3x-ui/web
MHSanaei 47ef765c1d
feat(api-docs): expose OpenAPI spec + render Swagger UI in panel
Replaces the hand-rolled API docs UI with industry-standard tooling so
external integrations (Postman, Insomnia, openapi-generator) can
consume the panel API without parsing endpoints.js by hand.

Generator
- frontend/scripts/build-openapi.mjs: walks the existing endpoints.js
  (still the single source of truth) and emits an OpenAPI 3.0.3 spec
  at frontend/public/openapi.json. Handles Gin :param → {param} path
  translation, body / query / path parameter splits, 200 + error
  response examples, and Bearer + cookie security schemes
- npm run build now runs gen:api before vite build, so the spec is
  always in sync with what's documented

Backend
- web/controller/dist.go exposes ServeOpenAPISpec which streams the
  embedded dist/openapi.json with a short Cache-Control. Public
  endpoint (no auth) so Postman can fetch it without first logging in
- web/web.go wires GET /panel/api/openapi.json before the auth-gated
  /panel/api router

Panel
- ApiDocsPage now renders swagger-ui-react fed by the basePath-aware
  openapi.json URL. Dark mode is overridden via CSS targeting the
  Swagger UI internals
- CodeBlock / EndpointRow / EndpointSection are gone; the swagger-ui
  vendor chunk (134 KB gzipped) only loads on this lazy route, not on
  every panel page
- vite.config: vendor-swagger manualChunk keeps the new dep out of
  the main vendor bundle

For Postman: import http://<panel>/panel/api/openapi.json. Everything
from /login + /panel/api/* shows up with auth, params, and examples.
2026-05-24 20:06:36 +02:00
..
controller feat(api-docs): expose OpenAPI spec + render Swagger UI in panel 2026-05-24 20:06:36 +02:00
entity Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
global Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
job Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
locale v3 2026-05-10 02:13:42 +02:00
middleware Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
runtime Feat/multi inbound clients (#4469) 2026-05-19 12:20:24 +02:00
service feat(clients): add inbound filter + mobile page-size control 2026-05-23 23:31:41 +02:00
session Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
translation i18n: translate hardcoded inbound action + security warning strings (#4502) 2026-05-23 19:43:21 +02:00
websocket fix(websocket): order register/unregister via single ops channel 2026-05-19 12:34:53 +02:00
web.go feat(api-docs): expose OpenAPI spec + render Swagger UI in panel 2026-05-24 20:06:36 +02:00