directly by operators',
         color: '#0ea5e9',
       },
       {
@@ -456,11 +515,19 @@ export class OpsViewRoutes extends DeesElement {
       },
     ];
 
-    // Filter routes based on selected tab
-    const isUserRoutes = this.routeFilter === 'User Routes';
-    const filteredRoutes = mergedRoutes.filter((mr) =>
-      isUserRoutes ? mr.origin === 'api' : mr.origin !== 'api'
-    );
+    const standardRoutes = mergedRoutes.filter((route) => !route.metadata?.managedRouteKind);
+    const filteredRoutes = standardRoutes.filter((route) => {
+      switch (this.ownerFilter) {
+        case 'operator':
+          return route.origin === 'api' && route.metadata?.ownerType !== 'gatewayClient';
+        case 'gatewayClient':
+          return route.metadata?.ownerType === 'gatewayClient';
+        case 'system':
+          return route.origin !== 'api' || route.metadata?.ownerType === 'system';
+        default:
+          return true;
+      }
+    });
 
     // Map filtered routes to sz-route-list-view format
     const szRoutes = filteredRoutes.map((mr) => {
@@ -482,6 +549,16 @@ export class OpsViewRoutes extends DeesElement {
       <dees-heading level="3">Route Management</dees-heading>
 
       <div class="routesContainer">
+        <dees-appui-tabs
+          .tabs=${this.sectionTabs}
+          .selectedTab=${this.getSelectedSectionTab()}
+        ></dees-appui-tabs>
+
+        ${this.activeSection === 'special'
+          ? html`<ops-view-special-forwards></ops-view-special-forwards>`
+          : this.activeSection === 'redirects'
+            ? html`<ops-view-redirects .embedded=${true}></ops-view-redirects>`
+            : html`
         <dees-statsgrid
           .tiles=${statsTiles}
           .gridActions=${[
@@ -498,12 +575,10 @@ export class OpsViewRoutes extends DeesElement {
           ]}
         ></dees-statsgrid>
 
-        <dees-input-multitoggle
-          class="routeFilterToggle"
-          .type=${'single'}
-          .options=${['User Routes', 'System Routes']}
-          .selectedOption=${this.routeFilter}
-        ></dees-input-multitoggle>
+        <dees-appui-tabs
+          .tabs=${this.ownerTabs}
+          .selectedTab=${this.getSelectedOwnerTab()}
+        ></dees-appui-tabs>
 
         ${warnings.length > 0
           ? html`
@@ -524,7 +599,7 @@ export class OpsViewRoutes extends DeesElement {
           ? html`
               <sz-route-list-view
                 .routes=${szRoutes}
-                .showActionsFilter=${isUserRoutes ? () => true : () => false}
+                .showActionsFilter=${(route: { id?: string; name?: string }) => this.canEditRoute(route)}
                 @route-click=${(e: CustomEvent) => this.handleRouteClick(e)}
                 @route-edit=${(e: CustomEvent) => this.handleRouteEdit(e)}
                 @route-delete=${(e: CustomEvent) => this.handleRouteDelete(e)}
@@ -532,10 +607,11 @@ export class OpsViewRoutes extends DeesElement {
             `
           : html`
               <div class="empty-state">
-                <p>No ${isUserRoutes ? 'user' : 'system'} routes</p>
-                <p>${isUserRoutes ? 'Add a route to get started.' : 'System routes are generated from config, email, and DNS settings.'}</p>
+                <p>No ${this.getOwnerFilterLabel().toLowerCase()} routes</p>
+                <p>Choose another ownership filter or add an operator route.</p>
               </div>
             `}
+        `}
       </div>
     `;
   }
@@ -560,7 +636,7 @@ export class OpsViewRoutes extends DeesElement {
           <p>Status: <strong>${merged.enabled ? 'Enabled' : 'Disabled'}</strong></p>
           ${merged.route.vpnOnly ? html`<p>Access: <strong style="color: #22c55e;">VPN only</strong></p>` : ''}
           <p>ID: <code style="color: #888;">${merged.id}</code></p>
-          ${isSystemManaged ? html`<p>This route is system-managed. Change its source config to modify it directly.</p>` : ''}
+          ${isSystemManaged ? html`<p>This route is managed by the system, a gateway client, or a specialized workflow.</p>` : ''}
           ${sourceBindingSummary ? html`<p>Source Bindings: <strong style="color: #a78bfa;">${sourceBindingSummary}</strong></p>` : ''}
           ${meta?.networkTargetName ? html`<p>Network Target: <strong style="color: #a78bfa;">${meta.networkTargetName}</strong></p>` : ''}
         </div>
@@ -1031,6 +1107,80 @@ export class OpsViewRoutes extends DeesElement {
     appstate.routeManagementStatePart.dispatchAction(appstate.fetchMergedRoutesAction, null);
   }
 
+  private getSelectedSectionTab(): IMenuItem {
+    const index = this.activeSection === 'special'
+      ? 1
+      : this.activeSection === 'redirects'
+        ? 2
+        : 0;
+    return this.sectionTabs[index];
+  }
+
+  private getSelectedOwnerTab(): IMenuItem {
+    const index = this.ownerFilter === 'operator'
+      ? 1
+      : this.ownerFilter === 'gatewayClient'
+        ? 2
+        : this.ownerFilter === 'system'
+          ? 3
+          : 0;
+    return this.ownerTabs[index];
+  }
+
+  private getOwnerFilterLabel(): string {
+    return this.getSelectedOwnerTab().key;
+  }
+
+  private setRouteView(section: TRoutesSection): void {
+    if (this.activeSection === section) return;
+    this.activeSection = section;
+    this.writeUrlState(section, this.ownerFilter, 'push');
+  }
+
+  private setRouteOwnerFilter(owner: TRouteOwnerFilter): void {
+    if (this.ownerFilter === owner) return;
+    this.ownerFilter = owner;
+    this.writeUrlState(this.activeSection, owner, 'push');
+  }
+
+  private readUrlState(): { section: TRoutesSection; owner: TRouteOwnerFilter } {
+    const params = new URL(window.location.href).searchParams;
+    const tabParam = params.get('tab');
+    const ownerParam = params.get('owner');
+    const section: TRoutesSection = tabParam === 'special' || tabParam === 'redirects'
+      ? tabParam
+      : 'standard';
+    const owner: TRouteOwnerFilter = (
+      ownerParam === 'operator'
+      || ownerParam === 'gatewayClient'
+      || ownerParam === 'system'
+    )
+      ? ownerParam
+      : 'all';
+    return { section, owner };
+  }
+
+  private writeUrlState(
+    section: TRoutesSection,
+    owner: TRouteOwnerFilter,
+    mode: 'push' | 'replace',
+  ): void {
+    if (window.location.pathname !== '/network/routes') return;
+    const url = new URL(window.location.href);
+    url.searchParams.set('tab', section);
+    url.searchParams.set('owner', owner);
+    window.history[mode === 'push' ? 'pushState' : 'replaceState'](
+      window.history.state,
+      '',
+      url,
+    );
+  }
+
+  private canEditRoute(clickedRoute: { id?: string; name?: string }): boolean {
+    const merged = this.findMergedRoute(clickedRoute);
+    return Boolean(merged && !this.isSystemManagedRoute(merged));
+  }
+
   private getSourceBindingRefs(metadata?: interfaces.data.IRouteMetadata): string[] {
     const bindingRefs = metadata?.sourceBindings
       ?.map((binding) => binding.sourceProfileRef)
@@ -1064,18 +1214,12 @@ export class OpsViewRoutes extends DeesElement {
   }
 
   private isSystemManagedRoute(merged: interfaces.data.IMergedRoute): boolean {
-    return merged.origin !== 'api';
+    return merged.origin !== 'api'
+      || merged.metadata?.ownerType === 'gatewayClient'
+      || Boolean(merged.metadata?.managedRouteKind);
   }
 
   async firstUpdated() {
     await appstate.routeManagementStatePart.dispatchAction(appstate.fetchMergedRoutesAction, null);
-
-    const toggle = this.shadowRoot!.querySelector('.routeFilterToggle') as any;
-    if (toggle) {
-      const sub = toggle.changeSubject.subscribe(() => {
-        this.routeFilter = toggle.selectedOption;
-      });
-      this.rxSubscriptions.push(sub);
-    }
   }
 }