3x-ui/internal/web/service
n0ctal 1230559e69
feat(api): scoped, optionally expiring API tokens (#6201)
* security(api): add scoped expiring API tokens

* security(api): make scoped token lifecycle enforceable

---------

Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>
2026-08-15 15:31:49 +02:00
..
email
integration
outbound fix(migration): stop a half-applied startup migration from committing silently (#6182) 2026-08-14 20:10:39 +02:00
panel feat(api): scoped, optionally expiring API tokens (#6201) 2026-08-15 15:31:49 +02:00
tgbot test(tgbot): detect open-coded keypad transitions (#6214) 2026-08-15 15:27:02 +02:00
access_log_parse_test.go
api_scale_postgres_test.go
backup_filename_test.go
bulk_clients_test.go
bulk_traffic_test.go
client.go
client_add_dedupe_test.go
client_apply_field_test.go
client_bulk.go fix(clients): push bulk client changes to nodes only after the commit lands (#6181) 2026-08-14 20:11:19 +02:00
client_bulk_flow_test.go
client_bulk_reenable_test.go
client_bulk_reset_reenable_test.go
client_create_fanout_test.go perf(clients): take one email snapshot per client fan-out, not one per inbound (#6091) 2026-07-25 00:51:48 +02:00
client_create_reuse_test.go
client_crud.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_delete_continue_test.go
client_delete_node_baseline_test.go
client_delete_node_full_test.go
client_delete_tombstone_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_effective_flow_test.go
client_email_validation_test.go
client_external_link.go
client_flow_isolation_test.go
client_group_bulk_test.go fix(groups): report changed bulk moves without restarting xray (#6199) 2026-08-14 19:50:06 +02:00
client_group_node_sync_test.go
client_group_reset_test.go
client_groups.go fix(groups): report changed bulk moves without restarting xray (#6199) 2026-08-14 19:50:06 +02:00
client_inbound_apply.go fix(xray): stop the runtime user API from crashing xray-core 2026-07-28 13:52:10 +02:00
client_link.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_locks.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_locks_test.go
client_lookup.go feat(api): add GET endpoint to look up clients by Telegram ID (#5945) 2026-07-28 22:38:44 +02:00
client_lookup_test.go feat(api): add GET endpoint to look up clients by Telegram ID (#5945) 2026-07-28 22:38:44 +02:00
client_paging.go perf(clients): make the clients page scale to large panels 2026-07-30 02:49:32 +02:00
client_paging_test.go perf(clients): make the clients page scale to large panels 2026-07-30 02:49:32 +02:00
client_portable.go
client_stat_reuse_test.go fix: refresh stale client_traffics row when an inbound-deleted client's email is reused (#6003) 2026-07-21 15:57:55 +02:00
client_sync_mtproto_test.go
client_sync_multiprotocol_test.go
client_sync_orphan.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_sync_orphan_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
client_test.go
client_traffic.go
client_update_enable_test.go
client_update_no_inbound_test.go
client_update_rename_test.go fix(clients): stop a stale IP row from blocking a client edit 2026-08-02 12:32:45 +02:00
client_wireguard.go fix(wireguard): widen the client address pool past a full /24 (#6089) 2026-07-24 22:21:18 +02:00
client_wireguard_crud_test.go
client_wireguard_test.go fix(wireguard): widen the client address pool past a full /24 (#6089) 2026-07-24 22:21:18 +02:00
config.json Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
del_shared_email_runtime_test.go
fallback.go
finalmask_rand_packet_test.go fix(xray): reject configs xray-core refuses, and check the fixtures against it 2026-07-28 14:43:55 +02:00
global_traffic_test.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
golden_fixtures_xray_test.go chore: refresh dependencies and modernize Go test idioms 2026-07-30 03:14:22 +02:00
host.go fix(hosts): assign group ids to imported hosts and repair empty ones 2026-07-23 18:52:42 +02:00
host_test.go
inbound.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_autorenew_shadowsocks_test.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_autorenew_test.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_client_ips.go fix(clients): stop a stale IP row from blocking a client edit 2026-08-02 12:32:45 +02:00
inbound_client_ips_merge_test.go
inbound_client_move_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
inbound_client_traffic_test.go
inbound_clients.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
inbound_disable.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_durable_postgres_test.go
inbound_fallback_runtime_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
inbound_finalmask_reality_test.go
inbound_finalmask_xmc_test.go feat(xray): update xray-core to v26.7.28 and adapt panel 2026-07-28 13:14:06 +02:00
inbound_flow_restore.go
inbound_flow_restore_test.go
inbound_import_external_proxy_test.go
inbound_import_shared_clients_test.go fix: refresh stale client_traffics row when an inbound-deleted client's email is reused (#6003) 2026-07-21 15:57:55 +02:00
inbound_migration.go fix(migration): stop a half-applied startup migration from committing silently (#6182) 2026-08-14 20:10:39 +02:00
inbound_migration_test.go fix(migration): stop a half-applied startup migration from committing silently (#6182) 2026-08-14 20:10:39 +02:00
inbound_mtproto.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
inbound_mtproto_apply_test.go
inbound_mtproto_client_test.go
inbound_mtproto_desired_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
inbound_mtproto_test.go
inbound_mtproto_txfail_test.go
inbound_node.go fix(node): adopt a matching deployed inbound instead of recreating it (#6197) 2026-08-14 20:01:35 +02:00
inbound_node_ips.go
inbound_node_ips_test.go
inbound_node_reconcile_test.go fix(node): adopt a matching deployed inbound instead of recreating it (#6197) 2026-08-14 20:01:35 +02:00
inbound_options_node_address_test.go
inbound_protocol.go
inbound_protocol_test.go
inbound_settings_clients.go
inbound_settings_clients_test.go
inbound_sub_sort_test.go
inbound_sublink.go
inbound_tgbot_lookup_test.go
inbound_traffic.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_traffic_apply.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
inbound_traffic_global.go fix(node): stop a departed master's frozen traffic from disabling clients (#6113) 2026-07-27 14:21:56 +02:00
inbound_traffic_reset_test.go inbounds: allow custom monthly traffic reset days (#6071) 2026-07-28 23:27:09 +02:00
inbound_update_tag_test.go
inbound_util.go
key_gen_parse_test.go
metric_history.go chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms 2026-07-25 16:08:09 +02:00
metric_history_test.go
mtproto_fake_test.go
node.go fix(node): adopt a matching deployed inbound instead of recreating it (#6197) 2026-08-14 20:01:35 +02:00
node_bulk_dispatch_test.go fix(clients): push bulk client changes to nodes only after the commit lands (#6181) 2026-08-14 20:11:19 +02:00
node_client_breakdown_test.go
node_client_expiry_sync_test.go
node_client_renew_sync_test.go
node_client_traffic_sum_test.go
node_contract.go fix(nodes): make node API tokens write-only (#5613) 2026-07-23 15:35:11 +02:00
node_credentials_writeonly_test.go fix(nodes): make node API tokens write-only (#5613) 2026-07-23 15:35:11 +02:00
node_delete_orphan_test.go
node_dirty_test.go
node_host_adopt_test.go
node_mtls.go
node_mtls_test.go
node_netmetrics_test.go
node_origin_guid_test.go
node_push_payload_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
node_shared_guid_test.go
node_sweep_guard_test.go fix(node): stop the node sync from deleting clients it never meant to 2026-08-01 15:19:08 +02:00
node_tag_sync_test.go fix(node): adopt a matching deployed inbound instead of recreating it (#6197) 2026-08-14 20:01:35 +02:00
node_test.go fix(node): adopt a matching deployed inbound instead of recreating it (#6197) 2026-08-14 20:01:35 +02:00
node_tree.go fix(nodes): make node API tokens write-only (#5613) 2026-07-23 15:35:11 +02:00
node_tree_test.go
outbound_subscription.go fix(outbounds): propagate allocation query failures (#6208) 2026-08-14 19:41:24 +02:00
outbound_subscription_ssrf_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
outbound_subscription_test.go fix(outbounds): propagate allocation query failures (#6208) 2026-08-14 19:41:24 +02:00
port_conflict.go
port_conflict_test.go
reality_scan.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
reality_scan_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
reset_writer_test.go
scale_helpers_test.go
server.go fix(database): create SQLite backup snapshots online (#6137) 2026-07-29 21:04:55 +02:00
server_import_sniff_test.go
server_import_stage_test.go
server_pg_restore_test.go
server_vlessenc_test.go
server_xray_checksum_test.go
setting.go fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195) 2026-08-14 20:03:54 +02:00
setting_clash_test.go
setting_factory_defaults_test.go fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195) 2026-08-14 20:03:54 +02:00
setting_mtls.go fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195) 2026-08-14 20:03:54 +02:00
setting_mtls_test.go fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195) 2026-08-14 20:03:54 +02:00
setting_security_test.go
setting_sub_identity_test.go feat(sub): allow identity tokens on every subscription link (#5935) 2026-07-28 22:12:52 +02:00
shadowsocks_client_key_test.go
stream_network_alias_test.go
sub_uri_base_test.go
sync_scale_postgres_test.go
traffic_commit_test.go
traffic_poll_scale_test.go
traffic_runtime_apply_test.go fix(traffic): apply maintenance side effects only after the commit lands (#6200) 2026-08-14 19:42:09 +02:00
traffic_writer.go
traffic_writer_test.go
url_safety.go
ws_payload_scale_test.go
xray.go fix(xray): synchronize lifecycle state (#6138) 2026-07-29 21:00:29 +02:00
xray_config_clients_test.go style: drop the line comments added with the triage fixes 2026-07-27 14:37:57 +02:00
xray_config_inject_test.go fix(xray): validate generated egress targets (#5989) 2026-07-21 15:57:34 +02:00
xray_config_scale_test.go
xray_lifecycle_test.go fix(xray): synchronize lifecycle state (#6138) 2026-07-29 21:00:29 +02:00
xray_metrics.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
xray_metrics_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
xray_restart_test.go
xray_setting.go fix(xray): synchronize lifecycle state (#6138) 2026-07-29 21:00:29 +02:00
xray_setting_dns_routing.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
xray_setting_dns_routing_test.go Bug-label issue sweep: 16 fixes (#6083) 2026-07-23 15:34:42 +02:00
xray_setting_routing_sync.go
xray_setting_routing_sync_test.go
xray_setting_test.go fix: gate embedded unencrypted-outbound rejection on running Xray core version (#6028) 2026-07-21 15:51:46 +02:00
xray_strip_rules_test.go
xray_wireguard_config_test.go
xray_xhttp_session_test.go