3x-ui/web
MHSanaei 0ae57881d5
fix: address copilot review on #4545
Two issues raised by the Copilot review:

1) subscriptionExpiryFromClient called time.Now() per invocation.
   Two clients with the same delayed-start duration normalized to
   timestamps a few milliseconds apart, so the aggregator's
   "if normalized != traffic.ExpiryTime" check tripped and the
   subscription header expire= dropped back to 0 — the exact bug
   the helper was meant to fix, just one client later.

   Take nowMs as a parameter; each of GetSubs / GetClash / GetConfig
   captures one timestamp per request and reuses it.

2) Guarding Flow against empty incoming values in SyncInbound
   prevented a user from ever clearing a VLESS flow via the panel.
   FlowOverride on client_inbounds is the per-inbound mechanism that
   already preserves flow correctly across protocols, so the guard
   on the shared clients.flow column is the wrong place.

   Drop the Flow guard, keep the rest (UUID/Password/Auth/Security/
   Reverse — none of which have a per-inbound override column).
   Adds a regression test that asserts clearing flow on the owning
   inbound makes ListForInbound return flow="".

   The existing cross-protocol test is rewritten to assert on the
   user-visible behavior (ListForInbound flow) instead of the shared
   clients.flow column.
2026-05-24 23:59:18 +02:00
..
controller feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00
entity Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
global Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
job fix(online): refresh online-clients list even when no WS frontend is connected (#4515) 2026-05-24 23:43:45 +02:00
locale v3 2026-05-10 02:13:42 +02:00
middleware Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
runtime Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
service fix: address copilot review on #4545 2026-05-24 23:59:18 +02:00
session Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
translation i18n: translate hardcoded inbound action + security warning strings (#4502) 2026-05-23 19:43:21 +02:00
websocket fix(websocket): order register/unregister via single ops channel 2026-05-19 12:34:53 +02:00
web.go feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00