3x-ui/internal/web/controller
libmur-dev a8d0700bf2
Some checks failed
CI / go-test (push) Has been cancelled
CI / postgres-durable-first (push) Has been cancelled
CI / codegen (push) Has been cancelled
CI / govulncheck (push) Has been cancelled
CI / race (push) Has been cancelled
CI / node-e2e (push) Has been cancelled
CI / fuzz-smoke (push) Has been cancelled
CI / golangci (push) Has been cancelled
CI / frontend (push) Has been cancelled
CodeQL Advanced / Analyze (go) (push) Has been cancelled
CodeQL Advanced / Analyze (actions) (push) Has been cancelled
CodeQL Advanced / Analyze (javascript-typescript) (push) Has been cancelled
Docs CI / build (push) Has been cancelled
Docs Deploy (GitHub Pages) / build (push) Has been cancelled
Release 3X-UI / build (386) (push) Has been cancelled
Release 3X-UI / build (amd64) (push) Has been cancelled
Release 3X-UI / build (arm64) (push) Has been cancelled
Release 3X-UI / build (armv5) (push) Has been cancelled
Release 3X-UI / build (armv6) (push) Has been cancelled
Release 3X-UI / build (armv7) (push) Has been cancelled
Release 3X-UI / build (s390x) (push) Has been cancelled
Release 3X-UI / Build for Windows (push) Has been cancelled
Docs Deploy (GitHub Pages) / deploy (push) Has been cancelled
Release 3X-UI / Publish rolling dev release (push) Has been cancelled
fix(auth): add node-admin token scope for panel updates (#6666)
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
2026-10-17 23:45:26 +02:00
..
api.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
api_auth_test.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
base.go
client.go
client_happ_test.go
client_partial_apply_test.go
client_renewal_preview_test.go
dist.go
dist_test.go
geodata_test.go
group.go
host.go
host_test.go
import_db_restart_test.go
inbound.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
inbound_node_sync_test.go fix(auth): add node-admin token scope for panel updates (#6666) 2026-10-17 23:45:26 +02:00
index.go
login_limiter.go
login_limiter_test.go
node.go
node_credentials_writeonly_test.go
panel_update_test.go
pwa.go
pwa_test.go
server.go
setting.go
setting_test.go
spa.go
spa_test.go
sub_balancer.go
sub_balancer_test.go
util.go
util_test.go
websocket.go
xray_setting.go feat(warp): register WARP over MASQUE from the WARP modal 2026-10-11 10:31:01 +02:00
xray_setting_warp_test.go