3x-ui/web/service
MHSanaei 0ae57881d5
fix: address copilot review on #4545
Two issues raised by the Copilot review:

1) subscriptionExpiryFromClient called time.Now() per invocation.
   Two clients with the same delayed-start duration normalized to
   timestamps a few milliseconds apart, so the aggregator's
   "if normalized != traffic.ExpiryTime" check tripped and the
   subscription header expire= dropped back to 0 — the exact bug
   the helper was meant to fix, just one client later.

   Take nowMs as a parameter; each of GetSubs / GetClash / GetConfig
   captures one timestamp per request and reuses it.

2) Guarding Flow against empty incoming values in SyncInbound
   prevented a user from ever clearing a VLESS flow via the panel.
   FlowOverride on client_inbounds is the per-inbound mechanism that
   already preserves flow correctly across protocols, so the guard
   on the shared clients.flow column is the wrong place.

   Drop the Flow guard, keep the rest (UUID/Password/Auth/Security/
   Reverse — none of which have a per-inbound override column).
   Adds a regression test that asserts clearing flow on the owning
   inbound makes ListForInbound return flow="".

   The existing cross-protocol test is rewritten to assert on the
   user-visible behavior (ListForInbound flow) instead of the shared
   clients.flow column.
2026-05-24 23:59:18 +02:00
..
api_token.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
client.go fix: address copilot review on #4545 2026-05-24 23:59:18 +02:00
client_sync_multiprotocol_test.go fix: address copilot review on #4545 2026-05-24 23:59:18 +02:00
client_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
config.json fix(xray): allow private-IP destinations via freedom finalRules 2026-05-19 15:42:16 +02:00
custom_geo.go fix(security): SSRF-guard node and remote HTTP clients 2026-05-13 13:33:53 +02:00
custom_geo_test.go v3 2026-05-10 02:13:42 +02:00
fallback.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
inbound.go Reduce list-page payloads with slim/paged endpoints (#4500) 2026-05-23 17:43:43 +02:00
metric_history.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
node.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
node_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
nord.go feat(xray/nord): searchable server list + colored load tag, surface API errors 2026-05-11 10:06:01 +02:00
outbound.go fix(outbound): probe UDP-based outbounds over UDP instead of TCP 2026-05-15 12:29:53 +02:00
panel.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
panel_other.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
panel_test.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
panel_unix.go feat: add panel update functionality via web GUI (#4117) 2026-04-28 18:46:55 +02:00
port_conflict.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
port_conflict_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
server.go Frontend rewrite: React + TypeScript with AntD v6 (#4498) 2026-05-23 15:21:45 +02:00
server_vlessenc_test.go Feat: clarify VLESS encryption auth selection (#4271) 2026-05-12 11:39:28 +02:00
setting.go Add possibility to remove client email from sub (#4297) 2026-05-13 19:04:17 +02:00
setting_security_test.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
tgbot.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
tgbot_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
traffic_writer.go Fix: traffic writer restart freeze (#4265) 2026-05-12 11:36:05 +02:00
traffic_writer_test.go Fix: traffic writer restart freeze (#4265) 2026-05-12 11:36:05 +02:00
url_safety.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
user.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
warp.go fix(warp): set license against Cloudflare API and surface errors inline 2026-05-13 21:13:16 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray.go fix(xray): resolve relative log paths under panel log folder 2026-05-21 19:15:24 +02:00
xray_metrics.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xray_setting.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
xray_setting_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00