Merge pull request #91 from smileoniks-ctrl/main

Fix node activity toggle runtime state

Author: ClickDevTech

README.md

@@ -523,6 +523,7 @@ Required scope: `users:read` (GET) / `users:write` (POST, PUT, DELETE)
 | POST | `/api/users` | Create user |
 | PUT | `/api/users/:userId` | Update user |
 | DELETE | `/api/users/:userId` | Delete user |
+| POST | `/api/users/bulk-delete` | Delete selected users (best-effort) |
 | POST | `/api/users/:userId/enable` | Enable user |
 | POST | `/api/users/:userId/disable` | Disable user |
 | POST | `/api/users/:userId/groups` | Add user to groups |
@@ -890,4 +891,4 @@ Pull requests welcome!
 
 ## 📄 License
 
-MIT
+MIT

docker-compose.local.yml

@@ -70,6 +70,7 @@ services:
       ACME_EMAIL: ${ACME_EMAIL:-dev@example.com}
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:-localdevencryptionkey0123456789ab}
       SESSION_SECRET: ${SESSION_SECRET:-localdevsessionsecret}
+      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-false}
       LOG_LEVEL: ${LOG_LEVEL:-debug}
     networks:
       - hysteria-net

docker.env.example

@@ -36,6 +36,10 @@ MONGO_USER=hysteria
 # Для локальной разработки по HTTP без домена см. docker-compose.local.yml.
 # USE_CADDY=true
 
+# Secure-cookie для сессии админа. По умолчанию включено.
+# docker-compose.local.yml выставляет false для локального HTTP.
+# SESSION_COOKIE_SECURE=true
+
 # Порт backend сервиса (по умолчанию: 3000)
 # PORT=3000
 
@@ -62,4 +66,4 @@ LOG_LEVEL=info
 # Защита от перегрузки CPU при сетевой нестабильности (issue #70).
 # По умолчанию: 3. Увеличивать на свой риск — на 1 vCPU больше 3 хэндшейков
 # одновременно гарантированно сажают панель.
-# SSH_DIRECT_MAX_CONCURRENT=3
+# SSH_DIRECT_MAX_CONCURRENT=3

index.js

@@ -40,6 +40,7 @@ const panelRoutes = require('./src/routes/panel');
 const mcpRoutes = require('./src/routes/mcp');
 const marzbanCompat = require('./src/routes/marzbanCompat');
 const { subscriptionLimiter, applyRateLimits } = require('./src/utils/rateLimiters');
+const { buildSessionCookieOptions } = require('./src/utils/sessionCookie');
 
 const helmet = require('helmet');
 const app = express();
@@ -81,11 +82,7 @@ function initSessionMiddleware() {
         secret: config.SESSION_SECRET,
         resave: false,
         saveUninitialized: false,
-        cookie: { 
-            secure: true,
-            sameSite: 'strict',
-            maxAge: 24 * 60 * 60 * 1000
-        }
+        cookie: buildSessionCookieOptions()
     });
 }
 
@@ -1049,4 +1046,4 @@ process.on('uncaughtException', (err) => {
     shutdown('uncaughtException').catch(() => process.exit(1));
 });
 
-startServer();
+startServer();

public/css/style.css

@@ -992,6 +992,32 @@ html {
     transition: all var(--transition);
 }
 
+.user-row.is-selected {
+    background: var(--accent-glow);
+}
+
+.user-select-cell {
+    width: 42px;
+    min-width: 42px;
+    text-align: center;
+}
+
+.user-select-checkbox {
+    width: 16px;
+    height: 16px;
+    accent-color: var(--accent);
+    cursor: pointer;
+}
+
+.bulk-delete-btn {
+    margin-left: 8px;
+    white-space: nowrap;
+}
+
+.bulk-delete-btn[hidden] {
+    display: none !important;
+}
+
 .user-info {
     display: flex;
     flex-direction: column;
@@ -2765,9 +2791,27 @@ html {
         margin-bottom: 12px;
         gap: 12px;
     }
+
+    .mobile-user-title-wrap {
+        display: flex;
+        align-items: flex-start;
+        gap: 10px;
+        min-width: 0;
+    }
+
+    .mobile-user-card.is-selected {
+        border-color: var(--accent);
+        background: rgba(99, 102, 241, 0.12);
+    }
+
+    .mobile-user-select {
+        margin-top: 2px;
+        flex: 0 0 auto;
+    }
 
     .mobile-node-title {
         flex: 1;
+        min-width: 0;
     }
 
     .mobile-node-title strong {