ldrouter 1.12.0 → 1.14.0

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.14.0] - 2026-09-11
+
+### Added
+
+- **Docker request logging**: every request now emits structured `info` logs when received and a completion log classified as `info` (2xx/3xx), `warn` (4xx), or `error` (5xx), with request ID, method, route, status, and duration. Query strings, headers, bodies, and secrets are excluded.
+
+## [1.13.1] - 2026-09-11
+
+### Fixed
+
+- **Update notification**: force a fresh npm registry check when the admin UI loads, so the update button is not hidden by the 15-minute cache.
+
+## [1.13.0] - 2026-09-11
+
+### Added
+
+- **Passphrase-protected full backups**: backups now include administrator state and a master-key envelope protected by a user-entered six-digit passphrase; `/setup` can import them without recreating the admin account.
+
 ## [1.12.0] - 2026-09-05
 
 ### Added

package/dist/server/app.js

@@ -21,7 +21,7 @@ import { registerGatewayRoutes } from './routes/gateway.js';
 import { registerHealthRoutes } from './routes/health.js';
 import { registerAdminIpGate } from './security/admin-ip-gate.js';
 import { metricsRegistry } from './metrics/registry.js';
-import { fatal, lifecycle, formatError, getDebugFlags, errorLine } from './logging/debug.js';
+import { fatal, lifecycle, formatError, getDebugFlags, errorLine, requestLogFields, requestLogLevel, requestLogMessage } from './logging/debug.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export async function buildApp(opts = {}) {
     const cfg = loadConfig();
@@ -43,9 +43,19 @@ export async function buildApp(opts = {}) {
         crossOriginEmbedderPolicy: false,
     });
     await app.register(cors, { origin: false, credentials: true });
-    // Per-request logging + error shaping
+    // Every request is logged as structured JSON for Docker. Bodies and headers
+    // are intentionally excluded; sensitive values must never reach logs.
+    app.addHook('onRequest', async (req) => {
+        req.requestStartedAt = Date.now();
+        log.info({ requestId: req.id, method: req.method, url: req.url }, 'request received');
+    });
     app.addHook('onResponse', async (req, reply) => {
         reply.header('x-request-id', req.id);
+        const startedAt = req.requestStartedAt ?? Date.now();
+        const statusCode = reply.statusCode;
+        const fields = requestLogFields(String(req.id), req.method, req.url, statusCode, Date.now() - startedAt, req.routeOptions?.url);
+        const level = requestLogLevel(statusCode);
+        log[level](fields, requestLogMessage(statusCode));
     });
     app.setErrorHandler((err, req, reply) => {
         // Zod validation failures surface as 400 with readable field messages;

package/dist/server/auth/api-key.js

@@ -37,8 +37,8 @@ export function authenticateGatewayKey(req) {
         candidate = anthropic;
     if (!candidate)
         return null;
-    // DEBUG: Log what we're trying to authenticate
-    console.log(`🔑 API KEY AUTH - Candidate extracted: ${candidate.slice(0, 8)}...${candidate.slice(-4)}`);
+    // Never log API-key material, including partial values.
+    console.log('🔑 API KEY AUTH - Candidate received');
     // Custom keys are stored verbatim (no prefix requirement); auto-generated
     // keys start with ld-, but authentication must accept any stored secret.
     const digest = sha256Hex(candidate);

package/dist/server/auth/backup-crypto.js

@@ -0,0 +1,31 @@
+import crypto from 'node:crypto';
+function passphraseKey(passphrase, salt) {
+    if (!/^\d{6}$/.test(passphrase))
+        throw new Error('Backup passphrase must contain exactly six digits');
+    return crypto.scryptSync(passphrase, salt, 32, { N: 16_384, r: 8, p: 1 });
+}
+export function encryptBackupMasterKey(masterKey, passphrase) {
+    const salt = crypto.randomBytes(16);
+    const nonce = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', passphraseKey(passphrase, salt), nonce);
+    const ciphertext = Buffer.concat([cipher.update(masterKey), cipher.final()]);
+    return {
+        algorithm: 'scrypt-aes-256-gcm',
+        salt: salt.toString('base64'),
+        nonce: nonce.toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+    };
+}
+export function decryptBackupMasterKey(envelope, passphrase) {
+    if (envelope.algorithm !== 'scrypt-aes-256-gcm')
+        throw new Error('Unsupported backup key encryption');
+    try {
+        const decipher = crypto.createDecipheriv('aes-256-gcm', passphraseKey(passphrase, Buffer.from(envelope.salt, 'base64')), Buffer.from(envelope.nonce, 'base64'));
+        decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'));
+        return Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, 'base64')), decipher.final()]);
+    }
+    catch {
+        throw new Error('Invalid backup passphrase');
+    }
+}

package/dist/server/auth/crypto.js

@@ -40,6 +40,9 @@ export function getMasterKey() {
 export function isMasterKeyConfigured() {
     return Boolean(loadConfig().masterKey);
 }
+export function resetMasterKeyCache() {
+    cachedKey = null;
+}
 export function masterKeyVersion() {
     return cachedKeyVersion;
 }

package/dist/server/logging/debug.js

@@ -14,6 +14,24 @@
 // they emit at debug, so set LOG_LEVEL=debug to see them.
 import process from 'node:process';
 import { redactValue } from '../security/redact.js';
+export function requestLogLevel(statusCode) {
+    if (statusCode >= 500)
+        return 'error';
+    if (statusCode >= 400)
+        return 'warn';
+    return 'info';
+}
+export function requestLogMessage(statusCode) {
+    if (statusCode >= 500)
+        return 'request completed with server error';
+    if (statusCode >= 400)
+        return 'request completed with client error';
+    return 'request completed';
+}
+export function requestLogFields(requestId, method, url, statusCode, durationMs, route) {
+    const safeUrl = url.split('?')[0] ?? url;
+    return { requestId, method, url: safeUrl, route: route ?? safeUrl, statusCode, durationMs };
+}
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'yes';

package/dist/server/routes/admin/api-keys.js

@@ -114,8 +114,8 @@ export async function registerApiKeyRoutes(app) {
         const enc = encryptSecret(secret);
         // DEBUG: Log what we're about to insert
         console.log(`📝 CREATE API KEY - Name: ${body.name}, Prefix: ${keyPrefix}`);
-        console.log(`📝 CREATE API KEY - Secret (full): ${secret}`);
-        console.log(`📝 CREATE API KEY - Digest: ${keyDigest}`);
+        console.log('📝 CREATE API KEY - Secret: [REDACTED]');
+        console.log('📝 CREATE API KEY - Digest: [REDACTED]');
         db.insert(schema.apiKeys).values({
             id,
             name: body.name,

package/dist/server/routes/admin/backup.js

@@ -7,11 +7,13 @@ import { getDb, closeDb, openDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { sha256Hex } from '../../auth/ids.js';
 import { recordAudit } from '../../db/repositories/audit.js';
-import { loadConfig } from '../../config/index.js';
+import { loadConfig, setConfigMasterKey } from '../../config/index.js';
 import { getSettings } from '../../db/repositories/settings.js';
 import { GatewayError } from '../../errors.js';
 import { getAppVersion } from '../../version.js';
 import { eq, sql } from 'drizzle-orm';
+import { decryptBackupMasterKey, encryptBackupMasterKey } from '../../auth/backup-crypto.js';
+import { parseMasterKey, resetMasterKeyCache } from '../../auth/crypto.js';
 const BACKUP_VERSION = 1;
 /** Reopen the in-process SQLite connection on the (possibly just-replaced)
  *  database file. The old connection must already be closed: a hot restore
@@ -52,8 +54,16 @@ function assertDatabaseUsable(expectedSchemaVersion) {
     }
 }
 export async function registerBackupRoutes(app) {
-    app.addHook('preHandler', requireAdminAuth);
+    app.addHook('preHandler', async (req, reply) => {
+        if (req.url === '/api/admin/backup/restore' && !getSettings().setupComplete)
+            return;
+        return requireAdminAuth(req, reply);
+    });
     app.post('/api/admin/backup/create', async (req, reply) => {
+        const passphrase = req.body?.passphrase ?? '';
+        if (!/^\d{6}$/.test(passphrase)) {
+            throw new GatewayError('invalid_request_error', 'Backup passphrase must contain exactly six digits', { status: 400 });
+        }
         const cfg = loadConfig();
         const temp = path.join(cfg.dataDir, `.backup-${Date.now()}.sqlite`);
         const Database = (await import('better-sqlite3')).default;
@@ -69,6 +79,7 @@ export async function registerBackupRoutes(app) {
         const compressed = zlib.gzipSync(buf, { level: 6 });
         const checksum = crypto.createHash('sha256').update(compressed).digest('hex');
         const settings = getSettings();
+        const masterKey = parseMasterKey(cfg.masterKey ?? fs.readFileSync(path.join(cfg.dataDir, 'master.key'), 'utf8').trim());
         const envelope = {
             format: 'latedev-backup',
             version: BACKUP_VERSION,
@@ -78,6 +89,7 @@ export async function registerBackupRoutes(app) {
             createdAt: new Date().toISOString(),
             payload: compressed.toString('base64'),
             checksum,
+            keyEnvelope: encryptBackupMasterKey(masterKey, passphrase),
         };
         const envBuf = Buffer.from(JSON.stringify(envelope), 'utf8');
         const fileName = `latedev-backup-${new Date().toISOString().replace(/[:.]/g, '-')}.ldb.json`;
@@ -88,12 +100,17 @@ export async function registerBackupRoutes(app) {
     });
     app.post('/api/admin/backup/restore', async (req, reply) => {
         const cfg = loadConfig();
-        // Expect raw JSON envelope in body
+        const incoming = req.body;
+        const wrapped = Boolean(incoming && 'backup' in incoming);
+        const wrappedBody = incoming;
+        const passphrase = wrapped ? wrappedBody.passphrase : undefined;
         let envelope;
         try {
-            envelope = req.body;
+            envelope = (wrapped ? wrappedBody.backup : incoming);
             if (!envelope || envelope.format !== 'latedev-backup')
                 throw new Error('not a backup envelope');
+            if (envelope.keyEnvelope && !/^\d{6}$/.test(passphrase ?? ''))
+                throw new Error('backup passphrase required');
         }
         catch {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'invalid_envelope' } });
@@ -122,6 +139,17 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'not_sqlite' } });
             throw new GatewayError('invalid_request_error', 'Backup does not contain a valid SQLite database', { status: 400 });
         }
+        let restoredMasterKey;
+        if (envelope.keyEnvelope) {
+            try {
+                restoredMasterKey = decryptBackupMasterKey(envelope.keyEnvelope, passphrase);
+                parseMasterKey(restoredMasterKey.toString('base64'));
+            }
+            catch {
+                recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'invalid_backup_passphrase' } });
+                throw new GatewayError('invalid_request_error', 'Invalid backup passphrase', { status: 400 });
+            }
+        }
         const liveDb = cfg.dbFile;
         // Snapshot current DB before restore (kept for manual rollback).
         const snapshot = path.join(cfg.dataDir, `pre-restore-${Date.now()}.sqlite`);
@@ -184,6 +212,12 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'validation_failed', err: e.message } });
             throw new GatewayError('gateway_error', `Restore failed: ${e.message}`, { status: 500 });
         }
+        if (restoredMasterKey) {
+            const restoredKey = restoredMasterKey.toString('base64');
+            fs.writeFileSync(path.join(cfg.dataDir, 'master.key'), restoredKey, { mode: 0o600, encoding: 'utf8' });
+            setConfigMasterKey(restoredKey);
+            resetMasterKeyCache();
+        }
         // The swap invalidates the previous admin session (its row lived in the
         // old database). Re-create the current session in the restored database so
         // the admin stays logged in across the hot restore.