fix: apply soft-delete filters consistently across api/v1 routes

Four missed cases where deleted/archived resources could leak through:
- acl.ts: exclude deleted databases from getAccessibleDatabaseIds
- databases/route.ts: exclude deleted databases in list endpoint
- agents/route.ts: re-apply isArchived guard on final fetch (ACL ids stale)
- databases/[id]/status/route.ts: exclude deleted restorations

app/api/v1/agents/route.ts

@@ -3,7 +3,7 @@ import { withApiKey, ApiKeyContext } from "@/lib/api-v1/middleware";
 import { getAccessibleAgentIds } from "@/lib/api-v1/acl";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { inArray, eq, count } from "drizzle-orm";
+import { inArray, eq, count, and, or, isNull } from "drizzle-orm";
 import { z } from "zod";
 import { slugify } from "@/utils/slugify";
 import { logger } from "@/lib/logger";
@@ -19,7 +19,13 @@ export const GET = withApiKey(async (_req: Request, ctx: ApiKeyContext) => {
     }
 
     const agents = await db.query.agent.findMany({
-      where: inArray(drizzleDb.schemas.agent.id, agentIds),
+      where: and(
+        inArray(drizzleDb.schemas.agent.id, agentIds),
+        or(
+          eq(drizzleDb.schemas.agent.isArchived, false),
+          isNull(drizzleDb.schemas.agent.isArchived)
+        )
+      ),
     });
 
     return NextResponse.json({ data: agents });

app/api/v1/databases/[id]/status/route.ts

@@ -35,7 +35,10 @@ export const GET = withApiKey(
           orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
         }),
         db.query.restoration.findFirst({
-          where: eq(drizzleDb.schemas.restoration.databaseId, id),
+          where: and(
+            eq(drizzleDb.schemas.restoration.databaseId, id),
+            isNull(drizzleDb.schemas.restoration.deletedAt)
+          ),
           orderBy: [desc(drizzleDb.schemas.restoration.createdAt)],
         }),
       ]);

app/api/v1/databases/route.ts

@@ -3,7 +3,7 @@ import { withApiKey, ApiKeyContext } from "@/lib/api-v1/middleware";
 import { getAccessibleAgentIds } from "@/lib/api-v1/acl";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { inArray } from "drizzle-orm";
+import { inArray, and, isNull } from "drizzle-orm";
 import { logger } from "@/lib/logger";
 
 const log = logger.child({ module: "api/v1/databases" });
@@ -17,7 +17,10 @@ export const GET = withApiKey(async (_req: Request, ctx: ApiKeyContext) => {
     }
 
     const databases = await db.query.database.findMany({
-      where: inArray(drizzleDb.schemas.database.agentId, agentIds),
+      where: and(
+        inArray(drizzleDb.schemas.database.agentId, agentIds),
+        isNull(drizzleDb.schemas.database.deletedAt)
+      ),
     });
 
     return NextResponse.json({ data: databases });

src/lib/api-v1/acl.ts

@@ -53,7 +53,10 @@ export async function getAccessibleDatabaseIds(userId: string): Promise<string[]
   if (agentIds.length === 0) return [];
 
   const databases = await db.query.database.findMany({
-    where: inArray(drizzleDb.schemas.database.agentId, agentIds),
+    where: and(
+      inArray(drizzleDb.schemas.database.agentId, agentIds),
+      isNull(drizzleDb.schemas.database.deletedAt)
+    ),
     columns: { id: true },
   });