fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds

xray-core builds a Shadowsocks-2022 inbound with users only for the AES
methods: the multi-user identity header is AES-only, so the config
builder and the multi-user server both reject chacha20. Every panel
inbound carries clients, so picking 2022-blake3-chacha20-poly1305 in the
inbound form kept the whole core from starting; its links also failed
on the client with "multi-key is not supported".

The inbound form no longer offers the method and AddInbound/UpdateInbound
reject it. Startup moves stored inbounds to 2022-blake3-aes-256-gcm,
which takes the same 32-byte keys, so every stored key stays valid.
Outbounds keep the method, since a single-key outbound to such a server
works. The share-link generator drops the single-user branch that only
this method reached.

frontend/src/lib/xray/inbound-link.ts

@@ -676,13 +676,8 @@ export interface GenShadowsocksLinkInput {
   externalProxy?: ExternalProxyEntry | null;
 }
 
-// Shadowsocks 2022 share link. The userinfo portion is base64(method:pw)
-// for single-user and base64(method:settingsPw:clientPw) for multi-user
-// 2022-blake3. Legacy SS (non-2022) leaves the password out of the
-// userinfo entirely — matches the legacy class's password-array logic.
-// Note: legacy `isSSMultiUser` returns true for everything except
-// 2022-blake3-chacha20-poly1305 (a curious classification, but we
-// preserve it for byte-stable parity).
+// Shadowsocks share link: base64(method:clientPw) for legacy SS, and
+// percent-encoded method:serverPw:clientPw for 2022-blake3 (SIP022).
 export function genShadowsocksLink(input: GenShadowsocksLinkInput): string {
   const {
     inbound,
@@ -725,10 +720,9 @@ export function genShadowsocksLink(input: GenShadowsocksLinkInput): string {
   }
 
   const isSS2022 = settings.method.substring(0, 4) === '2022';
-  const isSSMultiUser = settings.method !== '2022-blake3-chacha20-poly1305';
   const passwords: string[] = [];
   if (isSS2022) passwords.push(settings.password);
-  if (isSSMultiUser) passwords.push(clientPassword);
+  passwords.push(clientPassword);
 
   if (isSS2022) {
     // SIP022 (2022-blake3-*) forbids base64 userinfo: method and each key are
@@ -1430,10 +1424,8 @@ export function getInboundClients(inbound: Inbound): ClientShape[] | null {
       return (inbound.settings.clients ?? []) as ClientShape[];
     case 'tuic':
       return (inbound.settings.clients ?? []) as ClientShape[];
-    case 'shadowsocks': {
-      const isMultiUser = inbound.settings.method !== '2022-blake3-chacha20-poly1305';
-      return isMultiUser ? ((inbound.settings.clients ?? []) as ClientShape[]) : null;
-    }
+    case 'shadowsocks':
+      return (inbound.settings.clients ?? []) as ClientShape[];
     default:
       return null;
   }
@@ -1493,18 +1485,16 @@ export function genLink(input: GenLinkInput): string {
         flow: client.flow,
         externalProxy,
       });
-    case 'shadowsocks': {
-      const isMultiUser = inbound.settings.method !== '2022-blake3-chacha20-poly1305';
+    case 'shadowsocks':
       return genShadowsocksLink({
         inbound,
         address,
         port,
         forceTls,
         remark,
-        clientPassword: isMultiUser ? (client.password ?? '') : '',
+        clientPassword: client.password ?? '',
         externalProxy,
       });
-    }
     case 'trojan':
       return genTrojanLink({
         inbound,

frontend/src/pages/inbounds/form/protocols/shadowsocks.tsx

@@ -5,7 +5,7 @@ import { useFormContext } from 'react-hook-form';
 
 import { RandomUtil } from '@/utils';
 import { FormField } from '@/components/form/rhf';
-import { SSMethodSchema } from '@/schemas/protocols/shared/shadowsocks';
+import { SSInboundMethodSchema } from '@/schemas/protocols/shared/shadowsocks';
 
 interface ShadowsocksFieldsProps {
   isSSWith2022: boolean;
@@ -23,7 +23,7 @@ export default function ShadowsocksFields({ isSSWith2022 }: ShadowsocksFieldsPro
           setValue('settings.password', RandomUtil.randomShadowsocksPassword(v as string));
         }}
       >
-        <Select options={SSMethodSchema.options.map((m) => ({ value: m, label: m }))} />
+        <Select options={SSInboundMethodSchema.options.map((m) => ({ value: m, label: m }))} />
       </FormField>
       {isSSWith2022 && (
         <Form.Item label={t('password')}>

frontend/src/schemas/protocols/inbound/shadowsocks.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 
-import { SSMethodSchema } from '../shared/shadowsocks';
+import { SSInboundMethodSchema } from '../shared/shadowsocks';
 
 export const SSNetworkSchema = z.enum(['tcp', 'udp', 'tcp,udp']);
 export type SSNetwork = z.infer<typeof SSNetworkSchema>;
@@ -30,7 +30,7 @@ export const ShadowsocksClientSchema = z.object({
 export type ShadowsocksClient = z.infer<typeof ShadowsocksClientSchema>;
 
 export const ShadowsocksInboundSettingsSchema = z.object({
-  method: SSMethodSchema.default('2022-blake3-aes-256-gcm'),
+  method: SSInboundMethodSchema.default('2022-blake3-aes-256-gcm'),
   password: z.string().default(''),
   network: SSNetworkSchema.default('tcp,udp'),
   clients: z.array(ShadowsocksClientSchema).default([]),

frontend/src/schemas/protocols/shared/shadowsocks.ts

@@ -10,3 +10,7 @@ export const SSMethodSchema = z.enum([
   '2022-blake3-chacha20-poly1305',
 ]);
 export type SSMethod = z.infer<typeof SSMethodSchema>;
+
+// xray-core refuses a 2022 chacha20 inbound with users: the multi-user identity
+// header is AES-only, and every panel inbound carries users.
+export const SSInboundMethodSchema = SSMethodSchema.exclude(['2022-blake3-chacha20-poly1305']);

frontend/src/test/inbound-from-db.test.ts

@@ -266,16 +266,6 @@ describe('getInboundClients with schema-shaped inbound', () => {
     expect(getInboundClients(inbound)).toHaveLength(1);
   });
 
-  it('returns null for SS single-user', () => {
-    const inbound = inboundFromDb({
-      ...BASE_DB_FIELDS,
-      protocol: 'shadowsocks',
-      settings: { method: '2022-blake3-chacha20-poly1305', password: 'pw', clients: [] },
-      streamSettings: { network: 'tcp', security: 'none' },
-    });
-    expect(getInboundClients(inbound)).toBeNull();
-  });
-
   it('returns null for non-client protocols (http/mixed/tun/tunnel)', () => {
     for (const protocol of ['http', 'mixed', 'tun', 'tunnel']) {
       const inbound = inboundFromDb({

frontend/src/test/shadowsocks-inbound-method.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { ShadowsocksInboundSettingsSchema } from '@/schemas/protocols/inbound/shadowsocks';
+import { SSMethodSchema } from '@/schemas/protocols/shared/shadowsocks';
+
+// xray-core refuses 2022-blake3-chacha20-poly1305 on an inbound with users (the
+// multi-user identity header is AES-only), and every panel inbound carries users.
+describe('shadowsocks inbound method', () => {
+  it('rejects 2022-blake3-chacha20-poly1305 on an inbound', () => {
+    const parsed = ShadowsocksInboundSettingsSchema.safeParse({
+      method: '2022-blake3-chacha20-poly1305',
+    });
+    expect(parsed.success).toBe(false);
+    expect(parsed.error?.issues[0].path).toEqual(['method']);
+  });
+
+  it('still accepts the AES 2022 and the legacy chacha methods', () => {
+    for (const method of ['2022-blake3-aes-256-gcm', 'chacha20-ietf-poly1305']) {
+      expect(ShadowsocksInboundSettingsSchema.parse({ method }).method).toBe(method);
+    }
+  });
+
+  // A single-key outbound to a 2022-chacha20 server works, so only inbounds lose it.
+  it('keeps 2022-blake3-chacha20-poly1305 for outbounds', () => {
+    expect(SSMethodSchema.parse('2022-blake3-chacha20-poly1305')).toBe(
+      '2022-blake3-chacha20-poly1305',
+    );
+  });
+});