pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-18 20:05:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): add node-admin token scope for panel updates (#6666)

Browse Source 
* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>
This commit is contained in:
libmur-dev
2026-10-18 00:45:26 +03:00
committed by GitHub
parent a1f2589eb5
commit a8d0700bf2
42 changed files with 506 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/inbound.go
+3 -2
View File
@@ -64,10 +64,11 @@ func (a *InboundController) broadcastInboundsUpdate(userId int) {
// node-sync push, so the node stores the row instead of re-judging it.
func (a *InboundController) inboundServiceFor(c *gin.Context) *service.InboundService {
svc := a.inboundService
scope, _ := c.Get("api_token_scope")
scopeValue, _ := c.Get("api_token_scope")
scope, _ := scopeValue.(string)
// A master enrolled with an admin token (the -getApiToken default) has no
// node-sync scope, so it marks every request it sends instead.
svc.FromNodeSync = scope == model.ApiScopeNodeSync || c.GetHeader(wirecodec.MasterPushHeader) != ""
svc.FromNodeSync = model.IsNodeSyncApiScope(scope) || c.GetHeader(wirecodec.MasterPushHeader) != ""
return &svc
}