3x-ui/web/controller
MHSanaei e500c04877
refactor(server): move cached state and helpers into ServerService
ServerController had grown to hold its own status cache, version-list
TTL cache, history-bucket whitelist, and the loop that drove all three
— concerns that belong in the service layer. Pull them out:

- lastStatus + the @2s refresh become ServerService.RefreshStatus and
  ServerService.LastStatus; the controller's cron now just orchestrates
  the cross-service side effects (xrayMetrics sample, websocket broadcast).
- The 15-minute Xray-versions cache (with stale-on-error fallback) moves
  into ServerService.GetXrayVersionsCached, collapsing the controller
  handler to a single call.
- The freedom/blackhole outbound-tag walk used by /xraylogs becomes
  ServerService.GetDefaultLogOutboundTags.
- The allowed-history-bucket whitelist moves to package-level
  service.IsAllowedHistoryBucket, so both NodeController and
  ServerController validate against the same list.

Net result: web/controller/server.go drops from 458 to 365 lines and
contains only HTTP wiring + presentation-y side effects.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-17 18:17:50 +02:00
..
api.go feat(clients): add top-level Clients tab and CRUD API 2026-05-17 07:28:55 +02:00
api_docs_test.go refactor(clients): switch client API endpoints from id to email 2026-05-17 16:41:48 +02:00
base.go v3 2026-05-10 02:13:42 +02:00
client.go refactor(clients): switch client API endpoints from id to email 2026-05-17 16:41:48 +02:00
custom_geo.go v3 2026-05-10 02:13:42 +02:00
dist.go fix: Add base-path meta tag for Cloudflare Rocket Loader compatibility 2026-05-14 23:37:25 +02:00
inbound.go refactor(service): move all client mutation methods to ClientService 2026-05-17 10:48:28 +02:00
index.go fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop 2026-05-13 14:08:16 +02:00
login_limiter.go Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
login_limiter_test.go refactor(websocket): split controller into service + thin controller 2026-05-08 00:00:44 +02:00
node.go refactor(server): move cached state and helpers into ServerService 2026-05-17 18:17:50 +02:00
server.go refactor(server): move cached state and helpers into ServerService 2026-05-17 18:17:50 +02:00
setting.go feat(api-tokens): manage multiple named tokens; add tab/section anchor URLs 2026-05-13 16:34:31 +02:00
util.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
util_test.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
websocket.go v3 2026-05-10 02:13:42 +02:00
xray_setting.go Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275) 2026-05-13 12:52:52 +02:00
xui.go feat(clients): add top-level Clients tab and CRUD API 2026-05-17 07:28:55 +02:00