feat(clients): bind host rules to individual clients in subscriptions (#6620)

Host rules applied per inbound only, so every client of an inbound got the same
subscription endpoints (#6618). A client can now be bound to one or more host
rules, and its raw, JSON and Clash subscriptions render only those hosts, in
either subscription order; an unbound client is unchanged. A binding whose hosts
are deleted, disabled or excluded from the format fails closed: the client gets
no links there but stays in traffic accounting. Host edits keep row ids, so
bindings survive them; nil leaves a stored binding alone and an empty list
clears it.

internal/sub/clash_service.go

@@ -58,6 +58,7 @@ func (s *SubClashService) getClash(subId string, host string, legacy bool) (stri
 	var proxies []map[string]any
 	var ordered []orderedSubEntry[func() []map[string]any]
 	var hasInactiveExternal bool
+	var hasBoundClosed bool
 	var hasEnabledClient bool
 
 	seenEmails := make(map[string]struct{})
@@ -73,9 +74,11 @@ func (s *SubClashService) getClash(subId string, host string, legacy bool) (stri
 			continue
 		}
 		subReq.projectThroughFallbackMaster(inbound)
+		var baseEps []map[string]any
+		baseStream := inbound.StreamSettings
 		if !subReq.hostsFirst {
-			if hostEps := subReq.hostEndpoints(inbound, "clash"); len(hostEps) > 0 {
-				injectExternalProxy(inbound, hostEps)
+			if baseEps = subReq.hostEndpoints(inbound, "clash"); len(baseEps) > 0 {
+				injectExternalProxy(inbound, baseEps)
 			}
 		}
 		for _, client := range clients {
@@ -84,13 +87,26 @@ func (s *SubClashService) getClash(subId string, host string, legacy bool) (stri
 			}
 			seenEmails[client.Email] = struct{}{}
 			if subReq.hostsFirst {
-				for _, variant := range subReq.subscriptionHostVariants(inbound, "clash") {
+				variants, closed := subReq.clientHostVariants(inbound, client, "clash")
+				hasBoundClosed = hasBoundClosed || closed
+				for _, variant := range variants {
 					render := func() []map[string]any { return s.getProxies(subReq, variant.inbound(subReq, inbound), client, host) }
 					ordered = append(ordered, orderedSubEntry[func() []map[string]any]{variant.order, render})
 				}
-			} else {
-				proxies = append(proxies, s.getProxies(subReq, inbound, client, host)...)
+				continue
 			}
+			effective := inbound
+			if effectiveEps, bound := subReq.clientHostEndpoints(inbound, client, "clash", baseEps); bound {
+				if len(effectiveEps) == 0 {
+					hasBoundClosed = true
+					continue
+				}
+				clone := *inbound
+				clone.StreamSettings = baseStream
+				injectExternalProxy(&clone, effectiveEps)
+				effective = &clone
+			}
+			proxies = append(proxies, s.getProxies(subReq, effective, client, host)...)
 		}
 	}
 	if subReq.hostsFirst {
@@ -120,7 +136,7 @@ func (s *SubClashService) getClash(subId string, host string, legacy bool) (stri
 		}
 	}
 
-	if len(proxies) == 0 && !hasInactiveExternal {
+	if len(proxies) == 0 && !hasInactiveExternal && !hasBoundClosed {
 		return "", "", nil
 	}
 	if legacy {

internal/sub/host_order_test.go

@@ -208,6 +208,9 @@ func renderedHostAddresses(t *testing.T, format string, base *SubService) []stri
 				} `json:"settings"`
 			} `json:"outbounds"`
 		}
+		if body == "" {
+			break
+		}
 		if err := json.Unmarshal([]byte(body), &docs); err != nil {
 			t.Fatal(err)
 		}
@@ -277,3 +280,32 @@ func TestSub_HostOrderExpandsCIDRHosts(t *testing.T) {
 		}
 	}
 }
+
+// A client bound to host rules must get only those hosts in the hosts-first order too, on every
+// format, and a binding whose hosts are all gone must render nothing rather than every host.
+func TestSub_HostOrderRespectsClientHostBindings(t *testing.T) {
+	seedSubDB(t)
+	setHostSortMode(t, "hosts-first")
+	ib := seedSubInbound(t, "order-sub", "bound", 46920, 0, wsTLSStream)
+	seedHost(t, &model.Host{GroupId: "a", InboundId: ib.Id, SortOrder: 0, Remark: "A", Address: "a.example.com"})
+	b := seedHost(t, &model.Host{GroupId: "b", InboundId: ib.Id, SortOrder: 1, Remark: "B", Address: "b.example.com"})
+	bind := func(ids ...int) {
+		t.Helper()
+		if err := database.GetDB().Model(&model.ClientRecord{}).Where("sub_id = ?", "order-sub").
+			Update("client_host_rule_ids", model.EncodeClientHostRuleIds(ids)).Error; err != nil {
+			t.Fatal(err)
+		}
+	}
+	bind(b.Id)
+	for _, format := range []string{"raw", "clash", "json"} {
+		if got := renderedHostAddresses(t, format, NewSubService("")); !reflect.DeepEqual(got, []string{"b.example.com"}) {
+			t.Fatalf("%s addresses = %v, want only the bound host", format, got)
+		}
+	}
+	bind(999999)
+	for _, format := range []string{"raw", "clash", "json"} {
+		if got := renderedHostAddresses(t, format, NewSubService("")); len(got) != 0 {
+			t.Fatalf("%s addresses = %v, want none for a binding whose hosts are gone", format, got)
+		}
+	}
+}

internal/sub/host_sub.go

@@ -11,6 +11,86 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/logger"
 )
 
+// hostBinding is how a client's host binding applies to one inbound.
+type hostBinding int
+
+const (
+	hostBindingNone   hostBinding = iota // nothing bound here: the inbound's own hosts apply
+	hostBindingClosed                    // bound, but no bound host survives: render nothing
+	hostBindingBound                     // render only the returned bound hosts of this inbound
+)
+
+// clientHostBinding resolves the client's bound host rules against one inbound. A binding whose
+// every id is gone fails closed; a missing id beside a live one never silences other inbounds.
+func (s *SubService) clientHostBinding(inbound *model.Inbound, client model.Client) (hostBinding, []*model.Host) {
+	ids := model.EffectiveClientHostRuleIds(client)
+	if len(ids) == 0 || database.GetDB() == nil {
+		return hostBindingNone, nil
+	}
+	var rows []model.Host
+	if err := database.GetDB().Where("id IN ?", ids).Find(&rows).Error; err != nil {
+		logger.Warning("SubService - clientHostBinding:", err)
+		return hostBindingClosed, nil
+	}
+	if len(rows) == 0 {
+		return hostBindingClosed, nil
+	}
+	byId := make(map[int]*model.Host, len(rows))
+	for i := range rows {
+		byId[rows[i].Id] = &rows[i]
+	}
+	var here []*model.Host
+	for _, id := range ids {
+		if h, ok := byId[id]; ok && h.InboundId == inbound.Id {
+			here = append(here, h)
+		}
+	}
+	if len(here) == 0 {
+		return hostBindingNone, nil
+	}
+	return hostBindingBound, here
+}
+
+// clientHostEndpoints returns the endpoints of the client's usable bound hosts on this inbound, or
+// baseEps when nothing is bound here; (nil, true) fails closed, and the caller still accounts the client.
+func (s *SubService) clientHostEndpoints(inbound *model.Inbound, client model.Client, format string, baseEps []map[string]any) ([]map[string]any, bool) {
+	state, hosts := s.clientHostBinding(inbound, client)
+	switch state {
+	case hostBindingNone:
+		return baseEps, false
+	case hostBindingClosed:
+		return nil, true
+	}
+	defaultDest := s.resolveInboundAddress(inbound)
+	var eps []map[string]any
+	for _, h := range hosts {
+		if h.IsDisabled || slices.Contains(h.ExcludeFromSubTypes, format) {
+			continue
+		}
+		eps = append(eps, hostEndpointMaps(h, defaultDest, inbound.Port)...)
+	}
+	return eps, true
+}
+
+// clientHostVariants narrows the hosts-first variants of an inbound to the client's bound hosts;
+// closed reports a binding that leaves this client nothing to render on the inbound.
+func (s *SubService) clientHostVariants(inbound *model.Inbound, client model.Client, format string) (variants []subscriptionHostVariant, closed bool) {
+	all := s.subscriptionHostVariants(inbound, format)
+	state, hosts := s.clientHostBinding(inbound, client)
+	switch state {
+	case hostBindingNone:
+		return all, false
+	case hostBindingClosed:
+		return nil, true
+	}
+	for _, v := range all {
+		if v.host != nil && slices.ContainsFunc(hosts, func(h *model.Host) bool { return h.Id == v.host.Id }) {
+			variants = append(variants, v)
+		}
+	}
+	return variants, len(variants) == 0
+}
+
 // hostEndpoints loads an inbound's enabled hosts for the given subscription
 // format ("raw"|"json"|"clash") and returns them as externalProxy-shaped maps so
 // the existing per-format renderers can fan out one link/proxy per host. Returns

internal/sub/host_sub_test.go

@@ -14,6 +14,9 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+	"github.com/mhsanaei/3x-ui/v3/internal/web/entity"
+	"github.com/mhsanaei/3x-ui/v3/internal/web/service"
+	"github.com/mhsanaei/3x-ui/v3/internal/xray"
 )
 
 func seedSubDB(t *testing.T) {
@@ -999,3 +1002,649 @@ func TestSub_HostCIDR_ClashAndJson(t *testing.T) {
 		t.Errorf("JSON config should contain numbered host outbounds: %s", jsonDoc)
 	}
 }
+
+// seedSubClient adds a second client sharing subId to an already-seeded
+// inbound, so per-client host bindings can be compared within one sub.
+func seedSubClient(t *testing.T, ib *model.Inbound, subId, email string) {
+	t.Helper()
+	db := database.GetDB()
+	uuid := "22222222-3333-4444-8555-" + fmt.Sprintf("%012d", ib.Id)
+	client := &model.ClientRecord{Email: email, SubID: subId, UUID: uuid, Enable: true}
+	if err := db.Create(client).Error; err != nil {
+		t.Fatalf("seed client %s: %v", email, err)
+	}
+	if err := db.Create(&model.ClientInbound{ClientId: client.Id, InboundId: ib.Id}).Error; err != nil {
+		t.Fatalf("seed client_inbound %s: %v", email, err)
+	}
+}
+
+const tcpTLSStream = `{"network":"tcp","security":"tls","tlsSettings":{"serverName":"base.sni"}}`
+
+// A bound host with blank address and port must use the inbound's own, even after an earlier
+// client rewrote the shared inbound's Listen/Port while rendering its endpoints.
+func TestSub_JsonBoundHostBlankAddressIgnoresEarlierClient(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "mv", 4491, 1, tcpTLSStream)
+	// Host A has a real address and sorts last, so the unbound client (lower
+	// id, rendered first) leaves the shared inbound pointing at a.cdn.com:443.
+	seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls"})
+	// Host B is override-only: blank address and port, so the bound client's
+	// endpoint must inherit the inbound's own address and port.
+	hostB := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 0, Remark: "B", Security: "tls", Sni: "b.sni"})
+	seedSubClient(t, ib, "s1", "bound@e")
+
+	if err := database.GetDB().Model(&model.ClientRecord{}).Where("email = ?", "bound@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostB.Id})).Error; err != nil {
+		t.Fatalf("bind host rule: %v", err)
+	}
+
+	out, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+	if err != nil {
+		t.Fatalf("GetJson: %v", err)
+	}
+	type config struct {
+		Remarks   string `json:"remarks"`
+		Outbounds []struct {
+			Tag      string `json:"tag"`
+			Settings struct {
+				Address string `json:"address"`
+				Port    int    `json:"port"`
+			} `json:"settings"`
+		} `json:"outbounds"`
+	}
+	var docs []config
+	if err := json.Unmarshal([]byte(out), &docs); err != nil {
+		t.Fatalf("unmarshal json sub: %v\n%s", err, out)
+	}
+	var got struct {
+		address string
+		port    int
+	}
+	for _, doc := range docs {
+		if !strings.Contains(doc.Remarks, "bound@e") {
+			continue
+		}
+		for _, ob := range doc.Outbounds {
+			if ob.Tag == "proxy" {
+				got.address, got.port = ob.Settings.Address, ob.Settings.Port
+			}
+		}
+	}
+	if got.address == "" {
+		t.Fatalf("no proxy outbound found for the bound client:\n%s", out)
+	}
+	if got.address != ib.Listen || got.port != ib.Port {
+		t.Fatalf("override-only host resolved to %s:%d, want the inbound's own %s:%d",
+			got.address, got.port, ib.Listen, ib.Port)
+	}
+}
+
+// A client bound to one host renders only that host's link with its SNI,
+// while an unbound client on the same inbound still fans out to every host.
+func TestSub_ClientHostRule_SingleBinding(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "cb", 443, 1, tcpTLSStream)
+	seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
+	hostB := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 2, Remark: "B", Address: "b.cdn.com", Port: 443, Security: "tls", Sni: "b.sni"})
+	seedSubClient(t, ib, "s1", "other@e")
+
+	db := database.GetDB()
+	if err := db.Model(&model.ClientRecord{}).Where("email = ?", "cb@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostB.Id})).Error; err != nil {
+		t.Fatalf("bind host rule: %v", err)
+	}
+
+	links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetSubs: %v", err)
+	}
+	parts := strings.Split(strings.Join(links, "\n"), "\n")
+	if len(parts) != 3 {
+		t.Fatalf("bound client renders 1 link, unbound renders 2, got %d: %v", len(parts), parts)
+	}
+	bound := 0
+	for _, l := range parts {
+		if strings.Contains(l, "b.cdn.com:443") {
+			bound++
+			if !strings.Contains(l, "sni=b.sni") {
+				t.Fatalf("bound link must carry the bound host SNI: %s", l)
+			}
+		}
+	}
+	if bound != 2 {
+		t.Fatalf("want 2 links via b.cdn.com (1 bound + 1 unbound fan-out), got %d: %v", bound, parts)
+	}
+	aLinks := 0
+	for _, l := range parts {
+		if strings.Contains(l, "a.cdn.com:443") {
+			aLinks++
+			if strings.Contains(l, "sni=b.sni") {
+				t.Fatalf("unbound host-A link must not carry host-B SNI: %s", l)
+			}
+		}
+	}
+	if aLinks != 1 {
+		t.Fatalf("want exactly 1 link via a.cdn.com (unbound fan-out), got %d: %v", aLinks, parts)
+	}
+}
+
+// A client bound to several host rules renders one link per bound host,
+// and only those hosts — a third inbound host stays out of its links.
+func TestSub_ClientHostRule_MultipleBindings(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "mb", 444, 1, tcpTLSStream)
+	hostA := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
+	hostB := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 2, Remark: "B", Address: "b.cdn.com", Port: 443, Security: "tls", Sni: "b.sni"})
+	seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 3, Remark: "C", Address: "c.cdn.com", Port: 443, Security: "tls", Sni: "c.sni"})
+
+	db := database.GetDB()
+	if err := db.Model(&model.ClientRecord{}).Where("email = ?", "mb@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostA.Id, hostB.Id})).Error; err != nil {
+		t.Fatalf("bind host rules: %v", err)
+	}
+
+	links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetSubs: %v", err)
+	}
+	joined := strings.Join(links, "\n")
+	parts := strings.Split(joined, "\n")
+	if len(parts) != 2 {
+		t.Fatalf("two bound hosts must yield two links, got %d: %v", len(parts), parts)
+	}
+	if !strings.Contains(joined, "sni=a.sni") || !strings.Contains(joined, "sni=b.sni") {
+		t.Fatalf("each bound host SNI must appear: %s", joined)
+	}
+	if strings.Contains(joined, "c.cdn.com") {
+		t.Fatalf("unbound host must not render for the bound client: %s", joined)
+	}
+}
+
+// A deleted binding is skipped; with no valid binding left the client fails closed with zero
+// links (no fallback, no dummy link) but stays in traffic accounting.
+func TestSub_ClientHostRule_DeletedFallsBack(t *testing.T) {
+	t.Run("deleted and valid binding renders only the valid host", func(t *testing.T) {
+		seedSubDB(t)
+		ib := seedSubInbound(t, "s1", "fb", 445, 1, tcpTLSStream)
+		seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
+		hostB := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 2, Remark: "B", Address: "b.cdn.com", Port: 443, Security: "tls", Sni: "b.sni"})
+
+		db := database.GetDB()
+		if err := db.Model(&model.ClientRecord{}).Where("email = ?", "fb@e").
+			Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{9999, hostB.Id})).Error; err != nil {
+			t.Fatalf("bind host rules: %v", err)
+		}
+
+		links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+		if err != nil {
+			t.Fatalf("GetSubs: %v", err)
+		}
+		parts := strings.Split(strings.Join(links, "\n"), "\n")
+		if len(parts) != 1 {
+			t.Fatalf("deleted id skipped, want only the valid host's link, got %d: %v", len(parts), parts)
+		}
+		if !strings.Contains(parts[0], "b.cdn.com:443") || !strings.Contains(parts[0], "sni=b.sni") {
+			t.Fatalf("valid bound host must render with its SNI: %s", parts[0])
+		}
+		if strings.Contains(parts[0], "a.cdn.com") {
+			t.Fatalf("unbound host must not render for the bound client: %s", parts[0])
+		}
+	})
+
+	t.Run("deleted-only binding fails closed with zero links", func(t *testing.T) {
+		seedSubDB(t)
+		ib := seedSubInbound(t, "s1", "fb", 445, 1, tcpTLSStream)
+		seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
+		seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 2, Remark: "B", Address: "b.cdn.com", Port: 443, Security: "tls", Sni: "b.sni"})
+
+		db := database.GetDB()
+		if err := db.Model(&model.ClientRecord{}).Where("email = ?", "fb@e").
+			Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{9999})).Error; err != nil {
+			t.Fatalf("bind host rule: %v", err)
+		}
+		if err := db.Create(&xray.ClientTraffic{InboundId: ib.Id, Email: "fb@e", Up: 100, Down: 200, Enable: true}).Error; err != nil {
+			t.Fatalf("seed traffic: %v", err)
+		}
+
+		links, _, _, traffic, err := NewSubService("").GetSubs("s1", "req.example.com")
+		if err != nil {
+			t.Fatalf("GetSubs: %v", err)
+		}
+		if len(links) != 0 {
+			t.Fatalf("deleted-only binding must emit zero links, got %d: %v", len(links), links)
+		}
+		joined := strings.Join(links, "\n")
+		if strings.Contains(joined, "a.cdn.com") || strings.Contains(joined, "b.cdn.com") {
+			t.Fatalf("fail-closed must not fall back to inbound hosts: %s", joined)
+		}
+		if strings.Contains(joined, "socks://") || strings.Contains(joined, "127.0.0.1") {
+			t.Fatalf("fail-closed must not emit a dummy link: %s", joined)
+		}
+		if traffic.Up != 100 || traffic.Down != 200 {
+			t.Fatalf("usage = up %d/down %d, want 100/200: closed client stays in accounting", traffic.Up, traffic.Down)
+		}
+		if !traffic.Enable {
+			t.Fatalf("traffic.Enable = false, want true: closed client stays enabled")
+		}
+	})
+
+	// A deleted host id must not silence an inbound without the client's other bound hosts:
+	// relevance comes from rows that still exist, fail-closed only when every bound id is gone.
+	t.Run("deleted id on one inbound does not silence an unrelated inbound", func(t *testing.T) {
+		seedSubDB(t)
+		ibA := seedSubInbound(t, "s1", "xa", 4471, 1, tcpTLSStream)
+		ibB := seedSubInbound(t, "s1", "xb", 4472, 2, tcpTLSStream)
+
+		// Put the client on both inbounds under one email.
+		db := database.GetDB()
+		var client model.ClientRecord
+		if err := db.Where("email = ?", "xb@e").First(&client).Error; err != nil {
+			t.Fatalf("load client xb@e: %v", err)
+		}
+		if err := db.Create(&model.ClientInbound{ClientId: client.Id, InboundId: ibA.Id}).Error; err != nil {
+			t.Fatalf("link client to inbound A: %v", err)
+		}
+		// Host A lives on ibA; bind it plus a deleted id 9999.
+		hostA := seedHost(t, &model.Host{InboundId: ibA.Id, SortOrder: 1, Remark: "A", Address: "a.cdn.com", Port: 443, Security: "tls", Sni: "a.sni"})
+		if err := db.Model(&model.ClientRecord{}).Where("email = ?", "xb@e").
+			Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostA.Id, 9999})).Error; err != nil {
+			t.Fatalf("bind host rules: %v", err)
+		}
+
+		links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+		if err != nil {
+			t.Fatalf("GetSubs: %v", err)
+		}
+		joined := strings.Join(links, "\n")
+		// Inbound B has no bound host and none of the ids map to it, so its
+		// legacy fallback link must survive; inbound A still renders host A.
+		if !strings.Contains(joined, "a.cdn.com:443") {
+			t.Fatalf("inbound A's bound host must render: %s", joined)
+		}
+		if !strings.Contains(joined, fmt.Sprintf("203.0.113.5:%d", ibB.Port)) {
+			t.Fatalf("deleted id must not silence inbound B's fallback link: %s", joined)
+		}
+	})
+}
+
+// A client bound to a disabled host fails closed on every format (no links, outbounds or proxies)
+// but stays in traffic accounting, so quota and expiry headers stay correct.
+func TestSub_ClientHostRule_DisabledFailsClosed(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "dis", 447, 1, tcpTLSStream)
+	host := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "D", Address: "dis.cdn.com", Port: 443, Security: "tls", Sni: "dis.sni"})
+
+	db := database.GetDB()
+	if err := db.Model(&model.ClientRecord{}).Where("email = ?", "dis@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{host.Id})).Error; err != nil {
+		t.Fatalf("bind host rules: %v", err)
+	}
+	if err := db.Model(&model.Host{}).Where("id = ?", host.Id).Update("is_disabled", true).Error; err != nil {
+		t.Fatalf("disable host: %v", err)
+	}
+	if err := db.Create(&xray.ClientTraffic{InboundId: ib.Id, Email: "dis@e", Up: 100, Down: 200, Enable: true}).Error; err != nil {
+		t.Fatalf("seed traffic: %v", err)
+	}
+
+	t.Run("raw", func(t *testing.T) {
+		links, _, _, traffic, err := NewSubService("").GetSubs("s1", "req.example.com")
+		if err != nil {
+			t.Fatalf("GetSubs: %v", err)
+		}
+		if len(links) != 0 {
+			t.Fatalf("disabled binding must emit zero links, got %d: %v", len(links), links)
+		}
+		joined := strings.Join(links, "\n")
+		if strings.Contains(joined, "dis.cdn.com") || strings.Contains(joined, "203.0.113.5") {
+			t.Fatalf("fail-closed must not fall back: %s", joined)
+		}
+		if strings.Contains(joined, "socks://") || strings.Contains(joined, "127.0.0.1") {
+			t.Fatalf("fail-closed must not emit a dummy link: %s", joined)
+		}
+		if traffic.Up != 100 || traffic.Down != 200 {
+			t.Fatalf("usage = up %d/down %d, want 100/200", traffic.Up, traffic.Down)
+		}
+	})
+
+	t.Run("json", func(t *testing.T) {
+		out, header, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+		if err != nil {
+			t.Fatalf("GetJson: %v", err)
+		}
+		if strings.TrimSpace(out) != "" {
+			t.Fatalf("disabled binding must emit zero outbounds, got:\n%s", out)
+		}
+		if !strings.HasPrefix(header, "upload=100; download=200; ") {
+			t.Fatalf("header = %q, want usage prefix %q", header, "upload=100; download=200; ")
+		}
+		if strings.Contains(out, "dis.cdn.com") {
+			t.Fatalf("fail-closed json must not contain the disabled host:\n%s", out)
+		}
+	})
+
+	t.Run("clash", func(t *testing.T) {
+		out, header, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
+		if err != nil {
+			t.Fatalf("GetClash: %v", err)
+		}
+		if strings.TrimSpace(out) != "" {
+			t.Fatalf("disabled binding must emit zero proxies, got:\n%s", out)
+		}
+		if !strings.HasPrefix(header, "upload=100; download=200; ") {
+			t.Fatalf("header = %q, want usage prefix %q", header, "upload=100; download=200; ")
+		}
+		if strings.Contains(out, "dis.cdn.com") {
+			t.Fatalf("fail-closed clash must not contain the disabled host:\n%s", out)
+		}
+	})
+
+	t.Run("panel links", func(t *testing.T) {
+		if got := NewLinkProvider().LinksForClient("req.example.com", ib, "dis@e"); len(got) != 0 {
+			t.Fatalf("LinksForClient must emit zero links, got %v", got)
+		}
+		svc := NewSubService("")
+		svc.PrepareForRequest("req.example.com")
+		if got := svc.inboundLinks(ib); len(got) != 0 {
+			t.Fatalf("inboundLinks must emit zero links, got %v", got)
+		}
+	})
+}
+
+// A host excluded from one format fails closed only there: that format emits nothing but keeps
+// accounting, while the other formats still render the host.
+func TestSub_ClientHostRule_FormatExcludedFailsClosed(t *testing.T) {
+	formats := []string{"raw", "json", "clash"}
+	for _, format := range formats {
+		t.Run(format, func(t *testing.T) {
+			seedSubDB(t)
+			ib := seedSubInbound(t, "s1", "exc", 448, 1, tcpTLSStream)
+			host := seedHost(t, &model.Host{
+				InboundId: ib.Id, SortOrder: 1, Remark: "X", Address: "exc.cdn.com", Port: 443,
+				Security: "tls", Sni: "exc.sni", ExcludeFromSubTypes: []string{format},
+			})
+
+			db := database.GetDB()
+			if err := db.Model(&model.ClientRecord{}).Where("email = ?", "exc@e").
+				Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{host.Id})).Error; err != nil {
+				t.Fatalf("bind host rules: %v", err)
+			}
+			if err := db.Create(&xray.ClientTraffic{InboundId: ib.Id, Email: "exc@e", Up: 300, Down: 400, Enable: true}).Error; err != nil {
+				t.Fatalf("seed traffic: %v", err)
+			}
+
+			switch format {
+			case "raw":
+				links, _, _, traffic, err := NewSubService("").GetSubs("s1", "req.example.com")
+				if err != nil {
+					t.Fatalf("GetSubs: %v", err)
+				}
+				if len(links) != 0 {
+					t.Fatalf("format-excluded binding must emit zero links, got %d: %v", len(links), links)
+				}
+				if traffic.Up != 300 || traffic.Down != 400 {
+					t.Fatalf("usage = up %d/down %d, want 300/400", traffic.Up, traffic.Down)
+				}
+				out, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+				if err != nil {
+					t.Fatalf("GetJson: %v", err)
+				}
+				if !strings.Contains(out, "exc.cdn.com") {
+					t.Fatalf("json (not excluded) must still render the host:\n%s", out)
+				}
+				yaml, _, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
+				if err != nil {
+					t.Fatalf("GetClash: %v", err)
+				}
+				if !strings.Contains(yaml, "exc.cdn.com") {
+					t.Fatalf("clash (not excluded) must still render the host:\n%s", yaml)
+				}
+			case "json":
+				out, header, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+				if err != nil {
+					t.Fatalf("GetJson: %v", err)
+				}
+				if strings.TrimSpace(out) != "" {
+					t.Fatalf("format-excluded binding must emit zero outbounds, got:\n%s", out)
+				}
+				if !strings.HasPrefix(header, "upload=300; download=400; ") {
+					t.Fatalf("header = %q, want usage prefix", header)
+				}
+				links, _, _, traffic, err := NewSubService("").GetSubs("s1", "req.example.com")
+				if err != nil {
+					t.Fatalf("GetSubs: %v", err)
+				}
+				if len(links) != 1 || !strings.Contains(links[0], "exc.cdn.com") {
+					t.Fatalf("raw (not excluded) must still render the host: %v", links)
+				}
+				if traffic.Up != 300 || traffic.Down != 400 {
+					t.Fatalf("usage = up %d/down %d, want 300/400", traffic.Up, traffic.Down)
+				}
+			case "clash":
+				yaml, header, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
+				if err != nil {
+					t.Fatalf("GetClash: %v", err)
+				}
+				if strings.TrimSpace(yaml) != "" {
+					t.Fatalf("format-excluded binding must emit zero proxies, got:\n%s", yaml)
+				}
+				if !strings.HasPrefix(header, "upload=300; download=400; ") {
+					t.Fatalf("header = %q, want usage prefix", header)
+				}
+				links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+				if err != nil {
+					t.Fatalf("GetSubs: %v", err)
+				}
+				if len(links) != 1 || !strings.Contains(links[0], "exc.cdn.com") {
+					t.Fatalf("raw (not excluded) must still render the host: %v", links)
+				}
+			}
+		})
+	}
+}
+
+// The bound host's SNI wins in the JSON subscription too, and unbound
+// inbound hosts stay out of the bound client's configs.
+func TestSub_ClientHostRule_JSONSNI(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "jb", 446, 1, tcpTLSStream)
+	host := seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 1, Remark: "J", Address: "j.cdn.com", Port: 443, Security: "tls", Sni: "bound.sni"})
+	seedHost(t, &model.Host{InboundId: ib.Id, SortOrder: 2, Remark: "O", Address: "o.cdn.com", Port: 443, Security: "tls", Sni: "other.sni"})
+
+	db := database.GetDB()
+	if err := db.Model(&model.ClientRecord{}).Where("email = ?", "jb@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{host.Id})).Error; err != nil {
+		t.Fatalf("bind host rules: %v", err)
+	}
+
+	out, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+	if err != nil {
+		t.Fatalf("GetJson: %v", err)
+	}
+	if !strings.Contains(out, "bound.sni") {
+		t.Fatalf("json config must carry the bound host SNI:\n%s", out)
+	}
+	if !strings.Contains(out, "j.cdn.com") {
+		t.Fatalf("json config must dial the bound host address:\n%s", out)
+	}
+	if strings.Contains(out, "other.sni") || strings.Contains(out, "o.cdn.com") {
+		t.Fatalf("json config must not contain the unbound host:\n%s", out)
+	}
+}
+
+// A host bound on inbound A must not leak onto inbound B for a client on
+// both: A renders only the bound host, B keeps its own endpoint.
+func TestSub_ClientHostRule_ScopedToInbound(t *testing.T) {
+	seedSubDB(t)
+	db := database.GetDB()
+	ibA := seedSubInbound(t, "s1", "scope-a", 443, 1, tcpTLSStream)
+	var rec model.ClientRecord
+	if err := db.Where("email = ?", "scope-a@e").First(&rec).Error; err != nil {
+		t.Fatalf("load client record: %v", err)
+	}
+	ibB := &model.Inbound{
+		UserId: 1, Tag: "scope-b", Enable: true, Listen: "203.0.113.5", Port: 8443,
+		Protocol: model.VLESS, Remark: "scope-b", Settings: ibA.Settings,
+		StreamSettings: tcpTLSStream, SubSortIndex: 2,
+	}
+	if err := db.Create(ibB).Error; err != nil {
+		t.Fatalf("seed inbound B: %v", err)
+	}
+	if err := db.Create(&model.ClientInbound{ClientId: rec.Id, InboundId: ibB.Id}).Error; err != nil {
+		t.Fatalf("attach client to inbound B: %v", err)
+	}
+	hostA := seedHost(t, &model.Host{InboundId: ibA.Id, SortOrder: 1, Remark: "HA", Address: "host-a.cdn.com", Port: 9443, Security: "tls", Sni: "host-a.sni"})
+	seedHost(t, &model.Host{InboundId: ibA.Id, SortOrder: 2, Remark: "HA2", Address: "host-a2.cdn.com", Port: 9443, Security: "tls", Sni: "host-a2.sni"})
+	if err := db.Model(&model.ClientRecord{}).Where("id = ?", rec.Id).
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{hostA.Id})).Error; err != nil {
+		t.Fatalf("bind host rule: %v", err)
+	}
+
+	links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetSubs: %v", err)
+	}
+	parts := strings.Split(strings.Join(links, "\n"), "\n")
+	if len(parts) != 2 {
+		t.Fatalf("one link per inbound, got %d: %v", len(parts), parts)
+	}
+	joined := strings.Join(parts, "\n")
+	if got := strings.Count(joined, "host-a.cdn.com"); got != 1 {
+		t.Fatalf("host-a address appears %d times, want once (inbound A only):\n%s", got, joined)
+	}
+	if got := strings.Count(joined, "host-a.sni"); got != 1 {
+		t.Fatalf("host-a SNI appears %d times, want once (inbound A only):\n%s", got, joined)
+	}
+	if strings.Contains(joined, "host-a2.cdn.com") || strings.Contains(joined, "host-a2.sni") {
+		t.Fatalf("unbound host-a2 must not render for the bound client:\n%s", joined)
+	}
+	plain := ""
+	for _, l := range parts {
+		if strings.Contains(l, "203.0.113.5:8443") {
+			plain = l
+		}
+	}
+	if plain == "" {
+		t.Fatalf("inbound B must keep its own endpoint 203.0.113.5:8443:\n%s", joined)
+	}
+	if strings.Contains(plain, "host-a.cdn.com") || strings.Contains(plain, "host-a.sni") {
+		t.Fatalf("inbound B link leaked host A:\n%s", plain)
+	}
+
+	jsOut, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+	if err != nil {
+		t.Fatalf("GetJson: %v", err)
+	}
+	if got := strings.Count(jsOut, "host-a.cdn.com"); got != 1 {
+		t.Fatalf("json host-a address appears %d times, want once:\n%s", got, jsOut)
+	}
+	if got := strings.Count(jsOut, "host-a.sni"); got != 1 {
+		t.Fatalf("json host-a SNI appears %d times, want once:\n%s", got, jsOut)
+	}
+	if strings.Contains(jsOut, "host-a2.cdn.com") || strings.Contains(jsOut, "host-a2.sni") {
+		t.Fatalf("json must not contain the unbound host-a2:\n%s", jsOut)
+	}
+	if !strings.Contains(jsOut, "203.0.113.5") {
+		t.Fatalf("json must keep inbound B on its own address:\n%s", jsOut)
+	}
+
+	yaml, _, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetClash: %v", err)
+	}
+	if got := strings.Count(yaml, "host-a.cdn.com"); got != 1 {
+		t.Fatalf("clash host-a server appears %d times, want once:\n%s", got, yaml)
+	}
+	if strings.Contains(yaml, "host-a2.cdn.com") {
+		t.Fatalf("clash must not contain the unbound host-a2:\n%s", yaml)
+	}
+	if !strings.Contains(yaml, "203.0.113.5") {
+		t.Fatalf("clash must keep inbound B on its own server:\n%s", yaml)
+	}
+}
+
+// Binding survives a host-rule edit: UpdateHostGroup keeps row ids, so
+// raw/JSON/Clash still render only the bound host with the new SNI.
+func TestSub_ClientHostRule_SurvivesGroupEdit(t *testing.T) {
+	seedSubDB(t)
+	ib := seedSubInbound(t, "s1", "edit", 4451, 1, tcpTLSStream)
+	hostSvc := &service.HostService{}
+	created, err := hostSvc.AddHostGroup(&entity.HostGroup{
+		InboundIds: []int{ib.Id},
+		Hosts:      []string{"a.cdn.com:443", "b.cdn.com:443"},
+		Remark:     "orig",
+		Port:       443,
+		Security:   "tls",
+		Sni:        "old.sni",
+	})
+	if err != nil {
+		t.Fatalf("AddHostGroup: %v", err)
+	}
+	if len(created) != 2 {
+		t.Fatalf("created = %d rows, want 2", len(created))
+	}
+	boundId := 0
+	for _, h := range created {
+		if h.Address == "b.cdn.com" {
+			boundId = h.Id
+		}
+	}
+	if boundId == 0 {
+		t.Fatalf("bound host row not found in %v", created)
+	}
+
+	db := database.GetDB()
+	if err := db.Model(&model.ClientRecord{}).Where("email = ?", "edit@e").
+		Update("client_host_rule_ids", model.EncodeClientHostRuleIds([]int{boundId})).Error; err != nil {
+		t.Fatalf("bind host rule: %v", err)
+	}
+
+	g, err := hostSvc.GetHostGroup(created[0].GroupId)
+	if err != nil {
+		t.Fatalf("GetHostGroup: %v", err)
+	}
+	g.Remark = "renamed"
+	g.Sni = "new.sni"
+	if _, err := hostSvc.UpdateHostGroup(g.GroupId, g); err != nil {
+		t.Fatalf("UpdateHostGroup: %v", err)
+	}
+
+	links, _, _, _, err := NewSubService("").GetSubs("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetSubs: %v", err)
+	}
+	parts := strings.Split(strings.Join(links, "\n"), "\n")
+	if len(parts) != 1 {
+		t.Fatalf("edited binding must still render 1 link, got %d: %v", len(parts), parts)
+	}
+	if !strings.Contains(parts[0], "b.cdn.com:443") || !strings.Contains(parts[0], "sni=new.sni") {
+		t.Fatalf("bound link must carry the edited host with new SNI: %s", parts[0])
+	}
+	if strings.Contains(parts[0], "a.cdn.com") || strings.Contains(parts[0], "sni=old.sni") {
+		t.Fatalf("edited binding must not fall back to the unbound host: %s", parts[0])
+	}
+
+	jsOut, _, err := NewSubJsonService("", "", "", "", NewSubService("")).GetJson("s1", "req.example.com", false)
+	if err != nil {
+		t.Fatalf("GetJson: %v", err)
+	}
+	if !strings.Contains(jsOut, "b.cdn.com") || !strings.Contains(jsOut, "new.sni") {
+		t.Fatalf("json must carry the edited bound host with new SNI:\n%s", jsOut)
+	}
+	if strings.Contains(jsOut, "a.cdn.com") || strings.Contains(jsOut, "old.sni") {
+		t.Fatalf("json must not contain the unbound host or old SNI:\n%s", jsOut)
+	}
+
+	yaml, _, err := NewSubClashService(false, "", false, NewSubService("")).GetClash("s1", "req.example.com")
+	if err != nil {
+		t.Fatalf("GetClash: %v", err)
+	}
+	if got := strings.Count(yaml, "b.cdn.com"); got != 1 {
+		t.Fatalf("clash bound host appears %d times, want once:\n%s", got, yaml)
+	}
+	if !strings.Contains(yaml, "new.sni") {
+		t.Fatalf("clash must carry the new SNI:\n%s", yaml)
+	}
+	if strings.Contains(yaml, "a.cdn.com") || strings.Contains(yaml, "old.sni") {
+		t.Fatalf("clash must not contain the unbound host or old SNI:\n%s", yaml)
+	}
+}

internal/sub/json_service.go

@@ -132,6 +132,7 @@ func (s *SubJsonService) GetJson(subId string, host string, alwaysReturnArray bo
 
 	var header string
 	var hasInactiveExternal bool
+	var hasBoundClosed bool
 	var hasEnabledClient bool
 
 	seenEmails := make(map[string]struct{})
@@ -150,9 +151,14 @@ func (s *SubJsonService) GetJson(subId string, host string, alwaysReturnArray bo
 			continue
 		}
 		subReq.projectThroughFallbackMaster(inbound)
+		var baseEps []map[string]any
+		baseStream := inbound.StreamSettings
+		// getConfig rewrites inbound.Listen/Port per endpoint while rendering a client, so bound
+		// endpoints resolve against this pre-loop snapshot.
+		baseInbound := *inbound
 		if !subReq.hostsFirst {
-			if hostEps := subReq.hostEndpoints(inbound, "json"); len(hostEps) > 0 {
-				injectExternalProxy(inbound, hostEps)
+			if baseEps = subReq.hostEndpoints(inbound, "json"); len(baseEps) > 0 {
+				injectExternalProxy(inbound, baseEps)
 			}
 		}
 
@@ -163,16 +169,29 @@ func (s *SubJsonService) GetJson(subId string, host string, alwaysReturnArray bo
 			}
 			seenEmails[client.Email] = struct{}{}
 			if subReq.hostsFirst {
-				for _, variant := range subReq.subscriptionHostVariants(inbound, "json") {
+				variants, closed := subReq.clientHostVariants(&baseInbound, client, "json")
+				hasBoundClosed = hasBoundClosed || closed
+				for _, variant := range variants {
 					render := func() subConfigEntry {
 						configs := s.getConfig(subReq, variant.inbound(subReq, inbound), client, host)
 						return subConfigEntry{sortIndex: inbound.SubSortIndex, id: inbound.Id, configs: configs, hostOrder: variant.order}
 					}
 					ordered = append(ordered, orderedSubEntry[func() subConfigEntry]{variant.order, render})
 				}
-			} else {
-				inboundConfigs = append(inboundConfigs, s.getConfig(subReq, inbound, client, host)...)
+				continue
 			}
+			effective := inbound
+			if effectiveEps, bound := subReq.clientHostEndpoints(&baseInbound, client, "json", baseEps); bound {
+				if len(effectiveEps) == 0 {
+					hasBoundClosed = true
+					continue
+				}
+				clone := baseInbound
+				clone.StreamSettings = baseStream
+				injectExternalProxy(&clone, effectiveEps)
+				effective = &clone
+			}
+			inboundConfigs = append(inboundConfigs, s.getConfig(subReq, effective, client, host)...)
 		}
 		if len(inboundConfigs) > 0 {
 			entries = append(entries, subConfigEntry{
@@ -254,7 +273,7 @@ func (s *SubJsonService) GetJson(subId string, host string, alwaysReturnArray bo
 		}
 	}
 
-	if len(configArray) == 0 && !hasInactiveExternal {
+	if len(configArray) == 0 && !hasInactiveExternal && !hasBoundClosed {
 		return "", "", nil
 	}
 

internal/sub/links.go

@@ -38,9 +38,16 @@ func (p *LinkProvider) SubLinksForSubId(host, subId string) ([]string, error) {
 func (p *LinkProvider) LinksForClient(host string, inbound *model.Inbound, email string) []string {
 	svc := p.build(host)
 	svc.projectThroughFallbackMaster(inbound)
-	if endpoints := svc.hostEndpoints(inbound, "raw"); len(endpoints) > 0 {
-		if client, ok := svc.clientForLink(inbound, email); ok {
-			return splitLinkLines(svc.linkFromHosts(inbound, client, endpoints))
+	baseEps := svc.hostEndpoints(inbound, "raw")
+	if client, ok := svc.clientForLink(inbound, email); ok {
+		effectiveEps, bound := svc.clientHostEndpoints(inbound, client, "raw", baseEps)
+		if bound && len(effectiveEps) == 0 {
+			return nil
+		}
+		if len(effectiveEps) > 0 {
+			if link := svc.linkFromHosts(inbound, client, effectiveEps); link != "" {
+				return splitLinkLines(link)
+			}
 		}
 	}
 	return splitLinkLines(svc.GetLink(inbound, email))

internal/sub/service.go

@@ -513,7 +513,12 @@ func (s *SubService) getSubs(subId string) ([]string, []string, int64, xray.Clie
 			}
 			var link string
 			if s.hostsFirst {
-				for _, variant := range s.subscriptionHostVariants(inbound, "raw") {
+				variants, closed := s.clientHostVariants(inbound, client, "raw")
+				if closed {
+					seenEmails[client.Email] = struct{}{}
+					continue
+				}
+				for _, variant := range variants {
 					render := func() string {
 						if variant.host != nil {
 							return s.linkFromHosts(inbound, client, variant.endpoint(s, inbound))
@@ -522,8 +527,14 @@ func (s *SubService) getSubs(subId string) ([]string, []string, int64, xray.Clie
 					}
 					ordered = append(ordered, orderedSubEntry[func() string]{variant.order, render})
 				}
-			} else if len(hostEps) > 0 {
-				link = s.linkFromHosts(inbound, client, hostEps)
+			} else if effectiveEps, bound := s.clientHostEndpoints(inbound, client, "raw", hostEps); bound && len(effectiveEps) == 0 {
+				seenEmails[client.Email] = struct{}{}
+				continue
+			} else if len(effectiveEps) > 0 {
+				link = s.linkFromHosts(inbound, client, effectiveEps)
+				if link == "" {
+					link = s.GetLink(inbound, client.Email)
+				}
 			} else {
 				link = s.GetLink(inbound, client.Email)
 			}
@@ -601,9 +612,16 @@ func (s *SubService) inboundLinks(inbound *model.Inbound) []string {
 			continue
 		}
 		seen[key] = struct{}{}
+		effectiveEps, bound := s.clientHostEndpoints(inbound, client, "raw", hostEps)
+		if bound && len(effectiveEps) == 0 {
+			continue
+		}
 		var link string
-		if len(hostEps) > 0 {
-			link = s.linkFromHosts(inbound, client, hostEps)
+		if len(effectiveEps) > 0 {
+			link = s.linkFromHosts(inbound, client, effectiveEps)
+			if link == "" {
+				link = s.GetLink(inbound, client.Email)
+			}
 		} else {
 			link = s.GetLink(inbound, client.Email)
 		}