3x-ui/web
MHSanaei 8c8085f985
feat(server): Phase 8 — cut HTML routes over to web/dist/
Production cutover. Every user-facing HTML route now serves the
Vue-3-built bundle from web/dist/ instead of rendering the legacy
Go template; the long-hashed Vite assets are served at /assets/ from
the same embedded filesystem. The legacy templates in web/html/ and
the legacy static tree in web/assets/ are kept on disk for now in
case a quick revert is needed, but nothing the binary serves
references them.

What changed:
- web.go: a new //go:embed dist/* feeds the controller package via
  a SetDistFS hand-off before controller construction. The static
  /assets/ route is rebound: in dev to web/dist/assets/ on disk so
  Vite's incremental rebuilds show up live; in prod to the embedded
  dist via wrapDistFS (rooted one level deeper than wrapAssetsFS).
- controller/dist.go: serveDistPage helper used by every HTML
  handler. Reads dist/<name> from the embedded FS and applies two
  transforms before sending:
    1. injects <script>window.__X_UI_BASE_PATH__="..."</script>
       just before </head> so AppSidebar links resolve under the
       panel's basePath.
    2. when basePath != "/", rewrites Vite's absolute /assets/ URLs
       to <basePath>assets/ so installs running under a custom URL
       prefix load the bundle where the static handler lives.
  HTML responses go out with no-cache so panel upgrades reach
  users on the next refresh; hashed JS/CSS stays cacheable.
- controller/index.go: IndexController.index now serves
  dist/login.html for logged-out callers (the redirect for logged-in
  users is unchanged).
- controller/xui.go: XUIController.{index,inbounds,settings,xraySettings}
  each become a one-line wrapper around serveDistPage.

Smoke checklist for the maintainer:
- run `cd frontend && npm run build` to refresh web/dist/ before
  building the Go binary (the embed snapshot is taken at compile
  time);
- visit /panel/, /panel/inbounds, /panel/settings, /panel/xray and
  confirm each loads its Vue page;
- log out and log back in to verify the login flow;
- confirm the sidebar links navigate correctly under your install's
  basePath;
- POST flows (e.g. saving settings) still need the CSRF token —
  that endpoint (/panel/csrf-token, added earlier) is unchanged.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-08 14:39:55 +02:00
..
assets Axios v1.16.0 2026-05-08 09:41:56 +02:00
controller feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00
entity feat: add configurable auto-restart on client auto-disable 2026-05-04 23:19:25 +02:00
global Refactor code and fix linter warnings (#3627) 2026-01-05 05:54:56 +01:00
html feat(custom-geo): refresh index UI 2026-05-08 10:09:33 +02:00
job fix(fail2ban): fix banning regression and Docker zero-jail issue 2026-05-07 13:53:34 +02:00
locale update dependencies 2026-03-04 13:05:29 +01:00
middleware Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
network docs: add comments for all functions 2025-09-20 09:35:50 +02:00
service fix(warp): harden API client and frontend, bump to v0a4005 2026-05-08 09:29:42 +02:00
session Implement CSRF protection and security hardening across the application (#4179) 2026-05-07 23:36:11 +02:00
translation feat(custom-geo): refresh index UI 2026-05-08 10:09:33 +02:00
websocket ws/inbounds: realtime fixes + perf for 10k+ client inbounds (#4123) 2026-05-05 17:27:49 +02:00
web.go feat(server): Phase 8 — cut HTML routes over to web/dist/ 2026-05-08 14:39:55 +02:00