mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-03 19:55:05 +00:00
MHSanaei
fd7b3559bc
Monthly sponsor placements need to change without cutting a panel release. Panels now read 3X/sponsors.json from the MHSanaei/sponsors repo (GitHub Pages on sponsors.sanaei.dev) and show active sponsors in four slots: an overview banner, a rotating sidebar card (max three), the login page and a new Sponsors page that also lists open placements. An entry shows only while enable is not false and until is in the future; links must be https and logos are png/webp/jpg by name only. The list is cached for an hour and the last good copy survives upstream failures; logos are proxied through /sponsors/logo/:name with failures cached, so CSP stays 'self' and admin browsers never reach a third party. Admins can hide a slot for 24h. Under XUI_DEBUG the panel reads a sibling ../sponsors/3X checkout so edits can be previewed before push.
71 lines
4.4 KiB
Plaintext
71 lines
4.4 KiB
Plaintext
---
|
|
title: Authentication
|
|
description: Two authentication modes are supported. UI sessions use a cookie
|
|
set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
|
|
authenticate with a Bearer token taken from Settings → Security → API Token.
|
|
Both work for every endpoint under /panel/api/*.
|
|
full: true
|
|
_openapi:
|
|
preload:
|
|
- ./public/openapi.json
|
|
toc:
|
|
- depth: 2
|
|
title: Authenticate with username + password and receive a session cookie.
|
|
Required before any cookie-based API call.
|
|
url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
|
|
- depth: 2
|
|
title: Clear the session cookie. Requires the CSRF header for browser sessions.
|
|
url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
|
|
- depth: 2
|
|
title: Mint a CSRF token for the current session. The SPA replays it in the
|
|
X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
|
|
this — the middleware short-circuits CSRF for authenticated API
|
|
requests.
|
|
url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
|
|
- depth: 2
|
|
title: Public. Active paid sponsor placements read from the project
|
|
sponsors.json (cached for 1h); expired entries are dropped. Logos are
|
|
proxied by the panel at /sponsors/logo/{name}. Used by the login page
|
|
and panel sponsor slots.
|
|
url: '#public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-expired-entries-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots'
|
|
- depth: 2
|
|
title: Returns whether 2FA is enabled on the panel — used by the login page to
|
|
decide whether to show the OTP field.
|
|
url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
|
|
structuredData:
|
|
headings:
|
|
- content: Authenticate with username + password and receive a session cookie.
|
|
Required before any cookie-based API call.
|
|
id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
|
|
- content: Clear the session cookie. Requires the CSRF header for browser
|
|
sessions.
|
|
id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
|
|
- content: Mint a CSRF token for the current session. The SPA replays it in the
|
|
X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
|
|
this — the middleware short-circuits CSRF for authenticated API
|
|
requests.
|
|
id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
|
|
- content: Public. Active paid sponsor placements read from the project
|
|
sponsors.json (cached for 1h); expired entries are dropped. Logos are
|
|
proxied by the panel at /sponsors/logo/{name}. Used by the login page
|
|
and panel sponsor slots.
|
|
id: public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-expired-entries-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots
|
|
- content: Returns whether 2FA is enabled on the panel — used by the login page to
|
|
decide whether to show the OTP field.
|
|
id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
|
|
contents: []
|
|
---
|
|
|
|
{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
|
|
|
|
export default function Layout(props) {
|
|
const { APIPage, OpenAPIPage } = props.components ?? {};
|
|
// "APIPage" is the old name from v10, this allows both for backward compatibility
|
|
const Comp = OpenAPIPage ?? APIPage;
|
|
return (
|
|
<>
|
|
{props.children}
|
|
<Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"},{"path":"/sponsors","method":"get"},{"path":"/getTwoFactorEnable","method":"post"}]} showTitle />
|
|
</>
|
|
);
|
|
} |