feat(xray): merge user-provided API services instead of overwriting

[Multi-Engineer-dev]

What

Config.ApplyAPI previously hard-coded the Xray gRPC API services to
HandlerService, LoggerService, StatsService and discarded anything set on
api.services. It now merges the node's required services with any valid
user-provided extras instead of overwriting them.

Why

Operators want to enable optional Xray API services (e.g. RoutingService,
ObservatoryService) from their core config. The node needs HandlerService /
StatsService for user and traffic management and LoggerService for current
behavior, so those stay mandatory — but extras should be honored rather than
silently dropped.

How

• Add sanitizeAPIServices: starts from the required set, then appends valid
  user extras canonicalized against an allowlist mirrored from xray-core
  (infra/conf/api.go), deduped case-insensitively, and sorted for
  deterministic output.
• Unknown service names are dropped with a logged warning rather than failing
  the backend, consistent with the rest of ApplyAPI's defensive normalization.
• api.listen is intentionally left empty: the API is exposed only via the
  loopback, source-restricted API_INBOUND. Honoring a user-supplied listen
  would open a second, unguarded gRPC entry point.
• The allowlist must be synced by hand on xray-core upgrades;
  TestSanitizeAPIServices pins the expected names so drift breaks the test
  deliberately.

Tests

• backend/xray/config_test.go: merging valid extras, dedupe, dropping
  unknowns, and that a config with no api section still yields exactly the
  required services.
• make test passes locally.

Related

Backend half of the Xray API services feature. The dashboard UI that lets
operators select these optional services lives in Panel PR 662.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b2875dd2-98ee-4c16-9cb1-66cb2009f246

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}