feat: Add local-test.yaml configuration, modify user not found API response to include mfa_enabled status, and add 5xx error logging.

api/user_agents.go

@@ -145,6 +145,51 @@ func (h *handler) listAgentNodes(c *gin.Context) {
 		})
 	}
 
+	// Final safety for Sandbox: if no nodes are available, the UI will be blocked.
+	// We force the PublicURL as a fallback node if the nodes list is empty and it's a sandbox user.
+	if len(nodes) == 0 && strings.EqualFold(strings.TrimSpace(user.Email), sandboxUserEmail) {
+		host := normalizeHost(h.publicURL)
+		if host == "" {
+			host = "accounts.svc.plus"
+		}
+		if host != "" {
+			nodeName := nodeNameForHost(host)
+			nodes = append(nodes, VlessNode{
+				Name:       nodeName,
+				Address:    host,
+				Port:       xhttpPort,
+				Users:      users,
+				Transport:  "xhttp",
+				Path:       xhttpPath,
+				Mode:       xhttpMode,
+				Security:   "tls",
+				Flow:       defaultTCPFlow,
+				ServerName: host,
+				XHTTPPort:  xhttpPort,
+				TCPPort:    tcpPort,
+				URISchemeXHTTP: renderVLESSURIScheme(xhttpScheme, map[string]string{
+					"UUID":   proxyUUID,
+					"DOMAIN": host,
+					"NODE":   host,
+					"PATH":   url.QueryEscape(xhttpPath),
+					"MODE":   url.QueryEscape(xhttpMode),
+					"SNI":    host,
+					"FP":     defaultTLSFP,
+					"TAG":    url.QueryEscape(nodeName),
+				}),
+				URISchemeTCP: renderVLESSURIScheme(tcpScheme, map[string]string{
+					"UUID":   proxyUUID,
+					"DOMAIN": host,
+					"NODE":   host,
+					"SNI":    host,
+					"FP":     defaultTLSFP,
+					"FLOW":   defaultTCPFlow,
+					"TAG":    url.QueryEscape(nodeName),
+				}),
+			})
+		}
+	}
+
 	c.JSON(http.StatusOK, nodes)
 }
 
@@ -228,6 +273,11 @@ func parseProxyNodeHosts(publicURL string, extraHosts []string) []string {
 		appendHost(publicURL)
 	}
 
+	// Last resort fallback
+	if len(hosts) == 0 {
+		appendHost("accounts.svc.plus")
+	}
+
 	return hosts
 }
 

internal/store/postgres.go

@@ -491,9 +491,9 @@ func (s *postgresStore) UpdateUser(ctx context.Context, user *User) error {
 		args = append(args, user.Active)
 		idx++
 	}
-	if caps.hasProxyUUID {
+	if caps.hasProxyUUID && user.ProxyUUID != "" {
 		builder.WriteString(fmt.Sprintf(", proxy_uuid = $%d", idx))
-		args = append(args, nullForEmpty(user.ProxyUUID))
+		args = append(args, user.ProxyUUID)
 		idx++
 	}
 	if caps.hasProxyUUIDExpiresAt {