3x-ui/web/controller
MHSanaei 8c8085f985
feat(server): Phase 8 — cut HTML routes over to web/dist/
Production cutover. Every user-facing HTML route now serves the
Vue-3-built bundle from web/dist/ instead of rendering the legacy
Go template; the long-hashed Vite assets are served at /assets/ from
the same embedded filesystem. The legacy templates in web/html/ and
the legacy static tree in web/assets/ are kept on disk for now in
case a quick revert is needed, but nothing the binary serves
references them.

What changed:
- web.go: a new //go:embed dist/* feeds the controller package via
  a SetDistFS hand-off before controller construction. The static
  /assets/ route is rebound: in dev to web/dist/assets/ on disk so
  Vite's incremental rebuilds show up live; in prod to the embedded
  dist via wrapDistFS (rooted one level deeper than wrapAssetsFS).
- controller/dist.go: serveDistPage helper used by every HTML
  handler. Reads dist/<name> from the embedded FS and applies two
  transforms before sending:
    1. injects <script>window.__X_UI_BASE_PATH__="..."</script>
       just before </head> so AppSidebar links resolve under the
       panel's basePath.
    2. when basePath != "/", rewrites Vite's absolute /assets/ URLs
       to <basePath>assets/ so installs running under a custom URL
       prefix load the bundle where the static handler lives.
  HTML responses go out with no-cache so panel upgrades reach
  users on the next refresh; hashed JS/CSS stays cacheable.
- controller/index.go: IndexController.index now serves
  dist/login.html for logged-out callers (the redirect for logged-in
  users is unchanged).
- controller/xui.go: XUIController.{index,inbounds,settings,xraySettings}
  each become a one-line wrapper around serveDistPage.

Smoke checklist for the maintainer:
- run `cd frontend && npm run build` to refresh web/dist/ before
  building the Go binary (the embed snapshot is taken at compile
  time);
- visit /panel/, /panel/inbounds, /panel/settings, /panel/xray and
  confirm each loads its Vue page;
- log out and log back in to verify the login flow;
- confirm the sidebar links navigate correctly under your install's
  basePath;
- POST flows (e.g. saving settings) still need the CSRF token —
  that endpoint (/panel/csrf-token, added earlier) is unchanged.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-08 14:39:55 +02:00
..
api.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
base.go docs: add comments for all functions 2025-09-20 09:35:50 +02:00
custom_geo.go Add SSRF protection (#4044) 2026-04-20 00:18:20 +02:00
dist.go feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00
inbound.go ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123) 2026-05-05 17:27:49 +02:00
index.go feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
server.go fix(panel): silence update-check WARN spam when offline 2026-05-08 09:51:05 +02:00
setting.go ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123) 2026-05-05 17:27:49 +02:00
util.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
websocket.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
xray_setting.go fix: get client reverse tag in the outbound 2026-05-06 00:50:40 +02:00
xui.go feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00