ldrouter 1.11.8 → 1.11.15

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.11.9] - 2026-09-04
+
+### Fixed
+
+- **API routes now return proper JSON errors**: fixed `setNotFoundHandler` logic to ensure `/v1/*` routes always return JSON error responses instead of falling through to HTML SPA index. Route order confirmed: health → admin/gateway → static files.
+
 ## [1.11.8] - 2026-09-03
 
 ### Fixed

package/dist/server/app.js

@@ -82,6 +82,9 @@ export async function buildApp(opts = {}) {
     registerAdminIpGate(app);
     // Operational routes (always available)
     await registerHealthRoutes(app);
+    // Debug logging for request lifecycle (before routes)
+    const { registerDebugHook } = await import('./logging/debug.js');
+    registerDebugHook(app);
     // Admin + gateway routes MUST be registered BEFORE static files to avoid
     // 404s falling through to SPA index.html or static assets being served instead
     await registerAdminRoutes(app);
@@ -94,12 +97,19 @@ export async function buildApp(opts = {}) {
         await app.register(staticPlugin, { root: webDist, prefix: '/', decorateReply: false });
     }
     app.setNotFoundHandler((req, reply) => {
-        if (req.url.startsWith('/api') || req.url.startsWith('/v1') || req.url.startsWith('/health') || req.url.startsWith('/ready') || req.url.startsWith('/metrics') || !hasWeb) {
+        if (req.url.startsWith('/api') || req.url.startsWith('/v1') || req.url.startsWith('/health') || req.url.startsWith('/ready') || req.url.startsWith('/metrics')) {
             const e = new GatewayError('invalid_request_error', 'Route not found', { status: 404 });
             reply.code(404).send(toOpenAIError(e, req.id));
             return;
         }
-        reply.type('text/html').send(fs.readFileSync(path.join(webDist, 'index.html')));
+        // Serve SPA index.html only for non-API paths when web is available
+        if (hasWeb) {
+            reply.type('text/html').send(fs.readFileSync(path.join(webDist, 'index.html')));
+            return;
+        }
+        // No web assets - return error for all remaining paths
+        const err = new GatewayError('invalid_request_error', 'Not found', { status: 404 });
+        reply.code(404).send(toOpenAIError(err, req.id));
     });
     // On startup: ensure settings row + detect master key status
     app.addHook('onReady', async () => {

package/dist/server/auth/api-key.js

@@ -37,12 +37,21 @@ export function authenticateGatewayKey(req) {
         candidate = anthropic;
     if (!candidate)
         return null;
+    // DEBUG: Log what we're trying to authenticate
+    console.log(`🔑 API KEY AUTH - Candidate extracted: ${candidate.slice(0, 8)}...${candidate.slice(-4)}`);
     // Custom keys are stored verbatim (no prefix requirement); auto-generated
     // keys start with ld-, but authentication must accept any stored secret.
     const digest = sha256Hex(candidate);
+    console.log(`🔑 API KEY AUTH - SHA256 Digest: ${digest.slice(0, 16)}...`);
     const db = getDb();
+    // DEBUG: Check total keys in database
+    const allKeys = db.select().from(schema.apiKeys).all();
+    console.log(`📊 TOTAL KEYS IN DB: ${allKeys.length}`);
+    console.log(`📋 ALL KEYS:`, allKeys.map(k => ({ id: k.id.slice(0, 8), name: k.name, keyPrefix: k.keyPrefix, digestPreview: k.keyDigest?.slice(0, 16) + '...' })));
     const row = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.keyDigest, digest)).get();
+    console.log(`❓ QUERY RESULT: Found match? ${!!row}`);
     if (!row) {
+        console.error(`❌ INVALID API KEY - No matching digest found for: ${digest.slice(0, 32)}...`);
         throw new GatewayError('authentication_error', 'Invalid API key', { status: 401 });
     }
     return {

package/dist/server/logging/debug.js

@@ -0,0 +1,62 @@
+// Debug logging utilities for request lifecycle tracking
+import * as fs from 'fs';
+import * as path from 'path';
+const DEBUG_LOG_DIR = '/data';
+const DEBUG_LOG_FILE = path.join(DEBUG_LOG_DIR, 'ldrouter-debug.log');
+// Ensure log file exists
+if (!fs.existsSync(DEBUG_LOG_FILE)) {
+    try {
+        fs.writeFileSync(DEBUG_LOG_FILE, '');
+    }
+    catch (_err) {
+        // Silent fail - don't break the application
+        console.error('Failed to create debug log:', _err);
+    }
+}
+export function appendDebugLog(entry) {
+    const logLine = JSON.stringify(entry) + '\n';
+    try {
+        fs.appendFileSync(DEBUG_LOG_FILE, logLine);
+    }
+    catch (_err) {
+        // Silent fail - don't break the application
+        console.error('Failed to write debug log:', _err);
+    }
+}
+export function registerDebugHook(app) {
+    // Log every request entering the system
+    app.addHook('onRequest', async (req, _reply) => {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level: 'DEBUG',
+            requestId: req.id,
+            url: req.url,
+            method: req.method,
+            phase: 'REQUEST_ENTERED',
+            details: {
+                headers: {
+                    authorization: req.headers.authorization ? '[REDACTED]' : undefined,
+                    'content-type': req.headers['content-type'],
+                },
+            },
+        };
+        appendDebugLog(entry);
+    });
+    // Log before route handler execution
+    app.addHook('preHandler', async (req, _reply) => {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level: 'DEBUG',
+            requestId: req.id,
+            url: req.url,
+            method: req.method,
+            phase: 'ROUTE_MATCHED',
+            details: {},
+        };
+        appendDebugLog(entry);
+    });
+    // Log response completion with status code and content type
+    app.addHook('onResponse', async (_req, _reply) => {
+        // Note: We'll capture this in the onRequest handler instead for simpler logging
+    });
+}

package/dist/server/routes/admin/api-keys.js

@@ -112,6 +112,10 @@ export async function registerApiKeyRoutes(app) {
             throw new GatewayError('invalid_request_error', `An API key with this exact secret already exists ("${existing.name}"). Choose a different key value.`, { status: 409 });
         }
         const enc = encryptSecret(secret);
+        // DEBUG: Log what we're about to insert
+        console.log(`📝 CREATE API KEY - Name: ${body.name}, Prefix: ${keyPrefix}`);
+        console.log(`📝 CREATE API KEY - Secret (full): ${secret}`);
+        console.log(`📝 CREATE API KEY - Digest: ${keyDigest}`);
         db.insert(schema.apiKeys).values({
             id,
             name: body.name,
@@ -131,6 +135,12 @@ export async function registerApiKeyRoutes(app) {
             maxOutputTokensPerRequest: body.maxOutputTokensPerRequest ?? null,
             cacheOverrideEnabled: body.cacheOverrideEnabled ?? null,
         }).run();
+        // DEBUG: Verify it was actually inserted
+        const verify = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, id)).get();
+        console.log(`✅ INSERT VERIFICATION: ${verify ? 'SUCCESS' : 'FAILED'} - Key exists in DB? ${!!verify}`);
+        if (!verify) {
+            console.error('❌ DATABASE INSERT FAILED - Key should exist but query returned null');
+        }
         if (body.permissions) {
             for (const p of body.permissions) {
                 db.insert(schema.apiKeyModelPermissions).values({ id: uuid(), apiKeyId: id, targetKind: p.targetKind, targetId: p.targetId }).run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.11.8",
+  "version": "1.11.15",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",