3x-ui/internal/web/controller
libmur-dev a8d0700bf2
Some checks failed
CI / go-test (push) Has been cancelled
CI / postgres-durable-first (push) Has been cancelled
CI / codegen (push) Has been cancelled
CI / govulncheck (push) Has been cancelled
CI / race (push) Has been cancelled
CI / node-e2e (push) Has been cancelled
CI / fuzz-smoke (push) Has been cancelled
CI / golangci (push) Has been cancelled
CI / frontend (push) Has been cancelled
CodeQL Advanced / Analyze (go) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (javascript-typescript) (push) Has been cancelled
Docs CI / build (push) Has been cancelled
Docs Deploy (GitHub Pages) / build (push) Has been cancelled
Release 3X-UI / build (386) (push) Has been cancelled
Release 3X-UI / build (amd64) (push) Has been cancelled
Release 3X-UI / build (arm64) (push) Has been cancelled
Release 3X-UI / build (armv5) (push) Has been cancelled
Release 3X-UI / build (armv6) (push) Has been cancelled
Release 3X-UI / build (armv7) (push) Has been cancelled
Release 3X-UI / build (s390x) (push) Has been cancelled
Release 3X-UI / Build for Windows (push) Has been cancelled
Docs Deploy (GitHub Pages) / deploy (push) Has been cancelled
Release 3X-UI / Publish rolling dev release (push) Has been cancelled
fix(auth): add node-admin token scope for panel updates (#6666)
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
2026-10-17 23:45:26 +02:00
..
api.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
api_auth_test.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
base.go
client.go feat(clients): preserve traffic counters in portable export/import (#6469) 2026-09-27 02:48:40 +02:00
client_happ_test.go feat(happ): generate Crypt5 subscription links locally (#6494) 2026-09-13 12:44:55 +02:00
client_partial_apply_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
client_renewal_preview_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
dist.go feat(web): add network-only PWA installability (#6190) 2026-08-18 15:33:20 +02:00
dist_test.go feat(web): add network-only PWA installability (#6190) 2026-08-18 15:33:20 +02:00
geodata_test.go feat(xray): browse geosite/geoip categories from routing rules (#6165) 2026-08-15 17:12:59 +02:00
group.go fix(groups): report changed bulk moves without restarting xray (#6199) 2026-08-14 19:50:06 +02:00
host.go feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677) 2026-07-08 23:35:20 +02:00
host_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
import_db_restart_test.go fix(web): restart panel after ImportDB so subPath routes match (#6446) (#6456) 2026-09-13 21:39:15 +02:00
inbound.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
inbound_node_sync_test.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
index.go feat(panel): add sponsor slots fed from sponsors.sanaei.dev 2026-09-26 03:31:51 +02:00
login_limiter.go Repo-wide self-correcting audit: 54 verified bug fixes (#5970) 2026-07-17 00:33:06 +02:00
login_limiter_test.go chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms 2026-07-25 16:08:09 +02:00
node.go fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194) 2026-08-15 16:03:42 +02:00
node_credentials_writeonly_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
panel_update_test.go
pwa.go feat(web): add network-only PWA installability (#6190) 2026-08-18 15:33:20 +02:00
pwa_test.go feat(web): add network-only PWA installability (#6190) 2026-08-18 15:33:20 +02:00
server.go fix(server): apply the outbound address policy to remote cert pinning 2026-10-03 13:20:00 +02:00
setting.go feat(discord): add Discord notification bot service (#6486) 2026-09-13 14:04:53 +02:00
setting_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
spa.go refactor(frontend): replace axios with the native Fetch API 2026-07-08 01:09:18 +02:00
spa_test.go
sub_balancer.go feat(sub): leastLoad member weights for subscription balancers (#6304) 2026-09-02 20:21:27 +02:00
sub_balancer_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
util.go fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135) 2026-07-29 21:01:59 +02:00
util_test.go fix(sub): never use X-Real-IP as the subscription host (#6608) 2026-09-26 21:13:46 +02:00
websocket.go
xray_setting.go feat(warp): register WARP over MASQUE from the WARP modal 2026-10-11 10:31:01 +02:00
xray_setting_warp_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00