3x-ui/internal/web/service/xray_config_clients_test.go

package service

import (
	"encoding/json"
	"testing"

	"github.com/mhsanaei/3x-ui/v3/internal/database"
	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
	"github.com/mhsanaei/3x-ui/v3/internal/xray"
)

func seedVlessInbound(t *testing.T, tag string, port int, clients []model.Client) {
	t.Helper()
	setupSettingTestDB(t)
	db := database.GetDB()
	in := &model.Inbound{
		Tag:      tag,
		Enable:   true,
		Port:     port,
		Protocol: model.VLESS,
		Settings: `{"clients":[],"decryption":"none"}`,
	}
	if err := db.Create(in).Error; err != nil {
		t.Fatalf("create vless inbound: %v", err)
	}
	svc := ClientService{}
	if err := svc.SyncInbound(nil, in.Id, clients); err != nil {
		t.Fatalf("SyncInbound: %v", err)
	}
}

func disableClients(t *testing.T, emails ...string) {
	t.Helper()
	if err := database.GetDB().Model(&model.ClientRecord{}).
		Where("email IN ?", emails).
		Update("enable", false).Error; err != nil {
		t.Fatalf("disable clients: %v", err)
	}
}

func emittedClients(t *testing.T, tag string) (any, bool) {
	t.Helper()
	svc := &XrayService{}
	cfg, err := svc.GetXrayConfig()
	if err != nil {
		t.Fatalf("GetXrayConfig: %v", err)
	}
	for i := range cfg.InboundConfigs {
		if cfg.InboundConfigs[i].Tag != tag {
			continue
		}
		var s map[string]any
		if err := json.Unmarshal([]byte(cfg.InboundConfigs[i].Settings), &s); err != nil {
			t.Fatalf("unmarshal emitted settings: %v", err)
		}
		v, ok := s["clients"]
		return v, ok
	}
	t.Fatalf("inbound %q not found in generated config", tag)
	return nil, false
}

func TestGetXrayConfig_EmptyClientListIsArrayNotNull(t *testing.T) {
	seedVlessInbound(t, "vless-empty", 43101, []model.Client{
		{Email: "gone@x", ID: "11111111-1111-1111-1111-111111111111", Enable: true},
	})
	disableClients(t, "gone@x")

	value, present := emittedClients(t, "vless-empty")
	if !present {
		t.Fatal("the clients key must be present on a vless inbound")
	}
	if value == nil {
		t.Fatal(`settings.clients must be [] when every client is filtered out, got null`)
	}
	list, ok := value.([]any)
	if !ok {
		t.Fatalf("settings.clients must be an array, got %T", value)
	}
	if len(list) != 0 {
		t.Fatalf("a disabled client must not reach the config, got %d entries", len(list))
	}
}

func TestGetXrayConfig_EnabledClientsStillEmitted(t *testing.T) {
	seedVlessInbound(t, "vless-mixed", 43102, []model.Client{
		{Email: "live@x", ID: "22222222-2222-2222-2222-222222222222", Enable: true},
		{Email: "off@x", ID: "33333333-3333-3333-3333-333333333333", Enable: true},
	})
	disableClients(t, "off@x")

	value, _ := emittedClients(t, "vless-mixed")
	list, ok := value.([]any)
	if !ok {
		t.Fatalf("settings.clients must be an array, got %T", value)
	}
	if len(list) != 1 {
		t.Fatalf("expected only the enabled client, got %d entries: %#v", len(list), list)
	}
	entry, ok := list[0].(map[string]any)
	if !ok {
		t.Fatalf("client entry must be an object, got %T", list[0])
	}
	if entry["email"] != "live@x" {
		t.Errorf("wrong client emitted: %#v", entry)
	}
	if entry["id"] != "22222222-2222-2222-2222-222222222222" {
		t.Errorf("client id not carried through: %#v", entry)
	}
}

// A flow kept from a TCP+REALITY stream makes xray demand Vision on a transport that cannot run it
// without VLESS encryption: "XTLS only supports TLS and REALITY directly". XDRIVE refuses it even
// inside VLESS encryption since xray-core 26.10.17 (#7182).
func TestGetXrayConfig_OmitsVisionFlowOnIneligibleStream(t *testing.T) {
	cases := []struct {
		name     string
		stream   string
		settings string
	}{
		{
			"xdrive vlessenc", `{"network":"xdrive","security":"none","xdriveSettings":{"service":"local","remoteFolder":"/tmp/shared"}}`,
			`{"clients":[],"decryption":"` + goldenVlessDecryption + `"}`,
		},
		{"ws over tls", `{"network":"ws","security":"tls","wsSettings":{"path":"/"}}`, `{"clients":[],"decryption":"none"}`},
	}
	for i, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			tag := "stale-flow"
			seedVlessInbound(t, tag, 43110+i, []model.Client{
				{Email: "vision@x", ID: "44444444-4444-4444-4444-444444444444", Enable: true, Flow: "xtls-rprx-vision"},
			})
			if err := database.GetDB().Model(&model.Inbound{}).Where("tag = ?", tag).
				Updates(map[string]any{"stream_settings": tc.stream, "settings": tc.settings}).Error; err != nil {
				t.Fatalf("set stream: %v", err)
			}
			value, _ := emittedClients(t, tag)
			list, ok := value.([]any)
			if !ok || len(list) != 1 {
				t.Fatalf("settings.clients = %#v, want the one enabled client", value)
			}
			entry, _ := list[0].(map[string]any)
			if flow, present := entry["flow"]; present {
				t.Fatalf("flow %q emitted for a %s stream", flow, tc.name)
			}
		})
	}
}

// xray-core runs Vision over TLS/REALITY on RAW, or over VLESS encryption on any transport but XDRIVE.
func TestGetXrayConfig_KeepsVisionFlowWhereTheCoreRunsIt(t *testing.T) {
	const vlessenc = `{"clients":[],"decryption":"mlkem768x25519plus.native.600s.WB3OymHLL_DJ1jdHiqcMC-u84TgvfNFlgbZIJE-NtUQ"}`
	cases := []struct {
		name     string
		stream   string
		settings string
	}{
		{"tcp reality", `{"network":"tcp","security":"reality","realitySettings":{}}`, `{"clients":[],"decryption":"none"}`},
		{"raw vlessenc", `{"network":"tcp","security":"none"}`, vlessenc},
		{"ws vlessenc", `{"network":"ws","security":"none","wsSettings":{"path":"/"}}`, vlessenc},
	}
	for i, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			tag := "vision-flow"
			seedVlessInbound(t, tag, 43120+i, []model.Client{
				{Email: "vision@x", ID: "55555555-5555-5555-5555-555555555555", Enable: true, Flow: "xtls-rprx-vision"},
			})
			if err := database.GetDB().Model(&model.Inbound{}).Where("tag = ?", tag).
				Updates(map[string]any{"stream_settings": tc.stream, "settings": tc.settings}).Error; err != nil {
				t.Fatalf("set stream: %v", err)
			}
			value, _ := emittedClients(t, tag)
			list, _ := value.([]any)
			if len(list) != 1 {
				t.Fatalf("settings.clients = %#v, want one client", value)
			}
			if entry, _ := list[0].(map[string]any); entry["flow"] != "xtls-rprx-vision" {
				t.Fatalf("flow = %#v, want xtls-rprx-vision kept on %s", entry["flow"], tc.name)
			}
		})
	}
}

// With an empty client list xray-core runs a Shadowsocks-2022 inbound as a single-user
// server, and the server key it then accepts alone is the first half of every client's password.
func TestShadowsocks2022WithoutEnabledClientsStaysLocked(t *testing.T) {
	setupSettingTestDB(t)
	key := "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
	in := &model.Inbound{
		Tag: "ss-2022", Enable: true, Port: 43110, Protocol: model.Shadowsocks,
		Settings: `{"method":"2022-blake3-aes-256-gcm","password":"` + key + `","network":"tcp,udp","clients":[]}`,
	}
	if err := database.GetDB().Create(in).Error; err != nil {
		t.Fatalf("create shadowsocks inbound: %v", err)
	}
	if err := (&ClientService{}).SyncInbound(nil, in.Id, []model.Client{{Email: "only@x", Password: key, Enable: true}}); err != nil {
		t.Fatalf("SyncInbound: %v", err)
	}
	disableClients(t, "only@x")

	onlyLocked := func(where string, clients any) {
		t.Helper()
		list, _ := clients.([]any)
		if len(list) != 1 {
			t.Fatalf("%s: clients = %v, want only the locked placeholder", where, clients)
		}
		if email, _ := list[0].(map[string]any)["email"].(string); email != xray.LockedShadowsocks2022Email {
			t.Fatalf("%s: client %v served, want only the locked placeholder", where, list[0])
		}
	}
	emitted, _ := emittedClients(t, in.Tag)
	onlyLocked("config", emitted)

	var stored model.Inbound
	if err := database.GetDB().First(&stored, in.Id).Error; err != nil {
		t.Fatalf("read inbound: %v", err)
	}
	runtimeInbound, err := (&InboundService{}).buildInboundForLocalRuntime(database.GetDB(), &stored)
	if err != nil {
		t.Fatalf("buildInboundForLocalRuntime: %v", err)
	}
	var settings map[string]any
	if err := json.Unmarshal([]byte(runtimeInbound.Settings), &settings); err != nil {
		t.Fatalf("unmarshal runtime settings: %v", err)
	}
	onlyLocked("local runtime", settings["clients"])
}