3x-ui/internal/web
libmur-dev a8d0700bf2
Some checks failed
CI / go-test (push) Has been cancelled
CI / postgres-durable-first (push) Has been cancelled
CI / codegen (push) Has been cancelled
CI / govulncheck (push) Has been cancelled
CI / race (push) Has been cancelled
CI / node-e2e (push) Has been cancelled
CI / fuzz-smoke (push) Has been cancelled
CI / golangci (push) Has been cancelled
CI / frontend (push) Has been cancelled
CodeQL Advanced / Analyze (go) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (javascript-typescript) (push) Has been cancelled
Docs CI / build (push) Has been cancelled
Docs Deploy (GitHub Pages) / build (push) Has been cancelled
Release 3X-UI / build (386) (push) Has been cancelled
Release 3X-UI / build (amd64) (push) Has been cancelled
Release 3X-UI / build (arm64) (push) Has been cancelled
Release 3X-UI / build (armv5) (push) Has been cancelled
Release 3X-UI / build (armv6) (push) Has been cancelled
Release 3X-UI / build (armv7) (push) Has been cancelled
Release 3X-UI / build (s390x) (push) Has been cancelled
Release 3X-UI / Build for Windows (push) Has been cancelled
Docs Deploy (GitHub Pages) / deploy (push) Has been cancelled
Release 3X-UI / Publish rolling dev release (push) Has been cancelled
fix(auth): add node-admin token scope for panel updates (#6666)
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
2026-10-17 23:45:26 +02:00
..
controller fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
entity fix(settings): accept five-field crontab for report and LDAP schedules 2026-10-11 20:37:04 +02:00
global
job feat(xray): add the MASQUE protocol and transport 2026-10-11 10:28:49 +02:00
locale feat(discord): add Discord notification bot service (#6486) 2026-09-13 14:04:53 +02:00
middleware fix(inbounds): accept masque in the inbound protocol validator 2026-10-11 10:56:47 +02:00
network feat(tuic): implement native in-process Go TUIC v5 server (#6577) 2026-10-03 02:56:02 +02:00
runtime fix(node): don't delete clients when a node reports an empty snapshot (#6734) 2026-10-05 16:12:08 +02:00
service fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
session
translation fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
websocket fix(tuic): client speed display and certificate button layout (#6723) 2026-10-05 19:46:46 +02:00
cadence_test.go
node_contract_test.go fix(node): don't delete clients when a node reports an empty snapshot (#6734) 2026-10-05 16:12:08 +02:00
routes_contract_test.go perf(tests): copy a migrated template DB instead of migrating per test 2026-09-27 03:04:50 +02:00
schedule_test.go fix(settings): accept five-field crontab for report and LDAP schedules 2026-10-11 20:37:04 +02:00
web.go fix(settings): accept five-field crontab for report and LDAP schedules 2026-10-11 20:37:04 +02:00
web_mtls.go
web_mtls_test.go
web_tuic_shutdown_test.go feat(tuic): implement native in-process Go TUIC v5 server (#6577) 2026-10-03 02:56:02 +02:00