3x-ui/internal/database
libmur-dev a8d0700bf2
Some checks failed
CI / go-test (push) Has been cancelled
CI / postgres-durable-first (push) Has been cancelled
CI / codegen (push) Has been cancelled
CI / govulncheck (push) Has been cancelled
CI / race (push) Has been cancelled
CI / node-e2e (push) Has been cancelled
CI / fuzz-smoke (push) Has been cancelled
CI / golangci (push) Has been cancelled
CI / frontend (push) Has been cancelled
CodeQL Advanced / Analyze (go) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (javascript-typescript) (push) Has been cancelled
Docs CI / build (push) Has been cancelled
Docs Deploy (GitHub Pages) / build (push) Has been cancelled
Release 3X-UI / build (386) (push) Has been cancelled
Release 3X-UI / build (amd64) (push) Has been cancelled
Release 3X-UI / build (arm64) (push) Has been cancelled
Release 3X-UI / build (armv5) (push) Has been cancelled
Release 3X-UI / build (armv6) (push) Has been cancelled
Release 3X-UI / build (armv7) (push) Has been cancelled
Release 3X-UI / build (s390x) (push) Has been cancelled
Release 3X-UI / Build for Windows (push) Has been cancelled
Docs Deploy (GitHub Pages) / deploy (push) Has been cancelled
Release 3X-UI / Publish rolling dev release (push) Has been cancelled
fix(auth): add node-admin token scope for panel updates (#6666)
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
2026-10-17 23:45:26 +02:00
..
dbtest perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
model fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
api_token_timestamp_test.go feat(api): scoped, optionally expiring API tokens (#6201) 2026-08-15 15:31:49 +02:00
backup_test.go chore: refresh dependencies and modernize Go test idioms 2026-07-30 03:14:22 +02:00
client_email_lower_index_test.go perf(clients): write client_inbounds deltas and check identity from the clients table 2026-08-20 04:09:57 +02:00
client_hwid_schema_test.go feat(sub): add per-client subscription HWID limits (#5802) 2026-08-15 16:50:20 +02:00
client_weekly_renew_migration_test.go feat(clients): add calendar weekly renewal and schedule previews (#6524) 2026-09-26 22:59:23 +02:00
client_weekly_renew_postgres_test.go feat(clients): add calendar weekly renewal and schedule previews (#6524) 2026-09-26 22:59:23 +02:00
db.go fix(database): blank boolean-era verifyPeerCertByName values on hosts 2026-10-12 18:16:22 +02:00
db_permissions_test.go fix(database): keep the SQLite store owner-only (#6390) 2026-09-03 16:37:35 +02:00
db_reopen_test.go fix(database): close the pool a second InitDB replaces 2026-09-27 15:32:17 +02:00
db_seed_test.go fix(sub): randomize fresh panel subscription paths (#6375) 2026-09-03 16:34:37 +02:00
db_settled_test.go fix(database): stop noisy per-startup errors in the Postgres server log 2026-07-01 23:07:05 +02:00
dialect.go fix(node): stop stale expiry sync from undoing client extensions (#6228) (#6231) 2026-08-23 23:17:56 +02:00
dns_outbound_legacy_keys_migration_test.go fix(xray): migrate the dns outbound off its legacy nonIPQuery and blockTypes (#6519) 2026-09-14 12:30:23 +02:00
dns_outbound_qtype_zero_test.go fix(xray): stop a lone dns qType 0 from matching every query 2026-09-15 16:00:05 +02:00
dump_sqlite.go fix(database): keep the dump restore inside its own database file 2026-10-03 13:19:54 +02:00
dump_sqlite_test.go fix(database): keep the dump restore inside its own database file 2026-10-03 13:19:54 +02:00
fail2ban_state_test.go fix(database): keep IP limits when the fail2ban probe is inconclusive (#6176) 2026-08-14 20:12:07 +02:00
freedom_domain_strategy_migration_test.go fix(xray): read an outbound protocol id the way the core does (#6521) 2026-09-14 19:52:27 +03:00
freedom_finalrules_migration_test.go fix(db): harden unrestricted freedom outbounds (#6184) 2026-08-14 20:07:30 +02:00
host_migration_test.go fix(database): blank boolean-era verifyPeerCertByName values on hosts 2026-10-12 18:16:22 +02:00
host_test.go feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677) 2026-07-08 23:35:20 +02:00
inbound_dedupe_test.go fix(client): stop duplicate client entries accumulating in inbound settings 2026-07-05 21:17:25 +02:00
inbound_exclude_from_sub_migration_test.go feat(inbound): excludeFromSub hides links without disabling (#6463) 2026-09-27 12:26:37 +02:00
inbound_port_unique_migration_test.go fix(database): drop the legacy UNIQUE constraint on inbounds.port 2026-07-11 22:48:56 +02:00
index_tags_test.go fix: resolve a batch of open bug-tagged issues (traffic accounting, share strategy, sub address, CPU) (#5477) 2026-06-22 00:22:28 +02:00
journal_mode_test.go fix(database): create SQLite backup snapshots online (#6137) 2026-07-29 21:04:55 +02:00
migrate_data.go feat(tuic): implement native in-process Go TUIC v5 server (#6577) 2026-10-03 02:56:02 +02:00
migrate_data_test.go fix(database): make cross-db migration lossless, transactional, and pre-checked 2026-07-12 20:14:07 +02:00
migration_models_test.go fix(database): make cross-db migration lossless, transactional, and pre-checked 2026-07-12 20:14:07 +02:00
mtproto_migration_test.go fix(mtproto): stop persisting a vestigial inbound-level secret 2026-07-06 17:55:57 +02:00
outbound_removed_keys_migration_test.go feat(xray): update xray-core to v26.9.8 and adapt panel 2026-09-08 13:49:32 +02:00
prepare_sqlite_test.go fix(database): make cross-db migration lossless, transactional, and pre-checked 2026-07-12 20:14:07 +02:00
reality_finalmask_migration_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
removed_cipher_migration_test.go feat(xray): update xray-core to v26.7.11 and adapt panel 2026-07-12 00:30:47 +02:00
rewriter_protocol_case_test.go fix(xray): read an outbound protocol id the way the core does (#6521) 2026-09-14 19:52:27 +03:00
seeder_fastpath_test.go Repo-wide self-correcting audit: 54 verified bug fixes (#5970) 2026-07-17 00:33:06 +02:00
settings_index_test.go perf(db): add an index on settings.key (#5359) 2026-06-20 15:08:54 +03:30
shadowsocks_server_key_migration_test.go fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds 2026-10-11 21:20:07 +02:00
traffic_overflow_repair_test.go fix(db): clamp traffic counters below int64 max and repair overflowed rows 2026-07-05 20:33:09 +02:00
udphop_client_mask_migration_test.go fix(finalmask): hop client UDP through the udphop mask 2026-10-11 11:20:34 +02:00
wireguard_domain_strategy_migration_test.go feat(xray): update xray-core to v26.9.30 and adapt panel 2026-10-02 13:54:39 +02:00
wireguard_migration_test.go feat(wireguard): multi-client support 2026-06-28 00:44:38 +02:00
xdns_finalmask_migration_test.go feat(xray): update xray-core to v26.10.10 and adapt panel 2026-10-11 07:55:12 +02:00