From 2969f6e91dc891f9827e3a6f832f925066f30856 Mon Sep 17 00:00:00 2001
From: MHSanaei <ho3ein.sanaei@gmail.com>
Date: Tue, 9 Jun 2026 12:57:59 +0200
Subject: [PATCH] fix(client): preserve UUID/password/auth on partial client
 update (#5111)

---
 web/service/client.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/web/service/client.go b/web/service/client.go
index 20cb13261..f2114eaed 100644
--- a/web/service/client.go
+++ b/web/service/client.go
@@ -779,6 +779,20 @@ func (s *ClientService) Update(inboundSvc *InboundService, id int, updated model
 		updated.CreatedAt = existing.CreatedAt
 	}
 
+	// Preserve existing credentials when the caller omits them, so a partial
+	// update (e.g. only changing traffic/expiry) doesn't silently rotate the
+	// client's UUID/password/auth via fillProtocolDefaults. Supplying a new
+	// value still rotates it intentionally.
+	if updated.ID == "" {
+		updated.ID = existing.UUID
+	}
+	if updated.Password == "" {
+		updated.Password = existing.Password
+	}
+	if updated.Auth == "" {
+		updated.Auth = existing.Auth
+	}
+
 	if updated.Email != existing.Email {
 		var collisionCount int64
 		if err := database.GetDB().Model(&model.ClientRecord{}).