fix: prevent orphaned server_meta records on failed Pterodactyl deletion; hide delete button for suspended servers

Author: ddrayko

public/js/admin.js

@@ -443,13 +443,15 @@ async function renderAdminServerDetail(serverId) {
           <div id="admin-action-msg" style="margin-top:12px;display:none"></div>
         </div>
 
+        ${!isSuspended ? ahtml`
         <div class="card">
           <h2 class="card-title" style="margin-bottom:16px">Danger Zone</h2>
           <p style="color:var(--text-secondary);font-size:0.88rem;margin-bottom:12px">
             Irreversible actions.
           </p>
           <button class="btn btn-danger" id="admin-btn-delete" style="width:auto">Delete Server</button>
         </div>
+        ` : ''}
       </div>
     `;
 

public/js/app.js

@@ -2076,6 +2076,7 @@ async function renderServerDetail(serverId) {
           <button class="btn btn-warning btn-full btn-reinstall-server" data-server-id="${s.id}" data-server-name="${s.name.replace(/"/g, '&quot;')}">Reinstall Server</button>
         </div>
 
+        ${!isSuspended ? html`
         <div class="action-card">
           <div class="action-card-header">
             <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 6h18M19 6v14a2 2 0 01-2 2H7a2 2 0 01-2-2V6m3 0V4a2 2 0 012-2h4a2 2 0 012 2v2"/></svg>
@@ -2086,6 +2087,7 @@ async function renderServerDetail(serverId) {
           </div>
           <button class="btn btn-danger btn-full btn-delete-server" data-server-id="${s.id}" data-server-name="${s.name.replace(/"/g, '&quot;')}">Delete Server</button>
         </div>
+        ` : ''}
       </div>
     `;
 

routes/admin.js

@@ -218,7 +218,15 @@ router.delete('/servers/:id', authenticateToken, requireAdmin, async (req, res)
       return res.status(400).json({ error: 'Invalid server ID' });
     }
 
-    await deletePteroServer(serverId);
+    const meta = await query('SELECT status FROM server_meta WHERE ptero_server_id = ?', [serverId]);
+    if (meta.length > 0 && meta[0].status === 'suspended') {
+      return res.status(403).json({ error: 'Cannot delete a suspended server' });
+    }
+    try {
+      await deletePteroServer(serverId);
+    } catch (err) {
+      console.warn('Pterodactyl delete failed (proceeding with local cleanup):', err.message);
+    }
     await query('DELETE FROM server_meta WHERE ptero_server_id = ?', [serverId]);
     await logActivity(req.user.userId, 'admin_delete', `Admin deleted server #${serverId}`, serverId);
     res.json({ success: true });

routes/servers.js

@@ -338,7 +338,15 @@ router.delete('/:id', authenticateToken, async (req, res) => {
     if (isNaN(serverId)) {
       return res.status(400).json({ error: 'Invalid server ID' });
     }
-    await deletePteroServer(serverId);
+    const meta = await query('SELECT status FROM server_meta WHERE ptero_server_id = ?', [serverId]);
+    if (meta.length > 0 && meta[0].status === 'suspended') {
+      return res.status(403).json({ error: 'Cannot delete a suspended server' });
+    }
+    try {
+      await deletePteroServer(serverId);
+    } catch (err) {
+      console.warn('Pterodactyl delete failed (proceeding with local cleanup):', err.message);
+    }
     await query('DELETE FROM server_meta WHERE ptero_server_id = ?', [serverId]);
     await logActivity(req.user.userId, 'server_deleted', `Deleted server #${serverId}`);
     res.json({ success: true });