3x-ui/web/controller
MHSanaei 47ef765c1d
feat(api-docs): expose OpenAPI spec + render Swagger UI in panel
Replaces the hand-rolled API docs UI with industry-standard tooling so
external integrations (Postman, Insomnia, openapi-generator) can
consume the panel API without parsing endpoints.js by hand.

Generator
- frontend/scripts/build-openapi.mjs: walks the existing endpoints.js
  (still the single source of truth) and emits an OpenAPI 3.0.3 spec
  at frontend/public/openapi.json. Handles Gin :param → {param} path
  translation, body / query / path parameter splits, 200 + error
  response examples, and Bearer + cookie security schemes
- npm run build now runs gen:api before vite build, so the spec is
  always in sync with what's documented

Backend
- web/controller/dist.go exposes ServeOpenAPISpec which streams the
  embedded dist/openapi.json with a short Cache-Control. Public
  endpoint (no auth) so Postman can fetch it without first logging in
- web/web.go wires GET /panel/api/openapi.json before the auth-gated
  /panel/api router

Panel
- ApiDocsPage now renders swagger-ui-react fed by the basePath-aware
  openapi.json URL. Dark mode is overridden via CSS targeting the
  Swagger UI internals
- CodeBlock / EndpointRow / EndpointSection are gone; the swagger-ui
  vendor chunk (134 KB gzipped) only loads on this lazy route, not on
  every panel page
- vite.config: vendor-swagger manualChunk keeps the new dep out of
  the main vendor bundle

For Postman: import http://<panel>/panel/api/openapi.json. Everything
from /login + /panel/api/* shows up with auth, params, and examples.
2026-05-24 20:06:36 +02:00
..
api.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
api_docs_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
base.go v3 2026-05-10 02:13:42 +02:00
client.go Reduce list-page payloads with slim/paged endpoints (#4500) 2026-05-23 17:43:43 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go feat(api-docs): expose OpenAPI spec + render Swagger UI in panel 2026-05-24 20:06:36 +02:00
inbound.go fix(clients): drop tombstone gate that blocked re-import after delete 2026-05-23 23:05:43 +02:00
index.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
server.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
setting.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
util.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
util_test.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xui.go feat(frontend): collapse panel pages into a single React Router SPA 2026-05-24 18:37:09 +02:00