From 3048950743c1d8a161e5e53570a3f8b2792d1c88 Mon Sep 17 00:00:00 2001
From: root <root@Sora39.localdomain>
Date: Sun, 26 Apr 2026 00:47:44 +0800
Subject: [PATCH] fix: allow subscription links for disabled clients

---
 ...low-disabled-client-subscription-access.md | 55 +++++++++++++++++++
 sub/subClashService.go                        |  2 +-
 sub/subJsonService.go                         |  2 +-
 sub/subService.go                             |  2 +-
 4 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 docs/Tasktracking/2026-04-26-allow-disabled-client-subscription-access.md

diff --git a/docs/Tasktracking/2026-04-26-allow-disabled-client-subscription-access.md b/docs/Tasktracking/2026-04-26-allow-disabled-client-subscription-access.md
new file mode 100644
index 00000000..e0570322
--- /dev/null
+++ b/docs/Tasktracking/2026-04-26-allow-disabled-client-subscription-access.md
@@ -0,0 +1,55 @@
+Task Record
+
+Date: 2026-04-26
+Related Module: sub subscription services
+Change Type: Fix
+
+Background
+
+Current subscription generation logic filters clients by both `subId` and `enable=true`.
+As a result, when a client account is disabled, subscription endpoints cannot return Subscription Link or Clash Link content.
+Requirement is to allow access to subscription and Clash links even when the account is not enabled.
+
+Changes
+
+Updated client matching conditions in subscription generation flows to only match `subId` and not require `client.Enable`:
+- `sub/subService.go` (`GetSubs`)
+- `sub/subJsonService.go` (`GetJson`)
+- `sub/subClashService.go` (`GetClash`)
+
+The inbound-level enable filter remains unchanged.
+
+Impact
+
+Affected modules or files.
+- `sub/subService.go`
+- `sub/subJsonService.go`
+- `sub/subClashService.go`
+
+Whether APIs, database, config, build, or compatibility are affected.
+- API routes unchanged.
+- Database schema unchanged.
+- Configuration schema unchanged.
+- Runtime behavior changed: disabled clients with valid `subId` can now receive subscription payloads.
+
+Whether upstream or downstream callers are affected.
+- Subscription consumers (normal/JSON/Clash links) now receive content even when client enable flag is false.
+
+Verification
+
+List validation commands or checks performed.
+- `go test ./sub/...`
+
+State the result.
+- Passed.
+
+If not verified, explain why.
+- No remote runtime deployment verification was performed in this local environment.
+
+Risks And Follow-Up
+
+Remaining risks.
+- This change intentionally relaxes access control semantics for disabled clients at subscription layer. If disable is expected to fully revoke access, this behavior is now different by design.
+
+Recommended follow-up work.
+- Confirm product expectation on whether this policy should also apply to other export channels (if any).
diff --git a/sub/subClashService.go b/sub/subClashService.go
index a8d46f59..2d81622c 100644
--- a/sub/subClashService.go
+++ b/sub/subClashService.go
@@ -92,7 +92,7 @@ func (s *SubClashService) GetClash(subId string) (string, string, error) {
 		}
 
 		for _, client := range clients {
-			if client.Enable && client.SubID == subId {
+			if client.SubID == subId {
 				clientTraffics = append(clientTraffics, s.SubService.getClientTraffics(inbound.ClientStats, client.Email))
 				newProxies := s.getProxy(inbound, client)
 				proxies = append(proxies, newProxies...)
diff --git a/sub/subJsonService.go b/sub/subJsonService.go
index 72c5c6f1..faa64a70 100644
--- a/sub/subJsonService.go
+++ b/sub/subJsonService.go
@@ -101,7 +101,7 @@ func (s *SubJsonService) GetJson(subId string, host string) (string, string, err
 		}
 
 		for _, client := range clients {
-			if client.Enable && client.SubID == subId {
+			if client.SubID == subId {
 				clientTraffics = append(clientTraffics, s.SubService.getClientTraffics(inbound.ClientStats, client.Email))
 				newConfigs := s.getConfig(inbound, client, host)
 				configArray = append(configArray, newConfigs...)
diff --git a/sub/subService.go b/sub/subService.go
index ad6c5b45..cecfcc57 100644
--- a/sub/subService.go
+++ b/sub/subService.go
@@ -76,7 +76,7 @@ func (s *SubService) GetSubs(subId string, host string) ([]string, int64, xray.C
 			}
 		}
 		for _, client := range clients {
-			if client.Enable && client.SubID == subId {
+			if client.SubID == subId {
 				link := s.getLink(inbound, client.Email)
 				result = append(result, link)
 				ct := s.getClientTraffics(inbound.ClientStats, client.Email)