ldrouter 1.12.0 → 1.13.1

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.13.1] - 2026-09-11
+
+### Fixed
+
+- **Update notification**: force a fresh npm registry check when the admin UI loads, so the update button is not hidden by the 15-minute cache.
+
+## [1.13.0] - 2026-09-11
+
+### Added
+
+- **Passphrase-protected full backups**: backups now include administrator state and a master-key envelope protected by a user-entered six-digit passphrase; `/setup` can import them without recreating the admin account.
+
 ## [1.12.0] - 2026-09-05
 
 ### Added

package/dist/server/auth/backup-crypto.js

@@ -0,0 +1,31 @@
+import crypto from 'node:crypto';
+function passphraseKey(passphrase, salt) {
+    if (!/^\d{6}$/.test(passphrase))
+        throw new Error('Backup passphrase must contain exactly six digits');
+    return crypto.scryptSync(passphrase, salt, 32, { N: 16_384, r: 8, p: 1 });
+}
+export function encryptBackupMasterKey(masterKey, passphrase) {
+    const salt = crypto.randomBytes(16);
+    const nonce = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', passphraseKey(passphrase, salt), nonce);
+    const ciphertext = Buffer.concat([cipher.update(masterKey), cipher.final()]);
+    return {
+        algorithm: 'scrypt-aes-256-gcm',
+        salt: salt.toString('base64'),
+        nonce: nonce.toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+    };
+}
+export function decryptBackupMasterKey(envelope, passphrase) {
+    if (envelope.algorithm !== 'scrypt-aes-256-gcm')
+        throw new Error('Unsupported backup key encryption');
+    try {
+        const decipher = crypto.createDecipheriv('aes-256-gcm', passphraseKey(passphrase, Buffer.from(envelope.salt, 'base64')), Buffer.from(envelope.nonce, 'base64'));
+        decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'));
+        return Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, 'base64')), decipher.final()]);
+    }
+    catch {
+        throw new Error('Invalid backup passphrase');
+    }
+}

package/dist/server/auth/crypto.js

@@ -40,6 +40,9 @@ export function getMasterKey() {
 export function isMasterKeyConfigured() {
     return Boolean(loadConfig().masterKey);
 }
+export function resetMasterKeyCache() {
+    cachedKey = null;
+}
 export function masterKeyVersion() {
     return cachedKeyVersion;
 }

package/dist/server/routes/admin/backup.js

@@ -7,11 +7,13 @@ import { getDb, closeDb, openDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { sha256Hex } from '../../auth/ids.js';
 import { recordAudit } from '../../db/repositories/audit.js';
-import { loadConfig } from '../../config/index.js';
+import { loadConfig, setConfigMasterKey } from '../../config/index.js';
 import { getSettings } from '../../db/repositories/settings.js';
 import { GatewayError } from '../../errors.js';
 import { getAppVersion } from '../../version.js';
 import { eq, sql } from 'drizzle-orm';
+import { decryptBackupMasterKey, encryptBackupMasterKey } from '../../auth/backup-crypto.js';
+import { parseMasterKey, resetMasterKeyCache } from '../../auth/crypto.js';
 const BACKUP_VERSION = 1;
 /** Reopen the in-process SQLite connection on the (possibly just-replaced)
  *  database file. The old connection must already be closed: a hot restore
@@ -52,8 +54,16 @@ function assertDatabaseUsable(expectedSchemaVersion) {
     }
 }
 export async function registerBackupRoutes(app) {
-    app.addHook('preHandler', requireAdminAuth);
+    app.addHook('preHandler', async (req, reply) => {
+        if (req.url === '/api/admin/backup/restore' && !getSettings().setupComplete)
+            return;
+        return requireAdminAuth(req, reply);
+    });
     app.post('/api/admin/backup/create', async (req, reply) => {
+        const passphrase = req.body?.passphrase ?? '';
+        if (!/^\d{6}$/.test(passphrase)) {
+            throw new GatewayError('invalid_request_error', 'Backup passphrase must contain exactly six digits', { status: 400 });
+        }
         const cfg = loadConfig();
         const temp = path.join(cfg.dataDir, `.backup-${Date.now()}.sqlite`);
         const Database = (await import('better-sqlite3')).default;
@@ -69,6 +79,7 @@ export async function registerBackupRoutes(app) {
         const compressed = zlib.gzipSync(buf, { level: 6 });
         const checksum = crypto.createHash('sha256').update(compressed).digest('hex');
         const settings = getSettings();
+        const masterKey = parseMasterKey(cfg.masterKey ?? fs.readFileSync(path.join(cfg.dataDir, 'master.key'), 'utf8').trim());
         const envelope = {
             format: 'latedev-backup',
             version: BACKUP_VERSION,
@@ -78,6 +89,7 @@ export async function registerBackupRoutes(app) {
             createdAt: new Date().toISOString(),
             payload: compressed.toString('base64'),
             checksum,
+            keyEnvelope: encryptBackupMasterKey(masterKey, passphrase),
         };
         const envBuf = Buffer.from(JSON.stringify(envelope), 'utf8');
         const fileName = `latedev-backup-${new Date().toISOString().replace(/[:.]/g, '-')}.ldb.json`;
@@ -88,12 +100,17 @@ export async function registerBackupRoutes(app) {
     });
     app.post('/api/admin/backup/restore', async (req, reply) => {
         const cfg = loadConfig();
-        // Expect raw JSON envelope in body
+        const incoming = req.body;
+        const wrapped = Boolean(incoming && 'backup' in incoming);
+        const wrappedBody = incoming;
+        const passphrase = wrapped ? wrappedBody.passphrase : undefined;
         let envelope;
         try {
-            envelope = req.body;
+            envelope = (wrapped ? wrappedBody.backup : incoming);
             if (!envelope || envelope.format !== 'latedev-backup')
                 throw new Error('not a backup envelope');
+            if (envelope.keyEnvelope && !/^\d{6}$/.test(passphrase ?? ''))
+                throw new Error('backup passphrase required');
         }
         catch {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'invalid_envelope' } });
@@ -122,6 +139,17 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'not_sqlite' } });
             throw new GatewayError('invalid_request_error', 'Backup does not contain a valid SQLite database', { status: 400 });
         }
+        let restoredMasterKey;
+        if (envelope.keyEnvelope) {
+            try {
+                restoredMasterKey = decryptBackupMasterKey(envelope.keyEnvelope, passphrase);
+                parseMasterKey(restoredMasterKey.toString('base64'));
+            }
+            catch {
+                recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'invalid_backup_passphrase' } });
+                throw new GatewayError('invalid_request_error', 'Invalid backup passphrase', { status: 400 });
+            }
+        }
         const liveDb = cfg.dbFile;
         // Snapshot current DB before restore (kept for manual rollback).
         const snapshot = path.join(cfg.dataDir, `pre-restore-${Date.now()}.sqlite`);
@@ -184,6 +212,12 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'validation_failed', err: e.message } });
             throw new GatewayError('gateway_error', `Restore failed: ${e.message}`, { status: 500 });
         }
+        if (restoredMasterKey) {
+            const restoredKey = restoredMasterKey.toString('base64');
+            fs.writeFileSync(path.join(cfg.dataDir, 'master.key'), restoredKey, { mode: 0o600, encoding: 'utf8' });
+            setConfigMasterKey(restoredKey);
+            resetMasterKeyCache();
+        }
         // The swap invalidates the previous admin session (its row lived in the
         // old database). Re-create the current session in the restored database so
         // the admin stays logged in across the hot restore.