增加稳定版arm支持

.github/workflows/ci-build.yml

@@ -1,70 +0,0 @@
-name: CI Build Check
-
-on:
-  push:
-    branches: ['**']
-  pull_request:
-    branches: ['**']
-
-jobs:
-  frontend:
-    name: Build Frontend
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: vite-frontend
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.19.0'
-
-      - name: Install dependencies
-        run: npm install --legacy-peer-deps
-
-      - name: Build
-        run: npm run build
-
-  backend:
-    name: Build Go Backend
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: go-backend
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-          cache-dependency-path: go-backend/go.sum
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Build
-        run: go build -v ./...
-
-  agent:
-    name: Build Agent
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: go-gost
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-          cache-dependency-path: go-gost/go.sum
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Build
-        run: go build -v .

.github/workflows/deploy-docs.yml

@@ -1,43 +0,0 @@
-name: Deploy Docs
-on:
-  push:
-    branches:
-      - main
-      - master
-      - beta
-    paths:
-      - 'doc/**'
-      - 'mkdocs.yml'
-
-permissions:
-  contents: write
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: 3.x
-
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV 
-
-      - uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
-      - name: Install MkDocs and Material Theme
-        run: pip install mkdocs-material
-
-      - name: Build and Deploy
-        run: mkdocs gh-deploy --force

.github/workflows/docker-build.yml

@@ -1,71 +1,55 @@
-name: Build and Push Images
+name: Build and Push Images Based on Version
 
+# 在这里定义统一版本号
 env:
-  VERSION: "2.0.7-beta"  # 分支推送时使用的默认版本
-  REGISTRY: ghcr.io
+  VERSION: "1.4.3"
 
 on:
   push:
-    tags:
-      - '[0-9]*'  # 匹配 2.0.8, 2.0.8-beta 等格式
+    branches:
+      - main
+      - beta
 
 jobs:
   check-version:
     name: Check Version and Decide Build
     runs-on: ubuntu-latest
     outputs:
-      version: ${{ steps.version.outputs.version }}
-      should_build: ${{ steps.version.outputs.should_build }}
-      should_build_gost: ${{ steps.version.outputs.should_build_gost }}
-      is_tag: ${{ steps.version.outputs.is_tag }}
-      image_owner: ${{ steps.version.outputs.image_owner }}
+      version: ${{ env.VERSION }}
+      should_build: ${{ steps.check-tag.outputs.should_build }}
+      should_build_gost: ${{ steps.check-tag.outputs.should_build_gost }}
+      tag_exists: ${{ steps.check-tag.outputs.tag_exists }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
-      - name: Determine version and build strategy
-        id: version
+      - name: Display version
         run: |
-          # 镜像 owner 需要小写
-          IMAGE_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
-          echo "image_owner=$IMAGE_OWNER" >> $GITHUB_OUTPUT
+          echo "Current version: ${{ env.VERSION }}"
 
-          if [[ "${{ github.ref_type }}" == "tag" ]]; then
-            # Tag 触发：直接使用 tag 名作为版本，全量构建
-            VERSION="${{ github.ref_name }}"
-            echo "🏷️ Tag trigger detected: $VERSION"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "is_tag=true" >> $GITHUB_OUTPUT
-            echo "should_build=true" >> $GITHUB_OUTPUT
-            echo "should_build_gost=true" >> $GITHUB_OUTPUT
-          else
-            # 分支触发：使用 env.VERSION，检查是否需要构建
-            VERSION="${{ env.VERSION }}"
-            echo "🌿 Branch trigger detected, using version: $VERSION"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "is_tag=false" >> $GITHUB_OUTPUT
-
-            # 检查 tag 是否已存在
-            if git rev-parse "$VERSION" >/dev/null 2>&1; then
-              echo "Tag $VERSION already exists"
-              echo "should_build=false" >> $GITHUB_OUTPUT
-
-              # 检查 go-gost 目录是否有变化
-              TAG_COMMIT=$(git rev-list -n 1 "$VERSION")
-              if git diff --quiet --ignore-all-space --ignore-blank-lines $TAG_COMMIT HEAD -- go-gost/ 2>/dev/null; then
-                echo "✅ GOST files unchanged since tag"
-                echo "should_build_gost=false" >> $GITHUB_OUTPUT
-              else
-                echo "🔄 Detected changes in go-gost directory"
-                git diff --stat $TAG_COMMIT HEAD -- go-gost/ || true
-                echo "should_build_gost=true" >> $GITHUB_OUTPUT
-              fi
+      - name: Check if tag exists and detect changes
+        id: check-tag
+        run: |
+          if git rev-parse "${{ env.VERSION }}" >/dev/null 2>&1; then
+            echo "Tag ${{ env.VERSION }} already exists"
+            echo "tag_exists=true" >> $GITHUB_OUTPUT
+            echo "should_build=false" >> $GITHUB_OUTPUT
+            
+            # 检查从tag到现在，go-gost目录下的文件是否有变化
+            TAG_COMMIT=$(git rev-list -n 1 "${{ env.VERSION }}")
+            if git diff --quiet $TAG_COMMIT HEAD -- go-gost/; then
+              echo "✅ GOST files unchanged since tag"
+              echo "should_build_gost=false" >> $GITHUB_OUTPUT
             else
-              echo "Tag $VERSION does not exist, will build all components"
-              echo "should_build=true" >> $GITHUB_OUTPUT
+              echo "🔄 GOST files changed since tag, will rebuild GOST binary"
               echo "should_build_gost=true" >> $GITHUB_OUTPUT
             fi
+          else
+            echo "Tag ${{ env.VERSION }} does not exist, will build all components"
+            echo "should_build=true" >> $GITHUB_OUTPUT
+            echo "should_build_gost=true" >> $GITHUB_OUTPUT
+            echo "tag_exists=false" >> $GITHUB_OUTPUT
           fi
 
   build-gost:
@@ -74,42 +58,48 @@ jobs:
     if: needs.check-version.outputs.should_build_gost == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
         with:
-          go-version: '1.23'
+          go-version: '1.21'
 
       - name: Cache Go modules
-        uses: actions/cache@v4
+        uses: actions/cache@v3
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('go-gost/go.sum') }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
 
       - name: Install UPX
         run: |
-          wget -q https://github.com/upx/upx/releases/download/v4.2.1/upx-4.2.1-amd64_linux.tar.xz
+          wget https://github.com/upx/upx/releases/download/v4.2.1/upx-4.2.1-amd64_linux.tar.xz
           tar -xf upx-4.2.1-amd64_linux.tar.xz
           sudo mv upx-4.2.1-amd64_linux/upx /usr/local/bin/
           rm -rf upx-4.2.1-amd64_linux*
 
       - name: Build GOST binary (AMD64)
         working-directory: ./go-gost
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.version=${{ needs.check-version.outputs.version }}" -o gost-amd64
+        run: |
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o gost-amd64
 
       - name: Build GOST binary (ARM64)
         working-directory: ./go-gost
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${{ needs.check-version.outputs.version }}" -o gost-arm64
+        run: |
+          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o gost-arm64
 
-      - name: Compress with UPX
+      - name: Compress with UPX (AMD64)
         working-directory: ./go-gost
         run: |
           upx --best --lzma gost-amd64
+
+      - name: Compress with UPX (ARM64)
+        working-directory: ./go-gost
+        run: |
           upx --best --lzma gost-arm64
 
       - name: Upload GOST AMD64 artifact
@@ -129,102 +119,86 @@ jobs:
     needs: check-version
     if: needs.check-version.outputs.should_build == 'true'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
 
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+      - name: Log in to DockerHub
+        uses: docker/login-action@v2
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Prepare build args
-        run: |
-          VERSION="${{ needs.check-version.outputs.version }}"
-          {
-            echo "VITE_GITHUB_REPO=https://github.com/${{ github.repository }}"
-            echo "VITE_APP_VERSION=$VERSION"
-          } > ./vite-frontend/.env.production
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Build and push Vite Docker images
         run: |
           VERSION="${{ needs.check-version.outputs.version }}"
-          OWNER="${{ needs.check-version.outputs.image_owner }}"
-
           docker buildx build \
             --platform linux/amd64,linux/arm64 \
             --push \
-            -t ${{ env.REGISTRY }}/${OWNER}/vite-frontend:latest \
-            -t ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION} \
+            -t bqlpfy/vite-frontend:latest \
+            -t bqlpfy/vite-frontend:${VERSION} \
             ./vite-frontend
 
-  build-go-backend:
-    name: Build & Push Go Backend
+  build-java:
+    name: Build & Push Spring Boot Backend
     needs: check-version
     if: needs.check-version.outputs.should_build == 'true'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
+      - name: Set up JDK and Maven
+        uses: actions/setup-java@v3
         with:
-          go-version: '1.23'
+          java-version: 21
+          distribution: 'temurin'
 
-      - name: Cache Go dependencies
-        uses: actions/cache@v4
+      - name: Cache Maven dependencies
+        uses: actions/cache@v3
         with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-backend-${{ hashFiles('go-backend/go.sum') }}
-          restore-keys: ${{ runner.os }}-go-backend-
+          path: ~/.m2
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-m2
 
-      - name: Download dependencies
-        working-directory: ./go-backend
-        run: go mod download
+      - name: Build Java JAR
+        working-directory: ./springboot-backend
+        run: mvn clean package -DskipTests
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
 
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+      - name: Log in to DockerHub
+        uses: docker/login-action@v2
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
-      - name: Build and push Go backend Docker images
+      - name: Build and push Java Docker images
         run: |
           VERSION="${{ needs.check-version.outputs.version }}"
-          OWNER="${{ needs.check-version.outputs.image_owner }}"
-
           docker buildx build \
             --platform linux/amd64,linux/arm64 \
             --push \
-            -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:latest \
-            -t ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION} \
-            ./go-backend
+            -t bqlpfy/springboot-backend:latest \
+            -t bqlpfy/springboot-backend:${VERSION} \
+            ./springboot-backend
 
   create-release:
-    name: Create Release (Tag Only)
-    needs: [check-version, build-gost, build-vite, build-go-backend]
-    if: needs.check-version.outputs.is_tag == 'true'
+    name: Create Release and Tag
+    needs: [check-version, build-gost, build-vite, build-java]
+    if: needs.check-version.outputs.should_build == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
 
       - name: Download GOST AMD64 binary
         uses: actions/download-artifact@v4
@@ -238,118 +212,60 @@ jobs:
           name: gost-binary-arm64
           path: ./artifacts/arm64
 
-      - name: Prepare release files
+      - name: Rename binaries
         run: |
-          VERSION="${{ needs.check-version.outputs.version }}"
-          OWNER="${{ needs.check-version.outputs.image_owner }}"
-          REPO="${{ github.repository }}"
-
-          # 移动二进制文件
           mv ./artifacts/amd64/gost-amd64 ./artifacts/gost-amd64
           mv ./artifacts/arm64/gost-arm64 ./artifacts/gost-arm64
 
-          # 复制并修改 docker-compose 文件
-          cp docker-compose-v4.yml ./artifacts/docker-compose-v4.yml
-          cp docker-compose-v6.yml ./artifacts/docker-compose-v6.yml
-
-          # 替换镜像地址为 GHCR
-          sed -i "s|image: .*flux-panel-backend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
-          sed -i "s|image: .*vite-frontend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v4.yml
-          sed -i "s|image: .*flux-panel-backend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}|g" ./artifacts/docker-compose-v6.yml
-          sed -i "s|image: .*vite-frontend:[^[:space:]]*|image: ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}|g" ./artifacts/docker-compose-v6.yml
-
-          # 复制并修改安装脚本
-          cp install.sh ./artifacts/install.sh
-          cp panel_install.sh ./artifacts/panel_install.sh
-
-          # 替换仓库地址和版本号
-          sed -i "s|bqlpfy/flux-panel|${REPO}|g" ./artifacts/install.sh
-          sed -i "s|bqlpfy/flux-panel|${REPO}|g" ./artifacts/panel_install.sh
-          sed -i "s|2.0.7-beta|${VERSION}|g" ./artifacts/install.sh
-          sed -i "s|2.0.7-beta|${VERSION}|g" ./artifacts/panel_install.sh
-
-          # 注入固定版本号，使从 Release 页下载的脚本只安装该版本
-          sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/install.sh
-          sed -i "s|^PINNED_VERSION=\"\"|PINNED_VERSION=\"${VERSION}\"|" ./artifacts/panel_install.sh
-
       - name: Create Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           VERSION="${{ needs.check-version.outputs.version }}"
-          OWNER="${{ needs.check-version.outputs.image_owner }}"
-
+          
+          # 创建并推送 tag
+          git tag "${VERSION}" ${{ github.sha }}
+          git push origin "${VERSION}"
+          
           # 获取 commit 信息
           COMMIT_MSG=$(git log -1 --pretty=format:"%s")
           COMMIT_AUTHOR=$(git log -1 --pretty=format:"%an")
           COMMIT_DATE=$(git log -1 --pretty=format:"%ai")
-
+          
           # 创建 release
           gh release create "${VERSION}" \
             --title "Release ${VERSION}" \
-            --notes "## 📝 Release Information
-
-          - **Version**: ${VERSION}
-          - **Commit**: [\`${GITHUB_SHA:0:7}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }})
+            --notes "## 📝 Commit Information
+          - **Message**: ${COMMIT_MSG}
           - **Author**: ${COMMIT_AUTHOR}
           - **Date**: ${COMMIT_DATE}
-          - **Message**: ${COMMIT_MSG}
-
-          ## 📦 Docker Images
-
-          \`\`\`bash
-          # Backend
-          docker pull ${{ env.REGISTRY }}/${OWNER}/flux-panel-backend:${VERSION}
-
-          # Frontend
-          docker pull ${{ env.REGISTRY }}/${OWNER}/vite-frontend:${VERSION}
-          \`\`\`
-
-          ## 🚀 Quick Install
-
-          **Panel (安装此版本 ${VERSION}):**
-          \`\`\`bash
-          curl -L https://github.com/${{ github.repository }}/releases/download/${VERSION}/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
-          \`\`\`
-
-          **Node (安装此版本 ${VERSION}):**
-          \`\`\`bash
-          curl -L https://github.com/${{ github.repository }}/releases/download/${VERSION}/install.sh -o install.sh && chmod +x install.sh && ./install.sh
-          \`\`\`
-
-          **安装最新版:**
-          \`\`\`bash
-          # 面板端
-          curl -L https://raw.githubusercontent.com/${{ github.repository }}/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
-          # 节点端
-          curl -L https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
-          \`\`\`" \
+          - **Commit**: [\`${GITHUB_SHA:0:7}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }})" \
             --repo ${{ github.repository }}
-
+          
           # 上传所有文件到 release
           echo "📤 上传 GOST 二进制文件..."
           gh release upload "${VERSION}" ./artifacts/gost-amd64 --clobber
           gh release upload "${VERSION}" ./artifacts/gost-arm64 --clobber
-
+          
           echo "📤 上传安装脚本..."
-          gh release upload "${VERSION}" ./artifacts/install.sh --clobber
-          gh release upload "${VERSION}" ./artifacts/panel_install.sh --clobber
-
+          gh release upload "${VERSION}" ./install.sh --clobber
+          gh release upload "${VERSION}" ./panel_install.sh --clobber
+          
           echo "📤 上传 Docker Compose 配置文件..."
-          gh release upload "${VERSION}" ./artifacts/docker-compose-v4.yml --clobber
-          gh release upload "${VERSION}" ./artifacts/docker-compose-v6.yml --clobber
-
-          echo "✅ Release ${VERSION} 创建完成"
+          gh release upload "${VERSION}" ./docker-compose-v4.yml --clobber
+          gh release upload "${VERSION}" ./docker-compose-v6.yml --clobber
+          
+          echo "✅ 所有文件已上传到 Release ${VERSION}"
 
   update-release-gost:
     name: Update GOST Binaries in Release
     needs: [check-version, build-gost]
-    if: needs.check-version.outputs.is_tag == 'false' && needs.check-version.outputs.should_build == 'false' && needs.check-version.outputs.should_build_gost == 'true'
+    if: needs.check-version.outputs.should_build == 'false' && needs.check-version.outputs.should_build_gost == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
 
       - name: Download GOST AMD64 binary
         uses: actions/download-artifact@v4
@@ -373,10 +289,42 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           VERSION="${{ needs.check-version.outputs.version }}"
-
+          
           echo "🔄 更新 Release ${VERSION} 中的 GOST 二进制文件..."
-
+          
           gh release upload "${VERSION}" ./artifacts/gost-amd64 --clobber
           gh release upload "${VERSION}" ./artifacts/gost-arm64 --clobber
+          
+          echo "✅ GOST 二进制文件更新完成！"
+          echo "ℹ️ Docker 镜像未重新构建"
 
-          echo "✅ GOST 二进制文件更新完成"
+  update-release-files:
+    name: Update Release Files Only
+    needs: check-version
+    if: needs.check-version.outputs.tag_exists == 'true' && needs.check-version.outputs.should_build == 'false' && needs.check-version.outputs.should_build_gost == 'false'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Update Release Files
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${{ needs.check-version.outputs.version }}"
+          
+          echo "📤 更新 Release ${VERSION} 中的脚本和配置文件..."
+          
+          # 上传安装脚本（覆盖）
+          echo "📤 更新安装脚本..."
+          gh release upload "${VERSION}" ./install.sh --clobber
+          gh release upload "${VERSION}" ./panel_install.sh --clobber
+          
+          # 上传 Docker Compose 配置文件（覆盖）
+          echo "📤 更新 Docker Compose 配置文件..."
+          gh release upload "${VERSION}" ./docker-compose-v4.yml --clobber
+          gh release upload "${VERSION}" ./docker-compose-v6.yml --clobber
+          
+          echo "✅ 文件更新完成！Release ${VERSION} 中的脚本和配置已更新"
+          echo "ℹ️ Docker 镜像和 GOST 二进制未重新构建"

.gitignore

@@ -176,7 +176,6 @@ build/
 *.so
 *.dylib
 your_app.exe
-go-backend/paneld
 
 # Go 测试二进制文件
 *.test
@@ -257,8 +256,4 @@ gitee/
 *.cert
 doraemon.jks
 device.id
-commit.sh
-sql/
-!go-backend/internal/store/sqlite/sql/
-!go-backend/internal/store/sqlite/sql/schema.sql
-!go-backend/internal/store/sqlite/sql/data.sql
+commit.sh

.sisyphus/plans/001-setup-dev-environment.md

@@ -1,71 +0,0 @@
-# Plan: 搭建开发环境
-
-## 目标
-为 Flux Panel 项目安装所有缺失的开发依赖，使 3 个子项目都能本地开发和构建。
-
-## 当前状态
-
-### ✅ 已安装
-| 工具 | 版本 | 用途 |
-|------|------|------|
-| Node.js | v20.19.2 | vite-frontend |
-| npm | 9.2.0 | vite-frontend |
-| Go | 1.24.4 | go-gost |
-| Docker | 29.1.4 | 容器化部署 |
-
-### ❌ 缺失
-| 工具 | 需求版本 | 用途 |
-|------|----------|------|
-| Java | 21 | springboot-backend |
-| Maven | 3.x | 构建后端 |
-| Docker Compose | v2 | 容器编排 |
-
----
-
-## 执行任务
-
-### Task 1: 安装 Java 21
-```bash
-apt-get update && apt-get install -y openjdk-21-jdk
-```
-**验证**: `java -version` 应显示 openjdk 21
-
-### Task 2: 安装 Maven
-```bash
-apt-get install -y maven
-```
-**验证**: `mvn -v` 应显示 Maven 3.x
-
-### Task 3: 安装 Docker Compose Plugin
-```bash
-apt-get install -y docker-compose-plugin
-```
-**验证**: `docker compose version` 应显示版本号
-
-### Task 4: 安装前端依赖
-```bash
-cd /root/flux-panel/vite-frontend && npm install
-```
-**验证**: `node_modules/` 目录存在
-
-### Task 5: 验证后端可构建
-```bash
-cd /root/flux-panel/springboot-backend && mvn clean compile -q
-```
-**验证**: 编译成功无错误
-
-### Task 6: 验证 Go 模块
-```bash
-cd /root/flux-panel/go-gost && go mod download
-```
-**验证**: 依赖下载成功
-
----
-
-## 完成标准
-- [ ] `java -version` → openjdk 21
-- [ ] `mvn -v` → Maven 3.x
-- [ ] `docker compose version` → v2.x
-- [ ] 前端: `npm run dev` 可启动
-- [ ] 后端: `mvn compile` 成功
-- [ ] Go: `go build .` 成功

AGENTS.md

@@ -1,70 +0,0 @@
-# PROJECT KNOWLEDGE BASE
-
-**Generated:** Mon Feb 02 2026
-**Commit:** 7ca01ab
-**Branch:** beta
-
-## OVERVIEW
-FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
-
-## STRUCTURE
-```
-./
-├── go-gost/               # Go forwarding agent (forked gost + local x/)
-│   └── x/                 # Local fork of github.com/go-gost/x (replace => ./x)
-├── go-backend/            # Go Admin API (SQLite, net/http)
-├── vite-frontend/         # React/Vite dashboard (HeroUI + Tailwind)
-├── docker-compose-v4.yml  # Panel deploy (IPv4-only bridge)
-├── docker-compose-v6.yml  # Panel deploy (IPv6-enabled bridge)
-├── panel_install.sh       # Panel installer/upgrader (downloads compose)
-├── install.sh             # Node installer/upgrader (downloads gost binary)
-└── .github/workflows/     # CI: build/push images + release artifacts
-```
-
-## WHERE TO LOOK
-| Task | Location | Notes |
-|------|----------|-------|
-| **Deploy (Docker)** | `docker-compose-v4.yml` | Env: `JWT_SECRET`, `BACKEND_PORT`, `FRONTEND_PORT` |
-| **Deploy (IPv6)** | `docker-compose-v6.yml` | Same as v4 + IPv6-enabled bridge |
-| **Panel install** | `panel_install.sh` | Picks v4/v6, generates `JWT_SECRET`, downloads compose |
-| **Node install** | `install.sh` | Installs `/etc/flux_agent/flux_agent` + writes `config.json`/`gost.json` + systemd `flux_agent.service` |
-| **Admin API** | `go-backend/` | Go Admin API (SQLite) |
-| **Web UI** | `vite-frontend/` | React/Vite dashboard (HeroUI + Tailwind) |
-| **Go Agent** | `go-gost/` | Forwarding agent (forked gost + local x/) |
-| **Go Core** | `go-gost/x/` | Handlers/listeners/dialers + management API |
-
-## CODE MAP
-| Symbol | Type | Location | Role |
-|--------|------|----------|------|
-| `flvx` | Project | `.` | Root directory |
-| `main` | Func | `go-backend/cmd/paneld/main.go` | Backend Entry |
-| `App` | Component | `vite-frontend/src/App.tsx` | Frontend Entry |
-| `main` | Func | `go-gost/main.go` | Agent Entry |
-
-
-## CONVENTIONS
-- `Authorization` header carries the raw JWT token (no `Bearer` prefix) between `vite-frontend/` and `go-backend/`.
-- `go-gost/` uses `replace github.com/go-gost/x => ./x` and `go-gost/x/` is also its own Go module.
-
-## ANTI-PATTERNS (THIS PROJECT)
-- Do not edit generated protobuf output: `go-gost/x/internal/util/grpc/proto/*.pb.go`, `go-gost/x/internal/util/grpc/proto/*_grpc.pb.go`.
-
-## COMMANDS
-```bash
-# Panel (Docker)
-docker compose -f docker-compose-v4.yml up -d
-docker compose -f docker-compose-v6.yml up -d
-
-# Release-based install scripts
-./panel_install.sh
-./install.sh
-
-# Local dev (per subproject)
-(cd go-backend && make build)
-(cd vite-frontend && npm run dev)
-(cd go-gost && go run .)
-```
-
-## NOTES
-- LSP servers are not installed in this environment (gopls/jdtls/typescript-language-server); rely on grep-based navigation.
-- `vite-frontend/vite.config.ts` sets `minify: false` and disables treeshake; expect larger bundles.

LICENSE

@@ -1,674 +1,201 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer to sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<https://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<https://www.gnu.org/licenses/why-not-lgpl.html>.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LICENSE-APACHE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

NOTICE

@@ -1,19 +0,0 @@
-FLVX
-Copyright 2026 Sagit-chu
-
-This product includes software developed at
-flux-panel (https://github.com/bqlpfy/flux-panel)
-Copyright 2024-2026 bqlpfy
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
--------------------------------------------------------------------------
-This project is a derivative work based on flux-panel.
-Modifications and new components (backend, agents, frontend updates) 
-are licensed under the GNU General Public License v3.0 (GPLv3).
-See the LICENSE file for the full GPLv3 text.
--------------------------------------------------------------------------

README.md

@@ -1,35 +1,24 @@
-# FLVX
+# flux-panel转发面板 哆啦A梦转发面板
 
-> **联系我们**: [Telegram群组](https://t.me/flvxpanel)
+# 赞助商
+<p align="center">
+  <a href="https://vps.town" style="margin: 0 20px; text-align:center;">
+    <img src="./doc/vpstown.png" width="300">
+  </a>
 
-## Original Project
-- **Name**: flux-panel
-- **Source**: https://github.com/bqlpfy/flux-panel
-- **License**: Apache License 2.0
+  <a href="https://whmcs.as211392.com" style="margin: 0 20px; text-align:center;">
+    <img src="./doc/as211392.png" width="300">
+  </a>
+</p>
 
-## Modifications
-The following major changes and additions have been made in this fork (FLVX):
 
-### 1. Backend Architecture (Replaced)
-- **Removed**: The original `springboot-backend/` (Java/Spring Boot) has been entirely removed.
-- **Added**: A new `go-backend/` (Go/SQLite) implementation replaces the original backend.
 
-### 2. Forwarding Agent (Modified)
-- **Modified**: `go-gost/` - Modified forwarding agent wrapper.
-- **Modified**: `go-gost/x/` - Modified local fork of the `gost` extensions library.
 
-### 3. Frontend (Modified)
-- **Modified**: `vite-frontend/` - Significant updates to the React/Vite dashboard to compatible with the new Go backend, including UI/UX improvements (HeroUI + Tailwind).
+使用1.x版本的请使用上面给出的脚本，不要使用最新的，最新的默认2.x
+嫌弃麻烦或者想稳定的我不推荐你升级到2.x版本 目前还在beta阶段，很多问题。
 
-### 4. Mobile Applications (Removed)
-- **Removed**: `android-app/` - Source code for the Android client.
-- **Removed**: `ios-app/` - Source code for the iOS client.
-
-### 5. Infrastructure & Scripts
-- **Modified**: `docker-compose-v4.yml`, `docker-compose-v6.yml` (Updated for Go backend).
-- **Modified**: `install.sh`, `panel_install.sh` (Updated installation logic).
-- **Added**: `AGENTS.md` (Project documentation).
 
+本项目基于 [go-gost/gost](https://github.com/go-gost/gost) 和 [go-gost/x](https://github.com/go-gost/x) 两个开源库，实现了转发面板。
 ---
 ## 特性
 
@@ -44,26 +33,25 @@ The following major changes and additions have been made in this fork (FLVX):
 ## 部署流程
 ---
 ### Docker Compose部署
-#### 快速部署（安装最新版）
-面板端：
+#### 快速部署
+面板端(稳定版)：
 ```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+curl -L https://raw.githubusercontent.com/bqlpfy/flux-panel/refs/heads/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
 ```
-节点端：
+节点端(稳定版)：
 ```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+curl -L https://raw.githubusercontent.com/bqlpfy/flux-panel/refs/heads/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+
 ```
 
-#### 安装特定版本
-从 [Releases](https://github.com/Sagit-chu/flux-panel/releases) 页面复制对应版本的安装命令，脚本会自动安装该版本而非最新版。
-
-面板端（以 2.1.0 为例）：
+面板端(开发版)：
 ```bash
-curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+curl -L https://raw.githubusercontent.com/bqlpfy/flux-panel/refs/heads/beta/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
 ```
-节点端（以 2.1.0 为例）：
+节点端(开发版)：
 ```bash
-curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+curl -L https://raw.githubusercontent.com/bqlpfy/flux-panel/refs/heads/beta/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+
 ```
 
 #### 默认管理员账号
@@ -96,14 +84,16 @@ curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/install.
 作者对因使用本项目所造成的任何直接或间接损失概不负责，亦不提供任何形式的担保、承诺或技术支持。  
 
 
-请务必在合法、合规、安全的前提下使用本项目。
+请务必在合法、合规、安全的前提下使用本项目。  
 
 ---
 ## ⭐ 喝杯咖啡！（USDT）
 
 | 网络       | 地址                                                                 |
 |------------|----------------------------------------------------------------------|
-| BNB(BEP20) | `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`                          |
-| TRC20      | `TM8VYdU3s3gSX5PC8swjAJrAzZFCHKqG2k`                                  |
-| Aptos      | `0x49427bfcba1006a346447430689b2307ac156316bb34850d1d3029ff9d118da5`  |
-| polygon    |  `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`    |
+| BNB(BEP20) | `0x755492c03728851bbf855daa28a1e089f9aca4d1`                          |
+| TRC20      | `TYh2L3xxXpuJhAcBWnt3yiiADiCSJLgUm7`                                  |
+| Aptos      | `0xf2f9fb14749457748506a8281628d556e8540d1eb586d202cd8b02b99d369ef8`  |
+
+[![Star History Chart](https://api.star-history.com/svg?repos=bqlpfy/flux-panel&type=Date)](https://www.star-history.com/#bqlpfy/flux-panel&Date)
+

android-app/.gitignore

@@ -0,0 +1,15 @@
+*.iml
+.gradle
+/local.properties
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+.DS_Store
+/build
+/captures
+.externalNativeBuild
+.cxx
+local.properties

android-app/app/.gitignore

@@ -0,0 +1 @@
+/build

android-app/app/build.gradle

@@ -0,0 +1,45 @@
+plugins {
+    id 'com.android.application'
+    id 'org.jetbrains.kotlin.android'
+}
+
+android {
+    namespace 'com.flux'
+    compileSdk 34
+
+    defaultConfig {
+        applicationId "com.flux"
+        minSdk 24
+        targetSdk 34
+        versionCode 1
+        versionName "1.0.1"
+
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_1_8
+        targetCompatibility JavaVersion.VERSION_1_8
+    }
+    kotlinOptions {
+        jvmTarget = '1.8'
+    }
+}
+
+dependencies {
+
+    implementation 'androidx.core:core-ktx:1.9.0'
+    implementation 'androidx.appcompat:appcompat:1.7.1'
+    implementation 'com.google.android.material:material:1.12.0'
+    implementation 'androidx.constraintlayout:constraintlayout:2.2.1'
+    implementation 'androidx.webkit:webkit:1.8.0'
+    testImplementation 'junit:junit:4.13.2'
+    androidTestImplementation 'androidx.test.ext:junit:1.3.0'
+    androidTestImplementation 'androidx.test.espresso:espresso-core:3.7.0'
+}

android-app/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

android-app/app/release/output-metadata.json

@@ -0,0 +1,20 @@
+{
+  "version": 3,
+  "artifactType": {
+    "type": "APK",
+    "kind": "Directory"
+  },
+  "applicationId": "com.flux",
+  "variantName": "release",
+  "elements": [
+    {
+      "type": "SINGLE",
+      "filters": [],
+      "attributes": [],
+      "versionCode": 1,
+      "versionName": "1.0.1",
+      "outputFile": "app-release.apk"
+    }
+  ],
+  "elementType": "File"
+}

android-app/app/src/androidTest/java/com/flux/ExampleInstrumentedTest.kt

@@ -0,0 +1,24 @@
+package com.flux
+
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.ext.junit.runners.AndroidJUnit4
+
+import org.junit.Test
+import org.junit.runner.RunWith
+
+import org.junit.Assert.*
+
+/**
+ * Instrumented test, which will execute on an Android device.
+ *
+ * See [testing documentation](http://d.android.com/tools/testing).
+ */
+@RunWith(AndroidJUnit4::class)
+class ExampleInstrumentedTest {
+    @Test
+    fun useAppContext() {
+        // Context of the app under test.
+        val appContext = InstrumentationRegistry.getInstrumentation().targetContext
+        assertEquals("com.flux", appContext.packageName)
+    }
+}

android-app/app/src/main/AndroidManifest.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.flux" >
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+
+    <application
+        android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.Flux"
+        android:usesCleartextTraffic="true"
+        tools:targetApi="31" >
+        <activity
+            android:name="com.flux.MainActivity"
+            android:exported="true"
+            android:configChanges="uiMode|orientation|screenSize" >
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>

android-app/app/src/main/java/com/flux/MainActivity.kt

@@ -0,0 +1,214 @@
+package com.flux
+
+import androidx.core.content.edit
+import android.graphics.Color
+import android.os.Build
+import android.os.Bundle
+import android.view.View
+import android.view.WindowInsetsController
+import androidx.appcompat.app.AppCompatActivity
+import android.webkit.*
+import android.content.res.Configuration
+import org.json.JSONArray
+import org.json.JSONObject
+
+
+class MainActivity : AppCompatActivity() {
+
+    private lateinit var webView: WebView
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContentView(R.layout.activity_main)
+
+        webView = findViewById(R.id.webView)
+        WebView.setWebContentsDebuggingEnabled(true)
+        setupWebView()
+        loadUrl()
+
+        setupSystemBars()
+        setupRootBackground()
+    }
+
+    private fun setupWebView() {
+        val settings = webView.settings
+        settings.javaScriptEnabled = true
+        settings.domStorageEnabled = true
+        settings.databaseEnabled = true
+        settings.loadWithOverviewMode = true
+        settings.useWideViewPort = true
+        settings.setSupportZoom(true)
+        settings.builtInZoomControls = true
+        settings.displayZoomControls = false
+
+        // 隐藏滚动条但不影响滚动
+        webView.isVerticalScrollBarEnabled = false
+        webView.isHorizontalScrollBarEnabled = false
+        webView.scrollBarStyle = View.SCROLLBARS_INSIDE_OVERLAY
+        webView.overScrollMode = View.OVER_SCROLL_NEVER
+
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+            settings.mixedContentMode = WebSettings.MIXED_CONTENT_ALWAYS_ALLOW
+        }
+
+        val isDarkTheme = resources.configuration.uiMode and
+                Configuration.UI_MODE_NIGHT_MASK ==
+                Configuration.UI_MODE_NIGHT_YES
+
+        webView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
+
+
+        // 添加JavaScript接口
+        webView.addJavascriptInterface(object {
+
+            @android.webkit.JavascriptInterface
+            fun getPanelAddresses(callback: String) {
+                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
+                val addresses = sharedPrefs.getString("panel_addresses", "[]")
+                webView.post {
+                    webView.evaluateJavascript("window.$callback($addresses);", null)
+                }
+            }
+
+            @android.webkit.JavascriptInterface
+            fun savePanelAddress(name: String, address: String) {
+                val json = JSONObject()
+                json.put("name", name)
+                json.put("address", address)
+                json.put("inx", false)
+                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
+                val addresses = sharedPrefs.getString("panel_addresses", "[]")
+                val jsonArray = JSONArray(addresses)
+                jsonArray.put(json)
+                sharedPrefs.edit {
+                    putString("panel_addresses", jsonArray.toString())
+                }
+                webView.post {
+                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
+                }
+            }
+
+            @android.webkit.JavascriptInterface
+            fun setCurrentPanelAddress(name: String) {
+
+                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
+                val addresses = sharedPrefs.getString("panel_addresses", "[]")
+                val jsonArray = JSONArray(addresses)
+                for (i in 0 until jsonArray.length()) {
+                    val obj = jsonArray.getJSONObject(i)
+                    if (name == obj.getString("name")) {
+                        obj.put("inx", true)
+                    }else{
+                        obj.put("inx", false)
+                    }
+                }
+                sharedPrefs.edit {
+                    putString("panel_addresses", jsonArray.toString())
+                }
+                webView.post {
+                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
+                }
+            }
+
+            @android.webkit.JavascriptInterface
+            fun deletePanelAddress(name: String) {
+                val jsonArray = JSONArray()
+                val sharedPrefs = getSharedPreferences("panel_config", MODE_PRIVATE)
+                val addresses = sharedPrefs.getString("panel_addresses", "[]")
+                val jsonArraya = JSONArray(addresses)
+                for (i in 0 until jsonArraya.length()) {
+                    val obj = jsonArraya.getJSONObject(i)
+                    if (name != obj.getString("name")) {
+                        jsonArray.put(obj)
+                    }
+                }
+                sharedPrefs.edit {
+                    putString("panel_addresses", jsonArray.toString())
+                }
+                webView.post {
+                    webView.evaluateJavascript("window.setPanelAddresses(${jsonArray.toString()});", null)
+                }
+            }
+        }, "JsInterface")
+
+    }
+
+    private fun loadUrl() {
+        //webView.loadUrl("http://192.168.100.9:3000")
+        webView.loadUrl("file:///android_asset/index.html")
+    }
+
+    private fun setupSystemBars() {
+        val isDarkTheme = resources.configuration.uiMode and
+                Configuration.UI_MODE_NIGHT_MASK ==
+                Configuration.UI_MODE_NIGHT_YES
+
+        if (isDarkTheme) {
+            window.statusBarColor = Color.BLACK
+            window.navigationBarColor = Color.BLACK
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                window.insetsController?.setSystemBarsAppearance(
+                    0,
+                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
+                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS
+                )
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                @Suppress("DEPRECATION")
+                window.decorView.systemUiVisibility =
+                    window.decorView.systemUiVisibility and View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR.inv()
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                    @Suppress("DEPRECATION")
+                    window.decorView.systemUiVisibility =
+                        window.decorView.systemUiVisibility and View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR.inv()
+                }
+            }
+        } else {
+            window.statusBarColor = Color.WHITE
+            window.navigationBarColor = Color.WHITE
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                window.insetsController?.setSystemBarsAppearance(
+                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
+                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS,
+                    WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS or
+                            WindowInsetsController.APPEARANCE_LIGHT_NAVIGATION_BARS
+                )
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                @Suppress("DEPRECATION")
+                window.decorView.systemUiVisibility =
+                    window.decorView.systemUiVisibility or View.SYSTEM_UI_FLAG_LIGHT_STATUS_BAR
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                    @Suppress("DEPRECATION")
+                    window.decorView.systemUiVisibility =
+                        window.decorView.systemUiVisibility or View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR
+                }
+            }
+        }
+    }
+
+    override fun onBackPressed() {
+        if (webView.canGoBack()) webView.goBack() else super.onBackPressed()
+    }
+
+    override fun onConfigurationChanged(newConfig: Configuration) {
+        super.onConfigurationChanged(newConfig)
+        setupSystemBars()
+        setupWebViewBackground()
+        setupRootBackground()
+    }
+
+    private fun setupWebViewBackground() {
+        val isDarkTheme = resources.configuration.uiMode and
+                Configuration.UI_MODE_NIGHT_MASK ==
+                Configuration.UI_MODE_NIGHT_YES
+        webView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
+    }
+
+    private fun setupRootBackground() {
+        val isDarkTheme = resources.configuration.uiMode and
+                Configuration.UI_MODE_NIGHT_MASK ==
+                Configuration.UI_MODE_NIGHT_YES
+        val rootView = findViewById<View>(android.R.id.content)
+        rootView.setBackgroundColor(if (isDarkTheme) Color.BLACK else Color.WHITE)
+    }
+}

android-app/app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector
+    android:height="108dp"
+    android:width="108dp"
+    android:viewportHeight="108"
+    android:viewportWidth="108"
+    xmlns:android="http://schemas.android.com/apk/res/android">
+    <path android:fillColor="#3DDC84"
+          android:pathData="M0,0h108v108h-108z"/>
+    <path android:fillColor="#00000000" android:pathData="M9,0L9,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,0L19,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M29,0L29,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M39,0L39,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M49,0L49,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M59,0L59,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M69,0L69,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M79,0L79,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M89,0L89,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M99,0L99,108"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,9L108,9"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,19L108,19"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,29L108,29"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,39L108,39"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,49L108,49"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,59L108,59"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,69L108,69"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,79L108,79"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,89L108,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M0,99L108,99"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,29L89,29"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,39L89,39"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,49L89,49"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,59L89,59"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,69L89,69"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M19,79L89,79"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M29,19L29,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M39,19L39,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M49,19L49,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M59,19L59,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M69,19L69,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+    <path android:fillColor="#00000000" android:pathData="M79,19L79,89"
+          android:strokeColor="#33FFFFFF" android:strokeWidth="0.8"/>
+</vector>

android-app/app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -0,0 +1,30 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path android:pathData="M31,63.928c0,0 6.4,-11 12.1,-13.1c7.2,-2.6 26,-1.4 26,-1.4l38.1,38.1L107,108.928l-32,-1L31,63.928z">
+        <aapt:attr name="android:fillColor">
+            <gradient
+                android:endX="85.84757"
+                android:endY="92.4963"
+                android:startX="42.9492"
+                android:startY="49.59793"
+                android:type="linear">
+                <item
+                    android:color="#44000000"
+                    android:offset="0.0" />
+                <item
+                    android:color="#00000000"
+                    android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+    <path
+        android:fillColor="#FFFFFF"
+        android:fillType="nonZero"
+        android:pathData="M65.3,45.828l3.8,-6.6c0.2,-0.4 0.1,-0.9 -0.3,-1.1c-0.4,-0.2 -0.9,-0.1 -1.1,0.3l-3.9,6.7c-6.3,-2.8 -13.4,-2.8 -19.7,0l-3.9,-6.7c-0.2,-0.4 -0.7,-0.5 -1.1,-0.3C38.8,38.328 38.7,38.828 38.9,39.228l3.8,6.6C36.2,49.428 31.7,56.028 31,63.928h46C76.3,56.028 71.8,49.428 65.3,45.828zM43.4,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2c-0.3,-0.7 -0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C45.3,56.528 44.5,57.328 43.4,57.328L43.4,57.328zM64.6,57.328c-0.8,0 -1.5,-0.5 -1.8,-1.2s-0.1,-1.5 0.4,-2.1c0.5,-0.5 1.4,-0.7 2.1,-0.4c0.7,0.3 1.2,1 1.2,1.8C66.5,56.528 65.6,57.328 64.6,57.328L64.6,57.328z"
+        android:strokeWidth="1"
+        android:strokeColor="#00000000" />
+</vector>

android-app/app/src/main/res/layout/activity_main.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.constraintlayout.widget.ConstraintLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    tools:context=".MainActivity">
+
+    <WebView
+        android:id="@+id/webView"
+        android:layout_width="0dp"
+        android:layout_height="0dp"
+        app:layout_constraintBottom_toBottomOf="parent"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintEnd_toEndOf="parent"
+        app:layout_constraintTop_toTopOf="parent" />
+
+</androidx.constraintlayout.widget.ConstraintLayout>

android-app/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+</adaptive-icon>

android-app/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+</adaptive-icon>

android-app/app/src/main/res/values-night/themes.xml

@@ -0,0 +1,9 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Base.Theme.Flux" parent="Theme.Material3.DayNight.NoActionBar">
+        <!-- Customize your dark theme here. -->
+        <!-- <item name="colorPrimary">@color/my_dark_primary</item> -->
+        <item name="android:statusBarColor">@android:color/transparent</item>
+        <item name="android:navigationBarColor">@android:color/transparent</item>
+    </style>
+</resources>

android-app/app/src/main/res/values/colors.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="black">#FF000000</color>
+    <color name="white">#FFFFFFFF</color>
+
+</resources>

android-app/app/src/main/res/values/strings.xml

@@ -0,0 +1,3 @@
+<resources>
+    <string name="app_name">Flux</string>
+</resources>

android-app/app/src/main/res/values/themes.xml

@@ -0,0 +1,11 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Base.Theme.Flux" parent="Theme.Material3.DayNight.NoActionBar">
+        <!-- Customize your light theme here. -->
+        <!-- <item name="colorPrimary">@color/my_light_primary</item> -->
+        <item name="android:statusBarColor">@android:color/transparent</item>
+        <item name="android:navigationBarColor">@android:color/transparent</item>
+    </style>
+
+    <style name="Theme.Flux" parent="Base.Theme.Flux" />
+</resources>

android-app/app/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+   Sample backup rules file; uncomment and customize as necessary.
+   See https://developer.android.com/guide/topics/data/autobackup
+   for details.
+   Note: This file is ignored for devices older that API 31
+   See https://developer.android.com/about/versions/12/backup-restore
+-->
+<full-backup-content>
+    <!--
+   <include domain="sharedpref" path="."/>
+   <exclude domain="sharedpref" path="device.xml"/>
+-->
+</full-backup-content>

android-app/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+   Sample data extraction rules file; uncomment and customize as necessary.
+   See https://developer.android.com/about/versions/12/backup-restore#xml-changes
+   for details.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <!-- TODO: Use <include> and <exclude> to control what is backed up.
+        <include .../>
+        <exclude .../>
+        -->
+    </cloud-backup>
+    <!--
+    <device-transfer>
+        <include .../>
+        <exclude .../>
+    </device-transfer>
+    -->
+</data-extraction-rules>

android-app/app/src/test/java/com/flux/ExampleUnitTest.kt

@@ -0,0 +1,17 @@
+package com.flux
+
+import org.junit.Test
+
+import org.junit.Assert.*
+
+/**
+ * Example local unit test, which will execute on the development machine (host).
+ *
+ * See [testing documentation](http://d.android.com/tools/testing).
+ */
+class ExampleUnitTest {
+    @Test
+    fun addition_isCorrect() {
+        assertEquals(4, 2 + 2)
+    }
+}

android-app/build.gradle

@@ -0,0 +1,5 @@
+// Top-level build file where you can add configuration options common to all sub-projects/modules.
+plugins {
+    id 'com.android.application' version '8.2.2' apply false
+    id 'org.jetbrains.kotlin.android' version '1.8.0' apply false
+}

android-app/gradle.properties

@@ -0,0 +1,23 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app's APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Kotlin code style for this project: "official" or "obsolete":
+kotlin.code.style=official
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true

android-app/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Wed Aug 20 09:15:27 CST 2025
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

android-app/gradlew

@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+exec "$JAVACMD" "$@"

android-app/gradlew.bat

@@ -0,0 +1,89 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

android-app/settings.gradle

@@ -0,0 +1,17 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "Flux"
+include ':app'

doc/faq.md

@@ -1,24 +0,0 @@
-# 常见问题 (FAQ)
-
-### Q1: 安装脚本提示 "Docker command not found"？
-**A**: 请确保您的系统已安装 Docker 和 Docker Compose。
-- Ubuntu/Debian 安装 Docker: `curl -fsSL https://get.docker.com | bash`
-
-### Q2: 面板无法访问 (Connection Refused)？
-**A**:
-1. 检查防火墙是否放行了前端端口（默认 `6366`）。
-2. 检查容器是否正常运行: `docker ps`。
-3. 查看容器日志: `docker logs flux-panel-backend` 或 `docker logs vite-frontend`。
-
-### Q3: 节点显示离线？
-**A**:
-1. 检查节点服务器与面板服务器之间的网络连通性。
-2. 确认在节点端安装时输入的 **面板地址** 和 **密钥** 是否正确。
-3. 检查节点端服务状态: `systemctl status flux_agent`。
-4. 查看节点端日志: `journalctl -u flux_agent -f`。
-
-### Q4: 只有 TCP 能通，UDP 不通？
-**A**: 请检查服务器防火墙和安全组（AWS/阿里云/腾讯云等）是否同时放行了对应端口的 **TCP 和 UDP** 协议。
-
-### Q5: IPv6 无法使用？
-**A**: 面板安装脚本会自动尝试配置 Docker 的 IPv6。如果失败，请手动检查 `/etc/docker/daemon.json` 配置，确保 `ipv6: true` 且分配了正确的 `fixed-cidr-v6` 子网。

doc/index.md

@@ -1,37 +0,0 @@
-# FLVX 官方文档
-
-**FLVX** 是一个基于 [go-gost/gost](https://github.com/go-gost/gost) 和 [go-gost/x](https://github.com/go-gost/x) 开发的高性能流量转发管理系统。
-
-> 📞 **联系我们**: [Telegram群组](https://t.me/flvxpanel)
-
-## 核心特性
-
-- **多协议支持**: 完美支持 TCP 和 UDP 协议转发。
-- **灵活转发**: 支持 **端口转发** 与 **隧道转发** 两种模式。
-- **流量控制**: 支持按 **隧道账号级别** 管理流量转发数量，用于用户/隧道配额控制。
-- **限速管理**: 可针对 **指定用户的指定隧道进行限速** 设置。
-- **计费策略**: 支持配置 **单向或双向流量计费方式**，灵活适配不同计费模型。
-- **策略配置**: 提供灵活的转发策略配置，适用于多种网络场景。
-
-## 快速开始
-
-- [安装部署](./install.md)
-- [使用指南](./usage.md)
-- [常见问题](./faq.md)
-
-## 免责声明
-
-本项目仅供个人学习与研究使用，基于开源项目进行二次开发。  
-使用本项目所带来的任何风险均由使用者自行承担。本项目为开源的流量转发工具，仅限合法、合规用途。  
-**禁止将本项目用于任何违法或未经授权的行为，包括但不限于网络攻击、数据窃取、非法访问等。**
-
-## 捐赠支持
-
-如果您觉得本项目对您有帮助，欢迎请作者喝杯咖啡！
-
-| 网络       | 地址                                                                 |
-|------------|----------------------------------------------------------------------|
-| BNB(BEP20) | `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`                          |
-| TRC20      | `TM8VYdU3s3gSX5PC8swjAJrAzZFCHKqG2k`                                  |
-| Aptos      | `0x49427bfcba1006a346447430689b2307ac156316bb34850d1d3029ff9d118da5`  |
-| Polygon    | `0xa608708fdc6279a2433fd4b82f0b72b8cbe97ed5`                          |

doc/install.md

@@ -1,79 +0,0 @@
-# 安装部署指南
-
-本文档介绍如何部署 FLVX 面板端及节点端。
-
-## 一、面板端部署
-
-面板端负责管理用户、节点和转发规则。
-
-### 1. 环境要求
-- 操作系统：Linux (推荐 Debian 10+ / Ubuntu 20.04+)
-- 必须安装 Docker 和 Docker Compose
-
-### 2. 一键安装脚本
-
-使用以下命令即可快速安装面板：
-
-```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
-```
-
-**安装过程中会提示输入以下信息：**
-- **前端端口**: 默认为 `6366`
-- **后端端口**: 默认为 `6365`
-
-脚本会自动检测系统是否支持 IPv6，并自动配置 Docker 的 IPv6 支持。
-
-### 3. 访问面板
-
-安装完成后，访问：
-`http://<服务器IP>:<前端端口>` (默认: `http://<服务器IP>:6366`)
-
-**默认管理员账号：**
-- 用户名: `admin_user`
-- 密码: `admin_user`
-
-> ⚠️ **注意**: 首次登录后，请务必在“个人中心”或“设置”中修改默认密码！
-
-### 4. 维护命令
-
-再次运行 `./panel_install.sh` 脚本可以看到管理菜单：
-1. 安装面板
-2. 更新面板
-3. 卸载面板
-
----
-
-## 二、节点端部署
-
-节点端运行在实际进行流量转发的服务器上，需要连接到面板端进行管理。
-
-### 1. 获取接入密钥
-1. 登录面板端。
-2. 进入 **节点管理 (Node)** 页面。
-3. 点击 **添加节点**。
-4. 获取该节点的 **接入密钥 (Secret)**。
-
-### 2. 一键安装脚本
-
-在节点服务器上运行：
-
-```bash
-curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -o install.sh && chmod +x install.sh && ./install.sh
-```
-
-**安装过程中会提示输入：**
-- **服务器地址**: 面板端的通信地址（通常是 `http://<面板IP>:<后端端口>`，例如 `http://1.2.3.4:6365`）。
-- **密钥**: 刚才在面板中获取的节点密钥。
-
-或者直接使用带参数的命令（适用于自动化部署）：
-
-```bash
-# 替换 <面板地址> 和 <密钥>
-./install.sh -a "http://1.2.3.4:6365" -s "your_node_secret"
-```
-
-### 3. 验证安装
-安装完成后，服务会自动启动。
-- 查看状态: `systemctl status flux_agent`
-- 回到面板 **节点管理** 页面，该节点状态应显示为 **在线**。

doc/usage.md

@@ -1,35 +0,0 @@
-# 使用指南
-
-## 1. 仪表盘 (Dashboard)
-登录系统后首先看到的是仪表盘，这里展示了系统的整体运行状态，包括：
-- 在线节点数量
-- 用户总数
-- 流量统计信息
-
-## 2. 节点管理 (Node)
-节点是实际承载流量转发的服务器。
-- **添加节点**: 点击“添加”，获取密钥用于节点端安装。
-- **管理**: 可以查看节点在线状态、版本信息，以及对节点进行编辑或删除。
-
-## 3. 用户管理 (User)
-管理员可以创建和管理普通用户。
-- **创建用户**: 设置用户名、密码、流量配额等。
-- **用户组**: 可以将用户分配到不同的组 (Group)，便于统一管理权限或策略。
-
-## 4. 转发管理 (Forward)
-这是核心功能区，用于设置端口转发规则。
-- **端口转发**: 将节点服务器的某个端口流量转发到目标地址。
-    - **协议**: 支持 TCP / UDP。
-    - **入口**: 选择入口节点和监听端口。
-    - **出口**: 设置目标 IP 和端口。
-- **隧道转发**: 用于更复杂的网络穿透场景（具体配置视业务需求而定）。
-
-## 5. 限制与策略 (Limit)
-- **限速**: 可以对指定用户或指定隧道进行带宽限制，防止资源滥用。
-- **计费模式**: 支持配置流量计算方式（单向或双向），适合运营场景。
-
-## 6. 系统配置 (Config)
-在此页面进行系统的全局设置。
-
-## 7. 个人设置 (Profile)
-- **修改密码**: 为了安全，建议定期修改管理员密码。

docker-compose-v4.yml

@@ -1,42 +1,62 @@
 services:
-  backend:
-    image: ghcr.io/sagit-chu/flux-panel-backend:${FLUX_VERSION:-latest}
-    container_name: flux-panel-backend
+  mysql:
+    image: mysql:5.7
+    container_name: gost-mysql
     restart: unless-stopped
-    logging:
-      driver: json-file
-      options:
-        max-size: "20m"
     environment:
-      DB_PATH: /app/data/gost.db
+      MYSQL_ROOT_PASSWORD: ${DB_PASSWORD}
+      MYSQL_DATABASE: ${DB_NAME}
+      MYSQL_USER: ${DB_USER}
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+      TZ: Asia/Shanghai
+    volumes:
+      - mysql_data:/var/lib/mysql
+      - ./gost.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    command: >
+      --default-authentication-plugin=mysql_native_password
+      --character-set-server=utf8mb4
+      --collation-server=utf8mb4_unicode_ci
+      --max_connections=1000
+      --innodb_buffer_pool_size=256M
+    networks:
+      - gost-network
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      timeout: 10s
+      retries: 10
+
+  backend:
+    image: bqlpfy/springboot-backend:1.4.3
+    container_name: springboot-backend
+    restart: unless-stopped
+    environment:
+      DB_HOST: mysql
+      DB_NAME: ${DB_NAME}
+      DB_USER: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
       JWT_SECRET: ${JWT_SECRET}
       LOG_DIR: /app/logs
-      SERVER_ADDR: :6365
-      TZ: Asia/Shanghai
+      JAVA_OPTS: "-Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.timezone=Asia/Shanghai"
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:
       - backend_logs:/app/logs
-      - sqlite_data:/app/data
+    depends_on:
+      mysql:
+        condition: service_healthy
     networks:
       - gost-network
-    stop_grace_period: 30s
-    stop_signal: SIGTERM
     healthcheck:
       test: ["CMD", "sh", "-c", "wget --no-verbose --tries=1 --spider http://localhost:6365/flow/test || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 5
-      start_period: 30s
+      start_period: 90s
 
   frontend:
-    image: ghcr.io/sagit-chu/vite-frontend:${FLUX_VERSION:-latest}
+    image: bqlpfy/vite-frontend:1.4.3
     container_name: vite-frontend
     restart: unless-stopped
-    logging:
-      driver: json-file
-      options:
-        max-size: "20m"
     ports:
       - "${FRONTEND_PORT}:80"
     depends_on:
@@ -47,8 +67,8 @@ services:
 
 
 volumes:
-  sqlite_data:
-    name: sqlite_data
+  mysql_data:
+    name: mysql_data
     driver: local
   backend_logs:
     name: backend_logs
@@ -61,4 +81,4 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.20.0.0/16 
+        - subnet: 172.20.0.0/16 

docker-compose-v6.yml

@@ -1,42 +1,62 @@
 services:
-  backend:
-    image: ghcr.io/sagit-chu/flux-panel-backend:${FLUX_VERSION:-latest}
-    container_name: flux-panel-backend
+  mysql:
+    image: mysql:5.7
+    container_name: gost-mysql
     restart: unless-stopped
-    logging:
-      driver: json-file
-      options:
-        max-size: "20m"
     environment:
-      DB_PATH: /app/data/gost.db
+      MYSQL_ROOT_PASSWORD: ${DB_PASSWORD}
+      MYSQL_DATABASE: ${DB_NAME}
+      MYSQL_USER: ${DB_USER}
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+      TZ: Asia/Shanghai
+    volumes:
+      - mysql_data:/var/lib/mysql
+      - ./gost.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    command: >
+      --default-authentication-plugin=mysql_native_password
+      --character-set-server=utf8mb4
+      --collation-server=utf8mb4_unicode_ci
+      --max_connections=1000
+      --innodb_buffer_pool_size=256M
+    networks:
+      - gost-network
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      timeout: 10s
+      retries: 10
+
+  backend:
+    image: bqlpfy/springboot-backend:1.4.3
+    container_name: springboot-backend
+    restart: unless-stopped
+    environment:
+      DB_HOST: mysql
+      DB_NAME: ${DB_NAME}
+      DB_USER: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
       JWT_SECRET: ${JWT_SECRET}
       LOG_DIR: /app/logs
-      SERVER_ADDR: :6365
-      TZ: Asia/Shanghai
+      JAVA_OPTS: "-Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.timezone=Asia/Shanghai"
     ports:
       - "${BACKEND_PORT}:6365"
     volumes:
       - backend_logs:/app/logs
-      - sqlite_data:/app/data
+    depends_on:
+      mysql:
+        condition: service_healthy
     networks:
       - gost-network
-    stop_grace_period: 30s
-    stop_signal: SIGTERM
     healthcheck:
       test: ["CMD", "sh", "-c", "wget --no-verbose --tries=1 --spider http://localhost:6365/flow/test || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 5
-      start_period: 30s
+      start_period: 90s
 
   frontend:
-    image: ghcr.io/sagit-chu/vite-frontend:${FLUX_VERSION:-latest}
+    image: bqlpfy/vite-frontend:1.4.3
     container_name: vite-frontend
     restart: unless-stopped
-    logging:
-      driver: json-file
-      options:
-        max-size: "20m"
     ports:
       - "${FRONTEND_PORT}:80"
     depends_on:
@@ -47,8 +67,8 @@ services:
 
 
 volumes:
-  sqlite_data:
-    name: sqlite_data
+  mysql_data:
+    name: mysql_data
     driver: local
   backend_logs:
     name: backend_logs
@@ -63,4 +83,4 @@ networks:
     ipam:
       config:
         - subnet: 172.20.0.0/16 
-        - subnet: fd00:dead:beef::/48
+        - subnet: fd00:dead:beef::/48

go-backend/AGENTS.md

@@ -1,47 +0,0 @@
-# GO BACKEND KNOWLEDGE BASE
-
-## OVERVIEW
-Go-based Admin API for FLVX (formerly Flux Panel). Replaces the legacy Spring Boot backend.
-**Stack:** Go 1.23, net/http (std lib), SQLite (modernc.org/sqlite).
-
-## STRUCTURE
-```
-go-backend/
-├── cmd/paneld/main.go        # Entry point; starts HTTP server + WebSocket
-├── internal/
-│   ├── http/                 # HTTP layer
-│   │   ├── router.go         # Routes (NewServeMux) + Middleware chain
-│   │   ├── handler/          # API Handlers (User, Tunnel, Node, etc.)
-│   │   ├── middleware/       # JWT, CORS, Logging, Recover
-│   │   └── response/         # JSON response helpers
-│   ├── store/sqlite/         # Data Access Layer (Repository pattern)
-│   │   ├── repository.go     # SQL queries & Struct definitions
-│   │   └── sql/              # Embedded schema.sql & data.sql
-│   └── auth/                 # Auth logic
-├── tests/                    # Integration/Contract tests
-├── Dockerfile                # Multi-stage build (alpine)
-└── Makefile                  # Build commands
-```
-
-## WHERE TO LOOK
-| Task | Location | Notes |
-|------|----------|-------|
-| **API Routes** | `go-backend/internal/http/router.go` | Registers handlers to `http.ServeMux` |
-| **DB Schema** | `go-backend/internal/store/sqlite/sql/schema.sql` | Embedded in binary |
-| **SQL Queries** | `go-backend/internal/store/sqlite/repository.go` | Raw SQL, no ORM |
-| **Auth Middleware** | `go-backend/internal/http/middleware/jwt.go` | Extracts `Authorization` header |
-| **WebSocket** | `go-backend/internal/ws/` | Real-time updates (traffic, status) |
-
-## CONVENTIONS
-- **No ORM**: Uses raw SQL with `database/sql` and `modernc.org/sqlite`.
-- **Standard Lib**: Uses `net/http` for routing (Go 1.22+ patterns).
-- **Auth**: Expects raw JWT in `Authorization` header (no `Bearer` prefix).
-- **Config**: Loaded from environment variables (see `cmd/paneld/main.go`).
-
-## COMMANDS
-```bash
-cd go-backend
-go run ./cmd/paneld
-go test ./...
-make build
-```

go-backend/Dockerfile

@@ -1,19 +0,0 @@
-FROM golang:1.23-bookworm AS builder
-WORKDIR /src
-
-COPY go.mod ./
-RUN go mod download
-
-COPY . .
-ARG TARGETOS
-ARG TARGETARCH
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} env ${TARGETARCH:+GOARCH=${TARGETARCH}} go build -o /out/paneld ./cmd/paneld
-
-FROM debian:bookworm-slim
-WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /out/paneld /app/paneld
-
-ENV SERVER_ADDR=:6365
-EXPOSE 6365
-ENTRYPOINT ["/app/paneld"]

go-backend/Makefile

@@ -1,12 +0,0 @@
-GO ?= go
-
-.PHONY: test build run
-
-test:
-	$(GO) test ./...
-
-build:
-	$(GO) build ./cmd/paneld
-
-run:
-	SERVER_ADDR=:6365 $(GO) run ./cmd/paneld

go-backend/cmd/paneld/main.go

@@ -1,51 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"log"
-	"net/http"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	"go-backend/internal/app"
-	"go-backend/internal/config"
-)
-
-func main() {
-	cfg := config.FromEnv()
-	if cfg.JWTSecret == "" {
-		log.Println("warning: JWT_SECRET is empty")
-	}
-	log.Printf("starting go-backend on %s (db=%s)", cfg.Addr, cfg.DBPath)
-
-	a, err := app.New(cfg)
-	if err != nil {
-		log.Fatalf("failed to create app: %v", err)
-	}
-
-	errCh := make(chan error, 1)
-	go func() {
-		errCh <- a.Run()
-	}()
-
-	sigCh := make(chan os.Signal, 1)
-	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
-
-	select {
-	case sig := <-sigCh:
-		log.Printf("received signal %s, shutting down", sig)
-	case runErr := <-errCh:
-		if runErr != nil && !errors.Is(runErr, http.ErrServerClosed) {
-			log.Fatalf("server stopped unexpectedly: %v", runErr)
-		}
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	if err := a.Shutdown(ctx); err != nil {
-		log.Fatalf("shutdown failed: %v", err)
-	}
-}

go-backend/go.mod

@@ -1,23 +0,0 @@
-module go-backend
-
-go 1.23.0
-
-toolchain go1.24.4
-
-require (
-	github.com/gorilla/websocket v1.5.3
-	modernc.org/sqlite v1.37.1
-)
-
-require (
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	modernc.org/libc v1.65.7 // indirect
-	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
-)

go-backend/go.sum

@@ -1,49 +0,0 @@
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
-github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
-golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
-golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
-modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
-modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
-modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
-modernc.org/fileutil v1.3.1 h1:8vq5fe7jdtEvoCf3Zf9Nm0Q05sH6kGx0Op2CPx1wTC8=
-modernc.org/fileutil v1.3.1/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
-modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
-modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/libc v1.65.7 h1:Ia9Z4yzZtWNtUIuiPuQ7Qf7kxYrxP1/jeHZzG8bFu00=
-modernc.org/libc v1.65.7/go.mod h1:011EQibzzio/VX3ygj1qGFt5kMjP0lHb0qCW5/D/pQU=
-modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
-modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
-modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
-modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.37.1 h1:EgHJK/FPoqC+q2YBXg7fUmES37pCHFc97sI7zSayBEs=
-modernc.org/sqlite v1.37.1/go.mod h1:XwdRtsE1MpiBcL54+MbKcaDvcuej+IYSMfLN6gSKV8g=
-modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
-modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
-modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
-modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

go-backend/internal/app/app.go

@@ -1,60 +0,0 @@
-package app
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"time"
-
-	"go-backend/internal/config"
-	httpserver "go-backend/internal/http"
-	"go-backend/internal/http/handler"
-	"go-backend/internal/store/sqlite"
-)
-
-type App struct {
-	cfg    config.Config
-	server *http.Server
-	repo   *sqlite.Repository
-	h      *handler.Handler
-}
-
-func New(cfg config.Config) (*App, error) {
-	repo, err := sqlite.Open(cfg.DBPath)
-	if err != nil {
-		return nil, fmt.Errorf("open sqlite: %w", err)
-	}
-
-	h := handler.New(repo, cfg.JWTSecret)
-	router := httpserver.NewRouter(h, cfg.JWTSecret)
-
-	s := &http.Server{
-		Addr:              cfg.Addr,
-		Handler:           router,
-		ReadTimeout:       30 * time.Second,
-		ReadHeaderTimeout: 5 * time.Second,
-		WriteTimeout:      30 * time.Second,
-		IdleTimeout:       60 * time.Second,
-	}
-
-	return &App{cfg: cfg, server: s, repo: repo, h: h}, nil
-}
-
-func (a *App) Run() error {
-	if a.h != nil {
-		a.h.StartBackgroundJobs()
-	}
-	return a.server.ListenAndServe()
-}
-
-func (a *App) Shutdown(ctx context.Context) error {
-	if a.h != nil {
-		a.h.StopBackgroundJobs()
-	}
-	shutdownErr := a.server.Shutdown(ctx)
-	closeErr := a.repo.Close()
-	if shutdownErr != nil {
-		return shutdownErr
-	}
-	return closeErr
-}

go-backend/internal/auth/jwt.go

@@ -1,121 +0,0 @@
-package auth
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"strconv"
-	"time"
-)
-
-const (
-	algorithm  = "HmacSHA256"
-	expireTime = 90 * 24 * time.Hour
-)
-
-type Claims struct {
-	Sub    string `json:"sub"`
-	Iat    int64  `json:"iat"`
-	Exp    int64  `json:"exp"`
-	User   string `json:"user"`
-	Name   string `json:"name"`
-	RoleID int    `json:"role_id"`
-}
-
-type tokenHeader struct {
-	Alg string `json:"alg"`
-	Typ string `json:"typ"`
-}
-
-func GenerateToken(userID int64, username string, roleID int, secret string) (string, error) {
-	now := time.Now()
-	header := tokenHeader{Alg: algorithm, Typ: "JWT"}
-	claims := Claims{
-		Sub:    strconv.FormatInt(userID, 10),
-		Iat:    now.Unix(),
-		Exp:    now.Add(expireTime).Unix(),
-		User:   username,
-		Name:   username,
-		RoleID: roleID,
-	}
-
-	headerPart, err := encodeJSON(header)
-	if err != nil {
-		return "", err
-	}
-	payloadPart, err := encodeJSON(claims)
-	if err != nil {
-		return "", err
-	}
-	sig := sign(headerPart+"."+payloadPart, secret)
-
-	return headerPart + "." + payloadPart + "." + sig, nil
-}
-
-func ValidateToken(token, secret string) (Claims, bool) {
-	claims, err := ParseClaims(token, secret)
-	if err != nil {
-		return Claims{}, false
-	}
-	return claims, true
-}
-
-func ParseClaims(token, secret string) (Claims, error) {
-	parts := splitToken(token)
-	if len(parts) != 3 {
-		return Claims{}, errors.New("invalid token")
-	}
-
-	signedContent := parts[0] + "." + parts[1]
-	expected := sign(signedContent, secret)
-	if !hmac.Equal([]byte(expected), []byte(parts[2])) {
-		return Claims{}, errors.New("invalid signature")
-	}
-
-	payloadBytes, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return Claims{}, err
-	}
-
-	var claims Claims
-	if err := json.Unmarshal(payloadBytes, &claims); err != nil {
-		return Claims{}, err
-	}
-
-	if claims.Exp <= time.Now().Unix() {
-		return Claims{}, errors.New("token expired")
-	}
-
-	return claims, nil
-}
-
-func splitToken(token string) []string {
-	parts := make([]string, 0, 3)
-	current := ""
-	for i := 0; i < len(token); i++ {
-		if token[i] == '.' {
-			parts = append(parts, current)
-			current = ""
-			continue
-		}
-		current += string(token[i])
-	}
-	parts = append(parts, current)
-	return parts
-}
-
-func encodeJSON(v interface{}) (string, error) {
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(raw), nil
-}
-
-func sign(content, secret string) string {
-	h := hmac.New(sha256.New, []byte(secret))
-	h.Write([]byte(content))
-	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
-}

go-backend/internal/config/config.go

@@ -1,28 +0,0 @@
-package config
-
-import "os"
-
-type Config struct {
-	Addr      string
-	DBPath    string
-	JWTSecret string
-	LogDir    string
-}
-
-func FromEnv() Config {
-	cfg := Config{
-		Addr:      getEnv("SERVER_ADDR", ":6365"),
-		DBPath:    getEnv("DB_PATH", "/app/data/gost.db"),
-		JWTSecret: getEnv("JWT_SECRET", ""),
-		LogDir:    getEnv("LOG_DIR", "/app/logs"),
-	}
-
-	return cfg
-}
-
-func getEnv(key, fallback string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return fallback
-}

go-backend/internal/http/client/federation.go

@@ -1,327 +0,0 @@
-package client
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-)
-
-type FederationClient struct {
-	client *http.Client
-}
-
-type RemoteNodeInfo struct {
-	ShareID        int64  `json:"shareId"`
-	ShareName      string `json:"shareName"`
-	NodeID         int64  `json:"nodeId"`
-	NodeName       string `json:"nodeName"`
-	ServerIP       string `json:"serverIp"`
-	Status         int    `json:"status"`
-	MaxBandwidth   int64  `json:"maxBandwidth"`
-	CurrentFlow    int64  `json:"currentFlow"`
-	ExpiryTime     int64  `json:"expiryTime"`
-	PortRangeStart int    `json:"portRangeStart"`
-	PortRangeEnd   int    `json:"portRangeEnd"`
-}
-
-type RemoteTunnelResponse struct {
-	TunnelID int64 `json:"tunnelId"`
-}
-
-type RuntimeReservePortRequest struct {
-	ResourceKey   string `json:"resourceKey"`
-	Protocol      string `json:"protocol"`
-	RequestedPort int    `json:"requestedPort"`
-}
-
-type RuntimeReservePortResponse struct {
-	ReservationID string `json:"reservationId"`
-	BindingID     string `json:"bindingId"`
-	AllocatedPort int    `json:"allocatedPort"`
-}
-
-type RuntimeTarget struct {
-	Host     string `json:"host"`
-	Port     int    `json:"port"`
-	Protocol string `json:"protocol"`
-}
-
-type RuntimeApplyRoleRequest struct {
-	ReservationID string          `json:"reservationId"`
-	ResourceKey   string          `json:"resourceKey"`
-	Role          string          `json:"role"`
-	Protocol      string          `json:"protocol"`
-	Strategy      string          `json:"strategy"`
-	Targets       []RuntimeTarget `json:"targets"`
-}
-
-type RuntimeApplyRoleResponse struct {
-	BindingID     string `json:"bindingId"`
-	ReservationID string `json:"reservationId"`
-	AllocatedPort int    `json:"allocatedPort"`
-}
-
-type RuntimeReleaseRoleRequest struct {
-	BindingID     string `json:"bindingId"`
-	ReservationID string `json:"reservationId"`
-	ResourceKey   string `json:"resourceKey"`
-}
-
-type RuntimeDiagnoseRequest struct {
-	IP      string `json:"ip"`
-	Port    int    `json:"port"`
-	Count   int    `json:"count"`
-	Timeout int    `json:"timeout"`
-}
-
-func NewFederationClient() *FederationClient {
-	return &FederationClient{
-		client: &http.Client{
-			Timeout: 10 * time.Second,
-		},
-	}
-}
-
-func (c *FederationClient) Connect(url, token, localDomain string) (*RemoteNodeInfo, error) {
-	url = strings.TrimSuffix(url, "/")
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/connect", nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int            `json:"code"`
-		Msg  string         `json:"msg"`
-		Data RemoteNodeInfo `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return nil, err
-	}
-	if res.Code != 0 {
-		return nil, fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	return &res.Data, nil
-}
-
-func (c *FederationClient) CreateTunnel(url, token, localDomain, protocol string, remotePort int, target string) (*RemoteTunnelResponse, error) {
-	url = strings.TrimSuffix(url, "/")
-	payload := map[string]interface{}{
-		"protocol":   protocol,
-		"remotePort": remotePort,
-		"target":     target,
-	}
-	bodyBytes, _ := json.Marshal(payload)
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/tunnel/create", strings.NewReader(string(bodyBytes)))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int                  `json:"code"`
-		Msg  string               `json:"msg"`
-		Data RemoteTunnelResponse `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return nil, err
-	}
-	if res.Code != 0 {
-		return nil, fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	return &res.Data, nil
-}
-
-func (c *FederationClient) ReservePort(url, token, localDomain string, reqData RuntimeReservePortRequest) (*RuntimeReservePortResponse, error) {
-	url = strings.TrimSuffix(url, "/")
-	bodyBytes, _ := json.Marshal(reqData)
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/runtime/reserve-port", strings.NewReader(string(bodyBytes)))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int                        `json:"code"`
-		Msg  string                     `json:"msg"`
-		Data RuntimeReservePortResponse `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return nil, err
-	}
-	if res.Code != 0 {
-		return nil, fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	return &res.Data, nil
-}
-
-func (c *FederationClient) ApplyRole(url, token, localDomain string, reqData RuntimeApplyRoleRequest) (*RuntimeApplyRoleResponse, error) {
-	url = strings.TrimSuffix(url, "/")
-	bodyBytes, _ := json.Marshal(reqData)
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/runtime/apply-role", strings.NewReader(string(bodyBytes)))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int                      `json:"code"`
-		Msg  string                   `json:"msg"`
-		Data RuntimeApplyRoleResponse `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return nil, err
-	}
-	if res.Code != 0 {
-		return nil, fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	return &res.Data, nil
-}
-
-func (c *FederationClient) ReleaseRole(url, token, localDomain string, reqData RuntimeReleaseRoleRequest) error {
-	url = strings.TrimSuffix(url, "/")
-	bodyBytes, _ := json.Marshal(reqData)
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/runtime/release-role", strings.NewReader(string(bodyBytes)))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int    `json:"code"`
-		Msg  string `json:"msg"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return err
-	}
-	if res.Code != 0 {
-		return fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	return nil
-}
-
-func (c *FederationClient) Diagnose(url, token, localDomain string, reqData RuntimeDiagnoseRequest) (map[string]interface{}, error) {
-	url = strings.TrimSuffix(url, "/")
-	bodyBytes, _ := json.Marshal(reqData)
-	req, err := http.NewRequest("POST", url+"/api/v1/federation/runtime/diagnose", strings.NewReader(string(bodyBytes)))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if localDomain != "" {
-		req.Header.Set("X-Panel-Domain", localDomain)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("remote error %d: %s", resp.StatusCode, string(body))
-	}
-
-	var res struct {
-		Code int                    `json:"code"`
-		Msg  string                 `json:"msg"`
-		Data map[string]interface{} `json:"data"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return nil, err
-	}
-	if res.Code != 0 {
-		return nil, fmt.Errorf("remote api error: %s", res.Msg)
-	}
-
-	if res.Data == nil {
-		return nil, fmt.Errorf("remote api error: empty diagnosis payload")
-	}
-
-	return res.Data, nil
-}

go-backend/internal/http/handler/control_plane_test.go

@@ -1,55 +0,0 @@
-package handler
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestBuildForwardControlServiceNamesPauseResume(t *testing.T) {
-	base := "12_34_56"
-	want := []string{base + "_tcp", base + "_udp"}
-
-	for _, command := range []string{"PauseService", "ResumeService"} {
-		got := buildForwardControlServiceNames(base, command)
-		if !reflect.DeepEqual(got, want) {
-			t.Fatalf("command %s expected %v, got %v", command, want, got)
-		}
-	}
-}
-
-func TestBuildForwardControlServiceNamesDelete(t *testing.T) {
-	base := "12_34_56"
-	want := []string{base, base + "_tcp", base + "_udp"}
-	got := buildForwardControlServiceNames(base, " DeleteService ")
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("expected %v, got %v", want, got)
-	}
-}
-
-func TestBuildForwardServiceBaseCandidates(t *testing.T) {
-	got := buildForwardServiceBaseCandidates(12, 34, 56, []int64{56, 78, 90})
-	want := []string{"12_34_56", "12_34_78", "12_34_90", "12_34_0"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("expected %v, got %v", want, got)
-	}
-}
-
-func TestBuildForwardServiceBaseCandidatesWithZeroPreferred(t *testing.T) {
-	got := buildForwardServiceBaseCandidates(12, 34, 0, []int64{78, 0, 90})
-	want := []string{"12_34_0", "12_34_78", "12_34_90"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("expected %v, got %v", want, got)
-	}
-}
-
-func TestShouldTryLegacySingleService(t *testing.T) {
-	if !shouldTryLegacySingleService("PauseService") {
-		t.Fatalf("PauseService should require legacy fallback")
-	}
-	if !shouldTryLegacySingleService("resumeService") {
-		t.Fatalf("ResumeService should require legacy fallback")
-	}
-	if shouldTryLegacySingleService("DeleteService") {
-		t.Fatalf("DeleteService should not require legacy fallback")
-	}
-}

go-backend/internal/http/handler/federation_runtime_test.go

@@ -1,210 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/sqlite"
-)
-
-func TestPickPeerSharePortUsesRuntimeReservations(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer repo.Close()
-
-	h := &Handler{repo: repo}
-	now := time.Now().UnixMilli()
-
-	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, ?, ?, ?, ?, ?, ?)`, 1, 2, 1, 3000, "round", 1, "tls"); err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, 1, 3001); err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 77, 1, "res-1", "rk-1", "b-1", "exit", "", "fed_svc_1", "tls", "round", 3002, "", 1, 1, now, now); err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	share := &sqlite.PeerShare{
-		ID:             77,
-		NodeID:         1,
-		PortRangeStart: 3000,
-		PortRangeEnd:   3004,
-	}
-
-	port, err := h.pickPeerSharePort(share, 0)
-	if err != nil {
-		t.Fatalf("pick auto port: %v", err)
-	}
-	if port != 3003 {
-		t.Fatalf("expected port 3003, got %d", port)
-	}
-
-	if _, err := h.pickPeerSharePort(share, 3001); err == nil {
-		t.Fatalf("expected requested busy port to fail")
-	}
-}
-
-func TestApplyTunnelRuntimeSkipsRemoteNodes(t *testing.T) {
-	h := &Handler{}
-	state := &tunnelCreateState{
-		TunnelID: 1,
-		Type:     2,
-		InNodes: []tunnelRuntimeNode{
-			{NodeID: 11, ChainType: 1, Protocol: "tls"},
-		},
-		ChainHops: [][]tunnelRuntimeNode{
-			{
-				{NodeID: 12, ChainType: 2, Inx: 1, Port: 41000, Protocol: "tls", Strategy: "round"},
-			},
-		},
-		OutNodes: []tunnelRuntimeNode{
-			{NodeID: 13, ChainType: 3, Port: 42000, Protocol: "tls", Strategy: "round"},
-		},
-		Nodes: map[int64]*nodeRecord{
-			11: {ID: 11, Name: "remote-in", IsRemote: 1},
-			12: {ID: 12, Name: "remote-chain", IsRemote: 1},
-			13: {ID: 13, Name: "remote-out", IsRemote: 1},
-		},
-	}
-
-	chains, services, err := h.applyTunnelRuntime(state)
-	if err != nil {
-		t.Fatalf("apply runtime: %v", err)
-	}
-	if len(chains) != 0 {
-		t.Fatalf("expected no local chains created, got %d", len(chains))
-	}
-	if len(services) != 0 {
-		t.Fatalf("expected no local services created, got %d", len(services))
-	}
-}
-
-func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer repo.Close()
-
-	h := &Handler{repo: repo}
-	now := time.Now().UnixMilli()
-
-	insertNode := func(name string, status int, portRange string, isRemote int) int64 {
-		res, execErr := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":1}`)
-		if execErr != nil {
-			t.Fatalf("insert node %s: %v", name, execErr)
-		}
-		id, idErr := res.LastInsertId()
-		if idErr != nil {
-			t.Fatalf("node id %s: %v", name, idErr)
-		}
-		return id
-	}
-
-	entryID := insertNode("entry", 1, "31000-31010", 0)
-	remoteOutID := insertNode("remote-out", 1, "30000", 1)
-
-	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, remoteOutID, 30000); err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	tx, err := repo.DB().Begin()
-	if err != nil {
-		t.Fatalf("begin tx: %v", err)
-	}
-	defer tx.Rollback()
-
-	req := map[string]interface{}{
-		"name": "test-tunnel",
-		"inNodeId": []interface{}{
-			map[string]interface{}{"nodeId": float64(entryID), "protocol": "tls", "strategy": "round"},
-		},
-		"outNodeId": []interface{}{
-			map[string]interface{}{"nodeId": float64(remoteOutID), "protocol": "tls", "strategy": "round", "port": float64(0)},
-		},
-		"chainNodes": []interface{}{},
-	}
-
-	state, err := h.prepareTunnelCreateState(tx, req, 2, 0)
-	if err != nil {
-		t.Fatalf("prepare state should not fail for remote auto-port: %v", err)
-	}
-	if len(state.OutNodes) != 1 {
-		t.Fatalf("expected 1 out node, got %d", len(state.OutNodes))
-	}
-	if state.OutNodes[0].Port != 0 {
-		t.Fatalf("expected remote out port to remain 0 before federation reserve, got %d", state.OutNodes[0].Port)
-	}
-}
-
-func TestFederationRuntimeReservePortRejectsWhenShareFlowExceeded(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer repo.Close()
-
-	h := &Handler{repo: repo}
-	now := time.Now().UnixMilli()
-
-	if err := repo.CreatePeerShare(&sqlite.PeerShare{
-		Name:           "limited-share",
-		NodeID:         1,
-		Token:          "limited-token",
-		MaxBandwidth:   2048,
-		CurrentFlow:    2048,
-		PortRangeStart: 30000,
-		PortRangeEnd:   30010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-
-	body, err := json.Marshal(map[string]interface{}{
-		"resourceKey":   "tunnel:1:node:1:type:3:hop:0",
-		"protocol":      "tls",
-		"requestedPort": 0,
-	})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/runtime/reserve-port", bytes.NewReader(body))
-	req.Header.Set("Authorization", "Bearer limited-token")
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationRuntimeReservePort(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 403 {
-		t.Fatalf("expected response code 403, got %d (%s)", payload.Code, payload.Msg)
-	}
-	if payload.Msg != "Share traffic limit exceeded" {
-		t.Fatalf("unexpected response message: %q", payload.Msg)
-	}
-}

go-backend/internal/http/handler/federation_share_test.go

@@ -1,637 +0,0 @@
-package handler
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/sqlite"
-)
-
-func TestFederationShareCreateRejectsRemoteNode(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	insertRes, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-share-node", "remote-share-secret", "10.10.10.1", "10.10.10.1", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":1}`)
-	if err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-	remoteNodeID, err := insertRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get remote node id: %v", err)
-	}
-
-	body, err := json.Marshal(createPeerShareRequest{
-		Name:           "remote-node-share",
-		NodeID:         remoteNodeID,
-		MaxBandwidth:   0,
-		ExpiryTime:     0,
-		PortRangeStart: 20000,
-		PortRangeEnd:   20010,
-	})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/create", bytes.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationShareCreate(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != -1 {
-		t.Fatalf("expected response code -1, got %d", payload.Code)
-	}
-	if payload.Msg != "Only local nodes can be shared" {
-		t.Fatalf("expected rejection message %q, got %q", "Only local nodes can be shared", payload.Msg)
-	}
-
-	var shareCount int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, remoteNodeID).Scan(&shareCount); err != nil {
-		t.Fatalf("query peer_share count: %v", err)
-	}
-	if shareCount != 0 {
-		t.Fatalf("expected no share rows for remote node, got %d", shareCount)
-	}
-}
-
-func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	insertRes, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "local-share-node", "local-share-secret", "10.20.30.40", "10.20.30.40", "", "21000-21010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "")
-	if err != nil {
-		t.Fatalf("insert local node: %v", err)
-	}
-	localNodeID, err := insertRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get local node id: %v", err)
-	}
-
-	body, err := json.Marshal(createPeerShareRequest{
-		Name:           "local-node-share",
-		NodeID:         localNodeID,
-		MaxBandwidth:   0,
-		ExpiryTime:     0,
-		PortRangeStart: 21000,
-		PortRangeEnd:   21010,
-		AllowedIPs:     "bad-ip-entry",
-	})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/create", bytes.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationShareCreate(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != -1 {
-		t.Fatalf("expected response code -1, got %d", payload.Code)
-	}
-	if !strings.Contains(payload.Msg, "Invalid allowed IP or CIDR") {
-		t.Fatalf("expected invalid IP message, got %q", payload.Msg)
-	}
-
-	var shareCount int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, localNodeID).Scan(&shareCount); err != nil {
-		t.Fatalf("query peer_share count: %v", err)
-	}
-	if shareCount != 0 {
-		t.Fatalf("expected no share rows for node, got %d", shareCount)
-	}
-}
-
-func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := repo.CreatePeerShare(&sqlite.PeerShare{
-		Name:           "provider-share",
-		NodeID:         9,
-		Token:          "share-list-token",
-		MaxBandwidth:   1024,
-		CurrentFlow:    512,
-		PortRangeStart: 22000,
-		PortRangeEnd:   22010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-
-	share, err := repo.GetPeerShareByToken("share-list-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		share.ID, share.NodeID, "r-1", "rk-1", "b-1", "middle", "fed_chain_1", "fed_svc_1", "tls", "round", 22001, "", 1, 1, now, now,
-		share.ID, share.NodeID, "r-2", "rk-2", "b-2", "exit", "", "fed_svc_2", "tls", "round", 22002, "", 1, 1, now, now,
-		share.ID, share.NodeID, "r-3", "rk-3", "", "", "", "", "tls", "round", 22003, "", 0, 0, now, now,
-	); err != nil {
-		t.Fatalf("insert peer_share_runtime rows: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/list", nil)
-	res := httptest.NewRecorder()
-	h.federationShareList(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	rows, ok := payload.Data.([]interface{})
-	if !ok || len(rows) == 0 {
-		t.Fatalf("expected non-empty share list, got %T", payload.Data)
-	}
-
-	first, ok := rows[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected share row object, got %T", rows[0])
-	}
-
-	if int(first["activeRuntimeNum"].(float64)) != 2 {
-		t.Fatalf("expected activeRuntimeNum=2, got %v", first["activeRuntimeNum"])
-	}
-
-	usedPortsRaw, ok := first["usedPorts"].([]interface{})
-	if !ok {
-		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
-	}
-	if len(usedPortsRaw) != 2 {
-		t.Fatalf("expected 2 used ports, got %d", len(usedPortsRaw))
-	}
-	if int(usedPortsRaw[0].(float64)) != 22001 || int(usedPortsRaw[1].(float64)) != 22002 {
-		t.Fatalf("unexpected used ports payload: %v", usedPortsRaw)
-	}
-
-	detailsRaw, ok := first["usedPortDetails"].([]interface{})
-	if !ok {
-		t.Fatalf("expected usedPortDetails array, got %T", first["usedPortDetails"])
-	}
-	if len(detailsRaw) != 2 {
-		t.Fatalf("expected 2 usedPortDetails rows, got %d", len(detailsRaw))
-	}
-}
-
-func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := repo.CreatePeerShare(&sqlite.PeerShare{
-		Name:           "delete-cleanup-share",
-		NodeID:         99,
-		Token:          "delete-cleanup-token",
-		MaxBandwidth:   4096,
-		PortRangeStart: 40000,
-		PortRangeEnd:   40010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-
-	share, err := repo.GetPeerShareByToken("delete-cleanup-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		share.ID, 99, "dc-r1", "dc-rk1", "dc-b1", "exit", "", "fed_svc_dc1", "tls", "round", 40001, "", 1, 1, now, now,
-		share.ID, 99, "dc-r2", "dc-rk2", "dc-b2", "middle", "fed_chain_dc2", "fed_svc_dc2", "tls", "round", 40002, "", 1, 1, now, now,
-	); err != nil {
-		t.Fatalf("insert peer_share_runtime rows: %v", err)
-	}
-
-	var runtimeCount int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID).Scan(&runtimeCount); err != nil {
-		t.Fatalf("count active runtimes before: %v", err)
-	}
-	if runtimeCount != 2 {
-		t.Fatalf("expected 2 active runtimes before delete, got %d", runtimeCount)
-	}
-
-	body, err := json.Marshal(deletePeerShareRequest{ID: share.ID})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/delete", bytes.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationShareDelete(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	var shareCount int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID).Scan(&shareCount); err != nil {
-		t.Fatalf("count peer_share after: %v", err)
-	}
-	if shareCount != 0 {
-		t.Fatalf("expected peer_share deleted, got %d rows", shareCount)
-	}
-
-	var runtimeCountAfter int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID).Scan(&runtimeCountAfter); err != nil {
-		t.Fatalf("count peer_share_runtime after: %v", err)
-	}
-	if runtimeCountAfter != 0 {
-		t.Fatalf("expected all peer_share_runtime rows deleted, got %d", runtimeCountAfter)
-	}
-}
-
-func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`); err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
-	res := httptest.NewRecorder()
-	h.federationRemoteUsageList(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	rows, ok := payload.Data.([]interface{})
-	if !ok || len(rows) == 0 {
-		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
-	}
-
-	first, ok := rows[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected row map, got %T", rows[0])
-	}
-
-	if int64(first["shareId"].(float64)) != 42 {
-		t.Fatalf("expected stale shareId=42 on sync failure, got %v", first["shareId"])
-	}
-	if int64(first["currentFlow"].(float64)) != 999999 {
-		t.Fatalf("expected stale currentFlow=999999 on sync failure, got %v", first["currentFlow"])
-	}
-
-	syncErr, _ := first["syncError"].(string)
-	if syncErr == "" {
-		t.Fatalf("expected non-empty syncError field on unreachable provider")
-	}
-}
-
-func TestFederationShareResetFlow(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-	if err := repo.CreatePeerShare(&sqlite.PeerShare{
-		Name:           "reset-flow-share",
-		NodeID:         11,
-		Token:          "reset-flow-token",
-		MaxBandwidth:   4096,
-		CurrentFlow:    2048,
-		PortRangeStart: 23000,
-		PortRangeEnd:   23010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := repo.GetPeerShareByToken("reset-flow-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	body, err := json.Marshal(resetPeerShareFlowRequest{ID: share.ID})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/reset-flow", bytes.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationShareResetFlow(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	updated, err := repo.GetPeerShare(share.ID)
-	if err != nil || updated == nil {
-		t.Fatalf("reload peer share: %v", err)
-	}
-	if updated.CurrentFlow != 0 {
-		t.Fatalf("expected current flow reset to 0, got %d", updated.CurrentFlow)
-	}
-}
-
-func TestFederationRemoteUsageList(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	resNode, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`)
-	if err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-	nodeID, err := resNode.LastInsertId()
-	if err != nil {
-		t.Fatalf("remote node id: %v", err)
-	}
-
-	resTunnelA, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0)
-	if err != nil {
-		t.Fatalf("insert tunnel a: %v", err)
-	}
-	tunnelAID, _ := resTunnelA.LastInsertId()
-
-	resTunnelB, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0)
-	if err != nil {
-		t.Fatalf("insert tunnel b: %v", err)
-	}
-	tunnelBID, _ := resTunnelB.LastInsertId()
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx, remote_url, resource_key, remote_binding_id, allocated_port, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		tunnelAID, nodeID, 2, 1, "http://peer.example", "rk-a", "rb-a", 31001, 1, now, now,
-		tunnelBID, nodeID, 3, 0, "http://peer.example", "rk-b", "rb-b", 31002, 1, now, now,
-	); err != nil {
-		t.Fatalf("insert federation bindings: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
-	res := httptest.NewRecorder()
-	h.federationRemoteUsageList(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	rows, ok := payload.Data.([]interface{})
-	if !ok || len(rows) == 0 {
-		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
-	}
-
-	first, ok := rows[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected first usage row map, got %T", rows[0])
-	}
-	if int64(first["shareId"].(float64)) != 88 {
-		t.Fatalf("expected shareId=88, got %v", first["shareId"])
-	}
-
-	usedPortsRaw, ok := first["usedPorts"].([]interface{})
-	if !ok {
-		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
-	}
-	if len(usedPortsRaw) != 2 {
-		t.Fatalf("expected 2 used ports, got %d", len(usedPortsRaw))
-	}
-	if int(usedPortsRaw[0].(float64)) != 31001 || int(usedPortsRaw[1].(float64)) != 31002 {
-		t.Fatalf("unexpected used ports payload: %v", usedPortsRaw)
-	}
-
-	bindingsRaw, ok := first["bindings"].([]interface{})
-	if !ok {
-		t.Fatalf("expected bindings array, got %T", first["bindings"])
-	}
-	if len(bindingsRaw) != 2 {
-		t.Fatalf("expected 2 binding rows, got %d", len(bindingsRaw))
-	}
-}
-
-func TestAuthPeerAllowedIPs(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	tests := []struct {
-		name        string
-		allowedIPs  string
-		remoteAddr  string
-		xff         string
-		wantAllowed bool
-	}{
-		{
-			name:        "exact ip allowed",
-			allowedIPs:  "203.0.113.10",
-			remoteAddr:  "203.0.113.10:23456",
-			wantAllowed: true,
-		},
-		{
-			name:        "cidr allowed",
-			allowedIPs:  "203.0.113.0/24",
-			remoteAddr:  "203.0.113.11:23456",
-			wantAllowed: true,
-		},
-		{
-			name:        "trusted proxy xff allowed",
-			allowedIPs:  "198.51.100.20",
-			remoteAddr:  "172.20.0.3:34567",
-			xff:         "198.51.100.20, 172.20.0.3",
-			wantAllowed: true,
-		},
-		{
-			name:        "non whitelisted ip denied",
-			allowedIPs:  "203.0.113.10",
-			remoteAddr:  "203.0.113.99:23456",
-			wantAllowed: false,
-		},
-	}
-
-	for idx, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			token := fmt.Sprintf("share-token-%d", idx)
-			if err := repo.CreatePeerShare(&sqlite.PeerShare{
-				Name:           "share-" + tt.name,
-				NodeID:         1,
-				Token:          token,
-				PortRangeStart: 10000,
-				PortRangeEnd:   10010,
-				IsActive:       1,
-				CreatedTime:    now,
-				UpdatedTime:    now,
-				AllowedIPs:     tt.allowedIPs,
-			}); err != nil {
-				t.Fatalf("create peer share: %v", err)
-			}
-
-			nextCalled := false
-			wrapped := h.authPeer(func(w http.ResponseWriter, r *http.Request) {
-				nextCalled = true
-				response.WriteJSON(w, response.OKEmpty())
-			})
-
-			req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/connect", nil)
-			req.Header.Set("Authorization", "Bearer "+token)
-			if tt.xff != "" {
-				req.Header.Set("X-Forwarded-For", tt.xff)
-			}
-			req.RemoteAddr = tt.remoteAddr
-
-			res := httptest.NewRecorder()
-			wrapped(res, req)
-
-			var payload response.R
-			if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-				t.Fatalf("decode response: %v", err)
-			}
-
-			if tt.wantAllowed {
-				if !nextCalled {
-					t.Fatalf("expected next handler to be called")
-				}
-				if payload.Code != 0 {
-					t.Fatalf("expected code 0, got %d (%s)", payload.Code, payload.Msg)
-				}
-				return
-			}
-
-			if nextCalled {
-				t.Fatalf("expected next handler not to be called")
-			}
-			if payload.Code != 403 {
-				t.Fatalf("expected code 403, got %d (%s)", payload.Code, payload.Msg)
-			}
-			if payload.Msg != "IP not allowed" {
-				t.Fatalf("expected IP rejection message, got %q", payload.Msg)
-			}
-		})
-	}
-}

go-backend/internal/http/handler/flow_policy.go

@@ -1,409 +0,0 @@
-package handler
-
-import (
-	"database/sql"
-	"encoding/json"
-	"strconv"
-	"strings"
-	"time"
-)
-
-const bytesPerGB int64 = 1024 * 1024 * 1024
-
-type userTunnelPolicy struct {
-	ID       int64
-	UserID   int64
-	TunnelID int64
-	Flow     int64
-	InFlow   int64
-	OutFlow  int64
-	ExpTime  int64
-	Status   int
-}
-
-type gostConfigSnapshot struct {
-	Services []namedConfigItem `json:"services"`
-	Chains   []namedConfigItem `json:"chains"`
-	Limiters []namedConfigItem `json:"limiters"`
-}
-
-type namedConfigItem struct {
-	Name string `json:"name"`
-}
-
-func (h *Handler) processFlowItem(item flowItem) {
-	serviceName := strings.TrimSpace(item.N)
-	if serviceName == "" || serviceName == "web_api" {
-		return
-	}
-
-	forwardID, userID, userTunnelID, ok := parseFlowServiceIDs(serviceName)
-	if ok {
-		inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
-		_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
-
-		if userTunnelID > 0 {
-			h.enforceFlowPolicies(userID, userTunnelID)
-		}
-		return
-	}
-
-	runtimeID, ok := parsePeerShareRuntimeServiceID(serviceName)
-	if !ok {
-		return
-	}
-	h.processPeerShareFlow(runtimeID, item)
-}
-
-func parseFlowServiceIDs(serviceName string) (int64, int64, int64, bool) {
-	parts := strings.Split(serviceName, "_")
-	if len(parts) < 3 {
-		return 0, 0, 0, false
-	}
-
-	forwardID, err1 := strconv.ParseInt(parts[0], 10, 64)
-	userID, err2 := strconv.ParseInt(parts[1], 10, 64)
-	userTunnelID, err3 := strconv.ParseInt(parts[2], 10, 64)
-	if err1 != nil || err2 != nil || err3 != nil || forwardID <= 0 || userID <= 0 {
-		return 0, 0, 0, false
-	}
-
-	return forwardID, userID, userTunnelID, true
-}
-
-func parsePeerShareRuntimeServiceID(serviceName string) (int64, bool) {
-	const prefix = "fed_svc_"
-	if !strings.HasPrefix(serviceName, prefix) {
-		return 0, false
-	}
-	raw := strings.TrimPrefix(serviceName, prefix)
-	if raw == "" {
-		return 0, false
-	}
-	parts := strings.SplitN(raw, "_", 2)
-	runtimeID, err := strconv.ParseInt(parts[0], 10, 64)
-	if err != nil || runtimeID <= 0 {
-		return 0, false
-	}
-	return runtimeID, true
-}
-
-func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
-	if h == nil || h.repo == nil || runtimeID <= 0 {
-		return
-	}
-	runtime, err := h.repo.GetPeerShareRuntimeByID(runtimeID)
-	if err != nil || runtime == nil || runtime.ShareID <= 0 || runtime.Status != 1 {
-		return
-	}
-
-	delta := item.D + item.U
-	if delta <= 0 {
-		return
-	}
-
-	_ = h.repo.AddPeerShareCurrentFlow(runtime.ShareID, delta)
-
-	share, err := h.repo.GetPeerShare(runtime.ShareID)
-	if err != nil || share == nil {
-		return
-	}
-	if !isPeerShareFlowExceeded(share) {
-		return
-	}
-	h.enforcePeerShareFlowLimit(share.ID)
-}
-
-func (h *Handler) enforcePeerShareFlowLimit(shareID int64) {
-	if h == nil || h.repo == nil || shareID <= 0 {
-		return
-	}
-	runtimes, err := h.repo.ListActivePeerShareRuntimesByShareID(shareID)
-	if err != nil || len(runtimes) == 0 {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	for _, runtime := range runtimes {
-		if h.wsServer != nil && runtime.Applied == 1 {
-			if strings.TrimSpace(runtime.ServiceName) != "" {
-				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteService", map[string]interface{}{"services": []string{runtime.ServiceName}}, false, true)
-			}
-			if strings.TrimSpace(runtime.Role) == "middle" && strings.TrimSpace(runtime.ChainName) != "" {
-				_, _ = h.sendNodeCommand(runtime.NodeID, "DeleteChains", map[string]interface{}{"chain": runtime.ChainName}, false, true)
-			}
-		}
-		_ = h.repo.MarkPeerShareRuntimeReleased(runtime.ID, now)
-	}
-}
-
-func (h *Handler) scaleFlowByTunnel(forwardID int64, inFlow int64, outFlow int64) (int64, int64) {
-	forward, err := h.getForwardRecord(forwardID)
-	if err != nil || forward == nil {
-		return inFlow, outFlow
-	}
-
-	tunnel, err := h.getTunnelRecord(forward.TunnelID)
-	if err != nil || tunnel == nil {
-		return inFlow, outFlow
-	}
-
-	scaledIn := int64(float64(inFlow)*tunnel.TrafficRatio) * tunnel.Flow
-	scaledOut := int64(float64(outFlow)*tunnel.TrafficRatio) * tunnel.Flow
-	return scaledIn, scaledOut
-}
-
-func (h *Handler) enforceFlowPolicies(userID int64, userTunnelID int64) {
-	now := time.Now().UnixMilli()
-
-	if h.shouldPauseUser(userID, now) {
-		h.pauseUserForwards(userID, now)
-	}
-
-	policy, err := h.getUserTunnelPolicy(userTunnelID)
-	if err != nil || policy == nil {
-		return
-	}
-
-	if shouldPauseUserTunnel(policy, now) {
-		h.pauseUserTunnelForwards(policy.UserID, policy.TunnelID, now)
-	}
-}
-
-func (h *Handler) shouldPauseUser(userID int64, now int64) bool {
-	user, err := h.repo.GetUserByID(userID)
-	if err != nil || user == nil {
-		return false
-	}
-
-	flowLimit := user.Flow * bytesPerGB
-	current := user.InFlow + user.OutFlow
-	if flowLimit < current {
-		return true
-	}
-	if user.ExpTime > 0 && user.ExpTime <= now {
-		return true
-	}
-	return user.Status != 1
-}
-
-func shouldPauseUserTunnel(policy *userTunnelPolicy, now int64) bool {
-	if policy == nil {
-		return false
-	}
-
-	flowLimit := policy.Flow * bytesPerGB
-	current := policy.InFlow + policy.OutFlow
-	if current >= flowLimit {
-		return true
-	}
-	if policy.ExpTime > 0 && policy.ExpTime <= now {
-		return true
-	}
-	return policy.Status != 1
-}
-
-func (h *Handler) getUserTunnelPolicy(userTunnelID int64) (*userTunnelPolicy, error) {
-	if userTunnelID <= 0 {
-		return nil, nil
-	}
-
-	row := h.repo.DB().QueryRow(`
-		SELECT id, user_id, tunnel_id, flow, in_flow, out_flow, exp_time, status
-		FROM user_tunnel
-		WHERE id = ?
-		LIMIT 1
-	`, userTunnelID)
-
-	var policy userTunnelPolicy
-	if err := row.Scan(&policy.ID, &policy.UserID, &policy.TunnelID, &policy.Flow, &policy.InFlow, &policy.OutFlow, &policy.ExpTime, &policy.Status); err != nil {
-		if err == sql.ErrNoRows {
-			return nil, nil
-		}
-		return nil, err
-	}
-	return &policy, nil
-}
-
-func (h *Handler) pauseUserForwards(userID int64, now int64) {
-	forwards, err := h.listActiveForwardsByUser(userID)
-	if err != nil {
-		return
-	}
-	h.pauseForwardRecords(forwards, now)
-}
-
-func (h *Handler) pauseUserTunnelForwards(userID int64, tunnelID int64, now int64) {
-	forwards, err := h.listActiveForwardsByUserTunnel(userID, tunnelID)
-	if err != nil {
-		return
-	}
-	h.pauseForwardRecords(forwards, now)
-}
-
-func (h *Handler) pauseForwardRecords(forwards []forwardRecord, now int64) {
-	for i := range forwards {
-		forward := forwards[i]
-		_ = h.controlForwardServices(&forward, "PauseService", false)
-		_, _ = h.repo.DB().Exec(`UPDATE forward SET status = 0, updated_time = ? WHERE id = ?`, now, forward.ID)
-	}
-}
-
-func (h *Handler) listActiveForwardsByUser(userID int64) ([]forwardRecord, error) {
-	rows, err := h.repo.DB().Query(`
-		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, strategy, status
-		FROM forward
-		WHERE user_id = ? AND status = 1
-		ORDER BY id ASC
-	`, userID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	return scanForwardRecords(rows)
-}
-
-func (h *Handler) listActiveForwardsByUserTunnel(userID int64, tunnelID int64) ([]forwardRecord, error) {
-	rows, err := h.repo.DB().Query(`
-		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, strategy, status
-		FROM forward
-		WHERE user_id = ? AND tunnel_id = ? AND status = 1
-		ORDER BY id ASC
-	`, userID, tunnelID)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	return scanForwardRecords(rows)
-}
-
-func scanForwardRecords(rows *sql.Rows) ([]forwardRecord, error) {
-	out := make([]forwardRecord, 0)
-	for rows.Next() {
-		var record forwardRecord
-		if err := rows.Scan(&record.ID, &record.UserID, &record.UserName, &record.Name, &record.TunnelID, &record.RemoteAddr, &record.Strategy, &record.Status); err != nil {
-			return nil, err
-		}
-		if strings.TrimSpace(record.Strategy) == "" {
-			record.Strategy = "fifo"
-		}
-		out = append(out, record)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
-	if h == nil || h.repo == nil || h.repo.DB() == nil || nodeID <= 0 {
-		return
-	}
-	if strings.TrimSpace(rawConfig) == "" {
-		return
-	}
-
-	var snapshot gostConfigSnapshot
-	if err := json.Unmarshal([]byte(rawConfig), &snapshot); err != nil {
-		return
-	}
-
-	h.cleanOrphanedServices(nodeID, snapshot.Services)
-	h.cleanOrphanedChains(nodeID, snapshot.Chains)
-	h.cleanOrphanedLimiters(nodeID, snapshot.Limiters)
-}
-
-func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem) {
-	for _, item := range services {
-		name := strings.TrimSpace(item.Name)
-		if name == "" || name == "web_api" {
-			continue
-		}
-
-		parts := strings.Split(name, "_")
-		if len(parts) >= 3 {
-			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err == nil && forwardID > 0 && !h.forwardExists(forwardID) {
-				_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name, parts[0] + "_" + parts[1] + "_" + parts[2], parts[0] + "_" + parts[1] + "_" + parts[2] + "_tcp", parts[0] + "_" + parts[1] + "_" + parts[2] + "_udp"}}, false, true)
-				continue
-			}
-		}
-		suffix := parts[len(parts)-1]
-
-		switch suffix {
-		case "tls":
-			tunnelID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err != nil || tunnelID <= 0 || h.tunnelExists(tunnelID) {
-				continue
-			}
-			_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name}}, false, true)
-		case "tcp":
-			if len(parts) < 4 {
-				continue
-			}
-			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err != nil || forwardID <= 0 || h.forwardExists(forwardID) {
-				continue
-			}
-			base := strings.TrimSuffix(name, "_tcp")
-			_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{base + "_tcp", base + "_udp"}}, false, true)
-		}
-	}
-}
-
-func (h *Handler) cleanOrphanedChains(nodeID int64, chains []namedConfigItem) {
-	for _, item := range chains {
-		name := strings.TrimSpace(item.Name)
-		if name == "" {
-			continue
-		}
-
-		idx := strings.LastIndex(name, "_")
-		if idx <= 0 || idx >= len(name)-1 {
-			continue
-		}
-		tunnelID, err := strconv.ParseInt(name[idx+1:], 10, 64)
-		if err != nil || tunnelID <= 0 || h.tunnelExists(tunnelID) {
-			continue
-		}
-		_, _ = h.sendNodeCommand(nodeID, "DeleteChains", map[string]interface{}{"chain": name}, false, true)
-	}
-}
-
-func (h *Handler) cleanOrphanedLimiters(nodeID int64, limiters []namedConfigItem) {
-	for _, item := range limiters {
-		name := strings.TrimSpace(item.Name)
-		if name == "" || h.speedLimiterExists(name) {
-			continue
-		}
-		_, _ = h.sendNodeCommand(nodeID, "DeleteLimiters", map[string]interface{}{"limiter": name}, false, true)
-	}
-}
-
-func (h *Handler) tunnelExists(tunnelID int64) bool {
-	var count int
-	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE id = ?`, tunnelID).Scan(&count)
-	return err == nil && count > 0
-}
-
-func (h *Handler) forwardExists(forwardID int64) bool {
-	var count int
-	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM forward WHERE id = ?`, forwardID).Scan(&count)
-	return err == nil && count > 0
-}
-
-func (h *Handler) speedLimiterExists(name string) bool {
-	if name == "" {
-		return false
-	}
-	id, err := strconv.ParseInt(name, 10, 64)
-	if err != nil || id <= 0 {
-		return false
-	}
-
-	var count int
-	err = h.repo.DB().QueryRow(`SELECT COUNT(1) FROM speed_limit WHERE id = ?`, id).Scan(&count)
-	return err == nil && count > 0
-}

go-backend/internal/http/handler/flow_policy_federation_test.go

@@ -1,63 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/sqlite"
-)
-
-func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
-	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer repo.Close()
-
-	now := time.Now().UnixMilli()
-	if err := repo.CreatePeerShare(&sqlite.PeerShare{
-		Name:           "flow-share",
-		NodeID:         1,
-		Token:          "flow-share-token",
-		MaxBandwidth:   3000,
-		CurrentFlow:    1000,
-		PortRangeStart: 32000,
-		PortRangeEnd:   32010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := repo.GetPeerShareByToken("flow-share-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now); err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	h := &Handler{repo: repo}
-	h.processFlowItem(flowItem{N: "fed_svc_17", U: 1200, D: 900})
-
-	updatedShare, err := repo.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 3100 {
-		t.Fatalf("expected current_flow=3100, got %d", updatedShare.CurrentFlow)
-	}
-
-	runtime, err := repo.GetPeerShareRuntimeByID(17)
-	if err != nil || runtime == nil {
-		t.Fatalf("reload runtime: %v", err)
-	}
-	if runtime.Status != 0 {
-		t.Fatalf("expected runtime status=0 after limit enforcement, got %d", runtime.Status)
-	}
-}

go-backend/internal/http/handler/jobs.go

@@ -1,270 +0,0 @@
-package handler
-
-import (
-	"context"
-	"database/sql"
-	"time"
-)
-
-func (h *Handler) StartBackgroundJobs() {
-	if h == nil || h.repo == nil || h.repo.DB() == nil {
-		return
-	}
-
-	h.jobsMu.Lock()
-	if h.jobsStarted {
-		h.jobsMu.Unlock()
-		return
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	h.jobsCancel = cancel
-	h.jobsStarted = true
-	h.jobsWG.Add(2)
-	h.jobsMu.Unlock()
-
-	go h.runHourlyStatsLoop(ctx)
-	go h.runDailyMaintenanceLoop(ctx)
-}
-
-func (h *Handler) StopBackgroundJobs() {
-	if h == nil {
-		return
-	}
-
-	h.jobsMu.Lock()
-	if !h.jobsStarted {
-		h.jobsMu.Unlock()
-		return
-	}
-	cancel := h.jobsCancel
-	h.jobsCancel = nil
-	h.jobsStarted = false
-	h.jobsMu.Unlock()
-
-	if cancel != nil {
-		cancel()
-	}
-	h.jobsWG.Wait()
-}
-
-func (h *Handler) runHourlyStatsLoop(ctx context.Context) {
-	defer h.jobsWG.Done()
-
-	for {
-		wait := durationUntilNextHour(time.Now())
-		timer := time.NewTimer(wait)
-		select {
-		case <-ctx.Done():
-			if !timer.Stop() {
-				<-timer.C
-			}
-			return
-		case <-timer.C:
-			h.runStatisticsFlowJob(time.Now())
-		}
-	}
-}
-
-func (h *Handler) runDailyMaintenanceLoop(ctx context.Context) {
-	defer h.jobsWG.Done()
-
-	for {
-		wait := durationUntilNextDailyMaintenance(time.Now())
-		timer := time.NewTimer(wait)
-		select {
-		case <-ctx.Done():
-			if !timer.Stop() {
-				<-timer.C
-			}
-			return
-		case <-timer.C:
-			h.runResetAndExpiryJob(time.Now())
-		}
-	}
-}
-
-func durationUntilNextHour(now time.Time) time.Duration {
-	next := now.Truncate(time.Hour).Add(time.Hour)
-	return next.Sub(now)
-}
-
-func durationUntilNextDailyMaintenance(now time.Time) time.Duration {
-	next := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 5, 0, now.Location())
-	if !next.After(now) {
-		next = next.Add(24 * time.Hour)
-	}
-	return next.Sub(now)
-}
-
-func (h *Handler) runStatisticsFlowJob(now time.Time) {
-	if h == nil || h.repo == nil || h.repo.DB() == nil {
-		return
-	}
-
-	db := h.repo.DB()
-	nowMs := now.UnixMilli()
-	cutoffMs := nowMs - int64((48*time.Hour)/time.Millisecond)
-	_, _ = db.Exec(`DELETE FROM statistics_flow WHERE created_time < ?`, cutoffMs)
-
-	hourMark := now.Truncate(time.Hour)
-	hourText := hourMark.Format("15:04")
-	createdTime := hourMark.UnixMilli()
-
-	rows, err := db.Query(`SELECT id, in_flow, out_flow FROM user ORDER BY id ASC`)
-	if err != nil {
-		return
-	}
-	type userFlowSnapshot struct {
-		userID  int64
-		inFlow  int64
-		outFlow int64
-	}
-	users := make([]userFlowSnapshot, 0)
-
-	for rows.Next() {
-		var userID int64
-		var inFlow int64
-		var outFlow int64
-		if err := rows.Scan(&userID, &inFlow, &outFlow); err != nil {
-			continue
-		}
-		users = append(users, userFlowSnapshot{userID: userID, inFlow: inFlow, outFlow: outFlow})
-	}
-	_ = rows.Close()
-
-	for _, user := range users {
-		currentTotal := user.inFlow + user.outFlow
-		increment := currentTotal
-
-		var lastTotal sql.NullInt64
-		err := db.QueryRow(`SELECT total_flow FROM statistics_flow WHERE user_id = ? ORDER BY id DESC LIMIT 1`, user.userID).Scan(&lastTotal)
-		if err == nil && lastTotal.Valid {
-			increment = currentTotal - lastTotal.Int64
-			if increment < 0 {
-				increment = currentTotal
-			}
-		}
-
-		_, _ = db.Exec(`
-			INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time)
-			VALUES(?, ?, ?, ?, ?)
-		`, user.userID, increment, currentTotal, hourText, createdTime)
-	}
-}
-
-func (h *Handler) runResetAndExpiryJob(now time.Time) {
-	if h == nil || h.repo == nil || h.repo.DB() == nil {
-		return
-	}
-
-	h.resetMonthlyFlow(now)
-	h.disableExpiredUsers(now.UnixMilli())
-	h.disableExpiredUserTunnels(now.UnixMilli())
-}
-
-func (h *Handler) resetMonthlyFlow(now time.Time) {
-	db := h.repo.DB()
-	currentDay := now.Day()
-	lastDay := time.Date(now.Year(), now.Month()+1, 0, 0, 0, 0, 0, now.Location()).Day()
-
-	if currentDay == lastDay {
-		_, _ = db.Exec(`
-			UPDATE user
-			SET in_flow = 0, out_flow = 0
-			WHERE flow_reset_time != 0
-			  AND (flow_reset_time = ? OR flow_reset_time > ?)
-		`, currentDay, lastDay)
-		_, _ = db.Exec(`
-			UPDATE user_tunnel
-			SET in_flow = 0, out_flow = 0
-			WHERE flow_reset_time != 0
-			  AND (flow_reset_time = ? OR flow_reset_time > ?)
-		`, currentDay, lastDay)
-		return
-	}
-
-	_, _ = db.Exec(`
-		UPDATE user
-		SET in_flow = 0, out_flow = 0
-		WHERE flow_reset_time != 0
-		  AND flow_reset_time = ?
-	`, currentDay)
-	_, _ = db.Exec(`
-		UPDATE user_tunnel
-		SET in_flow = 0, out_flow = 0
-		WHERE flow_reset_time != 0
-		  AND flow_reset_time = ?
-	`, currentDay)
-}
-
-func (h *Handler) disableExpiredUsers(nowMs int64) {
-	db := h.repo.DB()
-	rows, err := db.Query(`
-		SELECT id
-		FROM user
-		WHERE role_id != 0
-		  AND status = 1
-		  AND exp_time IS NOT NULL
-		  AND exp_time < ?
-	`, nowMs)
-	if err != nil {
-		return
-	}
-	userIDs := make([]int64, 0)
-
-	for rows.Next() {
-		var userID int64
-		if err := rows.Scan(&userID); err != nil {
-			continue
-		}
-		userIDs = append(userIDs, userID)
-	}
-	_ = rows.Close()
-
-	for _, userID := range userIDs {
-		forwards, err := h.listActiveForwardsByUser(userID)
-		if err == nil {
-			h.pauseForwardRecords(forwards, nowMs)
-		}
-		_, _ = db.Exec(`UPDATE user SET status = 0 WHERE id = ?`, userID)
-	}
-}
-
-func (h *Handler) disableExpiredUserTunnels(nowMs int64) {
-	db := h.repo.DB()
-	rows, err := db.Query(`
-		SELECT id, user_id, tunnel_id
-		FROM user_tunnel
-		WHERE status = 1
-		  AND exp_time IS NOT NULL
-		  AND exp_time < ?
-	`, nowMs)
-	if err != nil {
-		return
-	}
-	type expiredUserTunnel struct {
-		userTunnelID int64
-		userID       int64
-		tunnelID     int64
-	}
-	items := make([]expiredUserTunnel, 0)
-
-	for rows.Next() {
-		var userTunnelID int64
-		var userID int64
-		var tunnelID int64
-		if err := rows.Scan(&userTunnelID, &userID, &tunnelID); err != nil {
-			continue
-		}
-		items = append(items, expiredUserTunnel{userTunnelID: userTunnelID, userID: userID, tunnelID: tunnelID})
-	}
-	_ = rows.Close()
-
-	for _, item := range items {
-		forwards, err := h.listActiveForwardsByUserTunnel(item.userID, item.tunnelID)
-		if err == nil {
-			h.pauseForwardRecords(forwards, nowMs)
-		}
-		_, _ = db.Exec(`UPDATE user_tunnel SET status = 0 WHERE id = ?`, item.userTunnelID)
-	}
-}

go-backend/internal/http/handler/jobs_test.go

@@ -1,128 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/sqlite"
-)
-
-func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "jobs-stats.db")
-	repo, err := sqlite.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "secret")
-	now := time.Date(2026, 2, 7, 12, 0, 0, 0, time.UTC)
-	nowMs := now.UnixMilli()
-
-	if _, err := repo.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`); err != nil {
-		t.Fatalf("seed user flow: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()); err != nil {
-		t.Fatalf("seed recent statistics row: %v", err)
-	}
-	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()); err != nil {
-		t.Fatalf("seed stale statistics row: %v", err)
-	}
-
-	h.runStatisticsFlowJob(now)
-
-	var staleCount int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond)).Scan(&staleCount); err != nil {
-		t.Fatalf("query stale statistics rows: %v", err)
-	}
-	if staleCount != 0 {
-		t.Fatalf("expected stale statistics rows to be pruned, got %d", staleCount)
-	}
-
-	var flow int64
-	var total int64
-	var hour string
-	if err := repo.DB().QueryRow(`SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`).Scan(&flow, &total, &hour); err != nil {
-		t.Fatalf("query latest statistics row: %v", err)
-	}
-	if flow != 50 {
-		t.Fatalf("expected increment flow 50, got %d", flow)
-	}
-	if total != 300 {
-		t.Fatalf("expected total flow 300, got %d", total)
-	}
-	if hour != "12:00" {
-		t.Fatalf("expected hour mark 12:00, got %s", hour)
-	}
-}
-
-func TestRunResetAndExpiryJobResetsFlowAndDisablesExpiredRecords(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "jobs-reset.db")
-	repo, err := sqlite.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = repo.Close() })
-
-	h := New(repo, "secret")
-	now := time.Date(2026, 3, 15, 0, 0, 5, 0, time.UTC)
-	nowMs := now.UnixMilli()
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'expired_user', 'x', 1, ?, 100, 1000, 2000, 15, 1, ?, ?, 1)
-	`, nowMs-1000, nowMs, nowMs); err != nil {
-		t.Fatalf("insert expired user: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, 't1', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, nowMs, nowMs); err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, 1, NULL, 1, 1, 300, 400, 15, ?, 1)
-	`, nowMs-1000); err != nil {
-		t.Fatalf("insert expired user_tunnel: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(20, 2, 'expired_user', 'f1', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, nowMs, nowMs); err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	h.runResetAndExpiryJob(now)
-
-	var userIn, userOut int64
-	var userStatus int
-	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user WHERE id = 2`).Scan(&userIn, &userOut, &userStatus); err != nil {
-		t.Fatalf("query user after maintenance: %v", err)
-	}
-	if userIn != 0 || userOut != 0 || userStatus != 0 {
-		t.Fatalf("expected user reset+disabled, got in=%d out=%d status=%d", userIn, userOut, userStatus)
-	}
-
-	var utIn, utOut int64
-	var utStatus int
-	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`).Scan(&utIn, &utOut, &utStatus); err != nil {
-		t.Fatalf("query user_tunnel after maintenance: %v", err)
-	}
-	if utIn != 0 || utOut != 0 || utStatus != 0 {
-		t.Fatalf("expected user_tunnel reset+disabled, got in=%d out=%d status=%d", utIn, utOut, utStatus)
-	}
-
-	var forwardStatus int
-	if err := repo.DB().QueryRow(`SELECT status FROM forward WHERE id = 20`).Scan(&forwardStatus); err != nil {
-		t.Fatalf("query forward after maintenance: %v", err)
-	}
-	if forwardStatus != 0 {
-		t.Fatalf("expected forward status=0 after expiry handling, got %d", forwardStatus)
-	}
-}

go-backend/internal/http/middleware/auth.go

@@ -1,133 +0,0 @@
-package middleware
-
-import (
-	"context"
-	"net/http"
-	"strings"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-type contextKey string
-
-const ClaimsContextKey contextKey = "claims"
-
-type AuthOptions struct {
-	JWTSecret string
-}
-
-func JWT(opts AuthOptions) func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if shouldSkip(r.URL.Path) {
-				next.ServeHTTP(w, r)
-				return
-			}
-
-			if !strings.HasPrefix(r.URL.Path, "/api/") {
-				next.ServeHTTP(w, r)
-				return
-			}
-
-			token := strings.TrimSpace(r.Header.Get("Authorization"))
-			if token == "" {
-				response.WriteJSON(w, response.Err(401, "未登录或token已过期"))
-				return
-			}
-
-			claims, ok := auth.ValidateToken(token, opts.JWTSecret)
-			if !ok {
-				response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
-				return
-			}
-
-			if requiresAdmin(r.URL.Path) && claims.RoleID != 0 {
-				response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
-				return
-			}
-
-			ctx := context.WithValue(r.Context(), ClaimsContextKey, claims)
-			next.ServeHTTP(w, r.WithContext(ctx))
-		})
-	}
-}
-
-func RequireAdmin(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		raw := r.Context().Value(ClaimsContextKey)
-		claims, ok := raw.(auth.Claims)
-		if !ok {
-			response.WriteJSON(w, response.Err(401, "无法获取用户权限信息"))
-			return
-		}
-		if claims.RoleID != 0 {
-			response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func shouldSkip(path string) bool {
-	switch {
-	case strings.HasPrefix(path, "/flow/"):
-		return true
-	case strings.HasPrefix(path, "/api/v1/open_api/"):
-		return true
-	case strings.HasPrefix(path, "/api/v1/captcha/"):
-		return true
-	case path == "/api/v1/config/get":
-		return true
-	case path == "/api/v1/user/login":
-		return true
-	case path == "/api/v1/federation/connect":
-		return true
-	case path == "/api/v1/federation/tunnel/create":
-		return true
-	case path == "/api/v1/federation/runtime/reserve-port":
-		return true
-	case path == "/api/v1/federation/runtime/apply-role":
-		return true
-	case path == "/api/v1/federation/runtime/release-role":
-		return true
-	case path == "/api/v1/federation/runtime/diagnose":
-		return true
-	default:
-		return false
-	}
-}
-
-func requiresAdmin(path string) bool {
-	if strings.HasPrefix(path, "/api/v1/group/") {
-		return true
-	}
-
-	if strings.HasPrefix(path, "/api/v1/federation/share/") {
-		return true
-	}
-
-	if strings.HasPrefix(path, "/api/v1/node/") {
-		return true
-	}
-
-	if strings.HasPrefix(path, "/api/v1/speed-limit/") {
-		return true
-	}
-
-	if strings.HasPrefix(path, "/api/v1/tunnel/") {
-		if strings.HasPrefix(path, "/api/v1/tunnel/user/tunnel") {
-			return false
-		}
-		return true
-	}
-
-	switch path {
-	case "/api/v1/user/create", "/api/v1/user/list", "/api/v1/user/update", "/api/v1/user/delete", "/api/v1/user/reset":
-		return true
-	case "/api/v1/config/update", "/api/v1/config/update-single":
-		return true
-	default:
-		return false
-	}
-}

go-backend/internal/http/middleware/cors.go

@@ -1,17 +0,0 @@
-package middleware
-
-import "net/http"
-
-func CORS(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Headers", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT, OPTIONS")
-		w.Header().Set("Access-Control-Expose-Headers", "Authorization")
-		if r.Method == http.MethodOptions {
-			w.WriteHeader(http.StatusNoContent)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}

go-backend/internal/http/middleware/recover.go

@@ -1,19 +0,0 @@
-package middleware
-
-import (
-	"fmt"
-	"net/http"
-
-	"go-backend/internal/http/response"
-)
-
-func Recover(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		defer func() {
-			if rec := recover(); rec != nil {
-				response.WriteJSON(w, response.Err(-2, fmt.Sprint(rec)))
-			}
-		}()
-		next.ServeHTTP(w, r)
-	})
-}

go-backend/internal/http/middleware/request_log.go

@@ -1,57 +0,0 @@
-package middleware
-
-import (
-	"bufio"
-	"io"
-	"log"
-	"net"
-	"net/http"
-	"time"
-)
-
-type statusWriter struct {
-	http.ResponseWriter
-	status int
-}
-
-func (w *statusWriter) WriteHeader(code int) {
-	w.status = code
-	w.ResponseWriter.WriteHeader(code)
-}
-
-func (w *statusWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	hj, ok := w.ResponseWriter.(http.Hijacker)
-	if !ok {
-		return nil, nil, http.ErrNotSupported
-	}
-	return hj.Hijack()
-}
-
-func (w *statusWriter) Flush() {
-	if f, ok := w.ResponseWriter.(http.Flusher); ok {
-		f.Flush()
-	}
-}
-
-func (w *statusWriter) ReadFrom(r io.Reader) (int64, error) {
-	if rf, ok := w.ResponseWriter.(io.ReaderFrom); ok {
-		return rf.ReadFrom(r)
-	}
-	return io.Copy(w.ResponseWriter, r)
-}
-
-func (w *statusWriter) Push(target string, opts *http.PushOptions) error {
-	if p, ok := w.ResponseWriter.(http.Pusher); ok {
-		return p.Push(target, opts)
-	}
-	return http.ErrNotSupported
-}
-
-func RequestLog(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		sw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
-		start := time.Now()
-		next.ServeHTTP(sw, r)
-		log.Printf("%s %s -> %d (%s)", r.Method, r.URL.Path, sw.status, time.Since(start).String())
-	})
-}

go-backend/internal/http/response/r.go

@@ -1,48 +0,0 @@
-package response
-
-import (
-	"encoding/json"
-	"net/http"
-	"time"
-)
-
-type R struct {
-	Code int         `json:"code"`
-	Msg  string      `json:"msg"`
-	TS   int64       `json:"ts"`
-	Data interface{} `json:"data,omitempty"`
-}
-
-func OK(data interface{}) R {
-	return R{
-		Code: 0,
-		Msg:  "操作成功",
-		TS:   time.Now().UnixMilli(),
-		Data: data,
-	}
-}
-
-func OKEmpty() R {
-	return R{
-		Code: 0,
-		Msg:  "操作成功",
-		TS:   time.Now().UnixMilli(),
-	}
-}
-
-func Err(code int, msg string) R {
-	return R{
-		Code: code,
-		Msg:  msg,
-		TS:   time.Now().UnixMilli(),
-	}
-}
-
-func ErrDefault(msg string) R {
-	return Err(-1, msg)
-}
-
-func WriteJSON(w http.ResponseWriter, payload R) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	_ = json.NewEncoder(w).Encode(payload)
-}

go-backend/internal/http/router.go

@@ -1,20 +0,0 @@
-package httpserver
-
-import (
-	"net/http"
-
-	"go-backend/internal/http/handler"
-	"go-backend/internal/http/middleware"
-)
-
-func NewRouter(h *handler.Handler, jwtSecret string) http.Handler {
-	mux := http.NewServeMux()
-	h.Register(mux)
-	mux.Handle("/system-info", h.WebSocketHandler())
-
-	wrapped := middleware.Recover(mux)
-	wrapped = middleware.JWT(middleware.AuthOptions{JWTSecret: jwtSecret})(wrapped)
-	wrapped = middleware.RequestLog(wrapped)
-	wrapped = middleware.CORS(wrapped)
-	return wrapped
-}

go-backend/internal/security/aes.go

@@ -1,65 +0,0 @@
-package security
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-)
-
-type AESCrypto struct {
-	key []byte
-}
-
-func NewAESCrypto(secret string) (*AESCrypto, error) {
-	if secret == "" {
-		return nil, fmt.Errorf("secret is empty")
-	}
-	hash := sha256.Sum256([]byte(secret))
-	return &AESCrypto{key: hash[:]}, nil
-}
-
-func (a *AESCrypto) Encrypt(plain []byte) (string, error) {
-	if len(plain) == 0 {
-		return "", fmt.Errorf("empty plaintext")
-	}
-	block, err := aes.NewCipher(a.key)
-	if err != nil {
-		return "", err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", err
-	}
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := rand.Read(nonce); err != nil {
-		return "", err
-	}
-	sealed := gcm.Seal(nil, nonce, plain, nil)
-	data := append(nonce, sealed...)
-	return base64.StdEncoding.EncodeToString(data), nil
-}
-
-func (a *AESCrypto) Decrypt(cipherText string) ([]byte, error) {
-	raw, err := base64.StdEncoding.DecodeString(cipherText)
-	if err != nil {
-		return nil, err
-	}
-	block, err := aes.NewCipher(a.key)
-	if err != nil {
-		return nil, err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-	nonceSize := gcm.NonceSize()
-	if len(raw) < nonceSize {
-		return nil, fmt.Errorf("ciphertext too short")
-	}
-	nonce := raw[:nonceSize]
-	data := raw[nonceSize:]
-	return gcm.Open(nil, nonce, data, nil)
-}

go-backend/internal/security/md5.go

@@ -1,11 +0,0 @@
-package security
-
-import (
-	"crypto/md5"
-	"fmt"
-)
-
-func MD5(input string) string {
-	hash := md5.Sum([]byte(input))
-	return fmt.Sprintf("%x", hash)
-}

go-backend/internal/store/sqlite/sql/data.sql

@@ -1,5 +0,0 @@
-INSERT OR IGNORE INTO user (id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1);
-
-INSERT OR IGNORE INTO vite_config (id, name, value, time)
-VALUES (1, 'app_name', 'flux', 1755147963000);

go-backend/internal/store/sqlite/sql/schema.sql

@@ -1,245 +0,0 @@
--- SQLite Auto-generated schema
--- This will be executed automatically on startup if tables don't exist
-
-CREATE TABLE IF NOT EXISTS forward (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL,
-  user_name VARCHAR(100) NOT NULL,
-  name VARCHAR(100) NOT NULL,
-  tunnel_id INTEGER NOT NULL,
-  remote_addr TEXT NOT NULL,
-  strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
-  in_flow INTEGER NOT NULL DEFAULT 0,
-  out_flow INTEGER NOT NULL DEFAULT 0,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER NOT NULL,
-  status INTEGER NOT NULL,
-  inx INTEGER NOT NULL DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS forward_port (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  forward_id INTEGER NOT NULL,
-  node_id INTEGER NOT NULL,
-  port INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS node (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(100) NOT NULL,
-  secret VARCHAR(100) NOT NULL,
-  server_ip VARCHAR(100) NOT NULL,
-  server_ip_v4 VARCHAR(100),
-  server_ip_v6 VARCHAR(100),
-  port TEXT NOT NULL,
-  interface_name VARCHAR(200),
-  version VARCHAR(100),
-  http INTEGER NOT NULL DEFAULT 0,
-  tls INTEGER NOT NULL DEFAULT 0,
-  socks INTEGER NOT NULL DEFAULT 0,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER,
-  status INTEGER NOT NULL,
-  tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
-  udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
-  inx INTEGER NOT NULL DEFAULT 0,
-  is_remote INTEGER DEFAULT 0,
-  remote_url TEXT,
-  remote_token TEXT,
-  remote_config TEXT
-);
-
-CREATE TABLE IF NOT EXISTS speed_limit (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(100) NOT NULL,
-  speed INTEGER NOT NULL,
-  tunnel_id INTEGER NOT NULL,
-  tunnel_name VARCHAR(100) NOT NULL,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER,
-  status INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS statistics_flow (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL,
-  flow INTEGER NOT NULL,
-  total_flow INTEGER NOT NULL,
-  time VARCHAR(100) NOT NULL,
-  created_time INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS tunnel (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(100) NOT NULL,
-  traffic_ratio REAL NOT NULL DEFAULT 1.0,
-  type INTEGER NOT NULL,
-  protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
-  flow INTEGER NOT NULL,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER NOT NULL,
-  status INTEGER NOT NULL,
-  in_ip TEXT,
-  inx INTEGER NOT NULL DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS chain_tunnel (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    tunnel_id INTEGER NOT NULL ,
-    chain_type VARCHAR(10) NOT NULL,
-    node_id INTEGER NOT NULL ,
-    port INTEGER,
-    strategy VARCHAR(10),
-    inx  INTEGER,
-    protocol  VARCHAR(10)
-);
-
-
-CREATE TABLE IF NOT EXISTS user (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user VARCHAR(100) NOT NULL,
-  pwd VARCHAR(100) NOT NULL,
-  role_id INTEGER NOT NULL,
-  exp_time INTEGER NOT NULL,
-  flow INTEGER NOT NULL,
-  in_flow INTEGER NOT NULL DEFAULT 0,
-  out_flow INTEGER NOT NULL DEFAULT 0,
-  flow_reset_time INTEGER NOT NULL,
-  num INTEGER NOT NULL,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER,
-  status INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS user_tunnel (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL,
-  tunnel_id INTEGER NOT NULL,
-  speed_id INTEGER,
-  num INTEGER NOT NULL,
-  flow INTEGER NOT NULL,
-  in_flow INTEGER NOT NULL DEFAULT 0,
-  out_flow INTEGER NOT NULL DEFAULT 0,
-  flow_reset_time INTEGER NOT NULL,
-  exp_time INTEGER NOT NULL,
-  status INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS tunnel_group (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(100) NOT NULL,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER NOT NULL,
-  status INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS user_group (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(100) NOT NULL,
-  created_time INTEGER NOT NULL,
-  updated_time INTEGER NOT NULL,
-  status INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS tunnel_group_tunnel (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  tunnel_group_id INTEGER NOT NULL,
-  tunnel_id INTEGER NOT NULL,
-  created_time INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS user_group_user (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_group_id INTEGER NOT NULL,
-  user_id INTEGER NOT NULL,
-  created_time INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS group_permission (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_group_id INTEGER NOT NULL,
-  tunnel_group_id INTEGER NOT NULL,
-  created_time INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS group_permission_grant (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_group_id INTEGER NOT NULL,
-  tunnel_group_id INTEGER NOT NULL,
-  user_tunnel_id INTEGER NOT NULL,
-  created_by_group INTEGER NOT NULL DEFAULT 0,
-  created_time INTEGER NOT NULL
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_name ON tunnel_group(name);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_name ON user_group(name);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group_tunnel(tunnel_group_id, tunnel_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);
-
-CREATE TABLE IF NOT EXISTS vite_config (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name VARCHAR(200) NOT NULL UNIQUE,
-  value VARCHAR(200) NOT NULL,
-  time INTEGER NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS peer_share (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT NOT NULL,
-    node_id INTEGER NOT NULL,
-    token TEXT NOT NULL UNIQUE,
-    max_bandwidth INTEGER DEFAULT 0,
-    expiry_time INTEGER DEFAULT 0,
-    port_range_start INTEGER DEFAULT 0,
-    port_range_end INTEGER DEFAULT 0,
-    current_flow INTEGER DEFAULT 0,
-    is_active INTEGER DEFAULT 1,
-    created_time INTEGER NOT NULL,
-    updated_time INTEGER NOT NULL,
-    allowed_domains TEXT DEFAULT '',
-    allowed_ips TEXT DEFAULT ''
-);
-
-CREATE TABLE IF NOT EXISTS peer_share_runtime (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    share_id INTEGER NOT NULL,
-    node_id INTEGER NOT NULL,
-    reservation_id TEXT NOT NULL UNIQUE,
-    resource_key TEXT NOT NULL UNIQUE,
-    binding_id TEXT NOT NULL DEFAULT '',
-    role TEXT NOT NULL DEFAULT '',
-    chain_name TEXT NOT NULL DEFAULT '',
-    service_name TEXT NOT NULL DEFAULT '',
-    protocol TEXT NOT NULL DEFAULT 'tls',
-    strategy TEXT NOT NULL DEFAULT 'round',
-    port INTEGER NOT NULL DEFAULT 0,
-    target TEXT NOT NULL DEFAULT '',
-    applied INTEGER NOT NULL DEFAULT 0,
-    status INTEGER NOT NULL DEFAULT 1,
-    created_time INTEGER NOT NULL,
-    updated_time INTEGER NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_share_node_status ON peer_share_runtime(share_id, node_id, status);
-CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_binding_id ON peer_share_runtime(binding_id);
-
-CREATE TABLE IF NOT EXISTS federation_tunnel_binding (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    tunnel_id INTEGER NOT NULL,
-    node_id INTEGER NOT NULL,
-    chain_type INTEGER NOT NULL,
-    hop_inx INTEGER NOT NULL DEFAULT 0,
-    remote_url TEXT NOT NULL,
-    resource_key TEXT NOT NULL UNIQUE,
-    remote_binding_id TEXT NOT NULL,
-    allocated_port INTEGER NOT NULL,
-    status INTEGER NOT NULL DEFAULT 1,
-    created_time INTEGER NOT NULL,
-    updated_time INTEGER NOT NULL
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_federation_tunnel_binding_unique ON federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx);
-CREATE INDEX IF NOT EXISTS idx_federation_tunnel_binding_tunnel ON federation_tunnel_binding(tunnel_id, status);

go-backend/internal/ws/server.go

@@ -1,430 +0,0 @@
-package ws
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/gorilla/websocket"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/security"
-	"go-backend/internal/store/sqlite"
-)
-
-type encryptedMessage struct {
-	Encrypted bool   `json:"encrypted"`
-	Data      string `json:"data"`
-	Timestamp int64  `json:"timestamp"`
-}
-
-type broadcastMessage struct {
-	ID   int64  `json:"id"`
-	Type string `json:"type"`
-	Data string `json:"data"`
-}
-
-type connWrap struct {
-	conn *websocket.Conn
-	mu   sync.Mutex
-}
-
-type nodeSession struct {
-	nodeID int64
-	secret string
-	conn   *connWrap
-}
-
-type commandResponse struct {
-	Type      string          `json:"type"`
-	Success   bool            `json:"success"`
-	Message   string          `json:"message"`
-	Data      json.RawMessage `json:"data,omitempty"`
-	RequestID string          `json:"requestId,omitempty"`
-}
-
-type pendingRequest struct {
-	nodeID int64
-	ch     chan CommandResult
-}
-
-type CommandResult struct {
-	Type    string                 `json:"type"`
-	Success bool                   `json:"success"`
-	Message string                 `json:"message"`
-	Data    map[string]interface{} `json:"data,omitempty"`
-}
-
-type Server struct {
-	repo      *sqlite.Repository
-	jwtSecret string
-	upgrader  websocket.Upgrader
-
-	mu      sync.RWMutex
-	admins  map[*connWrap]struct{}
-	nodes   map[int64]*nodeSession
-	byConn  map[*websocket.Conn]*nodeSession
-	pending map[string]pendingRequest
-}
-
-func NewServer(repo *sqlite.Repository, jwtSecret string) *Server {
-	return &Server{
-		repo:      repo,
-		jwtSecret: jwtSecret,
-		upgrader: websocket.Upgrader{
-			CheckOrigin: func(r *http.Request) bool { return true },
-		},
-		admins:  make(map[*connWrap]struct{}),
-		nodes:   make(map[int64]*nodeSession),
-		byConn:  make(map[*websocket.Conn]*nodeSession),
-		pending: make(map[string]pendingRequest),
-	}
-}
-
-func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	query := r.URL.Query()
-	typeVal := query.Get("type")
-	secret := query.Get("secret")
-
-	if typeVal == "1" {
-		node, err := s.repo.GetNodeBySecret(secret)
-		if err != nil || node == nil {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		s.handleNode(w, r, node.ID, secret)
-		return
-	}
-
-	if typeVal == "0" {
-		if _, ok := auth.ValidateToken(secret, s.jwtSecret); !ok {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		s.handleAdmin(w, r)
-		return
-	}
-
-	http.Error(w, "bad request", http.StatusBadRequest)
-}
-
-func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
-	conn, err := s.upgrader.Upgrade(w, r, nil)
-	if err != nil {
-		return
-	}
-	cw := &connWrap{conn: conn}
-
-	s.mu.Lock()
-	s.admins[cw] = struct{}{}
-	s.mu.Unlock()
-
-	defer func() {
-		s.mu.Lock()
-		delete(s.admins, cw)
-		s.mu.Unlock()
-		_ = conn.Close()
-	}()
-
-	for {
-		if _, _, err := conn.ReadMessage(); err != nil {
-			return
-		}
-	}
-}
-
-func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64, secret string) {
-	conn, err := s.upgrader.Upgrade(w, r, nil)
-	if err != nil {
-		return
-	}
-	cw := &connWrap{conn: conn}
-
-	version := r.URL.Query().Get("version")
-	httpVal := parseIntDefault(r.URL.Query().Get("http"), 0)
-	tlsVal := parseIntDefault(r.URL.Query().Get("tls"), 0)
-	socksVal := parseIntDefault(r.URL.Query().Get("socks"), 0)
-
-	s.mu.Lock()
-	if old, ok := s.nodes[nodeID]; ok {
-		_ = old.conn.conn.Close()
-		delete(s.byConn, old.conn.conn)
-	}
-	ns := &nodeSession{nodeID: nodeID, secret: secret, conn: cw}
-	s.nodes[nodeID] = ns
-	s.byConn[conn] = ns
-	s.mu.Unlock()
-
-	_ = s.repo.UpdateNodeOnline(nodeID, 1, version, httpVal, tlsVal, socksVal)
-	s.broadcastStatus(nodeID, 1)
-
-	defer func() {
-		needOfflineBroadcast := false
-		s.mu.Lock()
-		current, ok := s.nodes[nodeID]
-		if ok && current.conn.conn == conn {
-			delete(s.nodes, nodeID)
-			needOfflineBroadcast = true
-		}
-		delete(s.byConn, conn)
-		s.mu.Unlock()
-		if needOfflineBroadcast {
-			s.failPendingForNode(nodeID, "节点连接已断开")
-			_ = s.repo.UpdateNodeStatus(nodeID, 0)
-			s.broadcastStatus(nodeID, 0)
-		}
-		_ = conn.Close()
-	}()
-
-	for {
-		_, payload, err := conn.ReadMessage()
-		if err != nil {
-			return
-		}
-
-		msg := decryptIfNeeded(payload, secret)
-		s.tryResolvePending(nodeID, msg)
-		s.broadcastInfo(nodeID, msg)
-	}
-}
-
-func (s *Server) SendCommand(nodeID int64, cmdType string, data interface{}, timeout time.Duration) (CommandResult, error) {
-	if s == nil {
-		return CommandResult{}, errors.New("server not initialized")
-	}
-	if strings.TrimSpace(cmdType) == "" {
-		return CommandResult{}, errors.New("command type is empty")
-	}
-	if timeout <= 0 {
-		timeout = 10 * time.Second
-	}
-
-	s.mu.RLock()
-	ns, ok := s.nodes[nodeID]
-	s.mu.RUnlock()
-	if !ok || ns == nil || ns.conn == nil || ns.conn.conn == nil {
-		return CommandResult{}, errors.New("节点不在线")
-	}
-
-	requestID := fmt.Sprintf("%d_%d", nodeID, time.Now().UnixNano())
-	ch := make(chan CommandResult, 1)
-
-	s.mu.Lock()
-	s.pending[requestID] = pendingRequest{nodeID: nodeID, ch: ch}
-	s.mu.Unlock()
-
-	cleanup := func() {
-		s.mu.Lock()
-		if p, exists := s.pending[requestID]; exists {
-			delete(s.pending, requestID)
-			close(p.ch)
-		}
-		s.mu.Unlock()
-	}
-
-	cmdPayload := map[string]interface{}{
-		"type":      cmdType,
-		"data":      data,
-		"requestId": requestID,
-	}
-	rawCmd, err := json.Marshal(cmdPayload)
-	if err != nil {
-		cleanup()
-		return CommandResult{}, err
-	}
-
-	messageData := rawCmd
-	if strings.TrimSpace(ns.secret) != "" {
-		crypto, err := security.NewAESCrypto(ns.secret)
-		if err != nil {
-			cleanup()
-			return CommandResult{}, err
-		}
-		encrypted, err := crypto.Encrypt(rawCmd)
-		if err != nil {
-			cleanup()
-			return CommandResult{}, err
-		}
-		wrapper := map[string]interface{}{
-			"encrypted": true,
-			"data":      encrypted,
-			"timestamp": time.Now().UnixMilli(),
-		}
-		messageData, err = json.Marshal(wrapper)
-		if err != nil {
-			cleanup()
-			return CommandResult{}, err
-		}
-	}
-
-	ns.conn.mu.Lock()
-	err = ns.conn.conn.WriteMessage(websocket.TextMessage, messageData)
-	ns.conn.mu.Unlock()
-	if err != nil {
-		cleanup()
-		return CommandResult{}, err
-	}
-
-	select {
-	case result, ok := <-ch:
-		if !ok {
-			return CommandResult{}, errors.New("命令通道已关闭")
-		}
-		if !result.Success {
-			if strings.TrimSpace(result.Message) == "" {
-				result.Message = "命令执行失败"
-			}
-			return result, errors.New(result.Message)
-		}
-		return result, nil
-	case <-time.After(timeout):
-		cleanup()
-		return CommandResult{}, errors.New("等待节点响应超时")
-	}
-}
-
-func (s *Server) tryResolvePending(nodeID int64, message string) {
-	if s == nil || strings.TrimSpace(message) == "" {
-		return
-	}
-
-	var resp commandResponse
-	if err := json.Unmarshal([]byte(message), &resp); err != nil {
-		return
-	}
-	if strings.TrimSpace(resp.RequestID) == "" {
-		return
-	}
-
-	s.mu.Lock()
-	p, ok := s.pending[resp.RequestID]
-	if ok {
-		delete(s.pending, resp.RequestID)
-	}
-	s.mu.Unlock()
-	if !ok {
-		return
-	}
-	if p.nodeID != nodeID {
-		select {
-		case p.ch <- CommandResult{Type: resp.Type, Success: false, Message: "节点响应与请求不匹配"}:
-		default:
-		}
-		close(p.ch)
-		return
-	}
-
-	result := CommandResult{
-		Type:    resp.Type,
-		Success: resp.Success,
-		Message: resp.Message,
-	}
-	if len(resp.Data) > 0 {
-		var data map[string]interface{}
-		if err := json.Unmarshal(resp.Data, &data); err == nil {
-			result.Data = data
-		}
-	}
-
-	select {
-	case p.ch <- result:
-	default:
-	}
-	close(p.ch)
-}
-
-func (s *Server) failPendingForNode(nodeID int64, message string) {
-	if s == nil {
-		return
-	}
-
-	type pair struct {
-		id string
-		pr pendingRequest
-	}
-	items := make([]pair, 0)
-
-	s.mu.Lock()
-	for id, pr := range s.pending {
-		if pr.nodeID != nodeID {
-			continue
-		}
-		items = append(items, pair{id: id, pr: pr})
-		delete(s.pending, id)
-	}
-	s.mu.Unlock()
-
-	for _, item := range items {
-		select {
-		case item.pr.ch <- CommandResult{Success: false, Message: message}:
-		default:
-		}
-		close(item.pr.ch)
-	}
-}
-
-func (s *Server) broadcastStatus(nodeID int64, status int) {
-	payload := map[string]interface{}{
-		"id":   strconv.FormatInt(nodeID, 10),
-		"type": "status",
-		"data": status,
-	}
-	raw, _ := json.Marshal(payload)
-	s.broadcastToAdmins(string(raw))
-}
-
-func (s *Server) broadcastInfo(nodeID int64, data string) {
-	payload := broadcastMessage{ID: nodeID, Type: "info", Data: data}
-	raw, _ := json.Marshal(payload)
-	s.broadcastToAdmins(string(raw))
-}
-
-func (s *Server) broadcastToAdmins(message string) {
-	s.mu.RLock()
-	admins := make([]*connWrap, 0, len(s.admins))
-	for c := range s.admins {
-		admins = append(admins, c)
-	}
-	s.mu.RUnlock()
-
-	for _, c := range admins {
-		c.mu.Lock()
-		err := c.conn.WriteMessage(websocket.TextMessage, []byte(message))
-		c.mu.Unlock()
-		if err != nil {
-			log.Printf("websocket broadcast failed: %v", err)
-		}
-	}
-}
-
-func decryptIfNeeded(payload []byte, secret string) string {
-	text := string(payload)
-	var wrap encryptedMessage
-	if err := json.Unmarshal(payload, &wrap); err != nil || !wrap.Encrypted || strings.TrimSpace(wrap.Data) == "" {
-		return text
-	}
-
-	crypto, err := security.NewAESCrypto(secret)
-	if err != nil {
-		return text
-	}
-	plain, err := crypto.Decrypt(wrap.Data)
-	if err != nil {
-		return text
-	}
-	return string(plain)
-}
-
-func parseIntDefault(v string, fallback int) int {
-	x, err := strconv.Atoi(v)
-	if err != nil {
-		return fallback
-	}
-	return x
-}

go-backend/tests/contract/auth_contract_test.go

@@ -1,90 +0,0 @@
-package contract_test
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/middleware"
-	"go-backend/internal/http/response"
-)
-
-func TestJWTMiddlewareContracts(t *testing.T) {
-	secret := "unit-test-secret"
-
-	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response.WriteJSON(w, response.OK("pass"))
-	})
-
-	wrapped := middleware.JWT(middleware.AuthOptions{JWTSecret: secret})(next)
-
-	t.Run("login path is excluded", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", nil)
-		res := httptest.NewRecorder()
-		wrapped.ServeHTTP(res, req)
-		assertCode(t, res, 0)
-	})
-
-	t.Run("missing token returns 401 contract message", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-		res := httptest.NewRecorder()
-		wrapped.ServeHTTP(res, req)
-		assertCodeMsg(t, res, 401, "未登录或token已过期")
-	})
-
-	t.Run("invalid token returns 401 contract message", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-		req.Header.Set("Authorization", "invalid.token.value")
-		res := httptest.NewRecorder()
-		wrapped.ServeHTTP(res, req)
-		assertCodeMsg(t, res, 401, "无效的token或token已过期")
-	})
-
-	t.Run("valid token reaches next", func(t *testing.T) {
-		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-		if err != nil {
-			t.Fatalf("generate token: %v", err)
-		}
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/list", nil)
-		req.Header.Set("Authorization", token)
-		res := httptest.NewRecorder()
-		wrapped.ServeHTTP(res, req)
-		assertCode(t, res, 0)
-	})
-
-	t.Run("non-admin blocked on admin path", func(t *testing.T) {
-		token, err := auth.GenerateToken(2, "normal_user", 1, secret)
-		if err != nil {
-			t.Fatalf("generate token: %v", err)
-		}
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/config/update", nil)
-		req.Header.Set("Authorization", token)
-		res := httptest.NewRecorder()
-		wrapped.ServeHTTP(res, req)
-		assertCodeMsg(t, res, 403, "权限不足，仅管理员可操作")
-	})
-}
-
-func assertCode(t *testing.T, rec *httptest.ResponseRecorder, expected int) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expected {
-		t.Fatalf("expected code %d, got %d", expected, out.Code)
-	}
-}
-
-func assertCodeMsg(t *testing.T, rec *httptest.ResponseRecorder, expectedCode int, expectedMsg string) {
-	t.Helper()
-	var out response.R
-	if err := json.NewDecoder(rec.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != expectedCode || out.Msg != expectedMsg {
-		t.Fatalf("expected (%d,%q), got (%d,%q)", expectedCode, expectedMsg, out.Code, out.Msg)
-	}
-}

go-backend/tests/contract/diagnosis_contract_test.go

@@ -1,425 +0,0 @@
-package contract
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	httpserver "go-backend/internal/http"
-	"go-backend/internal/http/handler"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/sqlite"
-)
-
-func TestDiagnosisChainCoverageContracts(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupDiagnosisContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now); err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	tunnelRes, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-chain-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
-	if err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID, err := tunnelRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get tunnel id: %v", err)
-	}
-
-	insertNode := func(name, ip string) int64 {
-		res, err := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
-		if err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-		id, err := res.LastInsertId()
-		if err != nil {
-			t.Fatalf("get node id %s: %v", name, err)
-		}
-		return id
-	}
-
-	entryNodeID := insertNode("entry-node", "10.0.1.10")
-	chainNodeID := insertNode("chain-node", "10.0.1.20")
-	exitNodeID := insertNode("exit-node", "10.0.1.30")
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID); err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
-	`, tunnelID, chainNodeID); err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
-	`, tunnelID, exitNodeID); err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	forwardRes, err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
-	`, 2, "normal_user", "chain-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 0)
-	if err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID, err := forwardRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get forward id: %v", err)
-	}
-
-	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate user token: %v", err)
-	}
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	t.Run("forward diagnose includes entry chain exit paths", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+strconv.FormatInt(forwardID, 10)+`}`))
-		req.Header.Set("Authorization", userToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-
-		payload, ok := out.Data.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object payload, got %T", out.Data)
-		}
-		results, ok := payload["results"].([]interface{})
-		if !ok || len(results) == 0 {
-			t.Fatalf("expected non-empty results, got %v", payload["results"])
-		}
-
-		hasEntryToChain := false
-		hasChainToExit := false
-		hasExitToTarget := false
-		for _, raw := range results {
-			item, ok := raw.(map[string]interface{})
-			if !ok {
-				t.Fatalf("expected result object, got %T", raw)
-			}
-			if strings.TrimSpace(valueAsString(item["message"])) == "" {
-				t.Fatalf("expected non-empty message field")
-			}
-			from := valueAsInt(item["fromChainType"])
-			to := valueAsInt(item["toChainType"])
-			if from == 1 && to == 2 {
-				hasEntryToChain = true
-			}
-			if from == 2 && to == 3 {
-				hasChainToExit = true
-			}
-			if from == 3 {
-				hasExitToTarget = true
-			}
-		}
-
-		if !hasEntryToChain || !hasChainToExit || !hasExitToTarget {
-			t.Fatalf("expected entry->chain, chain->exit, exit->target coverage; got entry=%v chain=%v exit=%v", hasEntryToChain, hasChainToExit, hasExitToTarget)
-		}
-	})
-
-	t.Run("tunnel diagnose includes entry chain exit groups", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+strconv.FormatInt(tunnelID, 10)+`}`))
-		req.Header.Set("Authorization", adminToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-
-		payload, ok := out.Data.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object payload, got %T", out.Data)
-		}
-		results, ok := payload["results"].([]interface{})
-		if !ok || len(results) == 0 {
-			t.Fatalf("expected non-empty results, got %v", payload["results"])
-		}
-
-		hasEntry := false
-		hasChain := false
-		hasExit := false
-		for _, raw := range results {
-			item, ok := raw.(map[string]interface{})
-			if !ok {
-				t.Fatalf("expected result object, got %T", raw)
-			}
-			if strings.TrimSpace(valueAsString(item["message"])) == "" {
-				t.Fatalf("expected non-empty message field")
-			}
-			switch valueAsInt(item["fromChainType"]) {
-			case 1:
-				hasEntry = true
-			case 2:
-				hasChain = true
-			case 3:
-				hasExit = true
-			}
-		}
-
-		if !hasEntry || !hasChain || !hasExit {
-			t.Fatalf("expected entry/chain/exit groups, got entry=%v chain=%v exit=%v", hasEntry, hasChain, hasExit)
-		}
-	})
-}
-
-func TestDiagnosisUsesFederationRuntimeForRemoteNodes(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupDiagnosisContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	remoteToken := "remote-diagnose-token"
-	var remoteDiagnoseCalls int32
-	remoteServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/api/v1/federation/runtime/diagnose" {
-			http.NotFound(w, r)
-			return
-		}
-		if got := strings.TrimSpace(r.Header.Get("Authorization")); got != "Bearer "+remoteToken {
-			w.WriteHeader(http.StatusUnauthorized)
-			_ = json.NewEncoder(w).Encode(map[string]interface{}{"code": -1, "msg": "unauthorized"})
-			return
-		}
-
-		var req map[string]interface{}
-		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]interface{}{"code": -1, "msg": "bad request"})
-			return
-		}
-		if strings.TrimSpace(valueAsString(req["ip"])) != "10.50.0.30" {
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]interface{}{"code": -1, "msg": "unexpected target ip"})
-			return
-		}
-		if valueAsInt(req["port"]) != 30003 {
-			w.WriteHeader(http.StatusBadRequest)
-			_ = json.NewEncoder(w).Encode(map[string]interface{}{"code": -1, "msg": "unexpected target port"})
-			return
-		}
-
-		atomic.AddInt32(&remoteDiagnoseCalls, 1)
-		_ = json.NewEncoder(w).Encode(map[string]interface{}{
-			"code": 0,
-			"msg":  "success",
-			"data": map[string]interface{}{
-				"success":     true,
-				"averageTime": 12.5,
-				"packetLoss":  0,
-				"message":     "remote tcp ok",
-			},
-		})
-	}))
-	defer remoteServer.Close()
-
-	insertLocalNode := func(name, ip string) int64 {
-		res, err := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
-		if err != nil {
-			t.Fatalf("insert local node %s: %v", name, err)
-		}
-		id, err := res.LastInsertId()
-		if err != nil {
-			t.Fatalf("get local node id %s: %v", name, err)
-		}
-		return id
-	}
-
-	insertRemoteNode := func(name, ip string) int64 {
-		res, err := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, 1, ?, ?, ?, 1, ?, ?, ?)
-		`, name, name+"-secret", ip, "", "", "31000-31010", "", "", now, now, "[::]", "[::]", 1, remoteServer.URL, remoteToken, `{"shareId": 123}`)
-		if err != nil {
-			t.Fatalf("insert remote node %s: %v", name, err)
-		}
-		id, err := res.LastInsertId()
-		if err != nil {
-			t.Fatalf("get remote node id %s: %v", name, err)
-		}
-		return id
-	}
-
-	entryNodeID := insertLocalNode("entry-local", "10.50.0.10")
-	remoteChainNodeID := insertRemoteNode("middle-remote", "10.50.0.20")
-	exitNodeID := insertLocalNode("exit-local", "10.50.0.30")
-
-	tunnelRes, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-remote-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
-	if err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID, err := tunnelRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get tunnel id: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID); err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
-	`, tunnelID, remoteChainNodeID); err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
-	`, tunnelID, exitNodeID); err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+strconv.FormatInt(tunnelID, 10)+`}`))
-	req.Header.Set("Authorization", adminToken)
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-	}
-
-	payload, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected object payload, got %T", out.Data)
-	}
-	results, ok := payload["results"].([]interface{})
-	if !ok || len(results) == 0 {
-		t.Fatalf("expected non-empty results, got %v", payload["results"])
-	}
-
-	remoteStepFound := false
-	for _, raw := range results {
-		item, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if valueAsInt(item["fromChainType"]) == 2 && valueAsInt(item["toChainType"]) == 3 {
-			remoteStepFound = true
-			if !valueAsBool(item["success"]) {
-				t.Fatalf("expected remote chain->exit diagnosis success, got item=%v", item)
-			}
-			if strings.TrimSpace(valueAsString(item["message"])) != "remote tcp ok" {
-				t.Fatalf("expected remote diagnosis message, got %q", valueAsString(item["message"]))
-			}
-		}
-	}
-
-	if !remoteStepFound {
-		t.Fatalf("expected chain->exit diagnosis item for remote node")
-	}
-	if atomic.LoadInt32(&remoteDiagnoseCalls) == 0 {
-		t.Fatalf("expected federation runtime diagnose endpoint to be called")
-	}
-}
-
-func valueAsInt(v interface{}) int {
-	switch n := v.(type) {
-	case float64:
-		return int(n)
-	case int:
-		return n
-	case int64:
-		return int(n)
-	default:
-		return 0
-	}
-}
-
-func valueAsString(v interface{}) string {
-	s, _ := v.(string)
-	return s
-}
-
-func valueAsBool(v interface{}) bool {
-	switch b := v.(type) {
-	case bool:
-		return b
-	case float64:
-		return b != 0
-	case int:
-		return b != 0
-	case int64:
-		return b != 0
-	case string:
-		s := strings.TrimSpace(strings.ToLower(b))
-		return s == "1" || s == "t" || s == "true" || s == "yes" || s == "y"
-	default:
-		return false
-	}
-}
-
-func setupDiagnosisContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
-	t.Helper()
-	dbPath := filepath.Join(t.TempDir(), "diagnosis-contract.db")
-	repo, err := sqlite.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = repo.Close()
-	})
-
-	h := handler.New(repo, jwtSecret)
-	return httpserver.NewRouter(h, jwtSecret), repo
-}

go-backend/tests/contract/federation_dual_panel_contract_test.go

@@ -1,516 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/gorilla/websocket"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-	"go-backend/internal/security"
-	"go-backend/internal/store/sqlite"
-)
-
-func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
-	providerSecret := "provider-contract-jwt"
-	providerRouter, providerRepo := setupContractRouter(t, providerSecret)
-	providerServer := httptest.NewServer(providerRouter)
-	defer providerServer.Close()
-
-	consumerSecret := "consumer-contract-jwt"
-	consumerRouter, consumerRepo := setupContractRouter(t, consumerSecret)
-
-	consumerAdminToken, err := auth.GenerateToken(1, "consumer-admin", 0, consumerSecret)
-	if err != nil {
-		t.Fatalf("generate consumer admin token: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-	providerEntryNodeID := insertContractNode(t, providerRepo, "provider-entry", "198.51.100.11", "43000-43010", "provider-entry-secret", 1)
-	providerMiddleNodeID := insertContractNode(t, providerRepo, "provider-middle", "198.51.100.12", "44000-44010", "provider-middle-secret", 1)
-	providerExitNodeID := insertContractNode(t, providerRepo, "provider-exit", "198.51.100.13", "45000-45010", "provider-exit-secret", 1)
-
-	entryShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "entry-share",
-		NodeID:         providerEntryNodeID,
-		Token:          "share-entry-token",
-		PortRangeStart: 43000,
-		PortRangeEnd:   43010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-	middleShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "middle-share",
-		NodeID:         providerMiddleNodeID,
-		Token:          "share-middle-token",
-		PortRangeStart: 44000,
-		PortRangeEnd:   44010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-	exitShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "exit-share",
-		NodeID:         providerExitNodeID,
-		Token:          "share-exit-token",
-		PortRangeStart: 45000,
-		PortRangeEnd:   45010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-entry-token")
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-middle-token")
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-exit-token")
-
-	entryRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-entry-token")
-	middleRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-middle-token")
-	exitRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-exit-token")
-
-	stopMiddle := startMockNodeSession(t, providerServer.URL, "provider-middle-secret")
-	defer stopMiddle()
-	stopExit := startMockNodeSession(t, providerServer.URL, "provider-exit-secret")
-	defer stopExit()
-
-	createTunnel := func(name string) int64 {
-		payload := map[string]interface{}{
-			"name":   name,
-			"type":   2,
-			"flow":   99999,
-			"status": 1,
-			"inNodeId": []map[string]interface{}{
-				{"nodeId": entryRemoteNodeID, "protocol": "tls", "strategy": "round"},
-			},
-			"chainNodes": [][]map[string]interface{}{
-				{{"nodeId": middleRemoteNodeID, "protocol": "tls", "strategy": "round"}},
-			},
-			"outNodeId": []map[string]interface{}{
-				{"nodeId": exitRemoteNodeID, "protocol": "tls", "strategy": "round"},
-			},
-		}
-		body, err := json.Marshal(payload)
-		if err != nil {
-			t.Fatalf("marshal create payload: %v", err)
-		}
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/create", bytes.NewReader(body))
-		req.Header.Set("Authorization", consumerAdminToken)
-		req.Header.Set("Content-Type", "application/json")
-		res := httptest.NewRecorder()
-		consumerRouter.ServeHTTP(res, req)
-		assertCode(t, res, 0)
-
-		var tunnelID int64
-		if err := consumerRepo.DB().QueryRow(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, name).Scan(&tunnelID); err != nil {
-			t.Fatalf("query tunnel id (%s): %v", name, err)
-		}
-		if tunnelID <= 0 {
-			t.Fatalf("invalid tunnel id for %s", name)
-		}
-		return tunnelID
-	}
-
-	firstTunnelID := createTunnel("dual-panel-middle-exit-1")
-
-	assertTunnelPortInRange(t, consumerRepo, firstTunnelID, 2, middleRemoteNodeID, 44000, 44010)
-	assertTunnelPortInRange(t, consumerRepo, firstTunnelID, 3, exitRemoteNodeID, 45000, 45010)
-
-	assertCount(t, consumerRepo, `SELECT COUNT(1) FROM federation_tunnel_binding WHERE tunnel_id = ? AND status = 1`, firstTunnelID, 2)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, middleShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, exitShareID, 1)
-
-	deleteBody, err := json.Marshal(map[string]interface{}{"id": firstTunnelID})
-	if err != nil {
-		t.Fatalf("marshal delete payload: %v", err)
-	}
-	deleteReq := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/delete", bytes.NewReader(deleteBody))
-	deleteReq.Header.Set("Authorization", consumerAdminToken)
-	deleteReq.Header.Set("Content-Type", "application/json")
-	deleteRes := httptest.NewRecorder()
-	consumerRouter.ServeHTTP(deleteRes, deleteReq)
-	assertCode(t, deleteRes, 0)
-
-	assertCount(t, consumerRepo, `SELECT COUNT(1) FROM federation_tunnel_binding WHERE tunnel_id = ?`, firstTunnelID, 0)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 0`, middleShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 0`, exitShareID, 1)
-
-	secondTunnelID := createTunnel("dual-panel-middle-exit-2")
-	assertTunnelPortInRange(t, consumerRepo, secondTunnelID, 2, middleRemoteNodeID, 44000, 44010)
-	assertTunnelPortInRange(t, consumerRepo, secondTunnelID, 3, exitRemoteNodeID, 45000, 45010)
-
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, middleShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, exitShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, entryShareID, 0)
-}
-
-func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
-	providerSecret := "provider-contract-jwt"
-	providerRouter, providerRepo := setupContractRouter(t, providerSecret)
-	providerServer := httptest.NewServer(providerRouter)
-	defer providerServer.Close()
-
-	consumerSecret := "consumer-contract-jwt"
-	consumerRouter, consumerRepo := setupContractRouter(t, consumerSecret)
-
-	consumerAdminToken, err := auth.GenerateToken(1, "consumer-admin", 0, consumerSecret)
-	if err != nil {
-		t.Fatalf("generate consumer admin token: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-	providerEntryNodeID := insertContractNode(t, providerRepo, "provider-entry-dx", "203.0.113.11", "53000-53010", "provider-entry-dx-secret", 1)
-	providerMiddleNodeID := insertContractNode(t, providerRepo, "provider-middle-dx", "203.0.113.12", "54000-54010", "provider-middle-dx-secret", 1)
-	providerExitNodeID := insertContractNode(t, providerRepo, "provider-exit-dx", "203.0.113.13", "55000-55010", "provider-exit-dx-secret", 1)
-
-	entryShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "entry-share-dx",
-		NodeID:         providerEntryNodeID,
-		Token:          "share-entry-dx-token",
-		PortRangeStart: 53000,
-		PortRangeEnd:   53010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-	middleShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "middle-share-dx",
-		NodeID:         providerMiddleNodeID,
-		Token:          "share-middle-dx-token",
-		PortRangeStart: 54000,
-		PortRangeEnd:   54010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-	exitShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
-		Name:           "exit-share-dx",
-		NodeID:         providerExitNodeID,
-		Token:          "share-exit-dx-token",
-		PortRangeStart: 55000,
-		PortRangeEnd:   55010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	})
-
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-entry-dx-token")
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-middle-dx-token")
-	importRemoteNodeForContract(t, consumerRouter, consumerAdminToken, providerServer.URL, "share-exit-dx-token")
-
-	entryRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-entry-dx-token")
-	middleRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-middle-dx-token")
-	exitRemoteNodeID := queryRemoteNodeIDByToken(t, consumerRepo, "share-exit-dx-token")
-
-	stopMiddle := startMockNodeSession(t, providerServer.URL, "provider-middle-dx-secret")
-	defer stopMiddle()
-	stopExit := startMockNodeSession(t, providerServer.URL, "provider-exit-dx-secret")
-	defer stopExit()
-
-	createPayload := map[string]interface{}{
-		"name":   "dual-panel-diagnose-remote",
-		"type":   2,
-		"flow":   99999,
-		"status": 1,
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": entryRemoteNodeID, "protocol": "tls", "strategy": "round"},
-		},
-		"chainNodes": [][]map[string]interface{}{
-			{{"nodeId": middleRemoteNodeID, "protocol": "tls", "strategy": "round"}},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": exitRemoteNodeID, "protocol": "tls", "strategy": "round"},
-		},
-	}
-	body, err := json.Marshal(createPayload)
-	if err != nil {
-		t.Fatalf("marshal create payload: %v", err)
-	}
-	createReq := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/create", bytes.NewReader(body))
-	createReq.Header.Set("Authorization", consumerAdminToken)
-	createReq.Header.Set("Content-Type", "application/json")
-	createRes := httptest.NewRecorder()
-	consumerRouter.ServeHTTP(createRes, createReq)
-	assertCode(t, createRes, 0)
-
-	var tunnelID int64
-	if err := consumerRepo.DB().QueryRow(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, "dual-panel-diagnose-remote").Scan(&tunnelID); err != nil {
-		t.Fatalf("query tunnel id: %v", err)
-	}
-	if tunnelID <= 0 {
-		t.Fatalf("invalid tunnel id")
-	}
-
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, middleShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, exitShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, entryShareID, 0)
-
-	diagnoseReq := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(fmt.Sprintf(`{"tunnelId":%d}`, tunnelID)))
-	diagnoseReq.Header.Set("Authorization", consumerAdminToken)
-	diagnoseRes := httptest.NewRecorder()
-	consumerRouter.ServeHTTP(diagnoseRes, diagnoseReq)
-
-	var out response.R
-	if err := json.NewDecoder(diagnoseRes.Body).Decode(&out); err != nil {
-		t.Fatalf("decode diagnose response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected diagnose code 0, got %d (%s)", out.Code, out.Msg)
-	}
-
-	payload, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map payload, got %T", out.Data)
-	}
-	results, ok := payload["results"].([]interface{})
-	if !ok || len(results) == 0 {
-		t.Fatalf("expected non-empty results, got %v", payload["results"])
-	}
-
-	chainToExitFound := false
-	for _, raw := range results {
-		item, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if valueAsInt(item["fromChainType"]) == 2 && valueAsInt(item["toChainType"]) == 3 {
-			chainToExitFound = true
-			if !valueAsBool(item["success"]) {
-				t.Fatalf("expected chain->exit diagnosis success, got item=%v", item)
-			}
-			if msg := strings.TrimSpace(valueAsString(item["message"])); msg != "mock tcp ok" {
-				t.Fatalf("expected remote diagnosis message 'mock tcp ok', got %q", msg)
-			}
-		}
-	}
-	if !chainToExitFound {
-		t.Fatalf("expected chain->exit diagnosis item in results")
-	}
-}
-
-func insertContractNode(t *testing.T, repo *sqlite.Repository, name, ip, portRange, secret string, status int) int64 {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	res, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, name, secret, ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0)
-	if err != nil {
-		t.Fatalf("insert node %s: %v", name, err)
-	}
-	id, err := res.LastInsertId()
-	if err != nil {
-		t.Fatalf("node id %s: %v", name, err)
-	}
-	return id
-}
-
-func insertPeerShare(t *testing.T, repo *sqlite.Repository, share *sqlite.PeerShare) int64 {
-	t.Helper()
-	if share == nil {
-		t.Fatalf("share is nil")
-	}
-	if err := repo.CreatePeerShare(share); err != nil {
-		t.Fatalf("create peer share %s: %v", share.Name, err)
-	}
-	saved, err := repo.GetPeerShareByToken(share.Token)
-	if err != nil {
-		t.Fatalf("query peer share %s: %v", share.Name, err)
-	}
-	if saved == nil {
-		t.Fatalf("peer share %s not found after create", share.Name)
-	}
-	return saved.ID
-}
-
-func importRemoteNodeForContract(t *testing.T, router http.Handler, adminToken, remoteURL, token string) {
-	t.Helper()
-	body, err := json.Marshal(map[string]string{
-		"remoteUrl": remoteURL,
-		"token":     token,
-	})
-	if err != nil {
-		t.Fatalf("marshal import payload: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/node/import", bytes.NewReader(body))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-	assertCode(t, res, 0)
-}
-
-func queryRemoteNodeIDByToken(t *testing.T, repo *sqlite.Repository, token string) int64 {
-	t.Helper()
-	var id int64
-	if err := repo.DB().QueryRow(`SELECT id FROM node WHERE is_remote = 1 AND remote_token = ? ORDER BY id DESC LIMIT 1`, token).Scan(&id); err != nil {
-		t.Fatalf("query remote node by token %s: %v", token, err)
-	}
-	if id <= 0 {
-		t.Fatalf("invalid remote node id for token %s", token)
-	}
-	return id
-}
-
-func assertTunnelPortInRange(t *testing.T, repo *sqlite.Repository, tunnelID int64, chainType int, nodeID int64, minPort int, maxPort int) {
-	t.Helper()
-	var port int
-	err := repo.DB().QueryRow(`
-		SELECT port
-		FROM chain_tunnel
-		WHERE tunnel_id = ? AND chain_type = ? AND node_id = ?
-		LIMIT 1
-	`, tunnelID, chainType, nodeID).Scan(&port)
-	if err != nil {
-		t.Fatalf("query tunnel=%d chainType=%d node=%d port: %v", tunnelID, chainType, nodeID, err)
-	}
-	if port < minPort || port > maxPort {
-		t.Fatalf("expected port in range [%d,%d], got %d", minPort, maxPort, port)
-	}
-}
-
-func assertCount(t *testing.T, repo *sqlite.Repository, query string, arg interface{}, expected int) {
-	t.Helper()
-	var got int
-	if err := repo.DB().QueryRow(query, arg).Scan(&got); err != nil {
-		t.Fatalf("count query failed: %v", err)
-	}
-	if got != expected {
-		t.Fatalf("expected count %d, got %d (query: %s, arg: %v)", expected, got, query, arg)
-	}
-}
-
-func startMockNodeSession(t *testing.T, baseURL string, nodeSecret string) func() {
-	t.Helper()
-	u, err := url.Parse(baseURL)
-	if err != nil {
-		t.Fatalf("parse provider url: %v", err)
-	}
-	if strings.EqualFold(u.Scheme, "https") {
-		u.Scheme = "wss"
-	} else {
-		u.Scheme = "ws"
-	}
-	u.Path = "/system-info"
-	q := u.Query()
-	q.Set("type", "1")
-	q.Set("secret", nodeSecret)
-	q.Set("version", "v1")
-	q.Set("http", "1")
-	q.Set("tls", "1")
-	q.Set("socks", "1")
-	u.RawQuery = q.Encode()
-
-	conn, _, err := websocket.DefaultDialer.Dial(u.String(), nil)
-	if err != nil {
-		t.Fatalf("dial mock node websocket: %v", err)
-	}
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			_, raw, readErr := conn.ReadMessage()
-			if readErr != nil {
-				return
-			}
-
-			plain := raw
-			var wrap struct {
-				Encrypted bool   `json:"encrypted"`
-				Data      string `json:"data"`
-			}
-			if err := json.Unmarshal(raw, &wrap); err == nil && wrap.Encrypted && strings.TrimSpace(wrap.Data) != "" {
-				crypto, cryptoErr := security.NewAESCrypto(nodeSecret)
-				if cryptoErr == nil {
-					if dec, decErr := crypto.Decrypt(wrap.Data); decErr == nil {
-						plain = []byte(dec)
-					}
-				}
-			}
-
-			var cmd struct {
-				Type      string `json:"type"`
-				RequestID string `json:"requestId"`
-			}
-			if err := json.Unmarshal(plain, &cmd); err != nil {
-				continue
-			}
-			if strings.TrimSpace(cmd.RequestID) == "" {
-				continue
-			}
-
-			respType := fmt.Sprintf("%sResponse", cmd.Type)
-			respPayload := map[string]interface{}{
-				"type":      respType,
-				"success":   true,
-				"message":   "OK",
-				"requestId": cmd.RequestID,
-			}
-			if strings.EqualFold(strings.TrimSpace(cmd.Type), "TcpPing") {
-				respPayload["data"] = map[string]interface{}{
-					"success":     true,
-					"averageTime": 8.5,
-					"packetLoss":  0,
-					"message":     "mock tcp ok",
-				}
-			}
-			respBytes, err := json.Marshal(respPayload)
-			if err != nil {
-				continue
-			}
-			_ = conn.WriteMessage(websocket.TextMessage, respBytes)
-		}
-	}()
-
-	return func() {
-		_ = conn.Close()
-		wg.Wait()
-	}
-}
-
-func valueAsInt(v interface{}) int {
-	switch n := v.(type) {
-	case float64:
-		return int(n)
-	case int:
-		return n
-	case int64:
-		return int(n)
-	default:
-		return 0
-	}
-}
-
-func valueAsString(v interface{}) string {
-	s, _ := v.(string)
-	return s
-}
-
-func valueAsBool(v interface{}) bool {
-	switch b := v.(type) {
-	case bool:
-		return b
-	case float64:
-		return b != 0
-	case int:
-		return b != 0
-	case int64:
-		return b != 0
-	case string:
-		s := strings.TrimSpace(strings.ToLower(b))
-		return s == "1" || s == "t" || s == "true" || s == "yes" || s == "y"
-	default:
-		return false
-	}
-}

go-backend/tests/contract/flow_contract_test.go

@@ -1,44 +0,0 @@
-package contract_test
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"go-backend/internal/http/handler"
-)
-
-func TestFlowEndpointsStringResponses(t *testing.T) {
-	h := handler.New(nil, "secret")
-	mux := http.NewServeMux()
-	h.Register(mux)
-
-	tests := []struct {
-		name     string
-		method   string
-		path     string
-		expected string
-	}{
-		{name: "flow test", method: http.MethodGet, path: "/flow/test", expected: "test"},
-		{name: "flow config", method: http.MethodPost, path: "/flow/config?secret=abc", expected: "ok"},
-		{name: "flow upload", method: http.MethodPost, path: "/flow/upload?secret=abc", expected: "ok"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			req := httptest.NewRequest(tc.method, tc.path, nil)
-			res := httptest.NewRecorder()
-			mux.ServeHTTP(res, req)
-
-			body, err := io.ReadAll(res.Body)
-			if err != nil {
-				t.Fatalf("read body: %v", err)
-			}
-
-			if string(body) != tc.expected {
-				t.Fatalf("expected %q, got %q", tc.expected, string(body))
-			}
-		})
-	}
-}

go-backend/tests/contract/forward_contract_test.go

@@ -1,535 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestForwardOwnershipAndScopeContracts(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now); err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	res, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "contract-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0)
-	if err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID, err := res.LastInsertId()
-	if err != nil {
-		t.Fatalf("get tunnel id: %v", err)
-	}
-
-	nodeRes, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "entry-node", "entry-secret", "10.0.0.10", "10.0.0.10", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
-	if err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	entryNodeID, err := nodeRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get node id: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 20001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID); err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-
-	resAdmin, err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
-	`, 1, "admin_user", "admin-forward", tunnelID, "1.1.1.1:443", "fifo", now, now, 0)
-	if err != nil {
-		t.Fatalf("insert admin forward: %v", err)
-	}
-	adminForwardID, err := resAdmin.LastInsertId()
-	if err != nil {
-		t.Fatalf("get admin forward id: %v", err)
-	}
-
-	resUser, err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
-	`, 2, "normal_user", "user-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 1)
-	if err != nil {
-		t.Fatalf("insert user forward: %v", err)
-	}
-	userForwardID, err := resUser.LastInsertId()
-	if err != nil {
-		t.Fatalf("get user forward id: %v", err)
-	}
-
-	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate user token: %v", err)
-	}
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	t.Run("non-owner cannot delete another user's forward", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/delete", bytes.NewBufferString(`{"id":`+jsonNumber(adminForwardID)+`}`))
-		req.Header.Set("Authorization", userToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		assertCodeMsg(t, res, -1, "转发不存在")
-	})
-
-	t.Run("non-admin forward list is scoped to owner", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/list", bytes.NewBufferString(`{}`))
-		req.Header.Set("Authorization", userToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-		arr, ok := out.Data.([]interface{})
-		if !ok {
-			t.Fatalf("expected array data, got %T", out.Data)
-		}
-		if len(arr) != 1 {
-			t.Fatalf("expected 1 forward, got %d", len(arr))
-		}
-		item, ok := arr[0].(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object item, got %T", arr[0])
-		}
-		if got := int64(item["id"].(float64)); got != userForwardID {
-			t.Fatalf("expected forward id %d, got %d", userForwardID, got)
-		}
-	})
-
-	t.Run("forward diagnose returns structured payload", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+jsonNumber(userForwardID)+`}`))
-		req.Header.Set("Authorization", userToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-
-		payload, ok := out.Data.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object payload, got %T", out.Data)
-		}
-		results, ok := payload["results"].([]interface{})
-		if !ok || len(results) == 0 {
-			t.Fatalf("expected non-empty results, got %v", payload["results"])
-		}
-		first, ok := results[0].(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected result object, got %T", results[0])
-		}
-		if _, ok := first["message"]; !ok {
-			t.Fatalf("expected message field in diagnosis result")
-		}
-		if got := int(first["fromChainType"].(float64)); got != 1 {
-			t.Fatalf("expected fromChainType=1, got %d", got)
-		}
-	})
-
-	t.Run("tunnel diagnose returns structured payload", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+jsonNumber(tunnelID)+`}`))
-		req.Header.Set("Authorization", adminToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-
-		payload, ok := out.Data.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object payload, got %T", out.Data)
-		}
-		results, ok := payload["results"].([]interface{})
-		if !ok || len(results) == 0 {
-			t.Fatalf("expected non-empty results, got %v", payload["results"])
-		}
-		first, ok := results[0].(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected result object, got %T", results[0])
-		}
-		if _, ok := first["message"]; !ok {
-			t.Fatalf("expected message field in tunnel diagnosis result")
-		}
-	})
-}
-
-func TestForwardSwitchTunnelRollbackOnSyncFailure(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'switch_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now); err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	insertTunnel := func(name string, inx int) int64 {
-		res, err := repo.DB().Exec(`
-			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, 1.0, 1, "tls", 99999, now, now, 1, nil, inx)
-		if err != nil {
-			t.Fatalf("insert tunnel %s: %v", name, err)
-		}
-		id, err := res.LastInsertId()
-		if err != nil {
-			t.Fatalf("get tunnel id %s: %v", name, err)
-		}
-		return id
-	}
-
-	insertNode := func(name, ip, portRange string, inx int) int64 {
-		res, err := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", inx)
-		if err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-		id, err := res.LastInsertId()
-		if err != nil {
-			t.Fatalf("get node id %s: %v", name, err)
-		}
-		return id
-	}
-
-	tunnelA := insertTunnel("switch-tunnel-a", 0)
-	tunnelB := insertTunnel("switch-tunnel-b", 1)
-	nodeA := insertNode("switch-node-a", "10.10.0.1", "21000-21010", 0)
-	nodeB := insertNode("switch-node-b", "10.10.0.2", "22000-22010", 1)
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 21001, 'round', 1, 'tls')
-	`, tunnelA, nodeA); err != nil {
-		t.Fatalf("insert chain_tunnel tunnelA: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 22001, 'round', 1, 'tls')
-	`, tunnelB, nodeB); err != nil {
-		t.Fatalf("insert chain_tunnel tunnelB: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, tunnelA); err != nil {
-		t.Fatalf("insert user_tunnel A: %v", err)
-	}
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(11, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, tunnelB); err != nil {
-		t.Fatalf("insert user_tunnel B: %v", err)
-	}
-
-	forwardRes, err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, 'switch_user', 'switch-forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, tunnelA, now, now)
-	if err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID, err := forwardRes.LastInsertId()
-	if err != nil {
-		t.Fatalf("get forward id: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeA, 21001); err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	payload := `{"id":` + jsonNumber(forwardID) + `,"tunnelId":` + jsonNumber(tunnelB) + `}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/update", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected update failure when node is offline")
-	}
-
-	var tunnelAfter int64
-	if err := repo.DB().QueryRow(`SELECT tunnel_id FROM forward WHERE id = ?`, forwardID).Scan(&tunnelAfter); err != nil {
-		t.Fatalf("query forward tunnel_id: %v", err)
-	}
-	if tunnelAfter != tunnelA {
-		t.Fatalf("expected tunnel rollback to %d, got %d", tunnelA, tunnelAfter)
-	}
-
-	var nodeAfter int64
-	var portAfter int
-	if err := repo.DB().QueryRow(`SELECT node_id, port FROM forward_port WHERE forward_id = ? LIMIT 1`, forwardID).Scan(&nodeAfter, &portAfter); err != nil {
-		t.Fatalf("query forward_port: %v", err)
-	}
-	if nodeAfter != nodeA || portAfter != 21001 {
-		t.Fatalf("expected forward_port rollback to node=%d port=21001, got node=%d port=%d", nodeA, nodeAfter, portAfter)
-	}
-}
-
-func TestForwardBatchChangeTunnelRollbackOnSyncFailure(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'batch_switch_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now); err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	tunnelResA, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES('batch-switch-tunnel-a', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, now, now)
-	if err != nil {
-		t.Fatalf("insert tunnel A: %v", err)
-	}
-	tunnelA, _ := tunnelResA.LastInsertId()
-
-	tunnelResB, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES('batch-switch-tunnel-b', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 1)
-	`, now, now)
-	if err != nil {
-		t.Fatalf("insert tunnel B: %v", err)
-	}
-	tunnelB, _ := tunnelResB.LastInsertId()
-
-	nodeResA, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES('batch-switch-node-a', 'batch-switch-node-a-secret', '10.11.0.1', '10.11.0.1', '', '23000-23010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, now, now)
-	if err != nil {
-		t.Fatalf("insert node A: %v", err)
-	}
-	nodeA, _ := nodeResA.LastInsertId()
-
-	nodeResB, err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES('batch-switch-node-b', 'batch-switch-node-b-secret', '10.11.0.2', '10.11.0.2', '', '24000-24010', '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 1)
-	`, now, now)
-	if err != nil {
-		t.Fatalf("insert node B: %v", err)
-	}
-	nodeB, _ := nodeResB.LastInsertId()
-
-	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, 1, ?, 23001, 'round', 1, 'tls')`, tunnelA, nodeA); err != nil {
-		t.Fatalf("insert chain_tunnel A: %v", err)
-	}
-	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, 1, ?, 24001, 'round', 1, 'tls')`, tunnelB, nodeB); err != nil {
-		t.Fatalf("insert chain_tunnel B: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(20, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)`, tunnelA); err != nil {
-		t.Fatalf("insert user_tunnel A: %v", err)
-	}
-	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(21, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)`, tunnelB); err != nil {
-		t.Fatalf("insert user_tunnel B: %v", err)
-	}
-
-	forwardRes, err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, 'batch_switch_user', 'batch-switch-forward', ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, tunnelA, now, now)
-	if err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID, _ := forwardRes.LastInsertId()
-
-	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeA, 23001); err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	payload := `{"forwardIds":[` + jsonNumber(forwardID) + `],"targetTunnelId":` + jsonNumber(tunnelB) + `}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/batch-change-tunnel", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected API success envelope, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	result, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map result, got %T", out.Data)
-	}
-	if int(result["failCount"].(float64)) != 1 {
-		t.Fatalf("expected failCount=1, got %v", result["failCount"])
-	}
-
-	var tunnelAfter int64
-	if err := repo.DB().QueryRow(`SELECT tunnel_id FROM forward WHERE id = ?`, forwardID).Scan(&tunnelAfter); err != nil {
-		t.Fatalf("query forward tunnel_id: %v", err)
-	}
-	if tunnelAfter != tunnelA {
-		t.Fatalf("expected tunnel rollback to %d, got %d", tunnelA, tunnelAfter)
-	}
-
-	var nodeAfter int64
-	var portAfter int
-	if err := repo.DB().QueryRow(`SELECT node_id, port FROM forward_port WHERE forward_id = ? LIMIT 1`, forwardID).Scan(&nodeAfter, &portAfter); err != nil {
-		t.Fatalf("query forward_port: %v", err)
-	}
-	if nodeAfter != nodeA || portAfter != 23001 {
-		t.Fatalf("expected forward_port rollback to node=%d port=23001, got node=%d port=%d", nodeA, nodeAfter, portAfter)
-	}
-}
-
-func TestUserTunnelReassignmentKeepsStableID(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if _, err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(100, 'stable_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now); err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	tunnelRes, err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES('stable-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, now, now)
-	if err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID, _ := tunnelRes.LastInsertId()
-
-	// 1. Assign permission (creates new user_tunnel)
-	// userTunnelBatchAssign expects structure: {userId: 123, tunnels: [{tunnelId: 456, ...}]}
-	assignPayload := `{"userId":100,"tunnels":[{"tunnelId":` + jsonNumber(tunnelID) + `}]}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/batch-assign", bytes.NewBufferString(assignPayload))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d msg=%q", out.Code, out.Msg)
-	}
-
-	var initialID int64
-	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&initialID); err != nil {
-		t.Fatalf("query initial user_tunnel id: %v", err)
-	}
-
-	// 2. Re-assign permission (should UPDATE, not INSERT)
-	reassignPayload := `{"userId":100,"tunnels":[{"tunnelId":` + jsonNumber(tunnelID) + `}]}`
-	req2 := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/batch-assign", bytes.NewBufferString(reassignPayload))
-	req2.Header.Set("Authorization", adminToken)
-	req2.Header.Set("Content-Type", "application/json")
-	res2 := httptest.NewRecorder()
-	router.ServeHTTP(res2, req2)
-
-	var out2 response.R
-	if err := json.NewDecoder(res2.Body).Decode(&out2); err != nil {
-		t.Fatalf("decode response 2: %v", err)
-	}
-	if out2.Code != 0 {
-		t.Fatalf("expected code 0, got %d msg=%q", out2.Code, out2.Msg)
-	}
-
-	// 3. Verify stable ID and no duplicates
-	var count int
-	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&count); err != nil {
-		t.Fatalf("query count: %v", err)
-	}
-	if count != 1 {
-		t.Fatalf("expected exactly 1 user_tunnel record, got %d", count)
-	}
-
-	var currentID int64
-	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 100 AND tunnel_id = ?`, tunnelID).Scan(&currentID); err != nil {
-		t.Fatalf("query current user_tunnel: %v", err)
-	}
-
-	if currentID != initialID {
-		t.Fatalf("user_tunnel ID changed from %d to %d (unstable ID!)", initialID, currentID)
-	}
-}
-
-func jsonNumber(v int64) string {
-	return strconv.FormatInt(v, 10)
-}

go-backend/tests/contract/migration_contract_test.go

@@ -1,332 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	httpserver "go-backend/internal/http"
-	"go-backend/internal/http/handler"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/sqlite"
-
-	_ "modernc.org/sqlite"
-)
-
-func TestCaptchaVerifyLoginContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-
-	_, err := repo.DB().Exec(`
-		INSERT INTO vite_config(name, value, time)
-		VALUES(?, ?, ?)
-		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, "captcha_enabled", "true", time.Now().UnixMilli())
-	if err != nil {
-		t.Fatalf("enable captcha: %v", err)
-	}
-
-	t.Run("login denied without verified captcha token", func(t *testing.T) {
-		body := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":""}`)
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-		req.Header.Set("Content-Type", "application/json")
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCodeMsg(t, resp, -1, "验证码校验失败")
-	})
-
-	t.Run("captcha token is one-time and consumed by login", func(t *testing.T) {
-		verifyReq := httptest.NewRequest(http.MethodPost, "/api/v1/captcha/verify", bytes.NewBufferString(`{"id":"captcha-token-1","data":"ok"}`))
-		verifyReq.Header.Set("Content-Type", "application/json")
-		verifyResp := httptest.NewRecorder()
-
-		router.ServeHTTP(verifyResp, verifyReq)
-
-		var verifyOut struct {
-			Success bool `json:"success"`
-			Data    struct {
-				ValidToken string `json:"validToken"`
-			} `json:"data"`
-		}
-		if err := json.NewDecoder(verifyResp.Body).Decode(&verifyOut); err != nil {
-			t.Fatalf("decode captcha verify response: %v", err)
-		}
-		if !verifyOut.Success || verifyOut.Data.ValidToken != "captcha-token-1" {
-			t.Fatalf("unexpected captcha verify payload: success=%v token=%q", verifyOut.Success, verifyOut.Data.ValidToken)
-		}
-
-		loginBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
-		loginReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", loginBody)
-		loginReq.Header.Set("Content-Type", "application/json")
-		loginResp := httptest.NewRecorder()
-		router.ServeHTTP(loginResp, loginReq)
-		assertCode(t, loginResp, 0)
-
-		replayBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
-		replayReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", replayBody)
-		replayReq.Header.Set("Content-Type", "application/json")
-		replayResp := httptest.NewRecorder()
-		router.ServeHTTP(replayResp, replayReq)
-		assertCodeMsg(t, replayResp, -1, "验证码校验失败")
-	})
-}
-
-func TestOpenAPISubStoreContracts(t *testing.T) {
-	router, repo := setupContractRouter(t, "contract-jwt-secret")
-
-	const tunnelFlowGB = int64(500)
-	const tunnelInFlow = int64(123)
-	const tunnelOutFlow = int64(456)
-	const tunnelExpTimeMs = int64(2727251700000)
-
-	now := time.Now().UnixMilli()
-	res, err := repo.DB().Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		"contract-tunnel", 1.0, 1, "tls", 1, now, now, 1, nil, 0)
-	if err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID, err := res.LastInsertId()
-	if err != nil {
-		t.Fatalf("last insert id: %v", err)
-	}
-	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`,
-		1, tunnelID, 99999, tunnelFlowGB, tunnelInFlow, tunnelOutFlow, 1, tunnelExpTimeMs, 1); err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	t.Run("default user subscription payload", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user", nil)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		body, err := io.ReadAll(resp.Body)
-		if err != nil {
-			t.Fatalf("read body: %v", err)
-		}
-
-		expected := "upload=0; download=0; total=107373108658176; expire=2727251700"
-		if string(body) != expected {
-			t.Fatalf("expected body %q, got %q", expected, string(body))
-		}
-		if got := resp.Header().Get("subscription-userinfo"); got != expected {
-			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
-		}
-		if !strings.Contains(resp.Header().Get("Content-Type"), "text/plain") {
-			t.Fatalf("expected text/plain content type, got %q", resp.Header().Get("Content-Type"))
-		}
-	})
-
-	t.Run("tunnel scoped subscription payload", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel="+strconv.FormatInt(tunnelID, 10), nil)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		body, err := io.ReadAll(resp.Body)
-		if err != nil {
-			t.Fatalf("read body: %v", err)
-		}
-
-		expected := "upload=123; download=456; total=536870912000; expire=2727251700"
-		if string(body) != expected {
-			t.Fatalf("expected body %q, got %q", expected, string(body))
-		}
-		if got := resp.Header().Get("subscription-userinfo"); got != expected {
-			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
-		}
-	})
-
-	t.Run("invalid credentials returns contract error", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=wrong", nil)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCodeMsg(t, resp, -1, "鉴权失败")
-	})
-
-	t.Run("missing tunnel returns contract error", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel=999999", nil)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCodeMsg(t, resp, -1, "隧道不存在")
-	})
-}
-
-func TestSpeedLimitTunnelsRouteAlias(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, _ := setupContractRouter(t, secret)
-
-	t.Run("missing token blocked", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCodeMsg(t, resp, 401, "未登录或token已过期")
-	})
-
-	t.Run("admin token receives success envelope", func(t *testing.T) {
-		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-		if err != nil {
-			t.Fatalf("generate token: %v", err)
-		}
-
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
-		req.Header.Set("Authorization", token)
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		var out response.R
-		if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-	})
-}
-
-func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
-	t.Helper()
-	dbPath := filepath.Join(t.TempDir(), "contract.db")
-	repo, err := sqlite.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = repo.Close()
-	})
-
-	h := handler.New(repo, jwtSecret)
-	return httpserver.NewRouter(h, jwtSecret), repo
-}
-
-func TestOpenMigratesLegacyNodeDualStackColumns(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "legacy-2.0.7-beta.db")
-	legacyDB, err := sql.Open("sqlite", dbPath)
-	if err != nil {
-		t.Fatalf("open legacy sqlite: %v", err)
-	}
-
-	t.Cleanup(func() {
-		_ = legacyDB.Close()
-	})
-
-	if _, err := legacyDB.Exec(`
-		CREATE TABLE IF NOT EXISTS node (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			secret VARCHAR(100) NOT NULL,
-			server_ip VARCHAR(100) NOT NULL,
-			port TEXT NOT NULL,
-			interface_name VARCHAR(200),
-			version VARCHAR(100),
-			http INTEGER NOT NULL DEFAULT 0,
-			tls INTEGER NOT NULL DEFAULT 0,
-			socks INTEGER NOT NULL DEFAULT 0,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER,
-			status INTEGER NOT NULL,
-			tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
-			udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]'
-		)
-	`); err != nil {
-		t.Fatalf("create legacy node table: %v", err)
-	}
-
-	if _, err := legacyDB.Exec(`
-		CREATE TABLE IF NOT EXISTS tunnel (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			traffic_ratio REAL NOT NULL DEFAULT 1.0,
-			type INTEGER NOT NULL,
-			protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
-			flow INTEGER NOT NULL,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER NOT NULL,
-			status INTEGER NOT NULL,
-			in_ip TEXT
-		)
-	`); err != nil {
-		t.Fatalf("create legacy tunnel table: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-	if _, err := legacyDB.Exec(`
-		INSERT INTO node(name, secret, server_ip, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "legacy-node", "legacy-secret", "10.10.0.1", "10000-10010", "eth0", "v-old", 1, 1, 1, now, now, 1, "[::]", "[::]"); err != nil {
-		t.Fatalf("seed legacy node row: %v", err)
-	}
-
-	repo, err := sqlite.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open migrated sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = repo.Close()
-	})
-
-	nodes, err := repo.ListNodes()
-	if err != nil {
-		t.Fatalf("list nodes after migration: %v", err)
-	}
-	if len(nodes) != 1 {
-		t.Fatalf("expected 1 node after migration, got %d", len(nodes))
-	}
-
-	columns := readTableColumns(t, repo.DB(), "node")
-
-	for _, required := range []string{"server_ip_v4", "server_ip_v6", "inx"} {
-		if !columns[required] {
-			t.Fatalf("expected node column %q to exist after migration", required)
-		}
-	}
-
-	tunnelColumns := readTableColumns(t, repo.DB(), "tunnel")
-	if !tunnelColumns["inx"] {
-		t.Fatalf("expected tunnel column %q to exist after migration", "inx")
-	}
-}
-
-func readTableColumns(t *testing.T, db *sql.DB, table string) map[string]bool {
-	t.Helper()
-
-	rows, err := db.Query("PRAGMA table_info(" + table + ")")
-	if err != nil {
-		t.Fatalf("inspect %s columns: %v", table, err)
-	}
-	defer rows.Close()
-
-	columns := map[string]bool{}
-	for rows.Next() {
-		var cid, notNull, pk int
-		var name, typ string
-		var defaultValue sql.NullString
-		if err := rows.Scan(&cid, &name, &typ, &notNull, &defaultValue, &pk); err != nil {
-			t.Fatalf("scan %s pragma row: %v", table, err)
-		}
-		columns[name] = true
-	}
-	if err := rows.Err(); err != nil {
-		t.Fatalf("iterate %s pragma rows: %v", table, err)
-	}
-
-	return columns
-}