ldrouter 1.11.4 → 1.11.12

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.11.9] - 2026-09-04
+
+### Fixed
+
+- **API routes now return proper JSON errors**: fixed `setNotFoundHandler` logic to ensure `/v1/*` routes always return JSON error responses instead of falling through to HTML SPA index. Route order confirmed: health → admin/gateway → static files.
+
+## [1.11.8] - 2026-09-03
+
+### Fixed
+
+- **ESLint flat config updated**: added debug scripts to ignore list in `eslint.config.mjs` (flat config replaces `.eslintignore` in ESLint v9+).
+
+## [1.11.7] - 2026-09-03
+
+### Fixed
+
+- **API routes no longer return HTML on errors**: fixed route registration order so gateway routes (`/v1/*`) are registered BEFORE static file middleware, preventing API validation errors from serving SPA index.html instead of JSON error responses.
+
+## [1.11.6] - 2026-09-03
+
+### Fixed
+
+- **Debug scripts excluded from linting**: initially used `.eslintignore`, then migrated to ESLint flat config proper syntax.
+
 ## [1.11.3] - 2026-09-03
 
 ### Fixed

package/dist/server/app.js

@@ -80,27 +80,34 @@ export async function buildApp(opts = {}) {
     // Admin-site IP access control (Settings → Access Control). Root scope so it
     // covers the static UI, login/setup, and all admin APIs; /health stays open.
     registerAdminIpGate(app);
-    // Static admin UI (if built). The not-found handler is registered once:
-    // with a built UI it serves the SPA index.html for non-API paths; without it,
-    // every miss returns a JSON 404 in the requesting protocol's shape.
+    // Operational routes (always available)
+    await registerHealthRoutes(app);
+    // Admin + gateway routes MUST be registered BEFORE static files to avoid
+    // 404s falling through to SPA index.html or static assets being served instead
+    await registerAdminRoutes(app);
+    await registerGatewayRoutes(app);
+    // Static admin UI mounted AFTER routes so it only handles SPA not-found cases.
+    // This prevents conflicts with /v1/* API routes and /api/* endpoints.
     const webDist = path.resolve(__dirname, '../web');
     const hasWeb = fs.existsSync(webDist);
+    if (hasWeb) {
+        await app.register(staticPlugin, { root: webDist, prefix: '/', decorateReply: false });
+    }
     app.setNotFoundHandler((req, reply) => {
-        if (req.url.startsWith('/api') || req.url.startsWith('/v1') || req.url.startsWith('/health') || req.url.startsWith('/ready') || req.url.startsWith('/metrics') || !hasWeb) {
+        if (req.url.startsWith('/api') || req.url.startsWith('/v1') || req.url.startsWith('/health') || req.url.startsWith('/ready') || req.url.startsWith('/metrics')) {
             const e = new GatewayError('invalid_request_error', 'Route not found', { status: 404 });
             reply.code(404).send(toOpenAIError(e, req.id));
             return;
         }
-        reply.type('text/html').send(fs.readFileSync(path.join(webDist, 'index.html')));
+        // Serve SPA index.html only for non-API paths when web is available
+        if (hasWeb) {
+            reply.type('text/html').send(fs.readFileSync(path.join(webDist, 'index.html')));
+            return;
+        }
+        // No web assets - return error for all remaining paths
+        const err = new GatewayError('invalid_request_error', 'Not found', { status: 404 });
+        reply.code(404).send(toOpenAIError(err, req.id));
     });
-    if (hasWeb) {
-        await app.register(staticPlugin, { root: webDist, prefix: '/', decorateReply: false });
-    }
-    // Operational routes (always available)
-    await registerHealthRoutes(app);
-    // Admin + gateway routes
-    await registerAdminRoutes(app);
-    await registerGatewayRoutes(app);
     // On startup: ensure settings row + detect master key status
     app.addHook('onReady', async () => {
         const s = getSettings();

package/migrations/000_add_key_digest_to_old_keys.sql

@@ -0,0 +1,15 @@
+-- Migration: Ensure all existing API keys have keyDigest populated
+-- This fixes the issue where old keys stored without digest after restore
+-- or from instances that didn't properly compute keyDigest on creation
+
+BEGIN TRANSACTION;
+
+-- Add missing keyDigest for any existing keys (should not happen if working correctly)
+UPDATE apiKeys
+SET keyDigest = substr(
+    hex(sha256(keySecretEncrypted || keySecretNonce)),
+    1, 64
+)
+WHERE keyDigest IS NULL OR keyDigest = '';
+
+COMMIT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.11.4",
+  "version": "1.11.12",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",