libmur-devandlibmur-dev a8d0700bf2 fix(auth): add node-admin token scope for panel updates (#6666) ...

* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <[email protected]>

2026-10-17 23:45:26 +02:00

..

api_auth_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

api.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

base.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

client_happ_test.go

feat(happ): generate Crypt5 subscription links locally (#6494)

2026-09-13 12:44:55 +02:00

client_partial_apply_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client_renewal_preview_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

client.go

feat(clients): preserve traffic counters in portable export/import (#6469)

2026-09-27 02:48:40 +02:00

dist_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

dist.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

geodata_test.go

feat(xray): browse geosite/geoip categories from routing rules (#6165)

2026-08-15 17:12:59 +02:00

group.go

fix(groups): report changed bulk moves without restarting xray (#6199)

2026-08-14 19:50:06 +02:00

host_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

host.go

feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677)

2026-07-08 23:35:20 +02:00

import_db_restart_test.go

fix(web): restart panel after ImportDB so subPath routes match (#6446) (#6456)

2026-09-13 21:39:15 +02:00

inbound_node_sync_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

inbound.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

index.go

feat(panel): add sponsor slots fed from sponsors.sanaei.dev

2026-09-26 03:31:51 +02:00

login_limiter_test.go

chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms

2026-07-25 16:08:09 +02:00

login_limiter.go

Repo-wide self-correcting audit: 54 verified bug fixes (#5970)

2026-07-17 00:33:06 +02:00

node_credentials_writeonly_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

node.go

fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194)

2026-08-15 16:03:42 +02:00

panel_update_test.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

pwa_test.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

pwa.go

feat(web): add network-only PWA installability (#6190)

2026-08-18 15:33:20 +02:00

server.go

fix(server): apply the outbound address policy to remote cert pinning

2026-10-03 13:20:00 +02:00

setting_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

setting.go

feat(discord): add Discord notification bot service (#6486)

2026-09-13 14:04:53 +02:00

spa_test.go

fix(web): serve panel SPA routes from NoRoute (#5536)

2026-06-24 21:19:12 +02:00

spa.go

refactor(frontend): replace axios with the native Fetch API

2026-07-08 01:09:18 +02:00

sub_balancer_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

sub_balancer.go

feat(sub): leastLoad member weights for subscription balancers (#6304)

2026-09-02 20:21:27 +02:00

util_test.go

fix(sub): never use X-Real-IP as the subscription host (#6608)

2026-09-26 21:13:46 +02:00

util.go

fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135)

2026-07-29 21:01:59 +02:00

websocket.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

xray_setting_warp_test.go

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

xray_setting.go

feat(warp): register WARP over MASQUE from the WARP modal

2026-10-11 10:31:01 +02:00