xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-16 00:01:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): scoped, optionally expiring API tokens (#6201)

Browse Source 
* security(api): add scoped expiring API tokens

* security(api): make scoped token lifecycle enforceable

---------

Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>
This commit is contained in:
n0ctal
2026-08-15 18:31:49 +05:00
committed by GitHub
parent aecbad3ab1
commit 1230559e69
19 changed files with 785 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/setting.go
+17 -5
View File
@@ -216,11 +216,18 @@ func (a *SettingController) getDefaultXrayConfig(c *gin.Context) {
}
type apiTokenCreateForm struct {
Name string `json:"name" form:"name"`
Name string `json:"name" form:"name"`
Scope string `json:"scope" form:"scope"`
ExpiresAt int64 `json:"expiresAt" form:"expiresAt"`
}
type apiTokenEnabledForm struct {
Enabled bool `json:"enabled" form:"enabled"`
Enabled bool `json:"enabled" form:"enabled"`
ExpectedScope string `json:"expectedScope" form:"expectedScope"`
}
type apiTokenScopeForm struct {
ExpectedScope string `json:"expectedScope" form:"expectedScope"`
}
func (a *SettingController) listApiTokens(c *gin.Context) {
@@ -238,7 +245,7 @@ func (a *SettingController) createApiToken(c *gin.Context) {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
return
}
row, err := a.apiTokenService.Create(form.Name)
row, err := a.apiTokenService.Create(form.Name, form.Scope, form.ExpiresAt)
if err != nil {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
return
@@ -252,7 +259,12 @@ func (a *SettingController) deleteApiToken(c *gin.Context) {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
return
}
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.Delete(id))
form := &apiTokenScopeForm{}
if bindErr := c.ShouldBind(form); bindErr != nil {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), bindErr)
return
}
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.DeleteExpectedScope(id, form.ExpectedScope))
}
func (a *SettingController) setApiTokenEnabled(c *gin.Context) {
@@ -266,7 +278,7 @@ func (a *SettingController) setApiTokenEnabled(c *gin.Context) {
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), bindErr)
return
}
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.SetEnabled(id, form.Enabled))
jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), a.apiTokenService.SetEnabledExpectedScope(id, form.ExpectedScope, form.Enabled))
}
func (a *SettingController) testSmtp(c *gin.Context) {