mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-28 14:07:13 +00:00
Sanaei
3c087f6fd9
fumadocs-core 16.14.5 switched its search engine from Orama to zbsearch 4,
so the panel docs follow it up to the same major.
zbsearch 4 still rejects locale codes as tokenizer languages ("en" throws,
only "english" is accepted), so the custom search dialog that forces an
English index stays necessary — verified by loading the built static index
for all four locales and searching it through fumadocs' own client.
Around that:
- use `staticClient`, as `oramaStaticClient` is now a deprecated alias
- drop @orama/orama, which nothing depends on or imports any more
- correct the two comments that still described Orama and pointed at its
docs and tokenizer package, one of them suggesting a language zbsearch
does not have
- restore the corepack integrity hash on `packageManager`, which CI reads
through pnpm/action-setup
- prune minimumReleaseAgeExclude entries for versions no longer installed
The API reference MDX changes are serialization-only: fumadocs-openapi
11.2.4 emits plain scalars where it used folded ones. Parsed frontmatter
and page bodies are unchanged.
60 lines
3.4 KiB
Plaintext
60 lines
3.4 KiB
Plaintext
---
|
|
title: Authentication
|
|
description: Two authentication modes are supported. UI sessions use a cookie
|
|
set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
|
|
authenticate with a Bearer token taken from Settings → Security → API Token.
|
|
Both work for every endpoint under /panel/api/*.
|
|
full: true
|
|
_openapi:
|
|
preload:
|
|
- ./public/openapi.json
|
|
toc:
|
|
- depth: 2
|
|
title: Authenticate with username + password and receive a session cookie.
|
|
Required before any cookie-based API call.
|
|
url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
|
|
- depth: 2
|
|
title: Clear the session cookie. Requires the CSRF header for browser sessions.
|
|
url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
|
|
- depth: 2
|
|
title: Mint a CSRF token for the current session. The SPA replays it in the
|
|
X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
|
|
this — the middleware short-circuits CSRF for authenticated API
|
|
requests.
|
|
url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
|
|
- depth: 2
|
|
title: Returns whether 2FA is enabled on the panel — used by the login page to
|
|
decide whether to show the OTP field.
|
|
url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
|
|
structuredData:
|
|
headings:
|
|
- content: Authenticate with username + password and receive a session cookie.
|
|
Required before any cookie-based API call.
|
|
id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
|
|
- content: Clear the session cookie. Requires the CSRF header for browser
|
|
sessions.
|
|
id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
|
|
- content: Mint a CSRF token for the current session. The SPA replays it in the
|
|
X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
|
|
this — the middleware short-circuits CSRF for authenticated API
|
|
requests.
|
|
id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
|
|
- content: Returns whether 2FA is enabled on the panel — used by the login page to
|
|
decide whether to show the OTP field.
|
|
id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
|
|
contents: []
|
|
---
|
|
|
|
{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
|
|
|
|
export default function Layout(props) {
|
|
const { APIPage, OpenAPIPage } = props.components ?? {};
|
|
// "APIPage" is the old name from v10, this allows both for backward compatibility
|
|
const Comp = OpenAPIPage ?? APIPage;
|
|
return (
|
|
<>
|
|
{props.children}
|
|
<Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"},{"path":"/getTwoFactorEnable","method":"post"}]} showTitle />
|
|
</>
|
|
);
|
|
} |