3x-ui/web/controller
MHSanaei 7fda988fb2
feat(backend): gate request bodies with go-playground/validator
Add a generic BindAndValidate helper in web/middleware that wraps gin's
content-aware binder with an explicit validator.Struct call and emits a
structured `entity.Msg{Obj: ValidationPayload{Issues...}}` on failure so
the frontend can map each issue to an i18n key.

Tag the user-facing fields on model.Inbound, model.Node, and
entity.AllSetting with the range/enum constraints they were previously
relying on hand-rolled CheckValid logic (or nothing) to enforce, and
wire the helper into the inbound/node/settings controllers that bind
those structs directly. Promotes validator/v10 from indirect to direct
require, plus six unit tests covering valid payloads, range violations,
enum violations, malformed JSON, in-place binding, and JSON-only strict
mode.

This is PR1 of a planned end-to-end Zod rollout — controllers using
local form structs (custom_geo, setEnable, fallbacks, client) keep
their existing handling and will be migrated as their schemas firm up.
2026-05-25 19:17:54 +02:00
..
api.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
api_docs_test.go refactor(frontend): port api-docs/endpoints to TypeScript 2026-05-25 15:29:26 +02:00
base.go v3 2026-05-10 02:13:42 +02:00
client.go Reduce list-page payloads with slim/paged endpoints (#4500) 2026-05-23 17:43:43 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00
inbound.go feat(backend): gate request bodies with go-playground/validator 2026-05-25 19:17:54 +02:00
index.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go feat(backend): gate request bodies with go-playground/validator 2026-05-25 19:17:54 +02:00
server.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
setting.go feat(backend): gate request bodies with go-playground/validator 2026-05-25 19:17:54 +02:00
util.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
util_test.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xui.go feat(frontend): TanStack Query + React Router migration & in-panel API docs (#4541) 2026-05-24 21:34:52 +02:00