25f2002654 f6a233220a perf(auth): look up api tokens by their hash index (#6915) ...

Every bearer-authenticated request, including each node-sync call, loaded all
enabled api_tokens rows and compared each stored SHA-256 hash in constant time.
Tokens are stored hashed, so the database can compare hashes directly: a
timing leak there reveals only a stored hash, which cannot authenticate. The
lookup is now one indexed seek on idx_api_tokens_token, which AutoMigrate
creates from the model tag on new and existing databases; scope and expiry
are still checked afterwards.

2026-10-24 05:06:49 +02:00

..

dbtest

fix(database): create the first panel user with random credentials

2026-10-24 01:26:05 +02:00

model

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

api_token_timestamp_test.go

feat(api): scoped, optionally expiring API tokens (#6201)

2026-08-15 15:31:49 +02:00

backup_test.go

chore: refresh dependencies and modernize Go test idioms

2026-07-30 03:14:22 +02:00

client_email_lower_index_test.go

perf(clients): write client_inbounds deltas and check identity from the clients table

2026-08-20 04:09:57 +02:00

client_hwid_schema_test.go

feat(sub): add per-client subscription HWID limits (#5802)

2026-08-15 16:50:20 +02:00

client_weekly_renew_migration_test.go

feat(clients): add calendar weekly renewal and schedule previews (#6524)

2026-09-26 22:59:23 +02:00

client_weekly_renew_postgres_test.go

feat(clients): add calendar weekly renewal and schedule previews (#6524)

2026-09-26 22:59:23 +02:00

db_permissions_test.go

fix(database): keep the SQLite store owner-only (#6390)

2026-09-03 16:37:35 +02:00

db_reopen_test.go

fix(database): close the pool a second InitDB replaces

2026-09-27 15:32:17 +02:00

db_seed_test.go

fix(database): create the first panel user with random credentials

2026-10-24 01:26:05 +02:00

db_settled_test.go

fix(database): stop noisy per-startup errors in the Postgres server log

2026-07-01 23:07:05 +02:00

db.go

feat(notifications): add a failed-check threshold for node.down alerts (#6768)

2026-10-24 04:26:13 +02:00

dialect.go

fix(node-sync): do not latch node disable when master allows (#6870) (#6876)

2026-10-23 19:04:46 +02:00

dns_outbound_legacy_keys_migration_test.go

fix(xray): migrate the dns outbound off its legacy nonIPQuery and blockTypes (#6519)

2026-09-14 12:30:23 +02:00

dns_outbound_qtype_zero_test.go

fix(xray): stop a lone dns qType 0 from matching every query

2026-09-15 16:00:05 +02:00

dump_sqlite_test.go

fix(database): keep the dump restore inside its own database file

2026-10-03 13:19:54 +02:00

dump_sqlite.go

fix(database): keep the dump restore inside its own database file

2026-10-03 13:19:54 +02:00

fail2ban_state_test.go

fix(database): keep IP limits when the fail2ban probe is inconclusive (#6176)

2026-08-14 20:12:07 +02:00

freedom_domain_strategy_migration_test.go

fix(xray): read an outbound protocol id the way the core does (#6521)

2026-09-14 19:52:27 +03:00

freedom_finalrules_migration_test.go

fix(db): harden unrestricted freedom outbounds (#6184)

2026-08-14 20:07:30 +02:00

host_migration_test.go

fix(database): blank boolean-era verifyPeerCertByName values on hosts

2026-10-12 18:16:22 +02:00

host_test.go

feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677)

2026-07-08 23:35:20 +02:00

inbound_dedupe_test.go

fix(client): stop duplicate client entries accumulating in inbound settings

2026-07-05 21:17:25 +02:00

inbound_exclude_from_sub_migration_test.go

feat(inbound): excludeFromSub hides links without disabling (#6463)

2026-09-27 12:26:37 +02:00

inbound_port_unique_migration_test.go

fix(database): drop the legacy UNIQUE constraint on inbounds.port

2026-07-11 22:48:56 +02:00

index_tags_test.go

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

journal_mode_test.go

fix(database): create SQLite backup snapshots online (#6137)

2026-07-29 21:04:55 +02:00

migrate_data_test.go

fix(database): make cross-db migration lossless, transactional, and pre-checked

2026-07-12 20:14:07 +02:00

migrate_data.go

feat(tuic): implement native in-process Go TUIC v5 server (#6577)

2026-10-03 02:56:02 +02:00

migration_models_test.go

fix(database): make cross-db migration lossless, transactional, and pre-checked

2026-07-12 20:14:07 +02:00

mtproto_migration_test.go

fix(mtproto): stop persisting a vestigial inbound-level secret

2026-07-06 17:55:57 +02:00

node_down_notified_migration_test.go

feat(notifications): add a failed-check threshold for node.down alerts (#6768)

2026-10-24 04:26:13 +02:00

outbound_removed_keys_migration_test.go

feat(xray): update xray-core to v26.9.8 and adapt panel

2026-09-08 13:49:32 +02:00

prepare_sqlite_test.go

fix(database): make cross-db migration lossless, transactional, and pre-checked

2026-07-12 20:14:07 +02:00

reality_finalmask_migration_test.go

Bug-label issue sweep: 16 fixes (#6083)

2026-07-23 15:34:42 +02:00

removed_cipher_migration_test.go

feat(xray): update xray-core to v26.7.11 and adapt panel

2026-07-12 00:30:47 +02:00

rewriter_protocol_case_test.go

fix(xray): read an outbound protocol id the way the core does (#6521)

2026-09-14 19:52:27 +03:00

seeder_fastpath_test.go

Repo-wide self-correcting audit: 54 verified bug fixes (#5970)

2026-07-17 00:33:06 +02:00

settings_index_test.go

perf(db): add an index on settings.key (#5359)

2026-06-20 15:08:54 +03:30

shadowsocks_server_key_migration_test.go

fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds

2026-10-11 21:20:07 +02:00

traffic_overflow_repair_test.go

fix(db): clamp traffic counters below int64 max and repair overflowed rows

2026-07-05 20:33:09 +02:00

udphop_client_mask_migration_test.go

fix(finalmask): hop client UDP through the udphop mask

2026-10-11 11:20:34 +02:00

wireguard_domain_strategy_migration_test.go

feat(xray): update xray-core to v26.9.30 and adapt panel

2026-10-02 13:54:39 +02:00

wireguard_migration_test.go

feat(wireguard): multi-client support

2026-06-28 00:44:38 +02:00

xdns_finalmask_migration_test.go

feat(xray): update xray-core to v26.10.10 and adapt panel

2026-10-11 07:55:12 +02:00