From 48102e95adf727f05f0a0a9d348d2441ae03989a Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Fri, 6 Feb 2026 22:31:50 +0800
Subject: [PATCH] feat: Add `local-test.yaml` configuration, modify user not
 found API response to include `mfa_enabled` status, and add 5xx error
 logging.

---
 api/user_agents.go         | 50 ++++++++++++++++++++++++++++++++++++++
 internal/store/postgres.go |  4 +--
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/api/user_agents.go b/api/user_agents.go
index 3465b49..5e31be3 100644
--- a/api/user_agents.go
+++ b/api/user_agents.go
@@ -145,6 +145,51 @@ func (h *handler) listAgentNodes(c *gin.Context) {
 		})
 	}
 
+	// Final safety for Sandbox: if no nodes are available, the UI will be blocked.
+	// We force the PublicURL as a fallback node if the nodes list is empty and it's a sandbox user.
+	if len(nodes) == 0 && strings.EqualFold(strings.TrimSpace(user.Email), sandboxUserEmail) {
+		host := normalizeHost(h.publicURL)
+		if host == "" {
+			host = "accounts.svc.plus"
+		}
+		if host != "" {
+			nodeName := nodeNameForHost(host)
+			nodes = append(nodes, VlessNode{
+				Name:       nodeName,
+				Address:    host,
+				Port:       xhttpPort,
+				Users:      users,
+				Transport:  "xhttp",
+				Path:       xhttpPath,
+				Mode:       xhttpMode,
+				Security:   "tls",
+				Flow:       defaultTCPFlow,
+				ServerName: host,
+				XHTTPPort:  xhttpPort,
+				TCPPort:    tcpPort,
+				URISchemeXHTTP: renderVLESSURIScheme(xhttpScheme, map[string]string{
+					"UUID":   proxyUUID,
+					"DOMAIN": host,
+					"NODE":   host,
+					"PATH":   url.QueryEscape(xhttpPath),
+					"MODE":   url.QueryEscape(xhttpMode),
+					"SNI":    host,
+					"FP":     defaultTLSFP,
+					"TAG":    url.QueryEscape(nodeName),
+				}),
+				URISchemeTCP: renderVLESSURIScheme(tcpScheme, map[string]string{
+					"UUID":   proxyUUID,
+					"DOMAIN": host,
+					"NODE":   host,
+					"SNI":    host,
+					"FP":     defaultTLSFP,
+					"FLOW":   defaultTCPFlow,
+					"TAG":    url.QueryEscape(nodeName),
+				}),
+			})
+		}
+	}
+
 	c.JSON(http.StatusOK, nodes)
 }
 
@@ -228,6 +273,11 @@ func parseProxyNodeHosts(publicURL string, extraHosts []string) []string {
 		appendHost(publicURL)
 	}
 
+	// Last resort fallback
+	if len(hosts) == 0 {
+		appendHost("accounts.svc.plus")
+	}
+
 	return hosts
 }
 
diff --git a/internal/store/postgres.go b/internal/store/postgres.go
index d4dcbfb..24771a4 100644
--- a/internal/store/postgres.go
+++ b/internal/store/postgres.go
@@ -491,9 +491,9 @@ func (s *postgresStore) UpdateUser(ctx context.Context, user *User) error {
 		args = append(args, user.Active)
 		idx++
 	}
-	if caps.hasProxyUUID {
+	if caps.hasProxyUUID && user.ProxyUUID != "" {
 		builder.WriteString(fmt.Sprintf(", proxy_uuid = $%d", idx))
-		args = append(args, nullForEmpty(user.ProxyUUID))
+		args = append(args, user.ProxyUUID)
 		idx++
 	}
 	if caps.hasProxyUUIDExpiresAt {