hiddifypanel 10.30.7.dev0__py3-none-any.whl → 10.30.8.dev0__py3-none-any.whl

hiddifypanel/VERSION

@@ -1 +1 @@
-10.30.7.dev0
+10.30.8.dev0

hiddifypanel/VERSION.py

@@ -1,3 +1,3 @@
-__version__='10.30.7.dev0'
+__version__='10.30.8.dev0'
 from datetime import datetime
-__release_date__= datetime.strptime('2024-07-09','%Y-%m-%d')
+__release_date__= datetime.strptime('2024-07-10','%Y-%m-%d')

hiddifypanel/auth.py

@@ -98,8 +98,24 @@ def login_user(user: AdminUser | User, remember=False, duration=None, force=Fals
 
 
 def login_required(roles: set[Role] | None = None, node_auth: bool = False):
+
+    def decorator(func):
+        from flask import has_app_context, current_app
+        # Conditionally apply x if has_app_context() is true
+        if has_app_context():
+            func = current_app.doc(security='Hiddify-API-Key')(func)
+
+        # Always apply y
+        func = login_required2(roles, node_auth)(func)
+        return func
+    return decorator
+
+
+def login_required2(roles: set[Role] | None = None, node_auth: bool = False):
     '''When both roles and node_auth is set, means authentication can be done by either uuid or unique_id'''
+
     def wrapper(fn):
+
         @wraps(fn)
         def decorated_view(*args, **kwargs):
             # print('xxxx', current_account)

hiddifypanel/base.py

@@ -37,7 +37,7 @@ def init_logger(app, cli):
 
 def create_app(*args, cli=False, **config):
 
-    app = APIFlask(__name__, static_url_path="/<proxy_path>/static/", instance_relative_config=True, version='2.0.0', title="Hiddify API",
+    app = APIFlask(__name__, static_url_path="/<proxy_path>/static/", instance_relative_config=True, version='2.2.0', title="Hiddify API",
                    openapi_blueprint_url_prefix="/<proxy_path>/api", docs_ui='elements', json_errors=False, enable_openapi=not cli)
     # app = Flask(__name__, static_url_path="/<proxy_path>/static/", instance_relative_config=True)
 
@@ -72,6 +72,13 @@ def create_app(*args, cli=False, **config):
         app.config['SESSION_REDIS'] = redis_client
         app.config['SESSION_PERMANENT'] = True
         app.config['PERMANENT_SESSION_LIFETIME'] = datetime.timedelta(days=10)
+        app.security_schemes = {  # equals to use config SECURITY_SCHEMES
+            'Hiddify-API-Key': {
+                'type': 'apiKey',
+                'in': 'header',
+                'name': 'Hiddify-API-Key',
+            }
+        }
         Session(app)
 
         app.jinja_env.line_statement_prefix = '%'

hiddifypanel/drivers/ssh_liberty_bridge_api.py

@@ -40,6 +40,10 @@ class SSHLibertyBridgeApi(DriverABS):
         redis_client.save()
 
     def get_all_usage(self, users):
+        redis_client = self.get_ssh_redis_client()
+        allusage = redis_client.hgetall(USERS_USAGE)
+        redis_client.delete(USERS_USAGE)
+        return {u: int(allusage.get(u.uuid) or 0) for u in users}
         return {u: self.get_usage_imp(u.uuid) for u in users}
 
     def get_usage_imp(self, client_uuid: str, reset: bool = True) -> int:

hiddifypanel/drivers/wireguard_api.py

@@ -4,40 +4,25 @@ import os
 from .abstract_driver import DriverABS
 from hiddifypanel.models import User, hconfig, ConfigEnum
 from hiddifypanel.panel.run_commander import Command, commander
+import redis
+
+
+USERS_USAGE = "wg:users-usage"
 
 
 class WireguardApi(DriverABS):
+    def get_redis_client(self):
+        if not hasattr(self, 'redis_client'):
+            self.redis_client = redis.from_url('unix:///opt/hiddify-manager/other/redis/run.sock?db=1')
+
+        return self.redis_client
+
     def is_enabled(self) -> bool:
         return hconfig(ConfigEnum.wireguard_enable)
-    
-    WG_LOCAL_USAGE_FILE_PATH = os.path.join('/opt/hiddify-manager/','hiddify-panel','wireguard_usages.json')
-    OLD_WG_LOCAL_USAGE_FILE_PATH = os.path.join('/opt/hiddify-manager/','hiddify-panel','hiddify_usages.json')
 
     def __init__(self) -> None:
         super().__init__()
 
-        if os.path.isfile(WireguardApi.OLD_WG_LOCAL_USAGE_FILE_PATH) and not os.path.isfile(WireguardApi.WG_LOCAL_USAGE_FILE_PATH):
-            os.rename(WireguardApi.OLD_WG_LOCAL_USAGE_FILE_PATH,WireguardApi.WG_LOCAL_USAGE_FILE_PATH)
-
-        if not self.is_usages_file_exists_and_json():
-            self.init_empty_usages_file()
-        # create empty local usage file
-
-    def is_usages_file_exists_and_json(self) -> bool:
-        if os.path.isfile(WireguardApi.WG_LOCAL_USAGE_FILE_PATH):
-            try:
-                # try to load it as a JSON
-                self.__get_local_usage()
-                return True
-            except json.decoder.JSONDecodeError:
-                os.remove(WireguardApi.WG_LOCAL_USAGE_FILE_PATH)
-                return False
-        return False
-    def init_empty_usages_file(self):
-        with open(WireguardApi.WG_LOCAL_USAGE_FILE_PATH, 'w+') as f:
-            json.dump({}, f)
-
-    
     def __get_wg_usages(self) -> dict:
         raw_output = commander(Command.update_wg_usage, run_in_background=False)
         data = {}
@@ -54,11 +39,13 @@ class WireguardApi(DriverABS):
         return data
 
     def __get_local_usage(self) -> dict:
-        with open(WireguardApi.WG_LOCAL_USAGE_FILE_PATH, 'r') as f:
-            data = json.load(f)
-            return data
+        usage_data = self.get_redis_client() .get(USERS_USAGE)
+        if usage_data:
+            return json.loads(usage_data)
+
+        return {}
 
-    def __sync_local_usages(self) -> dict:
+    def __sync_local_usages(self, users) -> dict:
         local_usage = self.__get_local_usage()
         wg_usage = self.__get_wg_usages()
         res = {}
@@ -66,16 +53,18 @@ class WireguardApi(DriverABS):
         for local_wg_pub in local_usage.copy().keys():
             if local_wg_pub not in wg_usage:
                 del local_usage[local_wg_pub]
-
+        uuid_map = {u.wg_pub: u for u in users}
         for wg_pub, wg_usage in wg_usage.items():
+            user = uuid_map.get(wg_pub)
+            uuid = user.uuid if user else None
             if not local_usage.get(wg_pub):
-                local_usage[wg_pub] = wg_usage
+                local_usage[wg_pub] = {"uuid": uuid, "usage": wg_usage}
                 continue
-            res[wg_pub] = self.calculate_reset(local_usage[wg_pub], wg_usage)
-            local_usage[wg_pub] = wg_usage
+            res[wg_pub] = self.calculate_reset(local_usage[wg_pub]['usage'], wg_usage)
+            local_usage[wg_pub] = {"uuid": uuid, "usage": wg_usage}
+
+        self.get_redis_client().set(USERS_USAGE, json.dumps(local_usage))
 
-        with open(WireguardApi.WG_LOCAL_USAGE_FILE_PATH, 'w') as f:
-            json.dump(local_usage, f)
         return res
 
     def calculate_reset(self, last_usage: dict, current_usage: dict) -> dict:
@@ -94,15 +83,16 @@ class WireguardApi(DriverABS):
         if not hconfig(ConfigEnum.wireguard_enable):
             return {}
         usages = self.__get_wg_usages()
-        wg_pubs = set(usages.keys())
-
-        users = User.query.all()
-        enabled = {}
-        for u in users:
-            if u.wg_pub in wg_pubs:
+        new_wg_pubs = set(usages.keys())
+        old_usages = self.__get_local_usage()
+        old_wg_pubs = set(old_usages.keys())
+        enabled = {u['uuid']: 1 for u in old_usages.values()}
+        not_included = new_wg_pubs - old_wg_pubs
+        if not_included:
+            users = User.query.filter(User.wg_pub.in_(not_included).all())
+            for u in users:
                 enabled[u.uuid] = 1
-            else:
-                enabled[u.uuid] = 0
+
         return enabled
 
     def add_client(self, user):
@@ -114,7 +104,7 @@ class WireguardApi(DriverABS):
     def get_all_usage(self, users, reset=True):
         if not hconfig(ConfigEnum.wireguard_enable):
             return {}
-        all_usages = self.__sync_local_usages()
+        all_usages = self.__sync_local_usages(users)
         res = {}
         for u in users:
             if use := all_usages.get(u.wg_pub):

hiddifypanel/drivers/xray_api.py

@@ -56,12 +56,12 @@ class XrayApi(DriverABS):
     def get_inbound_tags(self):
         try:
             xray_client = self.get_xray_client()
-            inbounds = [inb.name.split(">>>")[1] for inb in xray_client.stats_query('')]
+            inbounds = {inb.name.split(">>>")[1] for inb in xray_client.stats_query('inbound')}
             print(f"Success in get inbound tags {inbounds}")
         except Exception as e:
             print(f"error in get inbound tags {e}")
-            inbounds = []
-        return list(set(inbounds))
+            inbounds = {}
+        return list(inbounds)
 
     def add_client(self, user):
         uuid = user.uuid

hiddifypanel/hutils/auth.py

@@ -6,7 +6,7 @@ from uuid import UUID
 def is_uuid_valid(uuid: str, version: int = 4) -> bool:
     try:
         uuid_obj = UUID(uuid, version=version)
-    except ValueError:
+    except Exception:
         return False
     return str(uuid_obj) == uuid
 

hiddifypanel/models/admin.py

@@ -1,5 +1,5 @@
 from enum import auto
-import uuid
+from uuid import uuid4
 from flask import g
 from hiddifypanel.models.usage import DailyUsage
 from sqlalchemy import event, Column, Integer, Enum, Boolean, ForeignKey
@@ -84,6 +84,9 @@ class AdminUser(BaseAccount, SerializerMixin):
             uuid = str(uuid)
         account = AdminUser.query.filter(AdminUser.uuid == uuid).first()
         if not account and create:
+            from hiddifypanel import hutils
+            if not hutils.auth.is_uuid_valid(uuid):
+                uuid = str(uuid4())
             dbuser = AdminUser(uuid=uuid, name="unknown", parent_admin_id=AdminUser.current_admin_or_owner().id)
             db.session.add(dbuser)
             db.session.commit()
@@ -103,11 +106,14 @@ class AdminUser(BaseAccount, SerializerMixin):
             else:
                 parent_admin = cls.by_uuid(parent, create=True)
             dbuser.parent_admin_id = parent_admin.id  # type: ignore
-
-        dbuser.mode = data.get('mode', AdminMode.agent)
-        dbuser.can_add_admin = data.get('can_add_admin') or False
-        dbuser.max_users = data.get('max_users', 100)
-        dbuser.max_active_users = data.get('max_active_users', 100)
+        if data.get('mode') is not None:
+            dbuser.mode = data.get('mode', AdminMode.agent)
+        if data.get('can_add_admin') is not None:
+            dbuser.can_add_admin = data['can_add_admin']
+        if data.get('max_users') is not None:
+            dbuser.max_users = data['max_users']
+        if data.get('max_active_users') is not None:
+            dbuser.max_active_users = data['max_active_users']
         if commit:
             db.session.commit()
         return dbuser
@@ -158,10 +164,10 @@ class AdminUser(BaseAccount, SerializerMixin):
         return str(self.name)
 
     @staticmethod
-    def get_super_admin():
+    def get_super_admin() -> "AdminUser":
         admin = AdminUser.by_id(1)
         if not admin:
-            db.session.add(AdminUser(id=1, uuid=str(uuid.uuid4()), name="Owner", mode=AdminMode.super_admin, comment=""))
+            db.session.add(AdminUser(id=1, uuid=str(uuid4()), name="Owner", mode=AdminMode.super_admin, comment=""))
             db.session.commit()
 
             db_execute("update admin_user set id=1 where name='Owner'", commit=True)

hiddifypanel/models/base_account.py

@@ -61,13 +61,21 @@ class BaseAccount(db.Model, SerializerMixin, FlaskLoginUserMixin):  # type: igno
         return cls.query.filter(cls.username == username, cls.password == password).first()
 
     @classmethod
-    def add_or_update(cls, commit: bool = True, **data):
-        db_account = cls.by_uuid(data['uuid'], create=True)
-        db_account.name = data.get('name', '')
-        db_account.comment = data.get('comment', '')
+    def add_or_update(cls, commit: bool = True, old_uuid=None, **data):
+        db_account: BaseAccount = cls.by_uuid(old_uuid or data.get('uuid'), create=True)
         from hiddifypanel import hutils
-        db_account.telegram_id = hutils.convert.to_int(data.get('telegram_id'))
-        db_account.lang = data.get('lang')
+        if hutils.auth.is_uuid_valid(data.get('uuid')):
+            db_account.uuid = data['uuid']
+
+        if data.get('name') is not None:
+            db_account.name = data.get('name')
+
+        if data.get('comment') is not None:
+            db_account.comment = data.get('comment')
+        if data.get('telegram_id') is not None:
+            db_account.telegram_id = hutils.convert.to_int(data.get('telegram_id'))
+        if data.get('lang') is not None:
+            db_account.lang = data.get('lang')
         if commit:
             db.session.commit()  # type: ignore
         return db_account

hiddifypanel/models/user.py

@@ -1,5 +1,6 @@
 import datetime
 from enum import auto
+from uuid import uuid4
 from hiddifypanel.models.role import Role
 from dateutil import relativedelta
 
@@ -54,7 +55,8 @@ class UserDetail(db.Model, SerializerMixin):
 
     @property
     def devices(self):
-        return [] if not self.connected_devices else self.connected_devices.split(",")
+        return []
+        # return [] if not self.connected_devices else self.connected_devices.split(",")
 
 
 class User(BaseAccount, SerializerMixin):
@@ -122,13 +124,14 @@ class User(BaseAccount, SerializerMixin):
             is_active = False
         elif self.remaining_days < 0:
             is_active = False
-        elif len(self.devices) > max(3, self.max_ips):
-            is_active = False
+        # elif len(self.devices) > max(3, self.max_ips):
+        #     is_active = False
         return is_active
 
     @property
     def devices(self):
         res = {}
+        return res
         for detail in UserDetail.query.filter(UserDetail.user_id == self.id):
             for device in detail.devices:
                 res[device] = 1
@@ -202,6 +205,10 @@ class User(BaseAccount, SerializerMixin):
             uuid = str(uuid)
         account = User.query.filter(User.uuid == uuid).first()
         if not account and create:
+            from hiddifypanel import hutils
+            if not hutils.auth.is_uuid_valid(uuid):
+                uuid = str(uuid4())
+
             dbuser = User(uuid=uuid, name="unknown", added_by=AdminUser.current_admin_or_owner().id)
             db.session.add(dbuser)
             db.session.commit()
@@ -216,11 +223,11 @@ class User(BaseAccount, SerializerMixin):
     @classmethod
     def add_or_update(cls, commit: bool = True, **data):
         from hiddifypanel import hutils
-        dbuser = super().add_or_update(commit=commit, **data)
+        dbuser: User = super().add_or_update(commit=commit, **data)
         if data.get('added_by_uuid'):
             admin = AdminUser.by_uuid(data.get('added_by_uuid'), create=True) or AdminUser.current_admin_or_owner()  # type: ignore
             dbuser.added_by = admin.id
-        else:
+        elif not dbuser.added_by:
             dbuser.added_by = 1
 
         # if data.get('expiry_time', ''): #v4
@@ -230,45 +237,50 @@ class User(BaseAccount, SerializerMixin):
         #     dbuser.start_date = last_reset_time
         #     dbuser.package_days = (expiry_time - last_reset_time).days  # type: ignore
         # el
-        if 'package_days' in data:
+        if data.get('package_days') is not None:
             dbuser.package_days = data['package_days']
-            if data.get('start_date', ''):
+
+            if data.get('start_date'):
                 dbuser.start_date = hutils.convert.json_to_date(data['start_date'])
-            else:
+            elif 'start_date' in data and data['start_date'] is None:
                 dbuser.start_date = None
 
         if (c_GB := data.get('current_usage_GB')) is not None:
             dbuser.current_usage_GB = c_GB
         elif (c := data.get('current_usage')) is not None:
             dbuser.current_usage = c
-        else:
+        elif dbuser.current_usage is None:
             dbuser.current_usage = 0
 
         if (l_GB := data.get('usage_limit_GB')) is not None:
             dbuser.usage_limit_GB = l_GB
         elif (l := data.get('usage_limit')) is not None:
             dbuser.usage_limit = l
-        else:
+        elif dbuser.usage_limit_GB is None:
             dbuser.usage_limit_GB = 1000
 
-        dbuser.enable = data.get('enable', True)
+        if data.get('enable') is not None:
+            dbuser.enable = data['enable']
 
-        if data.get('ed25519_private_key', ''):
+        if data.get('ed25519_private_key', '') and data.get('ed25519_public_key', ''):
             dbuser.ed25519_private_key = data.get('ed25519_private_key', '')
             dbuser.ed25519_public_key = data.get('ed25519_public_key', '')
-
-        dbuser.wg_pk = data.get('wg_pk', dbuser.wg_pk)
-        dbuser.wg_pub = data.get('wg_pub', dbuser.wg_pub)
-        dbuser.wg_psk = data.get('wg_psk', dbuser.wg_psk)
-
-        mode = data.get('mode', UserMode.no_reset)
-        if mode == 'disable':
-            mode = UserMode.no_reset
-            dbuser.enable = False
-
-        dbuser.mode = mode
-
-        dbuser.last_online = hutils.convert.json_to_time(data.get('last_online')) or datetime.datetime.min
+        if data.get('wg_pk') is not None:
+            dbuser.wg_pk = data['wg_pk']
+        if data.get('wg_pub') is not None:
+            dbuser.wg_pub = data['wg_pub']
+        if data.get('wg_psk') is not None:
+            dbuser.wg_psk = data['wg_psk']
+
+        if data.get('mode') is not None or dbuser.mode is None:
+            mode = data.get('mode', UserMode.no_reset)
+            if mode == 'disable':
+                mode = UserMode.no_reset
+                dbuser.enable = False
+            dbuser.mode = mode
+
+        if data.get('last_online') is not None:
+            dbuser.last_online = hutils.convert.json_to_time(data.get('last_online')) or datetime.datetime.min
         if commit:
             db.session.commit()
         return dbuser
@@ -305,6 +317,7 @@ class User(BaseAccount, SerializerMixin):
                 'wg_pk': self.wg_pk,
                 'wg_pub': self.wg_pub,
                 'wg_psk': self.wg_psk,
+                'is_active': self.is_active
                 }
 
     # @staticmethod

hiddifypanel/panel/cli.py

@@ -48,33 +48,7 @@ def backup():
 
 
 def all_configs():
-    valid_users = [u.to_dict(dump_id=True) for u in User.query.filter((User.usage_limit > User.current_usage)).all() if u.is_active]
-    host_child_ids = [c.id for c in Child.query.filter(Child.mode == ChildMode.virtual).all()]
-    configs = {
-        "users": valid_users,
-        "domains": [u.to_dict(dump_ports=True, dump_child_id=True) for u in Domain.query.filter(Domain.child_id.in_(host_child_ids)).all() if "*" not in u.domain],
-        # "hconfigs": get_hconfigs(json=True),
-        "chconfigs": get_hconfigs_childs(host_child_ids, json=True)
-    }
-
-    def_user = None if len(User.query.all()) > 1 else User.query.filter(User.name == 'default').first()
-    domains = Domain.query.all()
-    sslip_domains = [d.domain for d in domains if "sslip.io" in d.domain]
-
-    configs['chconfigs'][0]['first_setup'] = def_user is not None and len(sslip_domains) > 0
-    server_ip = hutils.network.get_ip_str(4)
-    owner = AdminUser.get_super_admin()
-
-    configs['admin_path'] = hiddify.get_account_panel_link(owner, server_ip, is_https=False, prefere_path_only=True)
-    configs['panel_links'] = []
-    configs['panel_links'].append(hiddify.get_account_panel_link(owner, server_ip, is_https=False))
-    configs['panel_links'].append(hiddify.get_account_panel_link(owner, server_ip))
-    domains = Domain.get_domains()
-
-    for d in domains:
-        configs['panel_links'].append(hiddify.get_account_panel_link(owner, d.domain))
-
-    print(json.dumps(configs, indent=4))
+    print(json.dumps(hiddify.all_configs_for_cli(), indent=4))
 
 
 def update_usage():

hiddifypanel/panel/commercial/restapi/v2/admin/__init__.py

@@ -13,12 +13,14 @@ def init_app(app):
         from .admin_user_api import AdminUserApi
         from .admin_users_api import AdminUsersApi
         from .admin_log_api import AdminLogApi
+        from .system_actions import UpdateUserUsageApi, AllConfigsApi
         bp.add_url_rule('/me/', view_func=AdminInfoApi)  # type: ignore
         bp.add_url_rule('/server_status/', view_func=AdminServerStatusApi)  # type: ignore
         bp.add_url_rule('/admin_user/<uuid:uuid>/', view_func=AdminUserApi)  # type: ignore
         bp.add_url_rule('/admin_user/', view_func=AdminUsersApi)  # type: ignore
         bp.add_url_rule('/log/', view_func=AdminLogApi)  # type: ignore
-
+        bp.add_url_rule('/update_user_usage/', view_func=UpdateUserUsageApi)  # type: ignore
+        bp.add_url_rule('/all-configs/', view_func=AllConfigsApi)  # type: ignore
         from .user_api import UserApi
         from .users_api import UsersApi
         bp.add_url_rule('/user/<uuid:uuid>/', view_func=UserApi)  # type: ignore

hiddifypanel/panel/commercial/restapi/v2/admin/admin_info_api.py

@@ -15,6 +15,7 @@ class AdminInfoApi(MethodView):
 
     @app.output(AdminSchema)  # type: ignore
     def get(self):
+        """Current Admin Info"""
         admin = g.account or abort(404, "user not found")
 
         dto = AdminSchema()

hiddifypanel/panel/commercial/restapi/v2/admin/admin_log_api.py

@@ -18,6 +18,7 @@ class AdminLogApi(MethodView):
     @app.output(fields.String(description="The html of the log", many=True))  # type: ignore
     @login_required({Role.super_admin})
     def post(self, data):
+        """System: View Log file"""
         file_name = data.get('file') or abort(400, "Parameter issue: 'file'")
         log_dir = f"{app.config['HIDDIFY_CONFIG_PATH']}log/system/"
         log_files = hutils.flask.list_dir_files(log_dir)

hiddifypanel/panel/commercial/restapi/v2/admin/admin_user_api.py

@@ -6,7 +6,7 @@ from hiddifypanel.auth import login_required
 from hiddifypanel.models import *
 
 from . import has_permission
-from .schema import AdminSchema, PutAdminSchema, PatchAdminSchema, SuccessfulSchema
+from .schema import AdminSchema, PatchAdminSchema, SuccessfulSchema
 
 
 class AdminUserApi(MethodView):
@@ -14,27 +14,16 @@ class AdminUserApi(MethodView):
 
     @app.output(AdminSchema)  # type: ignore
     def get(self, uuid):
+        """Admin: Get an admin"""
         admin = AdminUser.by_uuid(uuid) or abort(404, "Admin not found")
         if not has_permission(admin):
             abort(403, "you don't have permission to access this admin")
         return admin.to_schema()  # type: ignore
 
-    @app.input(PutAdminSchema, arg_name='data')  # type: ignore
-    @app.output(SuccessfulSchema)  # type: ignore
-    def put(self, uuid, data):
-        if AdminUser.by_uuid(uuid):
-            abort(400, "The admin exists")
-        data['uuid'] = uuid
-
-        if not data.get('added_by_uuid'):
-            data['added_by_uuid'] = g.account.uuid
-
-        _ = AdminUser.add_or_update(**data) or abort(502, "Unknown issue: Admin is not added")
-        return {'status': 200, 'msg': 'ok'}
-
     @app.input(PatchAdminSchema, arg_name='data')  # type: ignore
-    @app.output(SuccessfulSchema)  # type: ignore
+    @app.output(AdminSchema)  # type: ignore
     def patch(self, uuid, data):
+        """Admin: Update an admin"""
         admin = AdminUser.by_uuid(uuid) or abort(404, "Admin not found")
         if not has_permission(admin):
             abort(403, "You don't have permission to access this admin")
@@ -44,15 +33,15 @@ class AdminUserApi(MethodView):
                 continue
             if field not in data:
                 data[field] = getattr(admin, field)
-
-        _ = AdminUser.add_or_update(True, **data) or abort(502, "Unknown issue: Admin is not patched")
+        data['old_uuid'] = uuid
+        admin = AdminUser.add_or_update(True, **data) or abort(502, "Unknown issue: Admin is not patched")
         # the add_or_update doesn't update the uuid of AdminUser, so for now just delete old admin after adding new
-        if admin.uuid != data['uuid']:
-            admin.remove()
-        return {'status': 200, 'msg': 'ok'}
+
+        return admins
 
     @app.output(SuccessfulSchema)  # type: ignore
     def delete(self, uuid):
+        """Admin: Delete an admin"""
         admin = AdminUser.by_uuid(uuid) or abort(404, "Admin not found")
         if not has_permission(admin):
             abort(403, "You don't have permission to access this admin")

hiddifypanel/panel/commercial/restapi/v2/admin/admin_users_api.py

@@ -13,5 +13,19 @@ class AdminUsersApi(MethodView):
 
     @app.output(AdminSchema(many=True))  # type: ignore
     def get(self):
+        """Admin: Get all admins"""
         admins = AdminUser.query.filter(AdminUser.id.in_(g.account.recursive_sub_admins_ids())).all() or abort(404, "You have no admin")
         return [admin.to_schema() for admin in admins]  # type: ignore
+
+    @app.input(AdminSchema, arg_name='data')  # type: ignore
+    @app.output(AdminSchema)  # type: ignore
+    def post(self, data):
+        """Admin: Create an admin"""
+        if 'uuid' in data and AdminUser.by_uuid(data['uuid']):
+            abort(400, "The admin exists")
+
+        if not data.get('added_by_uuid'):
+            data['added_by_uuid'] = g.account.uuid
+
+        admin = AdminUser.add_or_update(**data) or abort(502, "Unknown issue: Admin is not added")
+        return admin