fix(job): handle access-log errors and resolve IP-limit clients relationally

The IP-limit job swallowed access-log open/copy/truncate errors and
matched a client's inbound with a fragile settings LIKE '%email%'
substring query. Handle those errors with early returns, verify the
access log is readable, and resolve the client to its inbound via the
clients/client_inbounds join, keeping the substring scan only as a
fallback.

Author: n0ctal

internal/web/job/check_client_ip_job.go

@@ -134,21 +134,34 @@ func (j *CheckClientIpJob) collectFromOnlineAPI() (map[string]map[string]int64,
 
 func (j *CheckClientIpJob) clearAccessLog() {
 	logAccessP, err := os.OpenFile(xray.GetAccessPersistentLogPath(), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
-	j.checkError(err)
+	if err != nil {
+		j.checkError(err)
+		return
+	}
 	defer logAccessP.Close()
 
 	accessLogPath, err := xray.GetAccessLogPath()
-	j.checkError(err)
+	if err != nil {
+		j.checkError(err)
+		return
+	}
 
 	file, err := os.Open(accessLogPath)
-	j.checkError(err)
+	if err != nil {
+		j.checkError(err)
+		return
+	}
 	defer file.Close()
 
-	_, err = io.Copy(logAccessP, file)
-	j.checkError(err)
+	if _, err = io.Copy(logAccessP, file); err != nil {
+		j.checkError(err)
+		return
+	}
 
-	err = os.Truncate(accessLogPath, 0)
-	j.checkError(err)
+	if err = os.Truncate(accessLogPath, 0); err != nil {
+		j.checkError(err)
+		return
+	}
 
 	j.lastClear = time.Now().Unix()
 }
@@ -188,8 +201,16 @@ func (j *CheckClientIpJob) processLogFile(enforce bool) bool {
 	emailRegex := regexp.MustCompile(`email: (.+)$`)
 	timestampRegex := regexp.MustCompile(`^(\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})`)
 
-	accessLogPath, _ := xray.GetAccessLogPath()
-	file, _ := os.Open(accessLogPath)
+	accessLogPath, err := xray.GetAccessLogPath()
+	if err != nil {
+		j.checkError(err)
+		return false
+	}
+	file, err := os.Open(accessLogPath)
+	if err != nil {
+		j.checkError(err)
+		return false
+	}
 	defer file.Close()
 
 	// Track IPs with their last seen timestamp
@@ -403,6 +424,15 @@ func (j *CheckClientIpJob) checkAccessLogAvailable(iplimitActive bool) bool {
 		return false
 	}
 
+	file, err := os.Open(accessLogPath)
+	if err != nil {
+		if iplimitActive {
+			logger.Warning("[LimitIP] Access log is not readable:", err)
+		}
+		return false
+	}
+	_ = file.Close()
+
 	return true
 }
 
@@ -685,10 +715,30 @@ func (j *CheckClientIpJob) getInboundByEmail(clientEmail string) (*model.Inbound
 	db := database.GetDB()
 	inbound := &model.Inbound{}
 
-	err := db.Model(&model.Inbound{}).Where("settings LIKE ?", "%"+clientEmail+"%").First(inbound).Error
-	if err != nil {
-		return nil, err
+	err := db.Model(&model.Inbound{}).
+		Joins("JOIN client_inbounds ON client_inbounds.inbound_id = inbounds.id").
+		Joins("JOIN clients ON clients.id = client_inbounds.client_id").
+		Where("clients.email = ?", clientEmail).
+		First(inbound).Error
+	if err == nil {
+		return inbound, nil
+	}
+
+	var candidates []model.Inbound
+	if listErr := db.Model(&model.Inbound{}).Where("settings LIKE ?", "%"+clientEmail+"%").Find(&candidates).Error; listErr != nil {
+		return nil, listErr
+	}
+	for i := range candidates {
+		settings := map[string][]model.Client{}
+		if jsonErr := json.Unmarshal([]byte(candidates[i].Settings), &settings); jsonErr != nil {
+			continue
+		}
+		for _, client := range settings["clients"] {
+			if client.Email == clientEmail {
+				return &candidates[i], nil
+			}
+		}
 	}
 
-	return inbound, nil
+	return nil, err
 }

internal/web/job/check_client_ip_job_integration_test.go

@@ -59,6 +59,11 @@ func setupIntegrationDB(t *testing.T) {
 // seed an inbound whose settings json has a single client with the
 // given email and ip limit.
 func seedInboundWithClient(t *testing.T, tag, email string, limitIp int) {
+	t.Helper()
+	seedInboundOnlyWithClient(t, tag, email, limitIp)
+}
+
+func seedInboundOnlyWithClient(t *testing.T, tag, email string, limitIp int) *model.Inbound {
 	t.Helper()
 	settings := map[string]any{
 		"clients": []map[string]any{
@@ -83,6 +88,21 @@ func seedInboundWithClient(t *testing.T, tag, email string, limitIp int) {
 	if err := database.GetDB().Create(inbound).Error; err != nil {
 		t.Fatalf("seed inbound: %v", err)
 	}
+	return inbound
+}
+
+func seedLinkedInboundWithClient(t *testing.T, tag, email string, limitIp int) *model.Inbound {
+	t.Helper()
+	inbound := seedInboundOnlyWithClient(t, tag, email, limitIp)
+	client := &model.ClientRecord{Email: email}
+	if err := database.GetDB().Create(client).Error; err != nil {
+		t.Fatalf("seed client record: %v", err)
+	}
+	link := &model.ClientInbound{ClientId: client.Id, InboundId: inbound.Id}
+	if err := database.GetDB().Create(link).Error; err != nil {
+		t.Fatalf("seed client inbound link: %v", err)
+	}
+	return inbound
 }
 
 // seed an InboundClientIps row with the given blob.
@@ -171,6 +191,31 @@ func TestRun_DisabledFail2BanSkipsProbeAndBanLog(t *testing.T) {
 	}
 }
 
+func TestGetInboundByEmailUsesClientInboundLink(t *testing.T) {
+	setupIntegrationDB(t)
+
+	want := seedLinkedInboundWithClient(t, "linked-inbound", "exact@example.com", 1)
+	seedInboundOnlyWithClient(t, "other-inbound", "not-exact@example.com", 1)
+
+	got, err := (&CheckClientIpJob{}).getInboundByEmail("exact@example.com")
+	if err != nil {
+		t.Fatalf("getInboundByEmail returned error: %v", err)
+	}
+	if got.Id != want.Id {
+		t.Fatalf("getInboundByEmail returned inbound %d, want %d", got.Id, want.Id)
+	}
+}
+
+func TestGetInboundByEmailRejectsSubstringFallbackMatch(t *testing.T) {
+	setupIntegrationDB(t)
+
+	seedInboundOnlyWithClient(t, "substring-only", "joann@example.com", 1)
+
+	if got, err := (&CheckClientIpJob{}).getInboundByEmail("ann@example.com"); err == nil {
+		t.Fatalf("substring email matched inbound %d; want no exact match", got.Id)
+	}
+}
+
 // #4091 repro: client has limit=3, db still holds 3 idle ips from a
 // few minutes ago, only one live ip is actually connecting. pre-fix:
 // live ip got banned every tick and never appeared in the panel.