pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-18 20:05:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): add node-admin token scope for panel updates (#6666)

Browse Source 
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
This commit is contained in:
libmur-dev
2026-10-18 00:45:26 +03:00
committed by GitHub
parent a1f2589eb5
commit a8d0700bf2
42 changed files with 506 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/public/openapi.json
+16 -8
View File
@@ -3,7 +3,7 @@
"info": {
"title": "3X-UI Panel API",
"version": "3.x",
"description": "Programmatic interface to a 3X-UI panel. Authenticate either by logging in (cookie) or with an API token from Settings → Security → API Token (Bearer). All endpoints under /panel/api/* honour both modes — an API token is a full-admin credential, so treat it like the panel password."
"description": "Programmatic interface to a 3X-UI panel. Authenticate either by logging in (cookie) or with a scoped API token from Settings → Security → API Token (Bearer). Token access is limited by its admin, monitor, node-sync, or node-admin scope; treat admin tokens like the panel password."
},
"servers": [
{
@@ -16,7 +16,7 @@
"bearerAuth": {
"type": "http",
"scheme": "bearer",
"description": "API token from Settings → Security → API Token. Send as `Authorization: Bearer <token>`."
"description": "Scoped API token from Settings → Security → API Token. Send as `Authorization: Bearer <token>`."
},
"cookieAuth": {
"type": "apiKey",
@@ -4855,7 +4855,7 @@
},
{
"name": "API Tokens",
"description": "Manage scoped Bearer tokens for programmatic auth. Tokens grant admin, monitor, or node-sync access, may expire, and are stored as SHA-256 hashes. The plaintext is returned only once at creation."
"description": "Manage scoped Bearer tokens for programmatic auth. admin grants the full panel API; monitor is read-only for status and metrics; node-sync manages node configuration without panel updates; node-admin adds panel self-update to node-sync. Tokens may expire and are stored as SHA-256 hashes. The plaintext is returned only once at creation."
},
{
"name": "Xray Settings",
@@ -7184,7 +7184,7 @@
"tags": [
"Server"
],
"summary": "Self-update the panel to the latest version. The server restarts on success.",
"summary": "Self-update the panel to the latest version. The server restarts on success. Bearer-token callers need admin or node-admin scope.",
"operationId": "post_panel_api_server_updatePanel",
"requestBody": {
"required": false,
@@ -13208,9 +13208,11 @@
"obj": [
{
"id": 1,
"name": "default",
"name": "central-panel-a",
"enabled": true,
"createdAt": 1736000000
"createdAt": 1736000000,
"scope": "node-admin",
"expiresAt": 0
}
]
}
@@ -13240,7 +13242,13 @@
},
"scope": {
"type": "string",
"description": "admin (default), monitor, or node-sync."
"enum": [
"admin",
"monitor",
"node-sync",
"node-admin"
],
"description": "admin (default), monitor, node-sync, or node-admin. node-admin inherits node-sync and may also start a panel update."
},
"expiresAt": {
"type": "integer",
@@ -13253,7 +13261,7 @@
},
"example": {
"name": "central-panel-a",
"scope": "node-sync",
"scope": "node-admin",
"expiresAt": 1798761600000
}
}