Method handleInboundUsers

internal/serverapi/inbounds.go:306–388

handleInboundUsers manages user assignments for an inbound. GET → list user IDs assigned to this inbound PUT → bulk-set user IDs (reconciles adds/removes)

(w http.ResponseWriter, r *http.Request, inboundID string)

// GET  → list user IDs assigned to this inbound
// PUT  → bulk-set user IDs (reconciles adds/removes)
func (a *inboundAPI) handleInboundUsers(w http.ResponseWriter, r *http.Request, inboundID string) {
	ib, err := a.store.GetInbound(inboundID)
	if err != nil {
		writeInboundError(w, err)
		return
	}

	switch r.Method {
	case http.MethodGet:
		existing, err := a.userStore.ListUserInboundsByInbound(inboundID)
		if err != nil {
			internalError(w, r, err)
			return
		}
		userIDs := make([]string, 0, len(existing))
		for _, acc := range existing {
			userIDs = append(userIDs, acc.UserID)
		}
		writeJSON(w, http.StatusOK, map[string]any{"user_ids": userIDs})

	case http.MethodPut:
		var req struct {
			UserIDs []string `json:"user_ids"`
		}
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeJSON(w, http.StatusBadRequest, map[string]any{"error": "invalid json body"})
			return
		}

		wanted := make(map[string]struct{}, len(req.UserIDs))
		for _, uid := range req.UserIDs {
			wanted[uid] = struct{}{}
		}

		existing, err := a.userStore.ListUserInboundsByInbound(inboundID)
		if err != nil {
			internalError(w, r, err)
			return
		}
		existingByUser := make(map[string]users.UserInbound, len(existing))
		for _, acc := range existing {
			existingByUser[acc.UserID] = acc
		}

		// Add new user assignments
		for _, uid := range req.UserIDs {
			if _, ok := existingByUser[uid]; !ok {
				secret := randomToken(12)
				if ib.Protocol == "shadowsocks" && strings.HasPrefix(ib.Method, "2022-") {
					secret = ssPassword(ib.Method)
				}
				acc := users.UserInbound{
					ID:        idgen.NextString(),
					UserID:    uid,
					InboundID: inboundID,
					NodeID:    ib.NodeID,
					UUID:      randomUUID(),
					Secret:    secret,