3x-ui/internal
libmur-dev a8d0700bf2
Some checks failed
CI / go-test (push) Has been cancelled
CI / postgres-durable-first (push) Has been cancelled
CI / codegen (push) Has been cancelled
CI / govulncheck (push) Has been cancelled
CI / race (push) Has been cancelled
CI / node-e2e (push) Has been cancelled
CI / fuzz-smoke (push) Has been cancelled
CI / golangci (push) Has been cancelled
CI / frontend (push) Has been cancelled
CodeQL Advanced / Analyze (go) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (javascript-typescript) (push) Has been cancelled
Docs CI / build (push) Has been cancelled
Docs Deploy (GitHub Pages) / build (push) Has been cancelled
Release 3X-UI / build (386) (push) Has been cancelled
Release 3X-UI / build (amd64) (push) Has been cancelled
Release 3X-UI / build (arm64) (push) Has been cancelled
Release 3X-UI / build (armv5) (push) Has been cancelled
Release 3X-UI / build (armv6) (push) Has been cancelled
Release 3X-UI / build (armv7) (push) Has been cancelled
Release 3X-UI / build (s390x) (push) Has been cancelled
Release 3X-UI / Build for Windows (push) Has been cancelled
Docs Deploy (GitHub Pages) / deploy (push) Has been cancelled
Release 3X-UI / Publish rolling dev release (push) Has been cancelled
fix(auth): add node-admin token scope for panel updates (#6666)
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
2026-10-17 23:45:26 +02:00
..
amneziawg fix(amneziawg): bound S1-S3 by the receive buffer, reject overlapping H (#6642) 2026-09-26 22:02:49 +02:00
amneziawgnet fix(amneziawg): respect tunnel MTU when writing UDP replies (#6780) 2026-10-12 03:11:09 +02:00
config v3.10.2 2026-10-14 17:18:43 +02:00
crypto/nodetoken fix(nodetoken): stop refusing every node-token key file on Windows 2026-09-27 15:55:42 +02:00
database fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
eventbus
logger fix(logger): reuse the open log rotator when InitLogger runs again 2026-09-27 15:32:20 +02:00
mtproto feat(mtproto): expose mtg-multi's per-IP pending-handshake limit 2026-10-14 16:46:20 +02:00
nodee2e chore(nodes): run the master+node scopes in parallel and document both layers 2026-10-05 13:30:18 +02:00
pia
sub fix(sub): export Hysteria2 Gecko obfs in Clash/Mihomo subscriptions 2026-10-14 14:42:00 +02:00
testpg test(database): give each package its own schema when tests run on PostgreSQL (#6594) 2026-09-26 21:13:42 +02:00
tuic fix(clients): balance renewal form layout and mode guidance (#6672) 2026-10-08 21:59:38 +02:00
tunnelmonitor
util fix(link): read the XHTTP fields a vmess link carries inline (#6808) 2026-10-14 15:34:35 +02:00
web fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
xray fix(xray): capture whole core crash reports instead of the first pipe chunk 2026-10-14 15:31:09 +02:00