3x-ui/web/controller
MHSanaei d9def73ee5
feat(frontend): collapse panel pages into a single React Router SPA
Replaces the 7-entry MPA shell (index/clients/inbounds/nodes/settings/
xray/api-docs HTML files) with one main.tsx + createBrowserRouter. The
Go backend now serves the same index.html for every authenticated
panel route; React Router reads the URL and mounts the page from cache
on subsequent navigation — no more full reloads between tabs.

Frontend
- main.tsx: single bootstrap (setupAxios, i18n, ThemeProvider,
  QueryProvider, RouterProvider) replacing 7 near-duplicate entries
- routes.tsx: declarative router with lazy()-loaded pages, basename
  derived from window.X_UI_BASE_PATH so panels at /secret/panel work
- layouts/PanelLayout.tsx: shell mount-point for the WS → queryClient
  bridge so connection survives navigation
- api/websocketBridge.ts: subscribes the singleton WebSocketClient to
  queryClient and dispatches invalidate/outbounds events to cached
  queries (page-level useWebSocket handlers stay until Phase 3 hooks
  migrate)
- AppSidebar: navigates via useNavigate + useLocation instead of
  window.location.href; drops basePath/requestUri props
- Pages: drop the unused basePath/requestUri locals exposed only for
  the old sidebar

Build
- vite.config: 9 rollup inputs → 3 (index, login, subpage). Dev proxy
  bypass collapses /panel/* to index.html and skips API prefixes
- vendor-tanstack + vendor-router chunks added to manualChunks

Backend
- xui.go: 7 per-page HTML handlers → one panelSPA handler serving
  index.html for /, /inbounds, /clients, /nodes, /settings, /xray,
  /api-docs. The /panel/api, /panel/setting, /panel/xray sub-routers
  are untouched
2026-05-24 18:37:09 +02:00
..
api.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
api_docs_test.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
base.go v3 2026-05-10 02:13:42 +02:00
client.go Reduce list-page payloads with slim/paged endpoints (#4500) 2026-05-23 17:43:43 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go fix: Add base-path meta tag for Cloudflare Rocket Loader compatibility 2026-05-14 23:37:25 +02:00
inbound.go fix(clients): drop tombstone gate that blocked re-import after delete 2026-05-23 23:05:43 +02:00
index.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
server.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
setting.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
util.go Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
util_test.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xui.go feat(frontend): collapse panel pages into a single React Router SPA 2026-05-24 18:37:09 +02:00