ldrouter 1.18.0 → 1.18.2

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.18.2] - 2026-10-02
+
+### Fixed
+
+- Restore now adopts the backup's master key, including across restarts.
+- Admin deletion now permanently removes API keys, models, and providers with dependent routing configuration cleaned up first.
+- `/setup` always exposes the master-key input and reports runtime key availability.
+
 ## [1.17.9] - 2026-09-22
 
 ### Fixed

package/dist/server/config/index.js

@@ -49,12 +49,21 @@ export function loadConfig(env = process.env, argv = process.argv) {
         (parsed.NODE_ENV === 'test' ? path.resolve('../.tmp/test-data') : path.resolve(os.homedir(), '.latedev-router'));
     const isContainer = Boolean(env.LATEDEV_DATA_DIR?.startsWith('/data') || process.env.CONTAINER === '1');
     const dbFile = parsed.LATEDEV_DB_URL ?? path.join(dataDir, 'data.sqlite');
+    const restoredMasterKeyPath = path.join(dataDir, 'master.key.restore');
+    let restoredMasterKey = null;
+    try {
+        if (fs.existsSync(restoredMasterKeyPath))
+            restoredMasterKey = fs.readFileSync(restoredMasterKeyPath, 'utf8').trim() || null;
+    }
+    catch {
+        /* ignore unreadable override — use the configured key */
+    }
     cached = {
         host: cliArgs.host ?? parsed.LATEDEV_HOST,
         port: cliArgs.port ?? parsed.LATEDEV_PORT,
         dataDir,
         dbFile,
-        masterKey: parsed.LATEDEV_MASTER_KEY ?? readMasterKeyFile(dataDir),
+        masterKey: restoredMasterKey ?? parsed.LATEDEV_MASTER_KEY ?? readMasterKeyFile(dataDir),
         trustProxyHops: parsed.LATEDEV_TRUST_PROXY,
         logLevel: parsed.LOG_LEVEL ?? parsed.LATEDEV_LOG_LEVEL,
         env: parsed.NODE_ENV,

package/dist/server/routes/admin/api-keys.js

@@ -215,8 +215,7 @@ export async function registerApiKeyRoutes(app) {
         const k = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, id)).get();
         if (!k)
             throw new GatewayError('invalid_request_error', 'API key not found', { status: 404 });
-        // Soft-delete: keep name/prefix snapshot for history; mark disabled
-        db.update(schema.apiKeys).set({ enabled: false, updatedAt: new Date().toISOString(), name: `${k.name} (deleted ${new Date().toISOString().slice(0, 10)})` }).where(eq(schema.apiKeys.id, id)).run();
+        db.delete(schema.apiKeys).where(eq(schema.apiKeys.id, id)).run();
         recordAudit({ action: 'api_key.delete', success: true, targetType: 'api_key', targetId: id, targetName: k.name, ip: req.ip });
         return { ok: true };
     });

package/dist/server/routes/admin/backup.js

@@ -156,6 +156,10 @@ export async function registerBackupRoutes(app) {
             }
         }
         const liveDb = cfg.dbFile;
+        const previousMasterKey = cfg.masterKey;
+        const restoreKeyPath = path.join(cfg.dataDir, 'master.key.restore');
+        const previousRestoreKey = fs.existsSync(restoreKeyPath) ? fs.readFileSync(restoreKeyPath) : null;
+        const restoredKey = restoredMasterKey?.toString('base64');
         // Snapshot current DB before restore (kept for manual rollback).
         const snapshot = path.join(cfg.dataDir, `pre-restore-${Date.now()}.sqlite`);
         const Database = (await import('better-sqlite3')).default;
@@ -186,6 +190,13 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'rename_failed', err: String(e) } });
             throw new GatewayError('gateway_error', 'Restore atomic replace failed', { status: 500 });
         }
+        // The backup key is authoritative. Apply it before reopening the restored
+        // database so every post-restore read uses the key that encrypted it.
+        if (restoredKey) {
+            fs.writeFileSync(restoreKeyPath, restoredKey, { mode: 0o600, encoding: 'utf8' });
+            setConfigMasterKey(restoredKey);
+            resetMasterKeyCache();
+        }
         // Hot-reload the database in-process: reopen the replaced file, validate
         // it, and keep serving. No gateway restart needed.
         try {
@@ -207,6 +218,16 @@ export async function registerBackupRoutes(app) {
                 }
                 fs.copyFileSync(snapshot, liveDb);
                 openDb(liveDb);
+                try {
+                    if (previousRestoreKey)
+                        fs.writeFileSync(restoreKeyPath, previousRestoreKey, { mode: 0o600 });
+                    else
+                        fs.unlinkSync(restoreKeyPath);
+                }
+                catch { /* no prior override */ }
+                if (previousMasterKey)
+                    setConfigMasterKey(previousMasterKey);
+                resetMasterKeyCache();
             }
             catch (rollbackErr) {
                 const err = e.message;
@@ -217,12 +238,6 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'validation_failed', err: e.message } });
             throw new GatewayError('gateway_error', `Restore failed: ${e.message}`, { status: 500 });
         }
-        if (restoredMasterKey) {
-            const restoredKey = restoredMasterKey.toString('base64');
-            fs.writeFileSync(path.join(cfg.dataDir, 'master.key'), restoredKey, { mode: 0o600, encoding: 'utf8' });
-            setConfigMasterKey(restoredKey);
-            resetMasterKeyCache();
-        }
         // The swap invalidates the previous admin session (its row lived in the
         // old database). Re-create the current session in the restored database so
         // the admin stays logged in across the hot restore.

package/dist/server/routes/admin/combos.js

@@ -8,9 +8,10 @@ import { uuid } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { circuitBlocks } from '../../routing/circuit.js';
 const MemberSpec = z.object({ modelId: z.string(), position: z.number().int().min(0), enabled: z.boolean().default(true) });
+const OptionalSlug = z.preprocess((value) => typeof value === 'string' && value.trim() === '' ? undefined : value, z.string().min(1).max(64).optional());
 const ComboCreate = z.object({
     name: z.string().min(1).max(128),
-    slug: z.string().min(1).max(64).optional(),
+    slug: OptionalSlug,
     mode: z.literal('fallback').default('fallback'),
     maxTotalAttempts: z.number().int().min(1).max(8).optional(),
     enabled: z.boolean().optional(),

package/dist/server/routes/admin/models.js

@@ -219,13 +219,13 @@ export async function registerModelRoutes(app) {
         const m = db.select().from(schema.models).where(eq(schema.models.id, id)).get();
         if (!m)
             throw new GatewayError('invalid_request_error', 'Model not found', { status: 404 });
-        const inCombo = db.select().from(schema.comboMembers).where(eq(schema.comboMembers.modelId, id)).all();
-        if (inCombo.length > 0) {
-            db.update(schema.models).set({ enabled: false, upstreamAvailable: false, updatedAt: new Date().toISOString() }).where(eq(schema.models.id, id)).run();
-            recordAudit({ action: 'model.soft_disable', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip, metadata: { reason: 'in_combo' } });
-            return { ok: true, softDisabled: true };
-        }
-        db.delete(schema.models).where(eq(schema.models.id, id)).run();
+        db.transaction((tx) => {
+            tx.delete(schema.comboMembers).where(eq(schema.comboMembers.modelId, id)).run();
+            tx.delete(schema.modelAliases).where(sql `target_kind = 'model' AND target_id = ${id}`).run();
+            tx.delete(schema.apiKeyModelPermissions).where(sql `target_kind = 'model' AND target_id = ${id}`).run();
+            tx.delete(schema.responseCache).where(sql `target_kind = 'model' AND target_id = ${id}`).run();
+            tx.delete(schema.models).where(eq(schema.models.id, id)).run();
+        });
         recordAudit({ action: 'model.delete', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip });
         return { ok: true };
     });

package/dist/server/routes/admin/providers.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { sql, eq } from 'drizzle-orm';
+import { sql, eq, inArray } from 'drizzle-orm';
 import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
@@ -156,19 +156,20 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        const used = db.select().from(schema.models).where(eq(schema.models.providerId, id)).all();
-        if (used.length > 0) {
-            // Soft-disable if there are dependent models
-            db.update(schema.providers).set({ enabled: false, updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
-            recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
-            return { ok: true, softDisabled: true };
-        }
-        try {
-            db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
-        }
-        catch (error) {
-            throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
-        }
+        const models = db.select({ id: schema.models.id }).from(schema.models).where(eq(schema.models.providerId, id)).all();
+        const modelIds = models.map((model) => model.id);
+        db.transaction((tx) => {
+            tx.delete(schema.codexAccounts).where(eq(schema.codexAccounts.providerId, id)).run();
+            tx.delete(schema.qoderAccounts).where(eq(schema.qoderAccounts.providerId, id)).run();
+            if (modelIds.length > 0) {
+                tx.delete(schema.comboMembers).where(inArray(schema.comboMembers.modelId, modelIds)).run();
+                tx.delete(schema.modelAliases).where(sql `target_kind = 'model' AND target_id IN (${sql.join(modelIds.map((modelId) => sql `${modelId}`), sql `, `)})`).run();
+                tx.delete(schema.apiKeyModelPermissions).where(sql `target_kind = 'model' AND target_id IN (${sql.join(modelIds.map((modelId) => sql `${modelId}`), sql `, `)})`).run();
+                tx.delete(schema.responseCache).where(sql `target_kind = 'model' AND target_id IN (${sql.join(modelIds.map((modelId) => sql `${modelId}`), sql `, `)})`).run();
+                tx.delete(schema.models).where(inArray(schema.models.id, modelIds)).run();
+            }
+            tx.delete(schema.providers).where(eq(schema.providers.id, id)).run();
+        });
         recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
         return { ok: true };
     });

package/dist/server/routes/admin/setup.js

@@ -20,7 +20,10 @@ export async function registerSetupRoutes(app) {
         const s = getSettings();
         return {
             setupComplete: s.setupComplete,
-            masterKeyConfigured: s.masterKeyConfigured || isMasterKeyConfigured(),
+            // The database flag can survive removal of the key file or env var. The
+            // setup form needs the runtime truth so it never hides the only recovery
+            // input when encryption is not actually available.
+            masterKeyConfigured: isMasterKeyConfigured(),
         };
     });
     app.post('/api/admin/setup', async (req, _reply) => {