From 9f96fdb2814ff24418dacb90ac77672c58833581 Mon Sep 17 00:00:00 2001 From: Kuzz007 Date: Tue, 4 Aug 2026 03:07:27 +0300 Subject: [PATCH] Give AmneziaWG its own case in client add/update protocol switches AmneziaWG previously fell into these switches' default branch (just checking client.ID isn't empty), unlike WireGuard's own dedicated case validating PublicKey -- even though AmneziaWG clients need a real key exactly like WireGuard ones (defaultAmneziaWGClients already auto-generates/derives PublicKey the same way). Worked in practice only because the real UI form happens to always populate a UUID regardless of protocol; a minimal API payload with just an email and no key would incorrectly pass validation and no clientId for update lookups. Mirror the existing wireguard cases exactly: validate PublicKey on add, use Email as the update-lookup id (matching is always by email regardless, per the existing comment -- this only affects the non-empty check). --- internal/web/service/client_inbound_apply.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/web/service/client_inbound_apply.go b/internal/web/service/client_inbound_apply.go index 28055a405..a67a49eb1 100644 --- a/internal/web/service/client_inbound_apply.go +++ b/internal/web/service/client_inbound_apply.go @@ -441,6 +441,10 @@ func (s *ClientService) addInboundClient(inboundSvc *InboundService, data *model if client.PublicKey == "" { return false, common.NewError("wireguard client requires a key") } + case "amneziawg": + if client.PublicKey == "" { + return false, common.NewError("amneziawg client requires a key") + } case "mtproto": if client.Secret == "" { return false, common.NewError("mtproto client requires a secret") @@ -622,6 +626,8 @@ func (s *ClientService) UpdateInboundClient(inboundSvc *InboundService, data *mo newClientId = clients[0].Auth case "wireguard": newClientId = clients[0].Email + case "amneziawg": + newClientId = clients[0].Email case "mtproto": newClientId = clients[0].Email default: